The recent case of I.F.T. S.A.L. Offshore v Barclays Bank PLC  EWHC 3125 (Comm) has provided an opportunity to consider the circumstances in which it would be appropriate to allow an Applicant to be discharged from its undertaking not to use documents obtained from a bank under a Norwich Pharmacal Order (NPO) for the purposes of proceedings against the bank. Although the case itself was only concerned with the use of the evidence and not with the merits of a potential claim against the bank, it also brought into focus a suite of matters which could give rise to a bank having to take responsibility for the fraudulent acts of one of its customers and the importance the Court places on a multi-tiered defence system in the battle against cyber fraud.
In early 2019, the banking industry introduced a new voluntary Code that would offer increased protection from scammers, including reimbursing victims of fraud. However, the Code is only intended to provide compensation to consumers, charities and micro-enterprises, leaving companies like the Claimant (IFT) having to resort to other avenues of recovery. Furthermore, it appears from recent talks arranged by UK Finance, a banking trade association, and attended by some of the UK's largest banks, that at least some of the banks want to water down the Code. A report prepared by the Lending Standards Board, which oversees the Code, and due by the end of the year, will give regulators an insight into the success or otherwise of the Code.
IFT was the victim of one such online fraud, known colloquially as an 'authorised push payment scam', and was induced to transfer c. USD 250,000 to an account at Barclays Bank (Barclays), set up just over a month earlier. The money had been intended to pay for the purchase of raw meat products from an Austrian supplier, but instead, as it later transpired from the documents handed over by Barclays, it was paid out by the fraudster to an account in the United Arab Emirates in various tranches over the course of two days. The last payment was made just 2 hours before IFT notified the fraud to Barclays.
The Norwich Pharmacal Order and the Claimant's undertaking
A NPO, or third party disclosure order, requires a respondent to disclose certain documents or information to an applicant. In these instances, the applicant knows that wrongdoing has occurred, but needs more information from a third party who is mixed up in the wrongdoing, whether innocently or not, to identify the proper defendant to an action or to be able to plead a claim. This type of relief is not generally available against someone who is likely to be a party to the potential proceedings; in those instances, an applicant would more typically apply for pre-action disclosure from a likely party under CPR 31.16.
In this particular case, after becoming aware of the fraud, IFT applied to Court for a NPO that Barclays provide them with documents and information relating to the bank account holder and the onward transactions, with the intention of pursuing the fraudster.
In the order it obtained, IFT undertook not, without the Court's permission, to use any information obtained as a result of the order for the purposes of any civil or criminal proceedings save for specified purposes, which did not include proceedings against Barclays.
The new application: discharging the undertaking
IFT later obtained the court's permission to review the documents to consider whether to proceed against Barclays. In its original application, IFT expressly stated that it had no intention of bringing proceedings against Barclays. But, having carried out the review of the documents it obtained, IFT wished to obtain pre-action disclosure from Barclays, with a view to bringing proceedings against the bank thereafter if appropriate. As a result, it made a further application seeking permission to be discharged from its undertaking.
The competing public interests
In its application, IFT invoked the public interest in the fair resolution of proceedings and the prevention and detection of fraud. Barclays on the other hand sought to rely on the public interest in protecting the confidentiality of the relationship between a bank and its customers. It also raised concerns that NPO applications might facilitate speculative claims against banks by victims of fraud, and in turn, might make banks less likely to consent to such applications when they are originally made.
Collateral use of documents granted
In a judgment handed down on 19 November 2020, the Court found in favour of IFT. In the absence of estoppel or abuse of process, which Barclays never suggested applied here, the Court should not stand in the way of the fair and just resolution of a case but should facilitate it. Furthermore, the Court saw a real interest in the prevention and detection of fraud, with banks standing in the main line of defence against fraud.
The judge was not persuaded by Barclays' points. It was held that it would still be open to a respondent to try and resist a NPO, and that discouragement of speculative claims will come about not by refusing use of documents obtained under a NPO but by striking out hopeless claims.
The judge concluded that he would give permission for IFT to use all the documents in respect of which it sought permission and to pursue claims against Barclays, if it chose to do so.
Collateral implications for the banking industry
Although the judge did not decide on the merits of the underlying case against the bank the Claimant relied on numerous points regarding the bank's conduct around the time of the fraud. These include the fact that, before making the large payments, the largest transaction on the fraudster's account was a credit of £200, and that upon being notified of the fraud, Barclays took no action whatsoever for 4 days and no steps to block the account for 5 days, and seemingly no steps to recall the payments made.
- Martin Shobbrook, Partner in the Fraud Defence and Business Disputes Group at Mishcon de Reya says:
"This case may prompt a change of approach on how third parties respond to a Norwich Pharmacal application. Traditionally banks and third parties adopted a neutral position leaving it to the Court to decide if disclosure should be made, without opposing the application. However, they may now consider their exposure more closely, and either choose to vigorously defend the application or at least create delays which may require more aggressive action from claimants. A victim of fraud should not assume that a bank is doing all it can to recover funds or assist with disclosure of information. In these circumstances, continuing to pursue other avenues of recovery, such as worldwide freezing orders to seize misappropriated funds, might still remain a claimant's most powerful weapon in actually recovering its losses."
- Simona Corcoz, Associate in the Fraud Defence and Business Disputes Group at Mishcon de Reya says:
"The case is a welcome decision for businesses that are not protected by the Code. Furthermore, this type of action might become all the more important for consumers as well as large companies, if banks decide to step away from the Code altogether. Having a legal avenue to potentially hold a bank liable if it has fallen short of standards expected of a financial institution (such as detecting high-risk payments or freezing payments that might be part of a scam) could prove essential in some instances. It is a reassuring thought that, in a world that is ever more digitalised and open to online fraud, banks are actively asked to take responsibility for the frontline role they play in the increasingly complicated battle against cyber fraud."