Philipp v Barclays Bank, the Quincecare duty and APP fraud

In Barclays Bank plc v Quincecare Ltd & Anor [1992] 4 All ER 363, Steyn J held at p 373:

“[…] a banker must refrain from executing an order if and for as long as the banker is ‘put on inquiry’ in the sense that he has reasonable grounds (although not necessarily proof) for believing that the order is an attempt to misappropriate the funds […].”

That duty on banks and bankers has been referred to as the “Quincecare duty”.

Thousands of people and businesses in the UK fall victim to authorised push payment (“APP”) fraud each year, with around £485 million lost in 2022 .

Assuming, for a given case:

• the customer gave instructions to their bank to make payment,
• until shortly before the instructions, the customer’s account had never previously been credited with sufficient funds to make such an unusually large payment, and
• the payment was to a company in another country with which the customer had never previously dealt,

is the bank in breach of the Quincecare duty and therefore liable for the customer’s loss?

Following Philipp v Barclays Bank UK plc [2023] UKSC 25; [2023] 3 WLR 284, the answer is clear: No.

Background to the decision in Philipp

In 2018, Mrs Fiona Philipp and her husband, Dr Robin Philipp, fell victim to a fraud . They were deceived by criminals into instructing Barclays Bank (the “Bank”) to transfer £700,000 in two payments from Mrs Philipp’s current account with the Bank to bank accounts in the UAE. The payments were made and the money was lost. Mrs Philipp brought a claim against the Bank, alleging it was liable for her loss.

At first instance ([2021] EWHC 10 (Comm); [2021] Bus LR 451), the High Court allowed the Bank’s summary judgment application on the basis there was no prospect of Mrs Philipp establishing a bank acting as a payment service provider owed a common law duty of care to its customers to take reasonable skill and care to protect them from the risk associated with APP fraud. The Court of Appeal ([2022] EWCA Civ 318; [2022] QB 578) allowed Mrs Philipp’s appeal, holding it was at least arguable the Quincecare duty applied to cases of APP fraud.

The Supreme Court’s decision

In a judgment authored by Lord Leggatt, the Supreme Court unanimously allowed the bank’s appeal. The judgment explains:

• the Quincecare duty is not “some special or idiosyncratic rule of law” but “simply an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions”: para 97; and
• it is not applicable to cases of APP fraud, in which the customer’s instructions are not themselves an attempt to misappropriate money, even though executing them correctly may lead to the money being misappropriated by a third party: para 59.

The following points help unpack these propositions:

• A bank is obliged, so long as its customer’s account is in credit or sufficient overdraft has been agreed, to make payments in accordance with the customer’s instructions. This has been said to be a bank’s principal obligation: Lipkin Gorman (a firm) v Karpnale Ltd [1989] 1 WLR 1340 per May LJ at pp 1355H–1356A.
• As with any contract for the supply of services in the course of a business, there is a term implied by law in the contract between a bank and its customer that the bank must carry out its services with reasonable care and skill.
• Notwithstanding its principal obligation to make payment in accordance with its customer’s instructions, a bank may therefore be liable to its customer if it fails to:

                  o    clarify instructions given by the customer which are, objectively, ambiguous: European Asian Bank AG v Punjab & Sind Bank (No 2) [1983] 1 WLR 642 at 656E–F per Goff LJ, applied in Patel v Standard Chartered Bank [2001] Lloyd’s Rep Bank 229; or
                  o    make enquiries where instructions are given to it by the customer’s agent, rather than the customer personally, in circumstances suggestive of dishonesty on the part of the agent: Philipp, at para 90.

The final bullet point above is at the heart of Lord Leggatt’s reasoning. His judgment clarifies that the proper justification for imposing liability on a bank in the Quincecare line of cases is found in the law of agency.

In, among others, Lipkin Gorman, Quincecare, and Singularis Holdings Ltd (in liq) v Daiwa Capital Markets Europe Ltd [2019] UKSC 50; [2020] AC 1189, the bank had been given fraudulent instructions by an agent of the customer. Where a bank receives such instructions in circumstances that indicate to an ordinary prudent banker they might be an attempt (by the agent) to defraud the customer, the bank is under a duty not to execute the instructions until it has confirmed them with the customer (Quincecare at p 376, Philipp at para 97). An “agent” who gives such instructions obviously does not have apparent authority. If the bank executes the instructions, and it transpires the agent also does not have actual authority, it is in breach of duty to the customer. By making the requested payment it will also act outside of its own authority, given by the customer’s mandate, and so cannot debit the customer’s account for the payment. Scenarios where an agent gives instructions on behalf of a customer arise in situations involving, among others, a corporate entity (where, say, a director gives instructions in their capacity as agent for the limited company) or a joint account held by individuals, where one individual has the power to bind the other.

