England and Wales High Court (Commercial Court) Decisions

IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
LONDON CIRCUIT COMMERCIAL COURT

		Royal Courts of Justice The Rolls Building 7 Rolls Buildings London EC4A 1NL
		17/05/2022

His Honour Judge Bird :

Introduction

1. The claimant company operates in Saudi Arabia and is part of a multi-national Italian corporation. On 30 October 2018, as a result of deception on the part of a fraudster, it instructed its bank to pay US $5 million to a dollar account held at the NatWest Bank ("the Bank") in Brixton in the name of a third-party, Asecna Limited ("the Account"). The Account was controlled by the fraudster. The fraudster arranged for the majority of the funds to be paid out of the Account over the course of the following 2 days. Some funds have been recovered but the majority has been lost. The claimant seeks restitution of most of the lost sums from the Bank. The claimant is the victim of an authorised push payment (or APP) fraud.
   
2. By way of brief chronology (set out in further detail below):
   

a. The Account was opened on 10 May 2018 with a deposit of $990. On 23 May 2018 $890 was paid out leaving a balance of $100. There was no further activity on the account until 30 October 2018.


b. The $5 Million deposit was received on 30 October. After charges, the sum of $4,999,990.83 was credited to the Account.


c. Between 2.29pm and 3.16pm on 30 October, the sum of $667,287.51 was transferred out by 6 separate transactions to various countries, each via the Bank's online banking system (known as "Bankline"). The authorised Bankline user was Mr Mobondo. The payments ranged in value between $126,019.59 and $95,799.59.


d. On 31 October there were 22 transfers out totalling $4,296,784.11. The transfers ranged in value from $97,919.52 to $1,249,764.55.


e. On 31 October, the Bank received, and acted on, 2 fraud alerts (the "SilverTail" alerts):the first was received at 10.10am; the second at 1.04pm. Each alert resulted in a temporary suspension of Bankline services. In each case the services were reinstated after investigation.


f. On 1 November by 11.56am the Bank became aware of the fraud. At that time the balance in the account was $36,019.21. There was a single transfer out on that date of $33,989.88 at 3.44pm.


g. Taking account of a small balance of $100 already in the Account the transactions (totalling $4,964,071.62) left a balance of $2,029.33


h. The claimant has recovered the total sum equivalent to $641,884.77. That sum, together with the $2,029.33 left in the Account has been paid to the claimant.


i. On 11 November, the Bank's anti-money laundering fraud detection systems triggered an alert in respect of the Account.


The Claim


3. It is now accepted that the Bank owes no duty of care to the Claimant which was never its customer. The claim is squarely based on the Bank's apparent unjust enrichment or its apparent knowing (or unconscionable) receipt of property subject to a trust. The Bank denies the claims. If the claimant succeeds in establishing unjust enrichment or knowing receipt (both of which are keenly disputed) the Bank relies on the defence of change of position or ministerial receipt as a complete answer to the claim.
   
4. If the claimant makes out each aspect of its unjust enrichment claim or succeeds in the knowing receipt claim, the claimant's position is that the Bank has no defence available to it after the first SilverTail alert. It submits that the defences are only available where the change of position (or ministerial receipt) is carried out in good faith. It is suggested that on the facts of the present case, the Bank cannot establish good faith for a number of reasons: first, by reason of the design and operation of the Bank's fraud detection systems, secondly because the second SilverTail alert was dealt with outside the Bank's usual processes and thirdly because the Bank had direct knowledge of the fraud when the final payment out was made.
   
5. It is therefore necessary to consider if the claimant has made out its claims for unjust enrichment or for knowing receipt and if the Bank's entitlement to rely on its defences was ever lost.

The Trial


6. During the course of the trial, it has been necessary to refer to sensitive and confidential Bank documents. Some factual and expert witness evidence has been heard in private. The court sanctioned a confidentiality ring to allow for the disclosure, inspection and use of certain confidential documents by the order of Mr Andrew Hochhauser QC sitting as a Deputy Judge on 18 December 2020. On 30 November 2021, His Honour Judge Pelling QC ordered that any submissions or cross examination which would refer to documents shared within the confidentiality ring was to be held in private.
7. I am satisfied that the requirements of open justice have been met in this case. The court heard evidence in private only when it was strictly necessary to do so. I have, from an abundance of caution, made orders pursuant to CPR 5 restricting access to any confidential documents referred to during the proceedings.
   

The Evidence


8. On the first day of trial, I heard oral evidence from the claimant's witnesses: Massimo Sicari; Arthur Vellozo; Arvel Titong and Fabio Fritelli. I did not hear from the claimant's other witnesses: Fabio Fagioli and Andrea Bonacina but was invited to read their statements.
   
9. On the second day I heard from the Bank's witnesses: Eleanor Gordon and Janet Parratt. I did not hear from the Bank's other witnesses: William Amancho; Rebecca Davey; Simon Probert and Nathan Robinson but was invited to read their statements: Scott Bennett was due to give evidence, but a short "fit-note" was produced recording that he was suffering from stress and so would not be attending. He was not available therefore for cross-examination. In assessing the weight to be given to his evidence, I bear in mind the guidance set out at section 4 of the Civil Evidence Act 1995.
   
10. On the second and third days I heard from the banking experts: Mr Brigden for the claimant and Mr Rochelle for the Defendant. On day 4 the parties prepared further written submissions and I heard closing submissions on the morning of the fifth day of the trial. I have had the benefit of written submissions from both parties.
    
11. I had the benefit of a live note transcription of proceedings and the benefit of a document presentation system provided by TrialView.




The facts


12. It is important to expand on the brief chronology I have set out above and to examine the evidence with some care.
    
13. I formed the clear view that each of the witnesses I heard gave their evidence carefully and with a view to assisting me to understand relevant processes and events. As far as Mr Bennett's evidence is concerned, I draw no adverse inference from his non-attendance. Much of his involvement in the relevant events is catalogued by the Bank's internal systems. The controversial aspects of his evidence relate to the second SilverTail alert and his dealing with it. I am satisfied that the picture painted by other witnesses (in particular Miss Gordon) is sufficient to allow me to make relevant findings. To the extent that Mr Bennett's evidence corroborates the record set out in the Bank's systems and the evidence of others I accept it.
    
14. The facts fall into the following chronological segments:
    

a. The mechanism of transfer.


b. Events before the claimant paid out $5 million. What happened and what should have happened? This goes to whether the Bank's enrichment was unjust. In essence the issue is whether the claimant made the payment by a material "mistake".


c. Events at the Bank after it received the $5 million payment. What happened and what should have happened? This aspect of the evidence goes to the Bank's defences and the presence or absence of good faith.


15. Having dealt with these matters, I will deal briefly with the evidence of the experts before turning to the law, the submissions and the application of the law to the facts.
    

Mechanism of transfer


16. The transfer is described by Mr Kramer QC in this way:

"[It] was an offshore transfer in US dollars from Saudi British Bank SJSC in Saudi Arabia ("SABB"), via Citibank in the US as SABB's correspondent/intermediary bank, to D in London, communicated using SWIFT messages. The transfer like all transfers involves the adjustment of the balances of different banks, here between SABB and Citibank and then Citibank and D. As Goode explains and is obvious, each pair of banks will net off various balances owed in two directions. Plainly Nat West had more than one dollar payment in or out on 30 October 2018 and the $5m from C was mixed in the process of international payment."


17. It follows:
    

"the claimant instructed SABB to make a payment. SABB issued a payment order to Citibank in the USA requiring Citibank to make the payment on SABB's behalf. Citibank made the required payment and so became a creditor of SABB. At some point Citibank would be instructed by a customer to make a payment in Saudi Arabia and Citibank would issue a payment order to SABB requiring it to make the payment on Citibank's behalf. SABB would make the payment and become a creditor of Citibank. At some point the credit and debit balances would be reconciled and so that (as it is put in Goode and McKendrick on Commercial Law 6^th ed.) it is usually unnecessary for either bank to transfer funds to the other". (emphasis added).


The Claimant


Events leading up to the payment of the $5 Million: the fraud


18. The claimant is part of the Maire Tecnimont group of companies. The business operates throughout the world building chemical, petrochemical and gas plants. There are around 50 group companies with more than 8,000 employees.
    
19. In July 2018 the claimant borrowed $7.5M from Tecnimont SpA ("TCM") to cover a cash flow shortfall on a particular project (the Petro Rabigh Project).
    
20. On 25 October 2018 Andrea Balboni of TCM requested that the money be repaid. On the same day, Arthur Vellozo of the claimant asked for details of the bank account into which the repayment should be made. Details of an account at Société Générale in Milan were provided.
    
21. On 27 October 2018 an email purporting to come from Fabio Fritelli, Group Finance Director of TCM was sent to Arthur Vellozo. It read as follows:
    

Dear Arthur,

I apologize for any inconvenience this may cause, and i appreciate your understanding. As our previous bank details given by Andrea is under scrutiny process, we are also yet to receive refunds made from other branch

Please note that after our executive meeting that was held on Friday (26-10-2018)

"the request of refund to TCM spa 7.5m USD" be informed that we came to conclusion that we will be receiving the refund in the stated below bank details

BANK: NATIONAL WESTMINSTER BANK PLC

BEN: ASECNA TECNIMONT SPA

SWIFT: NWBKGB2L

IBAN: GB91NWBK60730143170838

ADD: BRIXTON

Regards

Fabio Fritelli

Group Finance Vice President

Head of Group Finance




22. Mr Fritelli was not the sender of the email. Rather it emanated from a third-party fraudster who had gained access to Mr Fritelli's email account as the result of a phishing email sent to Mr Fritelli on 16 October 2018.
    
23. The documents show that Mr Vellozo (the regional finance manager) issued instructions that the payment be made in accordance with what he understood to be Mr Fritelli's (and so TCM's) instructions. He passed the instruction to Mr Murugesh Manickam who passed it on to Mr Arvel Titong at 9.11 am on Sunday 28 October 2018. Mr Titong attempted to action the transfer but discovered that the SWIFT code for the payee bank detailed in the email was incorrect. He emailed Mr Vellozo to ask how he should proceed. Mr Vellozo responded with the correct SWIFT code which he had located after an internet search. Armed with the correct SWIFT code Mr Titong sent instructions to TCM's bank using a proforma which recorded that payment instruction had been sent "for authorisation" and that payment was "pending authorisation". He was asked to send the document to TCM in Milan. Before he did so, he altered it to remove reference to the fact that the payment was pending or awaiting authorisation. In fact, the document he sent was diverted to the fraudster.
24. On 29 October 2018 the Claimant sent a priority payment instruction to its bank, The Saudi British Bank ("SABB"), via the Claimant's HSBCnet online banking service instructing SABB to transfer $5,000,000 to the Account. HSBCnet records the following on 29 and 30 October 2018 in respect of the transaction. The record assumes that persons to whom banking tokens were issued used them:
    

a. At 12.46 an action was "created" by use of a token issued to Mr Eden Costales. The transaction then required authorisation.

b. At 12.53 the transaction was authorised using a token issued to Mr Sicari. This was the first authorisation.

c. At 12.55 the second authorisation was provided by Mr Costales' token.

d. At 08.32 the bank processed the payment.


Payment to the Account and the events that followed


25. Payment was made on 30 October 2018 via Citibank. The sum of $4,999,990.83 was credited to the Account on the same day by 09.55am.
    
26. On 30 October Mr Murugesh Manickam emailed the fraudster (believing he was emailing Mr Fritelli) asking for an "official letter for audit" to show that the payment had not been made as payment for a supply of goods or services. He included a draft. Mr Vellozo was copied in. Mr Vellozo was clearly concerned that Mr Manickam had made an inappropriate request to a senior Vice President. He emailed the fraudster (again believing he was in contact with Mr Fritelli) saying he had reminded Mr Murugesh Manickam "who you are". The fraudster nonetheless provided the required letter by email sent at 10.47am.
    
