Quincecare duty: Supreme Court decision clarifies banks’ duty of care (Philipp v Barclays Bank)

Authorised Push Payment (APP) fraud has been on the top of the agenda for public and private bodies as they push for greater consumer protection amidst the rise of the prevalence of purchase, investment and romance scams. According to UK Finance’s 2023 Annual Fraud Report, the losses attributed to APP fraud totalled £485.2m in 2022. A series of recent measures have been introduced by the government and the regulators, but many have been alert to the case of Philipp v Barclays Bank UK PLC and what this could mean for banks from a legal and customer redress perspective. In this article we look at the headline points determined by the recent decision of the Supreme Court and where that decision fits in the wider context of the fight against APP fraud.

Background

Under the Quincecare duty, where a bank is on notice that a payment instruction from a customer’s agent may be a fraudulent attempt to obtain the account holder’s funds, it must refrain from making or executing that payment. If the bank is held to have breached this duty, then it would bear the financial consequences of the fraud and be made to pay damages. Mrs Philipp claimed that Barclays Bank UK Plc (the Bank) owed a Quincecare type duty in circumstances where no agent was involved.

In this case, Mrs and Dr Philipp fell victim to APP fraud after Dr Philipp was contacted by a fraudster who claimed he worked for the Financial Conduct Authority (FCA) in conjunction with the National Crime Agency (NCA) saying that they were investigating a fraud. The fraud purportedly occurred within HSBC and an investment firm, Tilney, which was where Dr Philip held substantial savings. In a series of telephone calls, Dr and Mrs Philipp were convinced that their money needed to be moved to safe accounts.

One of the striking features of the case, which was set out in the High Court judgment and referred to by the Supreme Court, was the sophistication of the fraud. This was shown by the fact that the victims were even convinced not to cooperate with the police. This happened in part through the fraudsters managing to make it appear that Dr Philipp was being called from an NCA telephone number. As a result, Dr Philipp transferred £950,000 from his investment account to his wife’s Barclays current account. Mrs and Dr Philipp then visited Barclays branches twice to instruct that a total of £700,000 should be transferred to a bank account in the UAE. On both occasions, the Bank sought express confirmation of instructions from Mrs Philipp. Following this, the Bank carried out the instructions, executed the transfers and the money was lost.

Mrs Philipp claimed that the Bank was liable for the loss. She argued that the Bank owed her a duty under the contract not to carry out her payment instructions if the Bank had reasonable grounds for believing that she was being defrauded.

At first instance, the Bank’s application for the claim to be summarily dismissed was allowed. On appeal, the Court of Appeal accepted that in principle the Bank owed a contractual duty of this kind to its customer and whether it arose on these facts was something that could only be decided at trial. The Court of Appeal’s decision was appealed by the Bank.

What did the Supreme Court decide?

In a unanimous decision, the Supreme Court held that the Quincecare duty does not apply in cases of APP fraud.

While the scope of the Quincecare duty has been moulded by a series of high-profile cases over the past few years, it has historically only applied to agency relationships. Barclays argued that an extension to the duty to include APP fraud would be unduly burdensome on banks, as the intention to complete the transaction is there, albeit made on the basis of a fraud behind the scenes.

The Court found that the Quincecare duty should not be extended to APP fraud as it directly conflicts with the general duty of a bank to act in accordance with its customer’s instructions. The banks cannot question the validity of the instruction when it comes directly from an individual. Provided the customer’s instruction is clear, no enquiries are needed to clarify or verify what the bank is authorised to do.

In summary, the key legal points to take away are as follows:

• Banks do not owe a duty of care to make inquiries to clarify or verify a customer’s clear and valid payment instruction.
• Where a bank is taking instructions from a customer’s agent, banks continue to be under a duty to make inquiries or verify they have reasonable grounds for believing the agent is defrauding the customer.
• This case will now revert to the High Court for the determination of the claim against Barclays Bank that it was in breach of duty in not taking adequate steps to attempt to recover the money transferred by the claimant promptly.

The Supreme Court’s reasoning

Interestingly, before getting to the substantive legal points, Lord Leggatt explicitly confirmed that the response to APP fraud is for the regulators and the government to consider and not the courts. Formulating policy is a very different exercise from identifying and applying legal rights and duties. In particular, the Payment System Regulator’s mandatory reimbursement scheme for APP fraud was highlighted as a key development (the PSR Scheme).

The Supreme Court said that a fundamental reason why the policy response to APP fraud was outside the scope of these proceedings was that the claim was based on a contractual relationship arising between Mrs Philipp and the Bank. The Bank’s contractual responsibilities were not affected by the general policy discussions as to whether banks should be required to reimburse customers who are victims of APP fraud. That would depend on the contract agreed between the parties.