Contrastingly, where a bank is given instructions directly by the customer, the fact that the customer has been induced to give the instructions by a fraudster does not invalidate those instructions. Accordingly, the bank’s execution of those instructions does not give rise to a claim against the bank (para 105). By executing the instructions, it must be remembered that the bank is simply complying with its principal obligation to the customer – and, indeed, failure to comply with that obligation might give rise to liability on the part of the bank to pay the customer damages if the failure to make payment causes the customer loss. The unusual size, destination of the payment or lack of previous dealing cannot be factors which suggest to the bank that the customer, if aware of those factors, might wish not to make the payment, since the customer is plainly already aware of the same (para 109). As such, Barclays was not liable to Mrs Philipp.

What next for Mrs Philipp and other victims of APP fraud?

Suppose a bank has reliable information, unknown to the customer, suggesting the customer’s instructions have been procured by fraud – which, as above, cannot be found simply in features which make the transaction an unusual one for the customer. At paras 107–108, Lord Leggatt referred to the Australian case of Ryan v Bank of New South Wales [1978] VR 555, in which McGarvie J held that a bank should not comply with its customer’s instruction “if a reasonable banker properly applying his mind to the situation would know that the [customer] would not desire their orders to be carried out if they were aware of the circumstances known to the bank”. Applying this logic, if, for example, the police have informed the bank that they suspect the customer’s intended payee is part of a fraud, the bank may well be under a duty to refrain from executing the order until it has told the customer this information and confirmed they still wish to go ahead. However, the Supreme Court left this question open, as it was unnecessary for the purposes of the appeal.

In Philipp, the police informed the Bank on 16 March 2018 that they suspected Mrs Philipp’s current account had been compromised by the fraudsters. The Bank therefore declined, pursuant to an express term of its contract with Mrs Philipp, to execute a further payment she instructed it to make on 19 March 2018. There could be no liability for the Bank on the basis outlined above in respect of the two payments Mrs Philipp had instructed prior to 16 March 2018. However, it seems that the Bank took no steps until 31 May 2018 to attempt to recover the funds transferred before that date. Mrs Philipp had an alternative claim, based on the alleged failure to attempt to recover the funds at an earlier time, in respect of which the first instance judge had held there were “too many imponderables in this counterfactual scenario for the matter to be decided against Mrs Philipp on paper”. The Supreme Court therefore varied the order summarily dismissing the claim in its entirety to allow the alternative claim to proceed, albeit commenting that the likelihood any of the money would have been recovered even if prompt action had been taken seems slim: paras 119 and 120.

The common law remedies for an APP fraud victim, as against their bank, are narrow: liability for the full amount of loss is unlikely to attach to the bank unless it has been tipped off by the police, say, that the customer’s intended payee is a scam and it nonetheless executes the customer’s order. Philipp, ultimately, might be regarded as a demonstration of the limits of the common law when responding to a wider social problem. The courts which have heard the case have all naturally expressed sympathy with Mrs and Dr Philipp’s position. But an extension of the common law that would provide them with relief would be unprincipled and have wider effects which the court is not well placed to consider. A legislative/ regulatory solution is required. Fortunately, a (partial) solution is in the offing:

• From 2024, pursuant to s 72 of the Financial Services and Markets Act 2023, the Payment Systems Regulator (“PSR”) will introduce a reimbursement requirement for APP fraud within the Faster Payments system (under which system most payments in APP frauds are made) .
• The PSR’s policy statement PS23/3 states this requirement will require payment firms to reimburse all in-scope customers who fall victim to APP fraud in most cases, share the costs of compensation 50/50 between the sending and receiving payment firms, and provide additional protections for vulnerable customers (para 1.3).
• The PSR is currently consulting on detailed features of the requirement, such as the appropriate maximum level of excess that firms can (optionally) deduct from compensation.