27. Mr Manickam and Mr Vellozo were both sacked. Mr Vellozo was subsequently re-instated. Mr Manickam was not.

What should have happened?


28. The correct practice is set out in a lengthy internal document entitled "management of financial activities". It sets out Group financial activity policies applicable to the claimant. Mr Fritelli was a co-author (with D Michelangelo) of the document and Mr Folgiero approved it. Under the heading "Management of current bank accounts" the policy requires that:
    

"All Group companies are asked to identify through formally approved and registered powers of attorney, the persons authorized to open/close current accounts as well as to operate on them; mechanisms of joint signature at two or more levels are to be preferred."


29. Under the heading "Remote banking systems" the policy provides:
    

"Access to the remote banking system is allowed only to duly authorized personnel "


30. There is broad agreement that Mr Sicari and Mr Costales did not in fact authorise or create the payment instruction, and that Mr Manickam in fact used both tokens to make the payment which Mr Titong had originated. Mr Manickam and Mr Titong are both based in Saudi Arabia. I accept Mr Titong's uncontroverted evidence that Mr Manickam had custody of and used the tokens issued to Mr Sicari and Mr Costales. There was therefore a failure to comply with the claimant's internal procedures when making the payment. It seems likely that this failure to comply with strict protocol led to Mr Manickam's dismissal.
    

The Bank


31. The chronology of events at the Bank concerns how the money was paid away and how the fraud warnings were dealt with. This part of the chronology touches on the Bank's confidential processes.
    

How the money was paid away


32. The Account was opened on 10 May 2018 with a deposit of $990. On 23 May, $890 was paid out leaving a credit balance of $100. The parties agree that the account was opened in line with regulatory guidance.
    
33. The claimant's payment of $4,999,990.83 (the initial deposit of $5,000,000 after a commission charge of $9.17) was credited to the Account on 30 October 2018. On the same day there were 6 transfers out of the account: 3 went to Hungary and 3 to Croatia. In total the transfers amounted to $667,287.51 leaving a balance of the initial deposit of $4,332,703.32. Each transfer out included bank charges (each transfer included an instruction that the Defendant's charges were to be paid by the "remitter") and was given a reference by the account holder. Of the 6 transfers, 5 references were invoice numbers (in the order they appear on the Bankline statement they were invoice numbers 3, 4, 5, 9 and 7). Payments out of the account were not made in the order that requests were submitted. The first payment to leave the account was requested at 14.50, the next at 14.46, the third at 14.29, the fourth 15.15, the fifth at 14.56 and the last at 15.16.
    
34. On 31 October 2018, there were 22 transfers out: 7 to Hungary, 6 to Croatia, 3 to the Czech Republic and 6 to Hong Kong. In total they amounted to $4,296,784.11. That left a balance of the initial deposit of $35,919.21. All payment references related to invoice numbers. There was a second reference 9 and two references 23. Including the payments made on 30 October (and missing out numbers 6, 8, 15, 21 ,25, 27, 28, 29, 32, 33, 34 and 36) the references run from 1 to 37. Taking account of the one payment that had no reference, to close of business on 31 October there were in total 28 transfers out.
    
35. On 1 November 2018 there was a single transfer out of $33,989.88. This brought the total number of transfers out to 29. There was no numerical reference number. The balance of the initial deposit was $1,929.33. The final recorded balance on the account at close of business on 1 November 2018, taking into account a $100 dollar balance when the initial deposit was made was $2,029.33.
    

Fraud warnings


The context


36. The Bank is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. It is required to comply with Money Laundering Regulations and to have effective procedures in place to detect and prevent money laundering. Guidance as to how legal requirements might be implemented in practice, indications of "good industry practice" in anti-money laundering procedures and guidance on the design and implementation of the systems and controls necessary to mitigate the risks of money laundering are set out by the Joint Money Laundering Steering Group ("JMLSG") in its 2017 revised "Guidance for the UK Financial Sector" (dated 13 December 2017) ("the Guidance").
    
37. Paragraph 5.7 of the Guidance deals with the Bank's obligation to monitor customer activity so it can spot unusual activity. Paragraph 5.7.4 expressly provides that such monitoring can be either in real time (so that transactions are reviewed as they take place or about to take place) or after the event. The essential elements of a monitoring system are set out at paragraph 5.7.3: transactions must be flagged for further examination, there must be a system to allow the reports to be reviewed promptly and appropriate action must be taken on such reports.
    
38. The parties agree that it is usual for banks to have separate systems to identify risks of different financial crimes. In the present case it is appropriate to have one system to deal with anti-money laundering ("AML") and other systems to deal with other risks.
    
39. Broadly speaking the Bank had at the relevant time 2 systems: the SilverTail system which operates in real time and the Fortent system which does not. Fortent is an AML system, SilverTail is aimed at protecting a Bank customer from fraud.
    

SilverTail


40. The Bankline Security Team manage 4 separate email accounts. One deals with Bankline Fraud Alerts. There are five categories of such alerts: SilverTail alerts, PinPoints, AML Sanctions, Faster Payment Alerts and BioCatch Alerts. Each alert has its own "script" or policy to be followed.
    
41. SilverTail is a third-party product licensed to the Bank by RSA. It generates one of a number of identified alerts when criteria (rules) set by the bank are met. The overarching (but not exclusive) aim of the system is to protect customers from fraud not to detect fraud perpetrated by customers.
    
42. "China Payment" and "Bad Country Payment" are examples of alerts triggered because a customer is seen to be attempting to transfer money to a destination often associated with fraudulent payments. These and similar rules, alerting the Bankline security team to the risk of fraud on a customer, are the commonplace alerts.
    
43. Alerts such as "3G_Connection" or "Mule_Beneficiaries" suggest that the customer's account is being used as a mule account to further a fraud. The customer may be complicit in that fraud or may be an innocent victim. The Defendant's evidence was that mule alerts were very rare (a team member might deal with between 50 and 200 alerts every week, perhaps 2 or 3 over a three-year period would be mule alerts).
44. Nathan Robinson's evidence was that SilverTail alerts "are automatically fed into a mailbox. A member of the bank line security team then works the mailbox on a rotational basis, suspends affected users and feeds each alert into a database. Once on the database, other members of the bank line security team pick up the alerts to work through them".
    
45. The alerts are sometimes accompanied by an "Auto-Suspend" alert. In such a case, access to the Bankline system is suspended automatically. The email will identify the particular rule which has triggered the alert, the time of the relevant transaction (or attempted transaction), the user, the amount of the transfer, the payee reference and other relevant information. Following an "Auto-Suspend" alert, the user's then current online session is terminated. Bankline staff must investigate the alert and have 5 minutes from receiving the alert to suspend the user.
    
46. The next steps to be taken by the Bankline staff are set out in internal Bank "scripts". What is to be done depends on the type of alert received. In summary, where there is a run-of-the-mill alert, the member of staff to whom the alert has been allocated must note on the Bankline Database that they are working on the matter and then access Bankline using the customer's ID. If necessary, access to Bankline is then suspended. What happens next depends on the previous history of alerts. If there have been three previous alerts for the same user and the user has been spoken to 3 times, then in some circumstances the user can be referred for what is described as "whitelisting"; in other circumstances the relevant account can be "profiled" (using what has been referred to as the Business Decision Matrix or "BDM") and might be reinstated without making contact. If there have not been three previous alerts for the same user, the customer is to be contacted by telephone.
    
47. If the customer is called, the member of staff making the call is required to look at payments made over the previous 3 working days (including the day on which the alert was raised) and check with the customer anything deemed to be suspicious. Questions are then put to the customer about the risk of a security breach and to ensure that the customer intended to make relevant payments. If all is clear, the account can be reinstated. Advice on security is then provided to the customer and an email is sent.
    
48. Profiling is in essence an information gathering exercise, carried out without direct contact with the customer, to enable a decision to be made about the "genuineness" of payments. First the Bank considers whether there have been previous alerts or reports of fraud. Then the Bank would "profile" each payment made by the specific user for the last 3 working days together with all (in effect) pending payments. The Bank then considers if there have been any changes to Bankline user details or payments in the last 3 working days, then using the "back office" system whether any similar payments have been made before or if the payments are usual. Payments are then checked against the "confirm fraud log". If after gathering that information the Bank is "happy that the payment(s) and account in question appears (sic) genuine you can now reinstate the user". If on the other hand, there remains a "suspicion" the customer should be called. It was accepted by Mr Brigden, the claimant's banking expert, and explained by the Bank's witnesses in particular Rebecca Davey, that the suspicion "must be a suspicion about fraud on a customer."
    

The first alert


49. The first email SilverTail alert was triggered at 10.10:05am (5 seconds after 10.10am) on 31 October. By the time Bankline access was re-instated $948,901.29 had been transferred out of the account on 31 October (and $667,287.51 on 30 October). The relevant payment was identified as submitted via Bankline at 10.09:44 in the sum of "125400" with payee reference "invoice 015"; no details of the beneficiary were provided. The alert identified the breached rule as "Rule_China_Payment". In her evidence, Eleanor Gordon explains that the rule was triggered because "a payment had been attempted to China which SilverTail deemed was sufficiently unusual".
    
50. I note that "invoice 015" does not appear as a payee reference on the relevant bank statements. However, the first payment submitted through Bankline after reinstatement of the facility was a payment of $125,919.55 to Hong Kong which was given payee reference "invoice 016".
    
51. The alert was picked up by Thulani Marvin Moyo. He looked at the Bankline "customer summary" (containing basic information such as customer details, payment preferences and payment limits) at 10.10:47am, the Bankline "user" details (setting out the name of each Bankline user, his or her user ID, whether the user was active or otherwise, the last time and date each user had logged on) at 10.10:51 and suspended the user's Bankline system privileges at 10.10:54. At 10.11:41 he viewed the customer's accounts list. The matter was passed to Mr Scott Bennett at 10.24:52.
    
52. Scott Bennett tried to telephone the customer. There was no answer. He left a message and emailed the customer at 10.27am.
    
53. The customer returned the call. He spoke to Raheem Saied on the Bankline Customer Service Desk who transferred the call to Nathan Robinson at 10.59am. Notes of the call set out that certain standard questions were answered and noted to be "consistent with no [security] compromise".
    
54. Mr Robinson had been with the Bank for just less than 2 years. He would expect to deal with between 50 and 200 SilverTail alerts every week. His evidence (which was read) was that the team was working on alerts which "indicated a risk of scammed payments". The call with the customer lasted 3 minutes and 57 seconds. Mr Robinson's evidence is that the purpose of the call was to "run through a set of questions to determine if a customer had been scammed". If the payment instruction was genuine and verified by the customer, his evidence was that the Bankline team "would reinstate a user's access". During that time Mr Robinson looked at and considered the customer's "payment summary". This set out a list of outgoing payments the customer needed to action, payments that had been actioned which were to be completed and payments that had completed on that day. The screen also included an option to "search payments". This would have allowed Mr Robinson to look at transactions over the last 3 days. In his evidence he described it as "normal" to look at the previous 3 days' transactions. His recollection accords with the Bank's guidance.
    
55. If Mr Robinson followed usual practice and guidance and looked at the previous 3 days, he would have seen a near $5m deposit on 30 October with substantial transfers out. He did not have access to account opening (or KYC) information. The account was re-instated by Mr Robinson at 11.00:56. The re-instatement had to be checked and verified. This was done by Sumbal Khalid. An "advice script" was emailed to the customer at 11.04am. It was open to any member of the Bankline team at any time to look at further information on the alerted account by accessing the "back office" system. This would have allowed access to the previous 6 months' transactions.
    

The second alert


56. At 1.04pm there was a second SilverTail alert. Since the first alert there had been 10 further transfers out totalling $2,358,647.50. The relevant rule this time was "Bad_Country_Payment". The amount was "124660" and the payee reference "invoice 028". Again, the relevant bank statements do not show a payment with such a reference. Eleanor Gordon explains this alert was triggered because a payment was attempted "to a particular country which the bank would have identified as having an increased risk of fraud".
    
