Search

How can we help?

Icon

Victim of fraud? How to identify the perpetrator

Every day companies and individuals lose money to fraudsters, who hack into email accounts and alter emails sent from companies to their customers, or send sophisticated phishing emails from fake domain names designed to dupe customers into believing they are from a trusted supplier. Often, the emails will say that bank details have been changed, and that customers should make payment of a genuine invoice into a new account, which in reality is an account controlled by the fraudster.

Once the customer has transferred the funds, the money is usually quickly transferred on or withdrawn by the fraudster, leaving the customer little opportunity to reverse the transaction and retrieve their money.

When asked to identify the individuals behind the accounts used in these scams, banks will typically refuse to help, citing confidentiality and data protection obligations. But it is possible to force a bank to disclose identity details and transaction records via court order.

A ‘Norwich Pharmacal’ order (“NPO”) is a type of court order which compels an innocent third party (often a bank) who is mixed up in wrongdoing to disclose information that will assist the victim in identifying the wrongdoer, or obtaining information which is necessary to bring a claim against the wrongdoer. To obtain an NPO, it is necessary to issue a claim against the bank or other third party holding the information, accompanied by a detailed witness statement setting out the fraud which has occurred, the information required and why it is needed. A hearing before a judge will then take place, which can be arranged at very short notice where time is of the essence.

The court has a discretion as to whether to make an NPO, and will need to be satisfied that there is clear evidence of wrongdoing, that the information requested is required by the victim and cannot be obtained any other way, and that the bank or other third party is involved in the wrongdoing and is not merely a witness to it.

When asked to identify the individuals behind the accounts used in these scams, banks will typically refuse to help, citing confidentiality and data protection obligations. But it is possible to force a bank to disclose identity details and transaction records via court order.

It is also necessary for the victim to agree to pay the bank’s costs of responding to the claim and complying with the order, and to agree to compensate the bank in the event that it suffers any loss if it later transpires that the order should not have been made.

Often, banks will take a neutral position in relation to applications for NPOs where there has been fraud i.e. they will not consent to the order sought, but will not oppose it either. An application to freeze any remaining funds in the relevant accounts can be made alongside the application for a NPO, although it may be too late to retrieve any funds if too much time has passed from the date of the fraud.

Obtaining an NPO requires some intensive work on the part of the victim and its lawyers and is not a cheap exercise; however an order can usually be obtained in a matter of days and in a large scale fraud, can be key to stopping the fraudster in their tracks and retrieving stolen funds.

About this article

Disclaimer
This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.

About this article

Read, listen and watch our latest insights

art
  • 04 July 2025
  • Employment

Update: The ‘Employment Rights Bill Implementation Roadmap’

The Employment Rights Bill is a draft law which is poised to expand the rights of employees, signifying a major overhaul in employment law. The ERB has already been passed by the House of Commons and is currently at the ‘Report Stage’ in the House of Lords.

Pub
  • 03 July 2025
  • Corporate and M&A

Get your tech business market ready for sale

In our latest podcast, join Stuart Mullins and Nicky Goringe Larkin to learn how to maximise your tech business value and get your tech business market ready for sale.

art
  • 03 July 2025
  • Immigration

Major Changes to the Immigration Rules from 1 July 2025: What Employers and Visa Holders Need to Know

We outline the key updates, how they affect employers and visa holders—particularly those on the Skilled Worker and Global Business Mobility (GBM) routes—and how our team can assist you in staying compliant and ahead of policy changes.

art
  • 02 July 2025
  • Employment

Day One Rights: What the New UK Employment Bill Means for You and Your Workplace

Let’s unpack what’s changing in the UK Employments Rights Bill, and why it matters, and what both employees and employers should expect.

art
  • 01 July 2025
  • Privacy and Data Protection

Data protection compliance: tricky issues for employers

This article highlights key issues organisations may face when processing personal data and stresses the importance of a proactive approach. It also outlines tailored training packages to support compliance and build internal expertise.

art
  • 26 June 2025
  • Employment

A shift in EHRC guidance on single sex spaces in the workplace

In a recent significant shift, the Equality and Human Rights Commission (“the EHRC”) has quietly amended its guidance on single sex spaces in the workplace.