Uncategorized

Quincecare: A panacea for victims of APP Fraud?

By July 25, 2022 No Comments
Quincecare_A_panacea_for_victims_of_APP_Fraud-400x269-fa1db3ad

A version of this article was published in Issue 9 of the ThoughtLeaders4 FIRE Magazine and is available to read here.

The Court of Appeal has recently handed down a judgment which widens the scope of the Quincecare duty of care owed by banks to their customers, far beyond the previously understood confinements of that duty. On this occasion Barclays Bank Plc (“Barclays”) lost the benefit of their summary judgment at first instance.

Fiona Lorraine Philipp v Barclays Bank UK Plc [2022] EWCA Civ 318

Executive Summary

The Court of Appeal found in favour of Mrs Philipp (“Mrs Philipp”) and agreed that the Judge at first instance had engaged in a “mini trial” of the facts and had wrongly ordered summary judgment in favour of Barclays. Strikingly, rather than leaving the matter there, Lord Justice Birss (delivering the leading judgment) went further and provided helpful comments concerning the construction of the Quincecare duty of care, as regards individual customers (as opposed to corporate customers, which the duty had previously been understood to exclusively apply to).

The Court of Appeal found that the duty owed by banks to their customers (including individuals) may arise in the case of a customer directly instructing their bank to make a payment out of their personal account, when such an instruction has been induced as part of an authorised push-payment (“APP”) fraud.

This is to be contrasted with the previous line of decisions arising out of Quincecare claims, which followed the reasoning that a bank’s duty was only engaged where an agent of a customer (typically a corporate entity) gave instructions to the bank that were fraudulent and in these circumstances should have put the bank on inquiry leading them to refuse to execute the payment instruction.

The Quincecare Duty

The Quincecare duty was first established in the 1992 case of Barclays Bank Plc -v- Quincecare Ltd1. At that time it was regarded as an extension of the duty of care that banks are said to owe to their customers (including compliance with their instructions), which was established in the preceding case of Lipkin Gorman v Karpnale2. In the Quincecare case, Mr Justice Steyn (as he then was) described the duty as one whereby3:

a banker must refrain from executing an order if and for as long as the banker is ‘put on inquiry’ in the sense that he has reasonable grounds (although not necessarily proof) for believing that the order is an attempt to misappropriate the funds of the company.”

APP Fraud

It is widely known that card related fraud saw something of an uptick during the COVID-19 pandemic as we all began making far more transactions from the perceived safety of our own homes. This uptick in fraudulent activity included an increased prevalence of APP Fraud, according to UK Finance’s review of payment industry fraud. In 2020, UK Finance members reported 149,946 incidents of APP scams with gross losses of approximately £479 million4.

APP frauds typically involve the deception of individuals into making payments, which they believe are genuine. This is to be contrasted with the position in “pull” frauds, where the receiving party takes funds from the victim’s account. Typically, such deception and impersonation scams involve the fraudster posing as a genuine individual or organisation and contacting the victim using a range of methods including via the telephone, email and text message.

This was the case in the Philipp appeal.

Background and First Instance

Decision The Philipps were duped by a fraudster, Mr Jonathan Watts who purported to act for the FCA in connection with fraudulent activity by staff within HSBC, the Philipps’ account provider. As a result the Philipps moved over £700,000 of their savings into an account in Mrs Philipp’s name with Barclays. Mrs Philipp then instructed Barclays to transfer that money, in two payments of £400,000 and £300,000, to separate bank accounts in the United Arab Emirates.

Mrs Philipp believed that what she was doing, was moving the money into safe accounts in order to protect it from fraud. The accounts were no such safe haven and by the time that the fraud was discovered, the monies were gone.

The claim against Barclays was for breach of duty. The duty that was said to be owed to Mrs Philipp was characterised as a duty to observe reasonable care in and about executing her instructions, as such it was said to be a specie of the duty identified in Quincecare.

In the present case Mrs Philipp’s instructions were to make the transfer. The Quincecare duty, Barclays argued, was not relevant because it is only concerned with the proper ascertainment of instructions and arises when the instructions are being given by an agent, usually an agent of a company. If the agent’s instructions are vitiated by fraud then the bank has no proper instructions at all, and that is how such a duty, to not do what the bank is apparently instructed to do, can arise.

It followed that the first instance court granted summary judgment in favour of Barclays.

What the Court of Appeal Decided

The Court of Appeal allowed Mrs Philipp’s appeal on the basis that the Judge at first instance had engaged in a mini trial of the facts. In doing so, the Court of Appeal referred to the principles set out in EasyAir Ltd v Opal Telecom and in AK Investment CJSC v Kyrgz Mobil Tel Ltd, which provided that “it is not normally appropriate to use a summary procedure for the determination of controversial questions of law”.

The Court of Appeal rejected Barclays’ submission that the Quincecare duty of care does not extend to cases such as Mrs Philipp’s because Mrs Philipp gave instructions to deal with her own funds and such those instructions were not intended to defraud herself, such that they would vitiate the instruction. In rejecting this submission, Lord Justice Birss examined the relationship between the bank and its customer, making the following key findings:

  1. In the context of an instruction to pay, the bank is the agent for the customer as principal;
  2. If a banker executes an instruction that they knew was an attempt to misappropriate funds, then the bank would be liable for the losses flowing from that transaction;
  3. What lesser state of knowledge will put the bank under a legal obligation to the principal? Following the reasoning in Singularis the Court held that “if the circumstances were such that an ordinary prudent banker would be “on inquiry” then the duty arises”.
  4. The duty of a banker is to not execute the order while on inquiry and to make inquiries. The purpose of this duty, the Court held, is to protect the customer.

Crucially, the Court found that as a matter of law the Quincecare duty:

does not depend on whether the instruction is being given by an agent. It is capable of applying with equal force to a case in which the instruction to the bank is given by a customer themselves who is the unwitting victim of APP fraud provided the circumstances are such that the bank in on inquiry that executing the order would result in the customer’s funds being misappropriated.”

The Court of Appeal rejected Barclays’ submission that even if a bank actually knew that a customer’s instruction to pay was a mistake by that customer arising from their having been deceived by a fraudster “the bank’s only duty to the customer would be to execute the order.”

In rejecting this proposition, the Court of Appeal noted that the bank’s duty of care to execute a customer’s instruction (per the mandate) is “not absolute” but is subject to its duty of care owed to the customer when carrying out those instructions. A bank’s obligation to comply with its customer’s instructions does not extend to “unthinkingly” executing each and every payment instruction given by that customer.

As to Barclays’ submission that such an expanded duty of care would represent an “onerous and unworkable burden on banks”, the Court did not agree and in doing so cited the existence of the voluntary codes of practice adopted by Barclays at the time of the Philipps’ losses, for example the Contingent Reimbursement Model.

Next Steps

Barclays now faces a difficult decision – seek to appeal to the Supreme Court where (subject to permission being granted) the duty will be further clarified, or settle Mrs Philipp’s claim and prevent further clarification of the law in this fast-developing area.

The judgment further increases the tension for banks between complying with the terms of the mandate in a timely fashion and investigating instructions potentially induced by fraud in order to protect its own position.

It is clear that the courts expect banks to play an ever more proactive role in the fight against fraud – no longer can banks simply say that their only obligation is to execute their client’s instructions in order to discharge their duties. There now appears to be an emphasis on the banks protecting the customers from themselves and in the age of such sophisticated automated security settings in the banking industry, this appears to be a modernised interpretation of the duty first set out by Lord Steyn in 1992.