57. Again, Mr Moyo suspended the account. Mr Bennett reinstated the account at 1.19pm. Anne Field authorised the re-instatement.
    
58. The Bankline notes record that Mr Bennett (who by then had been with the Bank for 2 to 3 years and describes himself as an "experienced Bankline Security Agent") picked up the alert at 1.19pm on 31 October 2018. The notes record that he decided to conduct a BDM profile "after reviewing previous cases". The notes record the following:
    

Q1: have we had any previous communications/alerts/outcome? Yes

Q2: has any fraud been recently reports on CES (Customer Event System, an internal system used by teams within the bank to note changes to a customer's profile)? No

Q3: has any fraud been recently reported on FMS (Fraud Management System a fraud logging system to record fraudulent payments or concerns)? No

Q4: does payment appear normal after a review of the last 3 working days? Yes

Q4a: have any changes been made to any user or payments in the last 3 days? No

Q4b: Has the payment been made before or is it normal for the customer to pay to that

country, account, for that amount etc? Yes

Q4c: cross check payments against confirm fraud log – any of the payments match? No


59. Mr Bennett notes in his written evidence that the BDM process "assisted customers who faced regular SilverTail alerts by preventing the disruption of receiving multiple phone calls from the bank." He does not recall why he applied the BDM. His recollection is that it was "normal to apply BDM where there had been one similar alert that same day". Dealing with question four Mr Bennett says, "our job was not really about looking at inbound payments - the Bankline security team was focused on payments the customer was trying to make." As to question 4a, his evidence is that he was required to look at whether there had been any changes to the customer or user profile of Bankline in the last three days and that he would concentrate on the type of changes that would indicate possible frauds on the customer. He accepts that had he investigated the Bankline audit log would have revealed some user payment changes in the three days prior to the second SilverTail alert.
    
60. In October 2018 Eleanor Gordon was a fraud operations analyst working in the Bankline Security Team. She had been in that role for about three years. She recalls that the BDM profile was employed at the discretion of the security team rather than in strict accordance with the relevant bank policy. She told me "we would weigh up the likely disruption calling a customer would cause, and the similarity of the rule, payment amount, beneficiary details et cetera when deciding to use BDM. The process guide description was not a hard and fast rule which could only be used in those particular circumstances." When cross examined on the point by Mr Anderson QC, Miss Gordon was adamant that, in practice, there was a discretion "to review and reinstate the customer without contacting them if we have already spoken to them on that specific day." Miss Gordon's evidence therefore corroborated the facts set out in Mr Bennett's statement.
    
61. The BDM method was intended to be used after 3 suspensions; here it was used after 2 (during the second). Before Mr Bennett carried out the BDM profile at least 2 payments had been edited by the user (at 13.17:12 on 30 October and at 09.29:16 on 31 October) and on at least 2 occasions payment preferences had been changed (at 12.14:25 and 12.39pm on 30 October and at 11.14:28 on 31 October). None of these changes, according to his evidence, would have caused Mr Bennett any concern had he found them.
    
62. The Bankline audit shows that Mr Bennett first looked at the matter at 13.18:40. He restored the account at 13.19:10. It follows that he conducted the BDM profile in around 30 seconds. I accept, as was common ground, that Mr Bennett did not undertake a review of payments made in "the last 3 working days".
    
63. After the second alert a further $1,023,225.20 , was transferred out through a further 6 transfers. On that day $4,296,884.11 was transferred out in 22 transactions. At close of business the account balance was $36,019.21.
    

Discovery of the fraud


64. At 5.37pm on 31 October 2018 a further fraudulent email purporting to come from Mr Fritelli was sent to Mr Vellozo. This time it asked for "the balance payment" of $1.5M to be sent to the bank account of YXI Trading Co. Limited held at a bank in Hong Kong.
    
65. At 4.12am on 1 November 2018 Mr Vellozo sent an email to SABB with the subject line "frauded transaction: urgent actions required". He asked that a SWIFT message be sent to the Bank "informing them that this transaction is frauded, block it for payment and return it as soon as possible if not yet paid to the beneficiary". Mr Santosh Shetty of SABB emailed the Bank (at RBS Services in Chennai India, at 5.13am) asking for a refund of the amount paid and confirming that he had asked his operation team "to send the SWIFT through our US correspondent bank". The SWIFT message (recall) was sent by Citibank to Chennai at 11.32am (GMT).
    
66. I heard evidence from Miss Janet Parratt, a senior fraud investigator with the bank of some 30 years' experience. She accepted that by 11:56am on 1 November when the Bank received an email from its investigation and fraud liaison team in India containing relevant details, the Bank had all the information needed to restrict the Account.
    
67. The broad outline of the fraud came to Miss Parratt's attention at about 1.00pm on 1 November 2018 when she received a telephone call from Yamini Patel of Citibank. It took some time to locate the relevant account and it was not until about 1:30pm that she was aware that there was about $36,000 left in the Account. Her evidence is that her "immediate thought" was to "instigate some recovery action".
    
68. Mr Simon Probert was working in the Bank's "core data and payment monitoring" ("CD&PM") team in November 2018. The team then comprised 10 to 12 people and its function was to implement or remove restrictions on the operation of given accounts. The process of restricting an account was required to comply with certain requirements set out in a standard operating procedure document. If a request to place restrictions on account failed to comply with those requirements it would not be actioned, and a clarification email would be sent setting out precisely what was required.
    
69. At 1.46pm Janet Parratt sent an email to "CD&PM Restrictions" asking that the "appropriate action" to block (or restrict) the account be taken. Mr Probert of CD&PM replied at 1.51pm with a list of requirements. If it was to place a restriction on an account, formal instructions were needed on headed Bank notepaper with account details and a signature verified by the Bank's internal systems ("an ISV authorisation"). Not all Bank employees were able to provide such a verified signature. During the course of her evidence Miss Parratt accepted that her signature was so verified. It follows that she would have been able to action the instruction to restrict the Account immediately. Her evidence was that it would take time for her to complete the required steps and that she made the "judgement call" to focus her immediate attention on recovery of the near $5m that had left the Account rather than restricting access to the relatively small amount of money left in the Account. She told me in evidence that this was the first time in her 16 years with the Bank that she had been called upon to restrict a dollar account.
    
70. By 2.09 pm Miss Parratt had a put in place a process to send out recalls with the hope of recouping money paid out of the account. She had by then contacted Sharon McGilvery in "OSS recoveries" by email. The main purpose of the email to Sharon McGilvery was to arrange for the recall but the email also, in effect, handed off responsibility to arrange the restriction. At 2.14pm she emailed Kerry Mezini in "Fraud and Chargeback operations". The aim of the email was for someone in the fraud and chargeback team to take over the case and be the point of contact with Yamini Patel.
    
71. Between 2.09pm and 3.28pm, despite a flurry of exchanges, very little progress seems to have been made.
    
72. Rebecca Davey accepts that she became involved at 3.28pm. By then she was aware of the fraud. She spoke to Janet Parratt at about 3.57pm. Her role was to support the Bank's first party fraud team acting as a facilitator for the actions that needed to take place. She would ensure that "the right people throughout the [Bank] were involved so that actions could be taken to protect the [Bank's] customers and to tell the relevant people within the [Bank] exactly what had happened to ensure there were no further risks to other [Bank] customers…". She saw her role in three parts: first to ensure that the Account was blocked, secondly to ensure the Bank had done what it could to recover payments and thirdly to consider if any other customers were at risk from the fraud. Graeme Davidson, a colleague of Rebecca Davey was responsible for blocking Asecna's sterling accounts. That appears to have been a much more straightforward process than blocking a foreign currency account. It appears that frauds involving currency accounts were unusual; this was the first such case with which Rebecca Davey had been involved in her four years at the Bank.
    
73. Rebecca Davey undertook some internal research to find out how a foreign currency account could be blocked. Those researches led her to the conclusion that it was the CD&PM restrictions team who needed to take responsibility. Janet Parratt had reached the same conclusion earlier that day and it is unfortunate that her researches had to be repeated. Rebecca Davey spoke to the team and was told that she would need to send an ISV authorisation. Miss Davey's signature was not ISV authorised and so a manager, Jenny Galloway, signed the request for her whereupon it was sent to the restrictions team.
    
74. Requests to recall sums paid out were sent at about 3.58pm.
    
75. Formal instructions (in appropriate from) were sent to CD&PM Restrictions by Rebecca Davey at 4.20pm. By then the last payment of $33,989.88 had left the account (at 3.44pm). The account was suspended at between 4.20pm and 4.42pm.
    
76. Miss Parratt accepted that the Bank had (at the time) no proper procedures in place to deal with the issues it was facing. There appears to have been a degree of frustration in the Bank. At around 3.24pm Kerry Mezini notes on an internal chat that "I have people flapping all over the [place] about it". Miss Parratt appears to have "reported" Kerry Mezini to more senior team members of staff in the bank because she felt that she was being "obstructive".
    

The Banking Experts


77. Each party had permission to rely on expert evidence. I have had the benefit of a report from Mr Nigel Brigden on behalf of the claimant and from Mr Martyn Rochelle for the defendant. I heard each give evidence and be cross examined. I also have an experts' joint memorandum and (although its status is not clear) I have a "supplemental report" from Mr Brigden which post-dates, and to some extent, attempts to explain, the joint memorandum.
    
78. In addition, I have seen a draft report prepared by Mr David Skade for the claimant together with certain attendance notes relating to that report. The claimant does not rely on that report. It and the related documentation was disclosed as a result of an order requiring such disclosure made by Cockerill J on 19 August 2021. I was not taken to the report during the course of submissions and the report was put only briefly to Mr Brigden, the claimant's expert. I do not therefore propose to refer to it in detail. I need only say that it appears to broadly support the Bank's position.
    
79. Mr Brigden's banking expertise was developed whilst working for Bank Leumi for 28 years between 1983 and 2012, latterly as its senior vice-president and head of operations and before that (as he explained in cross-examination) for 17 years at Midland Bank. Since leaving Bank Leumi Mr Brigden has acted as a consultant and held various senior finance roles.
    
80. Mr Rochelle worked for Lloyds Bank for 40 years from 1978 to 2018. Between 2003 and 2018 he held various senior management roles in the bank's risk management teams. Between 2012 and 2018 he was the commercial banking lead for fraud controls and education. He now operates as a bank risk consultant.
    
81. It became clear during cross examination that Bank Leumi was not a high street bank from the 1990s onwards. In its accounts for 2011 it is described as a "first class boutique bank" with "the highest emphasis" on first class customer service and "true relationship banking". It is a foreign bank in the sense that its principal shareholders are not based in this country. It had close ties to the Jewish community which it predominantly (but not exclusively) served. Mr Brigden told me that Bank Leumi "knew the community". In 2012 when Mr Brigden retired from the bank its accounts show that it had a net profit of around £12 million and around 197 employees. Mr Brigden was head of operations at the bank and told me there were about 25 people in his team. Operations covered retail payments, cheque clearing, foreign currency payments, security transactions and safe custody. It would be fair to say that Bank Leumi in 2012 was, when compared to the defendant, a small bank. In 2018 the Bank had an operating profit of around £4 billion and around 57,000 employees. Whilst at Bank Leumi, Mr Brigden was not responsible for compliance. He played no part in ensuring the bank complied with its money laundering obligations for example. At the relevant time before he retired, fraud enquiries at Bank Leumi were dealt with by a team of 2. His functions did include overseeing any operation that was required in accordance with money laundering procedures to prevent or reduce the risk of fraud. In 2012 Bank Leumi had automated software to search out fraud. Mr Brigden told me that whilst at Bank Leumi he had "not experienced" the situation in which the bank's customer was a fraudster.
82. Mr Brigden's report is dated 14 July 2021. In accordance with CPR 35.10(3) and paragraph 3.2(3) of CPR PD 35 it contains a statement setting out the substance of his instructions. Those instructions include "whether the defendant's decision not to undertake real-time checks on suspicious transactions (which had been flagged for 3^rd party fraud by its automated systems) against underlying AML data in its control was commercially unacceptable conduct" and if the Bank's systems and procedures "were followed and implemented in a commercially acceptable manner". Mr Rochelle's report is a response to Mr Brigden's report. He was asked to express a view as to "whether the bank's systems and procedures to prevent fraud as they operated in respect of the relevant account in real time and after the event were commercially unacceptable."
    
