The U.K.’s Supreme Court recently handed down its landmark decision in the case of Fiona Lorraine Philipp c Barclays Bank UK plc [2023] UKSC 25.

The decision means that a victim of an authorised push payment (“APP”) fraud will not be able to rely on the duty of care known as the ‘Quincecare’ duty to seek reimbursement of funds from the victim’s bank or payment service provider (“PSP”).

Background

Mrs Philipp and her husband were victims of APP fraud when a third-party, who claimed to be working for the Financial Conduct Authority, induced them into instructing their bank, Barclays, to transfer sums totalling £700,000 to a bank account in the United Arab Emirates. On each occasion, before making the transfer, Barclays telephoned Mrs Philipp to seek her confirmation that she had made the transfer request and wished to proceed with it. On each occasion, Mrs Philipp provided the required confirmation, and Barclays duly made the payments in accordance with her instructions.

Upon realising that they were the subject of a fraud, Mrs Philipp and her husband sought to recover the funds from Barclays, arguing that Barclays owed her a contractual duty of care or a duty under common law not to follow her instructions to make the payment if the bank had reasonable grounds to believe its customer was being defrauded (i.e. the Quincecare duty).

What is the Quincecare duty?

The Quincecare duty (derived from the decision of Barclays Bank plc v Quincecare Limited [1992]) is an important protection for bank customers. The duty imposes an implied duty that a bank will refrain from executing a payment instruction when the bank has reasonable grounds for believing that the instruction is an attempt to misappropriate the customer’s funds. In such circumstances, the bank will have a duty to take reasonable steps to investigate the matter, including, for example, contacting the customer to ask for clarification. If the bank fails to take reasonable steps to investigate the matter and it later becomes apparent that the payment was fraudulent, the bank may be liable to the customer for any losses that the customer suffers.

The judgment

Mrs Philipp’s main argument was that a bank owes its customer a duty not to carry out a payment instruction if the bank has reasonable grounds for believing the customer is being defrauded.

Lord Leggatt, after considering in depth the caselaw concerning the Quincecare duty, delivered the leading judgment and concluded that such principles have no application to a situation where the customer is a victim of APP fraud:

“In this situation the validity of the instruction is not in doubt. Provided the instruction is clear and is given by the customer personally or by an agent acting with apparent authority, no inquiries are needed to clarify or verify what the bank must do. The bank’s duty is to execute the instruction and any refusal or failure to do so will prima facie be a breach of duty by the bank.” (at [100]).

The key point here, (and ultimately the vulnerability in Mrs Philipp’s case) is that Mrs Philipp had given a clear instruction to Barclays to make the intended transfers to the bank account in the United Arab Emirates. For Barclays to not have executed Mrs Philipp’s instruction would have been a breach of a bank’s basic duty under its contract with a customer to make payments in line with a customer’s instructions.

Mrs Philipp sought to argue that instructions given by an agent acting in fraud of the customer, and instructions which the customer has been induced to give by fraud should reflect the customer’s true, genuinely held intention: it was not Mrs Philipp’s ‘genuinely held intention’ to transfer money to accounts that she believed to be ‘safe accounts’ but were actually controlled by criminals [101]. Lord Leggatt, however, did not accept this argument stating that the fact that an intention or desire results from a mistaken belief does not make it any less real or genuinely held [102], and “the fact that the customer’s payment instruction was induced by fraud entitled the customer to claim repayment from the fraudster but does not invalidate the instruction or give rise to any claim against the bank” [at 105].

The implications

The significance of this decision will come as a disappointment to consumers: with thousands of individuals and business falling victims to APP frauds every year, the judgment clarifies that a bank is not under an implied duty to make inquiries of a customer’s instruction in circumstances where the instruction given by the customer (or the customer’s agent acting with apparent authority) is clear and unequivocal, and there can be no question as to the validity of the customer’s instruction.

Regulatory change

Lord Leggatt was clear that any changes to the relationship between a bank and a customer would need to be introduced on a constitutional level by Parliament; it is not the Court’s role to introduce such changes.

So what protection is there for the thousands of consumers in Mrs Philipp’s position? It will come as some comfort to consumers that one such change being introduced is through the recent enactment of the Financial Services and Markets Act 2023 (“the Act”), which comes into effect in 2024.

One of the Act’s consequences is to require the Payment Systems Regulator to impose a requirement for losses arising from a fraud or dishonesty to be allocated on a 50:50 basis between the sending and receiving PSPs (Section 72 of the Act). There are however, limitations to this, such as:

1. The scheme is confined to consumers, charities and micro-enterprises (thereby excluding larger businesses);
2. The scheme is limited to payment orders executed over the Faster Payments Scheme (“FPS”);
3. The payment order must have been executed subsequent to fraud or dishonesty; and
4. The regulatory obligations under the scheme are not intended to be directly enforceable by bank customers.

The FPS applies to the majority of a bank customer’s payments. Barclays, for example, currently imposes an overall daily limit of £100,000 for international payments under the FPS. Taking Mrs Philipp as an example, who made two separate transfers of £400,000 and £300,000 to bank accounts in the United Arab Emirates, it is unclear whether at first blush Mrs Philipp would be afforded protection under the Act. Nevertheless, the Act will open up recourse to victims of APP fraud.