As to the contract between a bank and a customer, the court pointed to the fact that the principal obligation of a bank is to repay its customer, on demand, an equivalent sum to that deposited. Provided an account is in credit, it is the duty of the bank to make a payment from that account when a customer instructs them to do so and to do so promptly. The bank’s duty to comply with this mandate is strict. The main implied limit on the bank’s duty is not to carry out an unlawful act. Provided the customer’s instruction is clear, no enquiries are needed to clarify or verify what the bank is authorised to do. Unless otherwise expressly agreed, not to carry out the instruction would be a breach of duty.

There is, as with all contracts for the supply of services in the course of business, an implied duty to carry out the services with reasonable care and skill. The argument central to this appeal was the legal significance of the bank’s duty to its customer not to execute a payment instruction given by the customer’s agent if the bank has reasonable grounds for believing that the instruction is an attempt by the agent to misappropriate the customer’s funds.

The Supreme Court considered the Quincecare decision (Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363) and the following line of related cases. It noted that, in the present case, the Court of Appeal had accepted the reasoning that the Quincecare cases did not turn on the fact that the instruction was given by the customer’s agent. The duty was found to be equally applicable in a situation where an instruction was given by a customer who was the unwitting victim of APP fraud, where the bank was on inquiry as to the fraud.

The critical part of the Court of Appeal’s reasoning in this analysis was that a bank’s primary duty to execute a valid instruction potentially conflicted with its duty to exercise reasonable skill and care executing the instruction. That tension could, it said, be resolved by requiring the bank not to execute an instruction without making inquiries. The facts in the present case did not fall within the scope of what was decided in Quincecare, but the reasoning was that it was open to the claimant to persuade the court that the balance between the competing policy considerations should favour extending the Quincecare duty in cases of APP fraud.

The Supreme Court rejected this analysis as flawed. The first flaw was to regard the bank’s duty of care as potentially conflicting with its duty to execute its customer’s instruction. The court found there to be no conflict, as the duty to exercise reasonable skill and care only arises if the customer’s instruction is unclear or leaves the bank with a choice about how to carry out the instruction. Where the instruction is clear, the bank’s duty is simply to execute the order by making an order.

The second flaw, as held by the court, was that trying to reconcile these perceived conflicting contractual duties by relying on policy considerations was quite simply an inappropriate method for identifying a party’s duty under a contract. But this flawed reasoning in the Quincecare decision did not, the Supreme Court found, lead to the rejection of the conclusion reached.

When the principles of agency law were applied to the factual circumstances of the Quincecare line of cases, the Supreme Court observed that the legal conclusions were justified. The authority conferred on a bank customer’s agent does not include an authority to act dishonestly in pursuit of the agent’s own interests and in fraud of the customer. In consequence, the Supreme Court found that the Quincecare duty is part of a general duty of a bank to interpret, ascertain and act in accordance with its customer’s instructions. If it is put on inquiry by having reasonable grounds for believing that an agent’s payment instruction is an attempt to defraud the customer, the duty requires the bank not to act on the instructions without making inquiries to verify the instruction.

On application to the facts of this case, this led to the Supreme Court’s finding that these agency principles did not apply in a situation where the customer was a victim of APP fraud. In the present case there was no agent involved as the customer herself gave the payment instruction. As such the validity of the instruction was not in doubt and the bank was under no duty of care to make inquiries to clarify or verify what it should do.

The wider picture

While the decision is unwelcome news for victims of APP fraud, the scope of the Quincecare duty is only part of the picture in the context of new regulations and standards that apply to banks in relation to APP fraud.

Since the underlying facts of Philipp took place, we have seen the introduction of the voluntary Contingent Reimbursement Model (CRM) Code, the Strong Customer Authentication protections and confirmation of payee on transfers, which all play a part in tackling the prevalence of APP fraud.

Further, the PSR Scheme, a mandatory reimbursement scheme in respect of APP fraud, is now set to enter into force in 2024, following Royal Assent of the relevant provisions in the Financial Services and Markets Act 2023. However, this scheme will not apply to overseas payments and there will be a gap in the relevant protections for victims whilst the PSR Scheme is being implemented and where the CRM code falls short.

What is clear is that the banks are still being pushed to the front lines of the battle against APP fraud. This judgment won’t be the end of the story as the financial burden being placed on banks is a deliberate incentive for them to increase their protective measures.

The ultimate test of the success of those measures will be whether it works to prevent and address the growing APP fraud problem, and, at the same time, reduce the financial burden on the banks.

The Philipp decision will be welcomed by banks for providing clarity on their duty of care. Customers may be disappointed by the outcome, but the case is not quite over. Mrs Philipp was granted permission to proceed with her claim against the bank that it was in breach for failing to act promptly to try and recall the payment made to the UAE.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.

© Farrer & Co LLP, July 2023