83. The experts' joint memorandum records a large measure of agreement. In particular the experts agree that the opening of the Account was completed in accordance with regulatory guidance. Mr Brigden's agreement was qualified. He "would have expected the bank to have asked Mr Mobondo why he had approached that particular bank and also established if in fact he held accounts elsewhere." In his oral evidence there was some confusion about Mr Brigden's position. Initially he did not accept that the Account had been opened in accordance with regulatory guidance, but when pressed accepted that it had.
    
84. The experts agree that it is usual or in line with industry standards to have separate systems to identify different financial crime risks and that third party fraud monitoring (fraud perpetrated by a third party on a bank's customer) is usually done in real time. Mr Rochelle expressly noted that the protection of customers against fraud is a key priority for UK banks. An ability to intervene in real time is a necessary part of that function. The key question is whether the Bank's decision not to monitor for AML in real time was appropriate.
    

The expert view on real time AML investigation


85. Mr Brigden expressed the view that in order to comply with their "AML obligations to prevent fraud and look after customers, the monitoring of exceptional and unusual transactions, both credits and debits, should be monitored in real time. This is something I have experienced personally." (emphasis added).
    
86. Mr Rochelle's view on the other hand was that "it is consistent with market practice and commercially reasonable that the Bank's systems did not trigger a real-time investigation into first party fraud when a third-party fraud alert was raised by SilverTail. A separate system called Fortent triggered an alert in relation to the uncharacteristic credit transaction that could potentially indicate money laundering. It is standard practice in the industry for such systems to be monitored and operated by different teams. Once triggered alerts related to money-laundering take time to investigate and it would be impracticable to block payments in real time based on such alerts, as it could cause significant disruption to payments worldwide."
    
87. Mr Brigden accepted that "alerts related to money-laundering take time to investigate". He told me that "AML transaction monitoring is to meet regulatory requirements. In line with regulatory guidance provided by the JMLSG that recognises the obstacles therein, this is most often performed after the event, for example by looking at trends, with large teams utilised to review alerts which can take some time to perform". In particular he accepted that where there was a suspicion that a customer was involved in fraud it would be appropriate for the Bank to investigate the transaction and consider the account history. He accepted that there were difficulties if the account was immediately frozen because such a step might effectively tip off the customer. These points appear to support Mr Rochelle's conclusion that AML monitoring can sensibly be carried out other than in real-time.
    
88. As I understand his evidence, Mr Brigden felt that banks should have a real-time system profiling detection system for AML. He accepted that such systems were not standard and were not required by the Guidance. In other words, Mr Brigden felt that modern agreed industry standards were simply not good enough.
    
89. I prefer in every material respect the expert evidence of Mr Rochelle to that of Mr Brigden. Mr Rochelle's experience is clearly relevant to the evidence he gave, and I accept that he spoke from a position of experience and authority. Mr Brigden's experience on the other hand was far less relevant. His evidence harked back to the long-gone practices of a golden age of banking. I formed the view that he was attempting to impose on the Bank standards which were far more onerous than those required by the JMLSG and far more stringent than anything that could possibly be practical in the daily operation of a modern high street bank. Mr Brigden in effect took the practices and procedures of Bank Leumi in the 80s and 90s and the first decade of the 21st century as the measure of good practice. The passage of time, changes in the complexity, advances in computer science, and the scale of the Bank Leumi operation compared to that of the Bank mean that I cannot accept Mr Brigden's expert evidence. His approach to banking practice was out of date.
    
90. Having heard the expert evidence and having preferred Mr Rochelle's evidence over Mr Brigden's evidence I find that the Bank's fraud monitoring systems were at the relevant time perfectly appropriate and that at the relevant time it was perfectly acceptable and in line with industry standards to monitor AML systems retrospectively and to monitor third-party frauds in real time.
    

The expert view on SilverTail

91. Mr Brigden agreed that the role of the security team dealing with SilverTail alerts was "to confirm that outgoing payments were validly authorised, with other teams looking at uncharacteristic behaviour from alerts raised by other systems" and that it was quite usual and commercially acceptable to operate in that way.
    
92. The experts agree that Scott Bennett "made an incorrect decision" (in the sense that he failed to follow the letter of the Bank's internal guidance) by not calling Mr Mobondo to confirm the validity of the transactions in respect of the second SilverTail alert. Both experts agree, because Mr Mobondo was a fraudster, that if the call had been made its purpose would have been to confirm the validity of the payments out and whether they were authorised by the account holder. In those circumstances it is as Mr Brigden says "highly unlikely" that his answers would have alerted Mr Bennett to any issue.
    

The expert view on what Mr Bennett would have found had he reviewed payments


93. Mr Brigden's evidence on this issue has evolved over time. In the joint memorandum he expressed the view that Bankline staff would need to review account activity over a period of more than 3 days in order to conclude that the activity on the account was unusual. He felt that the unusual nature of these transactions would have only been seen if Bankline staff were required to view the accounts over a 3-month period. In his supplemental report Mr Brigden changed his view (as he accepted during the course of cross-examination). Now, he felt that Mr Bennett should have been "suspicious" about payments after a 3-day review. In his oral evidence, Mr Brigden reverted to the position he had adopted in the joint statement. He said "I think there is some sort of defence that 3 days may not have alerted them, bearing in mind these staff….are not just looking for fraud. They are looking for … unusual transactions".
    
94. Mr Rochelle's evidence on the point has been consistent throughout. In his written report he expressed the view that there was nothing in the information provided to Bankline staff "to suggest that there was at any time any knowledge or suspicion of the underlying fraud". In the joint statement he expressed the view that nothing he had seen had led him to conclude that Mr Bennett "was aware of any wrongdoing by Asecna". In his oral evidence Mr Rochelle explained that the pattern of transactions over the relevant 3 days might demonstrate fraudulent activity but might equally demonstrate "an ordinarily operating account". He emphasised that at the time, Mr Bennett

"[was] working in a third-party fraud team looking to identify the third-party fraud to protect the NatWest customer in this circumstance. His mind set would be is Asecna Limited being scammed out of these funds and that is what he is trying to establish…"


95. The final position on the expert evidence is that there was a consensus. If Mr Bennett had reviewed transactions over the previous 3 days, he would have seen nothing to cause him any concern. Insofar as Mr Brigden's evidence was equivocal on the matter, I prefer Mr Rochelle's evidence for the reasons I have already set out.

The Law

Knowing Receipt

96. Because it can be dealt with shortly, I will deal first with the claim for knowing receipt.
    
97. The essence of a knowing receipt claim is summarised at paragraphs 8-196 and 8-198 of Goff & Jones and accurately summarised by the Bank at paragraph 46 of its skeleton argument (and paragraph 53 of its written closing) in this way:
    

"the equitable principle of knowing receipt imposes a liability to account as a constructive trustee of assets received by a person in breach of trust or fiduciary duty where the recipient knows of that breach of trust or fiduciary duty, or otherwise has a state of mind that makes it unconscionable for the recipient to retain the benefit of the receipt."


98. If the transferred property is not trust property, there can be no liability for knowing receipt (see Byers v Samba Financial Group [2021] EWHC 60 (Ch) and Armstrong DLW GmbH v Winnington Networks Ltd [2013] Ch 156).
    
99. The claimant alleges that the transferred funds represent trust property because the transfer itself was procured by fraud. No authority is cited for that proposition. Having considered how the Bank put its case, the claimant made no submission on knowing receipt in closing. Whilst the point was not abandoned, it was not actively pursued.
    
100. In my judgment there is nothing in this part of the claim. The claimant paid away monies acting under a mistake induced by the deceit of a third party. In my judgment, the defendant is right to submit that the property was not trust property at the time it was received. Further, the Bank received the deposit for its customer and not for its own account and I accept that for that reason also no claim lies (see Twinsectra v Yardley [2002] UKHL 12 at paragraph 12 where Lord Millett accepted that the cause of action lies only where the defendant received or applied the relevant money in breach of trust for his own use).
     

Unjust Enrichment

101. If the claimant has a claim, it lies in unjust enrichment. According to Lord Steyn in Banque Financière de la cite v Parc (Battersea) Limited [1999] 1 AC 221 (reflecting the thoughts of Peter Birks in his "Introduction to the Law of Restitution" 1989) there are 4 matters to be considered when dealing with an unjust enrichment claim.

a. Has the defendant been benefited, in the sense of being enriched?

b. Was the enrichment at the expense of the claimant?

c. Was the enrichment unjust?

d. Are there any defences?

102. These matters are (see Investment Trust Companies v HMRC [2017] UKSC 275 – the ITC case - at paragraph 41)
     

"no more than broad headings for ease of exposition. They are intended to ensure a structured approach to the analysis of unjust enrichment, by identifying the essential elements in broad terms. If they are not separately considered and answered, there is a risk that courts will resort to an unstructured approach driven by perceptions of fairness, with consequent uncertainty and unpredictability. At the same time, the questions are not themselves legal tests, but are signposts towards areas of inquiry involving a number of distinct legal requirements. In particular, the words "at the expense of" do not express a legal test; and a test cannot be derived by exegesis of those words, as if they were the words of a statute. The structured approach provided by the four questions does not, therefore, dispense with the necessity for a careful legal analysis of individual cases. In carrying out that analysis, it is important to have at the forefront of one's mind the purpose of the law of unjust enrichment…. to correct normatively defective transfers of value, usually by restoring the parties to their pre-transfer positions. It reflects an Aristotelian conception of justice as the restoration of a balance or equilibrium which has been disrupted. That is why restitution is usually the appropriate remedy." (emphasis added).


Matters in issue

103. Whether the enrichment was at the claimant's expense is the real battleground between the parties. Its resolution turns on a mixed question of law and fact. Mr Anderson QC argues for a wide interpretation of the requirement whereas Mr Kramer QC urges caution.
104. Mr Kramer QC submits that the claimant has failed to discharge the burden which it bears to establish that the defendant's enrichment was unjust. The claimant says the payment was made by mistake. Mr Kramer QC submits that the claimant in fact ran the risk that the payment was a fraudulent payment or shut its eyes to that risk. The issue is essentially one of fact.
105. Mr Anderson QC accepts that the Bank would generally be entitled to benefit from the defences of change of position or ministerial receipt but submits on the facts of the present case it is debarred from doing so. The question is a mixed question of fact and law; on the facts would it in all the circumstances of the case be unconscionable or inequitable (and so unjust) to allow the defendant to rely on the defences and so deny restitution (Niru Battery Manufacturing Co v Milestone Trading (No.1) [2004] QB 985 at paragraph 149 and see Jeremy D Stone Consultants v National Westminster Bank plc [2013] EWHC 208 (Ch) at paragraph 246)?
     
106. Elements (b); (c) and (d) are in issue in the present claim.

Was there a transfer "at the expense of" the claimant?


ITC and the new approach


107. In ITC the claimant engaged the services of various self-employed investment managers who were paid on the submission of invoices. Those invoices included VAT. The claimant paid the VAT and the managers, after appropriate deductions, paid VAT to the HMRC. The payment of VAT by the claimants and the payment of VAT to HMRC by the managers was defective because in fact no VAT was due. The managers were able to reclaim the VAT they had paid to HMRC and were required to forward those payments to the claimants. That left the claimants with a shortfall because the managers' refunds were less than the sums paid by the claimants to the managers. The claimants brought a claim in unjust enrichment against HMRC. The main issue was whether HMRC's enrichment had been "at the expense of" the claimants.
     
