The Court held that banks do not owe this duty to customers deceived into instructing their banks to transfer money to fraudsters.

On 12 July 2023, the UK Supreme Court handed down its highly anticipated judgment in Philipp v. Barclays Bank UK PLC [2023] UKSC 25, allowing the appeal brought by Barclays Bank UK PLC (Barclays).

The Court’s decision, which resolved longstanding questions about the nature of the Quincecare duty, clarified that the Quincecare duty only arises in cases in which there is fraud by an agent acting for the customer. As a result, it cannot apply in circumstances in which the relevant payment was authorised by the bank’s customer directly, so it has no application in APP fraud cases. The Court overturned the decision of the Court of Appeal, which had expressly held that that it is “at least possible in principle” that the Quincecare duty could apply to a “victim of APP fraud” on the basis that the Quincecare duty “does not depend on the fact that the bank is instructed by an agent of the customer of the bank”. [1]

The Quincecare duty is the implied duty on a bank to refrain from executing a payment instruction when the bank is put on inquiry, in the sense that the bank has reasonable grounds for believing that the instruction is an attempt to misappropriate the customer’s funds.

“APP fraud” refers to fraud committed through “authorised push payment”. A bank customer is a victim of APP fraud if a fraudster deceives them into instructing their bank to transfer money from their account into an account controlled by the fraudster.

The Facts

In March 2018 Mrs Fiona Philipp and her husband (the Philipps) fell victim to a sophisticated APP fraud. Throughout a series of calls to the Philipps, fraudsters disguised the calling number that appeared on the Phillips’ phones and posed variously as representatives of the police, the National Crime Agency, and the Financial Conduct Authority, claiming to be investigating a fraud within a bank and investment firm in which the Philipps held substantial savings. The Philipps were told they would be eligible to receive compensation for assisting with the investigation but were warned not to tell anyone about it — even the police — because this might prejudice the case. Ultimately, the fraudsters convinced the Philipps that their savings were at risk of being misappropriated unless they urgently transferred them to “safe accounts”. In reality, these accounts were controlled by the fraudsters in the United Arab Emirates.

Under the spell of the fraudsters, the Philipps instructed Barclays to transfer £700,000 (the bulk of their life savings) to the “safe accounts” across two payments, attending branches of Barclays in person to do so. Before making each payment, Barclays telephoned Mrs Philipp to confirm that she wished to proceed with the transfer and Mrs Philipp provided the required confirmation. Her husband also falsely informed Barclays that he had dealt with one of the recipient companies before.

Once the fraud had been uncovered, Mrs Philipp brought a claim against Barclays, contending that it had breached its Quincecare duty by carrying out her payment instructions when it had reasonable grounds to believe that she was being defrauded. Barclays successfully applied to the High Court to have the claim summarily dismissed on the basis that Barclays did not owe this duty to Mrs Philipp as a matter of law. The Court of Appeal then reversed the summary dismissal, and that reversal was the subject of Barclays’ appeal before the Supreme Court.

The Judgment

The Supreme Court allowed the appeal in a judgment given by Lord Leggatt (with which Lord Reed, Lord Hodge, Lord Sales, and Lord Hamblen agreed).

Lord Leggatt was clear that banks have a strict contractual duty to make payments in compliance with their customers’ instructions (the Compliance Duty), and they also have a duty to exercise reasonable care and skill in executing their customers’ instructions (the Reasonable Skill Duty). The Quincecare duty is an application of the Reasonable Skill Duty rather than a special rule of law. Importantly, Lord Leggatt rejected the view, derived from Barclays Bank plc v. Quincecare Ltd [1992] 4 All ER 363 and subsequently accepted by the Court of Appeal in this case, that these duties operate in tension.

Lord Leggatt explained that the Reasonable Skill Duty (and therefore the Quincecare duty) is subordinate to the Compliance Duty, and only arises in the limited circumstances in which the validity or content of the customer’s instructions are ambiguous. To discharge its Reasonable Skill Duty in such cases, the bank must interpret, ascertain, and act in accordance with the customer’s instructions. The Reasonable Skill Duty is therefore complementary to the Compliance Duty. Consequently, Lord Leggatt held that the bank need not “concern itself with the wisdom or risks of its customer’s payment decisions” under the Quincecare duty in order either to resolve an apparent conflict between its duties, or for any other reason.

On Lord Leggatt’s analysis, the juridical basis of the Quincecare duty is rooted in the law of agency. Lord Leggatt noted that each of the relevant authorities proceeds on “the same basic factual situation” in which a payment instruction was given by an agent who was an authorised signatory of the customer’s account but was acting to defraud the customer. Accordingly, he held that the Quincecare duty arises when the bank has reason able grounds for believing that the agent’s instruction is in fact an attempt to defraud the customer and therefore it cannot have been made with the customer’s authority. On that basis, the Quincecare duty can clearly be seen as an application of the Reasonable Skill Duty, complementing the Compliance Duty: “the reason why the bank owes a duty to its customer to make inquiries is to ensure that it does not make a payment which the customer has not authorised”.

This reasoning necessarily cannot apply to APP fraud cases, in which the customers make the payment instruction themselves and the validity or authority of such instruction is beyond doubt. In such circumstances, the bank must discharge its primary Compliance Duty, and has no duty to make inquiries.

Comment

This decision will be a relief to banks. It confirms that the Quincecare duty only arises if a bank has reasonable grounds for believing that a payment instruction has not actually been authorised by the customer, and that the scope of this duty will not be expanded beyond that as a result of the Court of Appeal’s earlier analysis in this case. Accordingly, it dispels fears that the courts would impose additional, and potentially unworkable, common law obligations on banks to prevent third-party frauds on their customers.

Practitioners should, however, continue to be mindful of the Quincecare duty if one party gives payment instructions on behalf of another. Importantly, the Supreme Court has confirmed that these principles are not limited to corporate customers. In appropriate cases, banks or those acting for them may want to consider contractual language expressly excluding liability for breach of the Quincecare duty, or limiting the bank’s liability to instances of gross negligence.

Given the sharp rise in APP fraud since 2020, practitioners should anticipate further legislation and regulation in this area, expanding upon the Financial Services and Markets Act 2023, which as noted in the Supreme Court’s judgment, has recently made it mandatory for banks to reimburse customers in certain cases in which a payment order is executed following fraud or dishonesty. The Supreme Court specifically noted that the question of whether victims of APP fraud should be reimbursed by banks which have made or received fraudulent payments is one to be addressed by regulators, government, and Parliament, rather than the courts.

Endnote

[1] [2022] EWCA Civ 318.