108. The Supreme Court's decision in ITC represents a watershed. Previously, when considering if a defendant's benefit had been obtained "at the expense of" the claimant, the courts had been guided by perceptions of fairness rather than by ascertainable and fixed rules of law. Examples (dealt with by the Supreme Court at paragraph 37) include Menelaou v Bank of Cyprus [2016] AC 176, Relfo v Varsani [2015] 1 BCLC 14 and the Court of Appeal's decision in Investment Trust Companies [2015] STC 1280. In each of those cases, the court answered the "at the expense of question" by considering the closeness of the connection between the claimant's loss and the defendant's gain. In each case the court asked if the connection was "sufficient" but laid down no principle to explain when the "sufficiency" criterion was satisfied. The Supreme Court described this exercise as one that was "too vague to provide certainty".
     
109. Given that unjust enrichment ranks next to contract and tort as part of the law of obligations, the Supreme Court recognised that rights arising from it should be "determined by rules of law which are ascertainable and consistently applied". Resort "to an unstructured approach driven by perceptions of fairness, with consequent uncertainty and unpredictability" was impermissible.
     
110. In view of "the uncertainty which has resulted from the use of vague and generalised language" the Supreme Court noted that it had "a responsibility to establish more precise criteria". The approach can be summarised as follows:
     

a. The starting point is to bear in mind that the purpose of the "at the expense of" element is to check that there has been a "transfer of value" in the sense that the defendant has received a benefit from the claimant and the claimant has suffered a loss or detriment through his provision of that benefit. The aim of unjust enrichment remedies is to correct defective "transfers of value". Without such a transfer there is therefore no unjust enrichment (see paragraphs 43 to 45)


b. Most commonly, a "transfer of value" of this type arises in one of two situations:


i. when the claimant and the defendant deal directly with one another; and

ii. when they deal with one another's property (paragraph 46).


c. There are other situations when such a transfer of value can arise. Generally, the factors that distinguish these other situations from those where there is direct dealing are "more apparent than real" (paragraph 47).


d. In considering if there is a "transfer of value" it is not enough to ask if, as a matter of commercial or economic reality, there is a connection between the claimant's detriment and the defendant's benefit. The term "economic reality" was described as a "somewhat fuzzy concept" and one which would be difficult to apply "with any rigour or certainty". The phrase "Economic reality" was therefore part of the lexicon of "vague and generalised language" deprecated by the Supreme Court. A further "fundamental difficulty" in adopting economic reality as a test is that the function of a restitutionary remedy is not to compensate for a loss. Searching to identify a party who has suffered a loss is therefore often an unhelpful exercise.


111. The Supreme Court provided (at paragraphs 48 to 49) examples of dealings which are not direct, but which would be treated as if they were in the sense that "there is no substantive or real difference":

a. Where "the agent of one of the parties is interposed between them". The agent is the proxy of the principal and so the "series of transactions between the claimant and the agent and the agent and the defendant is therefore legally equivalent to a transaction directly between the claimant and the defendant". The example is clear, and no authority was cited in respect of it.

b. Where the right to restitution is assigned. There the assignee would not be a party to the transaction but would be treated as such by virtue of the assignment. Equuscorp Pty Ltd (formerly Equus Financial Services Ltd) v Haxton (2012) 246 CLR 498 is cited as an example.

c. Where intervening transactions are found to be a sham. In such cases the sham transaction falls away and is ignored. An example is Relfo v Varsani [2015] 1 BCLC 14.

d. "A set of co-ordinated transactions has sometimes been treated as forming a single scheme or transaction for the purpose of the "at the expense of" inquiry, on the basis that to consider each individual transaction separately would be unrealistic" (emphasis added). Two Supreme Court decisions are cited as examples at paragraphs 61 to 66 of the judgment: Banque Financiere de la cite v Parc (Battersea) Limited [1999] 1 AC 221 and Menelaou v Bank of Cyprus [2016] AC 176.

e. Where the claimant discharges the defendant's debt owed to a third party there is no direct dealing between claimant and defendant, but the defendant is nonetheless directly enriched. This situation is different from those dealt with above and is dealt with by the Supreme Court at paragraph 49.


112. At paragraph 48, the Supreme Court noted that the defendant might receive property from a third party, not directly from the claimant, into which the claimant can trace an interest. Such cases are exceptions to the general rule that a transfer of value of the type described above generally occurs when the defendant receives the claimant's property.
     
113. It follows from ITC that there are at least 4 ways in which a claimant can satisfy the court that the defendant has been unjustly enriched at its expense (assuming there to be a "transfer of value"):
     

a. The claimant and the defendant had direct dealings.


b. The claimant and the defendant did not have direct dealings, but the substance of their dealings was such that the law would treat them as direct.


c. The claimant and the defendant dealt with each other's property.


d. The claimant could trace an interest into property provided to the claimant by a third party.


114. The co-ordinated transactions exception has been described by Lord Burrows (see his article "In Defence of Unjust Enrichment" CLJ 2019 78(3)) as "the most difficult of all" (see footnote 94). Perhaps one reason for the difficulty is that the court is required to ask itself if it is more "realistic" to look at related transactions operating in a co-ordinated way separately or as a single transaction. But, in doing so, is not entitled to look at "economic reality" for the reasons given above.
     
115. At paragraph 61 of the decision, the Supreme Court explains that Banque Financiere and Menelaou, are cases which have been dealt with (at least in some judgments) as such cases. It is explained that in those cases the courts were considering reality "in a different sense", that is, a sense other than "economic reality". There is therefore an important difference between "economic reality" (which is an impermissible yardstick) and what might be described as "transactional reality" (which should be considered). It is important not to elide or confuse the two.
     

Menelaou and Banque Financiere


116. These cases are examples of cases where a series of co-ordinated transactions is treated (as a matter of "transactional reality") as a single scheme or transaction so there can be said to be a "transfer of value" between the claimant and defendant.
     
117. In Menelaou the claimant's parents owed the bank £2.2M. The debt was secured on the family home (Rush Green Hall). The parents found a buyer for the family home and agreed a sale price of £1.9m. As the proceeds of sale would be insufficient to satisfy the bank's charge, the bank agreed to release its charge and allow the parents £785,000 to purchase a new property on condition that the parents consented to a charge over the proceeds of the new house (Great Oak Court). That house was to be transferred into the name of their daughter (Melissa), the claimant. The transaction proceeded as anticipated save that the claimant did not consent to the charge and sought an order rectifying the property register to remove the charge. The bank conceded that the charge was invalid but counterclaimed on the basis (see the headnote):
     

"that the claimant had been unjustly enriched and that it was entitled, under unjust enrichment principles, to an equitable charge to the extent of that enrichment by the process of being subrogated to the rights of any other person who at the relevant time had any security over the same property and whose debts had been discharged by the money so provided by it, namely the vendor who had sold the house to the claimant, who had by law been entitled to a lien on the property until receipt of the full sum contracted, and which lien had been extinguished with funds in effect provided by the bank."


118. The Supreme Court found that Melissa had been enriched "at the expense of" the bank. Lord Clarke concluded that "the two arrangements, namely the sale of Rush Green Hall and the purchase of Great Oak Court, were not separate but part of one scheme, which involved the bank throughout". At paragraph 65 of ITC the Court noted that Lord Neuberger had agreed with Lord Clarke's conclusion and had observed that "it is appropriate not merely to consider the purchase of, and charge over, [the second property] as a single composite transaction", applying the approach to property purchases involving a charge which was adopted in Abbey National Building Society v Cann [1991] 1 AC 56 (that "the acquisition of the legal estate and the charge are not only precisely simultaneous but indissolubly bound together" per Lord Oliver), but that it was "also appropriate in the present case to treat the sale of [the first property] and the purchase of [the second property] as one scheme, at least for present purposes". Lord Kerr and Lord Wilson JJSC agreed with both judgments in relation to this issue. It was on that basis that Lord Clarke considered, at paragraph 33, that the "the reality of the transaction" was that there had been a transfer of value between the bank and Melissa "notwithstanding the absence of a direct payment by the former to the latter.
     
119. In the Banque Financiere case (as summarised at paragraph 61 of ITC) the claimant had entered into a refinancing arrangement involving the loan of a sum of money to the manager of a holding company, which he in turn lent to a subsidiary of that company so that it could discharge a debt secured by a first-ranking security. The purpose of interposing the manager between the claimant and the first subsidiary was to avoid a requirement to make a public disclosure of the loan, which would have applied if the claimant had lent the money directly to the first subsidiary. The claimant paid the money directly to the subsidiary's creditor, so discharging the debt. It was conceded that this enriched the defendant, which was another subsidiary of the holding company, since it promoted the ranking of its own security, with the consequence that it was the only creditor of the first subsidiary which was likely to be repaid. This was contrary to the understanding on which the claimant had advanced the loan, namely that it would be repaid in priority to all intra-group debts. The House of Lords held that this would unjustly enrich the defendant, and therefore subrogated the claimant to the discharged security, as against the defendant, so as to prevent the unjust enrichment. Lord Steyn proceeded on the basis that the interposition of the loan to the manager was "no more than a formal act designed to allow the transaction to proceed … To allow [it] to alter the substance of the transaction would be pure formalism".
     
120. In my judgment it is important to recognise that the Supreme Court referred to Menelaou and Banque Financiere as examples. The following brief features of the cases are of some relevance:
     

a. The nature of the transaction was important in Menelaou. As a matter of established law (see Abbey National v Cann) that the acquisition of a legal estate and the registration of a charge were "indissolubly bound together".

b. In each case there was only one provider of funds.

c. The purpose and genuineness of the co-ordinated transactions was important. In Banque Financiere the interposition of the manager was a contrived additional step which added nothing to the transaction itself but afforded the claimant a collateral advantage by avoiding the need to declare the loan.


The outcome in ITC


121. The outcome of the ITC case provides a helpful application of the principles set out in that case. The relevant conclusion is expressed at paragraphs 71 and 72. The claim was dismissed. The following points appear from those paragraphs:
     

a. The key consideration was: had there been a transfer of value from the claimants to HMRC?


b. There were in fact 2 transfers of value: from the claimant to the managers and subsequently from the managers to HMRC.


c. The 2 transactions could not be collapsed into one for a number of reasons:


i. The managers did not act as the claimant's agents when paying money to HMRC. Their involvement could not be ignored, and they could not be treated as proxies for the claimant when making payments to HMRC.


ii. Payments made to the managers by the claimant were mixed with the managers' funds and could be dealt with as the managers saw fit. The payments could not be traced into the payments made to HMRC.


iii. The fact that there were 2 separate transactions could not be ignored because (in particular) the transaction was not a sham, it did not involve an artificial step and it did not involve a single scheme.


The submissions in more detail


122. Mr Kramer QC opened the case on the basis that where, as here, there is no proprietary claim, common law tracing "is the way the law decides whether the "at the expense of" requirement is satisfied" and so, whether there is a sufficient link between the claimant and the defendant. He made it clear that there must be a direct connection.
123. Mr Anderson QC submits (by reference to Investment Trust Companies) that the picture is in fact more complicated. He relied on the "co-ordinated transactions" exception and to some extent on the agency exception.
124. Mr Anderson relies on academic commentaries to support his argument. In particular the 9^th edition of Goff & Jones (2016) at paragraph 6-62:
     

"Whoever is identified as the proper claimant, the cases also show that a personal claim in unjust enrichment may lie against a remoter recipient of the sums paid. This may be the intended beneficiary of an inter-account funds transfer, or the intended beneficiary's bank (subject to defences), or both of them. In principle, it should also be possible (subject to defences) to bring a claim against a third bank, which acted as an intermediary in the payment process. At first sight, some cases seem to be inconsistent with this, since they deny claims against the intended beneficiaries of inter-account funds transfers and their banks, on the ground that the funds became untraceable when they became "mixed" in an inter-bank clearing and settlement system. However, these cases rest on a misconception. There are no problems "tracing" through the bank payment system; and in any case, there will be no need to "trace" if the claimant is merely making a personal claim in unjust enrichment. Whether the claimant is the paying customer or his bank, causation-based agency reasoning is sufficient to explain why the claimant has standing to sue any of the successive recipients in the payment chain, and it does not matter how many intermediaries are employed to bring about the ultimate flow of funds from the claimant to the intended beneficiary". (emphasis added)


125. The claimant also relies on Brindle and Cox (5^th ed. 2018) paragraph 6-62:
     

"The test for when enrichment is at the claimant's expense is still in the process of being developed but the current state of the authorities tends towards a general rule that there must be a "direct" provision of a benefit for the claimant to the defendant subject to possible exceptions. It is submitted that where A pays B through the banking system, this ought generally to be understood as a "direct provision" (even though there may be a complicated series of transfers between banks to give effect to a payment), and in consequence there should be no need to refer to the rules on tracing. This has the substantial benefit of avoiding the unsatisfactory distinctions created by the common law tracing rules." (emphasis added)


Discussion

126. I have set out at paragraph 113 above that there are (as the law now stands) 4 ways in which the necessary "at the expense of" element of a claim in unjust enrichment might be established. It follows that it is necessary to consider if the claimant and the defendant had direct dealings and there was a transfer of value in the sense set out above, if the claimant and the defendant did not have direct dealings it is necessary to consider if the substance of their dealings was such that the law would treat them as direct. It is also necessary to consider if the claimant and the defendant dealt with each other's property and finally if the claimant could trace an interest into property provided to the claimant by a third party.
     
127. I therefore do not accept that Mr Kramer QC's submission that in order to resolve the "at the expense of" question I need do no more than consider the common law rules of tracing.
     
128. In the present case there is clearly no direct transfer between SABB and the Bank, and the parties did not deal directly with the other's property. The real question is whether the transactions outlined above should be seen as a single scheme or transaction on the basis that it would be unrealistic to treat them in any other way. I will come to the issue of tracing in due course.
     
129. In dealing with the "realistic" treatment of the transactions, I remind myself that I must consider "transactional reality" and not the "economic reality" of a transaction. I remind myself of the guidance set out at paragraph 102 above.
     
130. In considering whether the transaction should be treated as a direct transfer in my view the following factors derived from ITC (and from Menelaou and Banque Financiere) are of relevance:
     

a. The analysis must focus on the transactions and not the effect of the transaction. This reflects the need to avoid considering the "economic reality" of the transaction.


b. The substance of the transaction is key rather than its form. This reflects "transactional reality" and ensures that "apparent" features of the transaction give way to "real" features. The purpose and genuineness of each step must be considered.


c. The nature of the transactions may be important. The fact that charges and land purchases are "indissolubly bound together" as a matter of law (see Abbey National v Cann) was an important feature in Menelaou.


d. The number of parties providing (in this case) funds should be considered.


The transactions (not their effect)


131. The transaction in this case, an international foreign currency transfer, is a standard, well recognised transaction of the type that takes place every day in a well-regulated and controlled financial environment. This type of transaction is part of the fabric of international trade. The legal structure of the transaction is well understood and is described in textbooks.
132. The actual mechanism of the payment is described at paragraphs 16 and 17 above and is undisputed. The transfer involves "the adjustment of balances" between two pairs of banks: SABB and Citibank; and Citibank and the Bank. The interbank accounts are settled in the normal course of business by a running account and "it is usually unnecessary for either bank to transfer funds to the other".

The substance, purpose and genuineness of the transactions


133. The transactions followed a standard and established form and process. The purpose was to make funds available in the Account.
     
134. There is no suggestion that any step was interposed in order to obtain a collateral benefit for one party or the other.
     
     The nature of the transactions
     
135. It is important to note that transactions of the type seen here are commonplace. Their structure is well recognised, and their effect is that money is made available to a bank's customer through an "adjustment of balances".
     
136. The generally recognised position (at least before ITC) was that international payments of this type were not "at the claimant's expense". That is at least in part because it was not possible to trace the finds at common law and because there had been no suggestion of proxy, agency or other basis on which international transfer payments would be treated as "direct" payments.
     
137. I note that ITC itself makes no reference at all international bank payments of this type.
     

The parties providing funds


138. Funds were made available in the Account as a result of adjustments to interbank balances between SABB and Citibank and between Citibank and the Bank. On that basis funds might be said to have been provided by 3 parties. This is certainly not a case where, as a matter of transactional reality, there is a single provider of funds.
     

Conclusion on "at the expense of"


139. Taking each of the factors set out above into account, and taking an overall view of the transactions, it is clear that it would be wrong to treat the international inter-bank transactions in the present case as forming a single scheme or transaction. On analysis it is necessary (and realistic) to treat individual transactions separately.
     
140. It is only by taking a broad (and impermissible) view of "economic reality" that it could be said that the present case should be treated as a direct transaction case. Mr Anderson QC noted in closing submissions that "only a lawyer" could describe the transfer of value as indirect. In my judgment this makes the point. A pragmatic non-lawyer observer might conclude otherwise, but in doing so would be attempting (inappropriately) to apply an oversimplified version of "economic reality".
     
141. I have also considered if the agency exception might apply. In my view it does not. If A makes a payment to B and B makes a payment to C it would be appropriate to treat the co-ordinated transactions as a direct transfer from A to C if B is the agent of one party or the other (110a above and paragraph 48 of ITC) . While the exception allows the agent's involvement to be ignored, it does not create a direct transfer where there is none.
     
142. In my judgment, the conclusion that the Bank was enriched "at the expense of" the claimant would be contrary to the decision in ITC and would fail to recognise the established manner in which international bank transfers are made.
     

The textbooks


143. In considering the academic views expressed in the textbooks, I bear in mind (as the editors of Goff and Jones themselves point out at paragraph 6-49 by reference to the Court of Appeal decision in ITC) that
     

"notwithstanding [the] influence and the analytical force of many [academic] arguments, it is the authorities which are the sources of the law, and for that reason, … they, rather than the large number of publications put before us, must be our starting point".


144. It is important to note that the 9^th edition of Goff and Jones (2016) precedes the Supreme Court decision in ITC. The commentary should therefore be read subject to that decision. The learned editors (see paragraph 6-50) express the view that "a transfer of value may sometimes be found where D makes a gain and C suffers a subtraction from his wealth as a result of sequence of transactions that are themselves joined by a counter-factual, "but for" causal connection." This is the type of approach which the Supreme Court expressly disapproved of in ITC as part of the previous "unstructured approach driven by perceptions of fairness, with consequent uncertainty and unpredictability".
     
145. The reference in Goff and Jones to "causation-based agency reasoning" is a clear reference to the state of the law before the Supreme Court's decision in ITC. In my judgment the views there expressed do not reflect the present state of the law.
     
146. The editors of Brindle and Cox accept that the law is developing and put forward a view (by way of submission) as to how the law might develop. That view appears to rely, at least in part, on a pure economic reality argument rather than an argument based on "transactional reality". For those reasons I do not think it appropriate to regard either text as mapping out a path which I ought to follow in this case.
     

Developing law


147. Although the Supreme Court made it clear that the instances cited of where indirect payments may be treated as direct are not closed, it would not be appropriate to extend the class of cases to international bank transfers of the type which are present here. There is no principled basis on which there could be such an extension. In my judgment to do so here would have far-reaching and potentially unforeseen consequences and be no more than an (impermissible) "resort to an unstructured approach driven by perceptions of fairness" in this case.
     

Tracing

148. None of the other category of cases suggested by Supreme Court apply. There is no agency, no assignment, no sham, no property provided by a third party which can be traced using the common law rules and there is no discharge of debt.
149. For those reasons in the present case the issue of whether the defendant's enrichment was at the expense of the claimant is to be determined by the application of the common law rules of tracing.
150. The law in this area is settled. Tracing through mixed funds (included those created by international banking transfers of the type present in this case) is impermissible at common law. The correct approach is that set out in Agip (Africa) Limited v Jackson [1991] Ch 547. Mr Kramer QC makes the point at paragraphs 40 and 41 of his skeleton. Mr Anderson QC does not seek to persuade me not to follow Agip. There can be no tracing into a mixed fund and so the transfer cannot be categorised as being at the expense of the claimant.
151. It follows that the unjust enrichment claim must fail. I will go on to consider the other aspects of the claim in any event.

Was the enrichment unjust?

152. Next, I must consider if the enrichment was unjust (element (c)). Was there a material mistake on the part of the claimant? In my judgment this element is made out.
153. Mr Anderson QC submits that this aspect of the claim is made out because Mr Manickam (who made the payment) and Mr Vellozo (who instructed him to make the payment) believed that the email instructing them to send the money to the Defendant was genuine and that it represented a proper instruction from Mr Fritelli. Mr Kramer QC for the Defendant submits that it is open to me to find here that the claimant did not act under the influence of a material mistake when it paid away the $5m.
154. In my judgment the law is summarised by the editors of Goff and Jones at paragraph 9-40 of the 9^th edition of "The Law of Unjust Enrichment".
     
155. First, the concept of a "mistake" requires, as a threshold matter, that a claimant believed that it was more likely than not that the true facts or true state of the law were otherwise than they actually were. Secondly, this belief must cause the claimant to confer the benefit on the defendant, in the required sense. Thirdly, even if a causative mistake can be shown, a claimant may sometimes be denied relief on the basis that he responded unreasonably to his doubts, and so unreasonably ran the risk of error. Fourthly, beyond this, a claimant who had doubts may be denied relief on the distinct grounds that he has compromised or settled with the defendant, or on the basis that he is estopped from pleading his mistake. There is no need for any independent "assumption of risk" bar in this context, and the language of assumption of risk is a redundant way of expressing the conclusion that a claimant's claim must fail on one or more of the foregoing grounds.
     
156. There are elements of the fraud that appear, at least with benefit of hindsight, to be amateurish and inept. It is not clear why for example Fabio Fritelli would apologise for "any inconvenience", what was meant by bank details being "under scrutiny", what the reference to "refunds made from other branch" means and why money would be transferred to a high street bank branch in Brixton.
     
157. On the other hand, the fraudster's email was specific and accurate in a number of respects:
     

a. It came from the genuine email address of Mr Fritelli, he had been copied into all earlier relevant email correspondence and held a senior position.


b. It mentioned that details of the account (the Société Generale account) into which money was to be paid had already been provided.


c. It correctly identified that the account details had been provided by "Andrea [Balboni]".


d. It had the same subject line as all earlier relevant emails ("refund to TCM spa of 7.5M USD granted to TAL").


e. It was apparently copied to all others involved in the earlier email chain.


f. The sum was to be paid to an account apparently held in the name of a "Tecnimont" company.


g. TAL replied to the email more than once and received further replies.


158. Taking these matters together, I have no doubt that the claimant's agents at every stage believed that they were acting on a true instruction from TCM to pay the money to a bank account at the Defendant's branch in Brixton. That belief was clearly wrong. I am satisfied (and easily so) that the claimant did not unreasonably run the risk that it was acting on a mistake. In short, the claimant was completely taken in by the fraud. It is easy with hindsight and after careful forensic examination to say that a prudent and vigilant claimant would have seen through the fraud, perhaps been concerned by the language of the fraudulent email and perhaps ought to have noticed that the payee was not in fact one of the 50 or so worldwide subsidiaries of TCM. But I do not accept that that is the case.
159. I am satisfied that the enrichment was unjust.

Do any defences arise?


160. I must now consider the defences (element (d)) that would be available to the Bank in the event that my conclusion on element (b) is found to be wrong.
     
161. The claimant relies on the following matters to defeat the defences:
     

a. On 1 November after 11.56 the Bank knew the money held in the Account had been obtained by fraud. Its failure to take steps to secure the money before it was transferred away at 15.44 is said to have been unconscionable.


b. On 31 October the second SilverTail alert was dealt with in a manner outside the Bank's usual processes. The claimant submits that this was a knowing and deliberate failure.


c. The claimant contends that the design of the Bank's fraud systems was such that they operated in a commercially unacceptable manner. First, the Bank's third-party fraud detection systems worked in real time and were capable of preventing a transaction taking place, but the Bank's first party fraud detection systems operated retrospectively when it would almost certainly be too late to prevent the dissipation of money. Secondly, the Bankline Security team dealing with SilverTail alerts did not have access to KYC information.

The law on change of position and bad faith


162. The change of position defence was first recognised by Lord Goff in Lipkin Gorman [1991] 2 AC 548. At p.580 he said:

"It is, of course, plain that the [change of position] defence is not open to one who has changed his position in bad faith, as where the defendant has paid away the money with knowledge of the facts entitling the plaintiff to restitution; and it is commonly accepted that the defence should not be open to a wrongdoer. These are matters which can, in due course, be considered in depth in cases where they arise for consideration ... At present I do not wish to state the principle any less broadly than this: that the defence is available to a person whose position has so changed that it would be inequitable in all the circumstances to require him to make restitution, or alternatively, to make restitution in full." (emphasis added)


163. In Niru Battery the Court of Appeal emphasised that the essential inquiry was about unconscionability. Clarke LJ (as he then was) concluded (see paragraphs 149, 162 and 171) that Lipkin Gorman was authority for the view that:
     

"the essential question is whether it would be inequitable or unconscionable, and thus unjust, to allow the recipient of money paid under a mistake of fact to deny restitution to the payer."


164. Clarke LJ found that the answer to this essential question: "depends upon the circumstances so that it is not possible to lay down absolute principles". He noted that, at first instance, Moore-Bick J addressed the problem in the following passage (which the Court of Appeal approved):
     

"I do not think that it is desirable to attempt to define the limits of good faith; it is a broad concept, the definition of which, in so far as it is capable of definition at all, will have to be worked out through the cases. In my view it is capable of embracing a failure to act in a commercially acceptable way and sharp practice of a kind that falls short of outright dishonesty as well as dishonesty itself. The factors which will determine whether it is inequitable to allow the claimant to obtain restitution in a case of mistaken payment will vary from case to case…." (emphasis added).


165. In the same passage approved by the Court of Appeal, Moore-Bick J went on to consider the position where the payee has voluntarily parted with the money. In that case he said:
     

"….much is likely to depend on the circumstances in which he did so and the extent of his knowledge about how the payment came to be made. Where he knows that the payment he has received was made by mistake, the position is quite straightforward: he must return it. This applies as much to a banker who receives a payment for the account of his customer as to any other person"


166. Lipkin Gorman (as explained in Niru) laid down a broad principle as to when the defence of change of position would not be available. Whether that principle applies in a given case will always depend on the particular facts and circumstances of that case. The factual circumstances in which money might be paid away after a defendant has actual notice of a restitutionary claim fall across a wide spectrum. On the one hand a bank might acquire actual knowledge a matter of seconds before a wrongdoer pays away money and on the other actual knowledge might be acquired months before money is paid away. To suggest in the former case that the bank should be prevented from relying on the change of position defence would clearly be "unjust". In the latter case on the other hand, it would be unjust to suggest that the bank could rely on the defence. The broad principle laid down by Lipkin Gorman allows the court to consider all relevant factors and determine if it is appropriate to allow a defendant to rely on the defence.
     
167. It follows that Clarke LJ did not intend to lay down a fixed rule that knowledge precludes reliance on the change of position defence. As he put it at paragraph 152:
     

"where the recipient knows that the payer has paid the money to him as a result of a mistake of fact, or indeed a mistake of law, it will in general be unconscionable or inequitable to refuse restitution to the payer" (emphasis added).


Clarke LJ's framing of the "essential question" (whether it would be inequitable or unconscionable, and thus unjust, to allow the recipient of money paid under a mistake of fact to deny restitution to the payer") in my judgment makes the point.


168. The fundamental question is not whether the defendant has acted in a commercially unacceptable way, has been guilty of sharp practice, has been dishonest, or even if the defendant knew that sums in a bank account had been paid by mistake, it is whether it would be unjust to allow the defendant to deny restitution.
     
169. The editors of Goff & Jones on Restitution (9^th ed.) support this view and note (at para.7-42) that "it would be wrong to conclude that a defendant can never plead change of position where he has suffered detriment after becoming aware of the circumstances entitling the claimant to restitution……knowledge and bad faith do not always go hand in hand".
     

Point of knowledge


170. There is no issue that the Bank "knew" of the fraud visited on the claimant after it had received the relevant SWIFT recall. The claimant argued that the Bank should be taken to have "known" of the fraud earlier, or at least was put on inquiry. The starting point for the argument is the decision of Gibson J in Baden v Societe Generale [1993] 1 WLR 509 and the 5 categories of knowledge there set out: (1) actual knowledge; (2) wilfully shutting one's eyes to the obvious; (3) wilfully and recklessly failing to make such inquiries as an honest and reasonable man would make; (4) knowledge of circumstances which would indicate the facts to an honest and reasonable man; and (5) knowledge of circumstances which would put an honest and reasonable man on inquiry.
     
171. The claimant's position is that Mr Bennett, when dealing with the second SilverTail alert, wilfully and recklessly failed to make such inquiries as an honest and reasonable man would make (and so had type (3) knowledge).
     
172. In support of that submission the claimant refers to Armstrong v Winnington [2012] 3 WLR 835 a decision of Stephen Morris QC (as he then was). The case concerned the sale of EU Allowances to omit carbon dioxide ("EUAs"). A third-party fraudster ("Zen") transferred 21,000 EUAs belonging to Armstrong, without Armstrong's knowledge, to Winnington. Zen fraudulently misled Winnington to buy the EUAs (from Zen) and Armstrong paid Zen €267,645. Winnington knew that the EUAs had been transferred from an account numbered DE-1712-0 but did not know if the account was Zen's account.
     
173. Armstrong brought a proprietary restitutionary claim, an unjust enrichment claim and a claim in knowing receipt (the first 2 claims are common law restitutionary claims, the third is a personal claim in equity). Winnington defended the claims on the basis that it was a bona fide purchaser without notice of the EUAs and relied on the defence of change of position. Armstrong's position was that Winnington had failed to comply with its own due diligence procedures. The evidence accepted by the Judge was that after transfer of the EUAs Winnington contacted Zen and required proof that it owned account number DE-1712-0 before it would pay. No such confirmation was provided (because the account in fact belonged to Armstrong). The Judge found as a fact that, by paying the EUAs before receiving the requested confirmation, Winnington (acting through Mr Pursell) consciously chose to take the risk that the EUAs did not belong to Zen. Mr Pursell:
     

"wilfully and recklessly closed his eyes to the possibility that the EUAs did not belong to Zen which [possibility] he by then had appreciated. At the very least, Mr Pursell knew that something further was needed to make the transaction regular and without finding that out, that there was a risk. He knew of circumstances which caused him to ask questions. He asked those questions but did not wait for an answer. It was the not waiting for an answer which was wilful and reckless."


174. On that basis, the Judge found:
     

"that the state of Winnington's knowledge of the relevant circumstances was such as to render its receipt of the EUAs "unconscionable". Whilst I accept that no one at Winnington had actual knowledge of the "phishing" fraud nor, in this way, that the EUAs were "stolen", I am satisfied that the relevant personnel at Winnington were actually aware that there was a possibility that Zen did not have title to, or authority to sell, the EUAs and that they are consciously and deliberately "closed their eyes" to that risk or possibility".


At paragraphs 284 and 285 the Judge said this:


"Put another way, Winnington's knowledge fell within, at least, Baden type (3), because Winnington wilfully and reckless failed to make such further inquiries as an honest and reasonable man would have made in the circumstances then pertaining. These facts constitute knowledge within the band of Baden types (2) and (3) and in any event are such as to render Winnington's receipt of the EUAs unconscionable." (emphasis added).


175. In the commercial context, the learned Judge concluded that if a defendant had Baden types (1) to (3) knowledge he would not be able to rely on the change of position defence. Types (4) and (5) would defeat the defence "only if, on the facts actually known to this defendant, a reasonable person would either have appreciated that the transaction was probably [fraudulent] or would have made inquiries or sought advice which would have revealed the probability of [fraud]." (see paragraph 132).
     
176. The claimant notes in the present case that a failure to follow a KYC procedure in Armstrong was enough to tip the case into bad faith and submits that Mr Bennett's failure to follow internal procedures has the same effect.
     
177. The extent of Winnington's failure was serious. It was clear that Winnington knew there was a risk of fraud and took the EUAs (and paid for them) in spite of that risk. The circumstances were such that Winnington's receipt and retention of the EUAs was clearly unconscionable. An investigation into whether internal policies (be they KYC policies or other policies) were or were not followed is, of itself, not fruitful. The central question remains: would it be unjust to allow the defendant to deny restitution?
     

Baden categorisation


178. In BCCI v Akindele [2001] Ch 437 the Court of Appeal was concerned with a claim by liquidators for knowing assistance and knowing receipt. The issues were whether either claim required the proof of dishonesty and if not what state of knowledge would be sufficient? At page 455 Nourse LJ asked what, in the context of knowing receipt, is the purpose to be served by the Baden categorisation of knowledge? He concluded that the purpose "can only be to enable the court to determine whether…. the recipient can "conscientiously retain [the] funds against the company" or…. "[the recipient's] conscience is sufficiently affected for it to be right to bind him by the obligations of a constructive trustee". If that was the purpose, then the categorisation of knowledge serves no useful purpose. He concluded:
     

"All that is necessary is that the recipient's state of knowledge should be such as to make it unconscionable for him to retain the benefit of the receipt."


179. The same point can be made in respect of a claim in unjust enrichment where the essential question (see Clarke LJ in Niru) when determining if the defendant can rely on a change of position defence is whether it would be "inequitable or unconscionable, and thus unjust, to allow the recipient of money paid under a mistake of fact to deny restitution to the payer".
     
180. Nourse LJ went on to say that a "test" formulated as a single essential question (as in Niru and Lipkin Gorman) ought to avoid the difficulties of "definition and allocation" which abound when trying to characterise knowledge in the way that Baden suggests. Whilst the classification set out in Baden might be useful in some cases, it is in my judgment important not to allow the Baden categorisation to confuse or change the essential question to be answered in determining if a defendant is entitled to rely on change of position as a defence to a claim in unjust enrichment.
     

Jones v Churcher


181. The claimant relies also on Jones v Churcher [2009] EWHC 722 (QB). In that case, the claimant mistakenly paid £42,300 to the defendant's Abbey National account on 7 March 2006. By no later than the beginning of normal business hours on Friday, 10th March, Abbey National had actual knowledge that the remitting bank was asking for the money back because the payment had been made in error (see paragraph 85) and by the opening of business on Thursday 9 March Abbey National was "on inquiry" that Miss Churcher had received the money as a result of a mistake (see paragraph 97). No steps were taken to process the recall until 22 March, when a letter was sent to Miss Churcher asking her to complete an enclosed debit authority. In the meantime, between 13 and 15 March the defendant had paid away most of the money.
     
182. The trial judge set out, at paragraph 44 of his judgment, the "essential question" framed by Clarke LJ in Niru (see paragraph 160 above). At paragraph 94 he said the question for him to decide was "whether Abbey National acted with good faith in allowing the money to be withdrawn from Miss Churcher's account….".
     
183. The learned judge did not decide the case on the basis that Abbey National had lost the right to rely on the change of position defence as soon as it became aware that Miss Churcher had received the payment of £42,300 by mistake. Instead, he concluded that the account ought to have been ring-fenced pending further enquiries. The failure to ring-fence the relevant account on 9 or 10 March or (ignoring the weekend of 11 and 12 March) at any point on 13 March was sufficient for the judge to conclude that Abbey National had not acted in good faith (the question posed at paragraph 94), and that it would be "inequitable or unconscionable, and thus unjust" to permit Abbey National to deny a restitutionary remedy (this "essential question" taken from Niru was referred to by the Judge at paragraph 44 of the judgment).
     
184. The learned judge said this at paragraph 97:
     

"I need go no further than to hold that, as of 9th March, Abbey was on inquiry that Miss Churcher was not entitled to the money and that in those circumstances Abbey cannot be heard to argue that it changed its position in good faith by paying away the money to Miss Churcher in the following week. The claim to recover the money as money paid under a mistake of fact succeeds against Abbey National for that reason. I would add, however, that the facts of this case demonstrate that the system in place at Abbey National in 2006 for dealing with recall requests in cases of mistaken payment was inadequate. Steps could and should have been taken to ring-fence the money pending further inquiries and an attempt should have been made to contact Miss Churcher within at most 3 working days." (emphasis added).


185. At paragraph 81 the Judge noted that "where fraud is alleged it is clearly important that swift action [to ring-fence the money] should be taken".
     
186. The court's approach in Jones further emphasises the need to consider the "essential question" (would it be inequitable or unconscionable, and thus unjust, to allow the recipient of money paid under a mistake of fact to deny restitution to the payer). Nothing in Jones suggests that knowledge will always defeat the defence of change of position.
     
     

Is the Bank's defence available on the facts?


187. In my judgment, and if my conclusion that the elements of an unjust enrichment claim are found to be wrong, the Bank in any event and for the following reasons, has a complete defence to the claimant's claims. The Bank's conduct at no stage was such that it would be unjust to permit it to rely on the defence of change of position.
     

The systems case


188. Were the Bank's systems designed and used in such a way that I should find that it would be unjust (unconscionable or inequitable) to allow it to rely on the defence of change of position?
     
189. It is clear that the Bank was entitled to adopt different systems to detect on the one hand money laundering by its customers (AML systems in respect of first party fraud, the Fortent system) and on the other hand to detect fraud on its customers (third party frauds, the SilverTail system). It is equally clear that there was nothing objectionable in the former system working retrospectively and the latter system working in real time.
     
190. I accept that an important part of a bank's relationship with its customer is to protect the customer from fraud. A bank is entitled, having gone through an appropriate due diligence procedure before opening an account in the form of KYC (at the end of the hearing the Bank's KYC procedure here was not criticised), to proceed on the basis that its customers operate legitimately. The Bank is entitled therefore to concentrate its efforts on protecting its customers rather than investigating them.
     
191. I am satisfied that the main purpose of the SilverTail system was to detect third party fraud. The evidence was that alerts that might suggest an account was being used a mule account were very rare and amounted to no more than 2 or 3 per member of staff every 3 years. That is a vanishingly small number when a member of staff might deal with between 50 and 200 alerts per week. Even then a mule alert does not necessarily mean that a first party fraud is underway. The Bank's guidance makes plain that a customer might in such cases be an innocent victim of a fraudster.
     
192. In my judgment it is plain that the Bank had in place adequate and properly designed systems to deal with frauds on and by its customers. The absence of an ability to consider KYC detail during a standard "bad country" alert is in my judgment not material.
     
193. I am satisfied that there is nothing in the design or operation of the Bank's systems which would make it unjust to allow the Bank to rely on the change of position defence.




Mr Bennett


194. Mr Bennett used the BDM and did not record accurate answers to the questions he was required to answer. I need to consider the following points:
     

a. Was Mr Bennett entitled to use the BDM?


b. If so, what would have happened if he had recorded accurate answers to the relevant questions?


c. If not, what would have happened if he had followed the correct procedure?


Was Mr Bennett entitled to use the BDM?


195. The evidence was that in practice (as Eleanor Gordon told me) a team member had a discretion about when to use the BDM process. I accept that evidence. It follows that the processes set out in the guidelines were not regarded as set in stone. In my view when Mr Bennett applied the BDM process, he did so in good faith in order to avoid disruption to a customer who had already that day confirmed its desire to make payments which the Bank might consider would be indicative of a fraud on the customer. I therefore conclude that he was entitled to use the BDM.
     

If the answers had been accurate


196. If Mr Bennett had used the BDM system appropriately, he would have provided a different answer to question 4a. He would have noted that 2 payments had been edited by the customer and that twice payment preferences had been changed. His written evidence was that none of these changes would have caused him any concern. I accept that evidence.
     
197. If he had reviewed transactions over the last 3 working days (that is from 29 October to 31 October) Mr Bennett would have seen the following:
     

a. A small balance of $100 on 29 October but with no activity on that date.

b. On 30 October a credit of $4,999,990.83 and 6 debit payments (3 to Croatia and 3 to Hungary) of between $95,799.59 and $126,019.59.

c. On 31 October at 13.04 he would have seen 16 debit transactions (6 to Hungary, 5 to Croatia, 4 to Hong Kong and 1 to the Czech Republic) ranging from $97,919 to $1,249,764.55.

d. Of the 22 debit payments, 15 were between $120,000 and $129,000.


198. The payment to which the second SilverTail alert related was not processed. The amount of the payment ($124,660) was well within the range of payments made from the account in the 3-day period and might have been regarded as an "average payment" for the period and there was nothing out of the ordinary about a payment to a foreign account. The expert evidence (which I have accepted or preferred) is that there was nothing to cause any concern in the transactions which would have been considered.
     
199. In my judgment the answers provided to question 4 and question 4b by Mr Bennett would have been accurate and reasonable responses if he had looked at the relevant transactions. Question 4 required a value judgment to be made and question 4a is clearly designed to determine if, after consideration of a number of factors, the payment was extraordinary. I am further fortified in that conclusion because, as Mr Bennett was aware, Mr Robinson had gone through a similar process earlier in the day (when there had only been 11 transfers out). The context in which the questions were posed is important. Their point was to uncover a fraud on the customer, not a fraud by the customer.
     

If BDM should not have been used


200. If, contrary to my finding, Mr Bennett had not been entitled to use the BDM procedure and had instead called the customer, his primary task would have been to investigate whether the customer had been the subject of a fraud. Mr Robinson makes this plain. His uncontested evidence was that the purpose of the call was to "run through a set of questions to determine if a customer had been scammed". The customer had already provided convincing answers to Mr Robinson earlier that day. Mr Robinson had recorded those answers as being "consistent with no compromise". Mr Robinson's approach was not criticised and had been checked and verified on the day by Sumbal Khalid. Indeed, it should be noted that the customer's responses to questions directed at discovering if it was the victim of fraud were probably truthful. I can see no basis to conclude that, if he had gone through the appropriate script, Mr Bennett would have discovered (or been put on notice of the risk of) any fraud being committed by the customer.
     
201. If I am wrong to conclude that (save for the answer to question 4a) Mr Bennett's responses to the BDM questions were appropriate and if in considering questions 4 and 4b Mr Bennett had noted a cause for concern, I think it likely (bearing in mind the primary purpose of monitoring these SilverTail alerts was to protect the customer from fraud) that he would simply have abandoned the BDM process and called the customer.


Mr Bennett's State of Mind

202. If I conducted a Baden enquiry into Mr Bennett's knowledge, I would conclude that he had no notice of the fraud at all. Even if Mr Bennett might have fallen into Baden category 4 or 5 on the facts actually known to him at the time, it cannot be said that a reasonable person would either "have appreciated that the transaction was probably fraudulent or would have made inquiries or sought advice which would have revealed the probability of fraud."
     
203. The test to apply is, in any event, not one that begins and ends with knowledge. The real question is: would it be unjust (unconscionable or inequitable) to allow the Bank to rely on the defence of change of position given Mr Bennett's conduct?
     
204. If I am wrong to conclude that Mr Bennett was entitled to use the BDM, or wrong that (save for question 4a) his responses were reasonable, the highest criticism that can be levelled at him is that he failed to follow internal procedures, or that he was careless. In my view that is far from enough to justify the conclusion that the Bank should be precluded from relying on the change of position defence.
     
205. In my judgment nothing in Mr Bennett's conduct raises any question of unconscionability.
     

Actual Knowledge


206. By 11.56am on 1 November the Bank was aware that money had been paid to the Account as a result of a mistake induced by a fraud. The information was received by Miss Parratt at about 1.00pm and by 1.30pm she had located the Account and was aware that around $36,000 remained. At 1.46pm she began to investigate what steps should be taken to freeze the account. She received the required information at 1.51pm from Mr Probert. Mr Anderson QC on behalf of the claimant submits that this was the point at which the Account should have been frozen.
     
207. The Account was frozen at some point between 4.20pm and 4.42pm. The request to freeze was sent out at 4.20pm. The last payment from the Account was made at 3.44pm. The relevant period relied on by the claimant to show an absence of good faith on the Bank's part is between 1.51pm and 3.44pm, a period of 1 hour and 53 minutes. Would it, in the light of this delay (during which time the Bank was aware of the relevant fraud) be inequitable or unconscionable, and thus unjust, to allow the Bank to deny restitution of the US$33,989.88 paid out at 3.44pm?
     
208. The delay is relatively short. It is not suggested that the Bank did nothing in this period. Miss Parratt made the "judgment call" to begin work on securing the repayment of sums paid out rather than on the retention of the relatively small amount remaining. The remaining sum represents approximately 0.7% of the funds paid away and about one-third of the smallest previous payment out. In the abstract at least it seems perfectly rational to choose to spend time trying to recover very large sums of money rather than to preserve very small amounts of money.
     
209. By 2.09pm Miss Parratt had in effect delegated the freezing of the account and the issue of SWIFT recall messages to others. It then took until 3.28pm for Miss Davey to be asked to deal with the account freezing.
     
210. The process of freezing the Account was, I accept, not dealt with efficiently. It was perfectly possible to have frozen the account before the final payment was made. If Miss Parratt had actioned the instructions to freeze at any time before 3.20pm it is likely that the Account would have been frozen, and the last payment saved.
     
211. It is important to bear in mind that the payment out of money from the Account was essentially an automated process. The final transfer out was not actively authorised by the Bank, the payment was "permitted" by the Bank's automated processes. The reality of the complaint is not that the Bank actively paid out the final payment in full knowledge of the fraud, but that the Bank failed to stop the payment, by freezing the account, when it knew of the fraud.
     
212. I am satisfied here that the delay in freezing the Account here is not such that I can conclude that it would be unjust to allow the Bank to rely on the defence of change of position. I accept that Miss Parratt could have acted sooner, but I do not accept that overall, the conduct of those involved would make it "unjust" to allow the Bank to rely on the defence.
     
213. Miss Parratt passed the responsibility to freeze the account and to start the process of recalling monies to others in the Bank. She acted in my judgment in a perfectly understandable way. The process might have been more efficient, but a lack of efficiency is far from a sufficient reason to conclude that it would be unjust to allow the Bank to rely on the defence.
     
214. For those reasons in my view, despite the fact that the last payment was made when the Bank had knowledge of the fraud, the Bank remains entitled to rely on the defence of change of position.
     

Conclusion


215. The claim in respect of knowing receipt must fail.
     
216. The Bank's unjust enrichment was not "at the claimant's expense". It follows that the claimant has no right to restitution of any sums.
     
217. If I am wrong in that conclusion, then I am in any event satisfied that the Bank is entitled to rely on the defence of change of position in respect of each payment out.
     
218. I therefore dismiss the claim.
     
219. I am very grateful to Leading and junior counsel for their assistance in the determination of this claim.