• The Supreme Court has unanimously narrowed the scope of the so-called “Quincecare duty”. In particular, it rejected the reasoning of the Court of Appeal that it could apply to a situation where an instruction is given by a customer who is an unwitting victim of authorised push payment (APP) fraud. Lord Leggatt, who gave the sole judgment, with which the other four Lords agreed, even went so far as to doubt whether the “Quincecare duty” existed as a separate doctrine under the law of England & Wales. This reduces the risk to financial institutions of litigation being brought by victims of APP fraud.
• Properly understood, Lord Leggatt held that the “Quincecare duty” is simply an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions [para 97].
• Banks have a strict and primary contractual duty to carry out their customers’ authorised payment instructions and prevent the misappropriation of funds. They are not under a duty to prevent APP fraud.
• There are limits on a bank’s duty to carry out a customer’s authorised payment instructions. For example:
  
  • an implied condition that a bank cannot be required to carry out an unlawful act (e.g., because it would constitute money laundering); an
  • an implied condition that a bank will act honestly towards its customer
• Contrary to what is suggested in the Quincecare¹ line of authorities, a bank’s primary duty to execute a valid payment order does not conflict with its duty to exercise reasonable skill and care in relation to executing such orders.
• The duty to exercise reasonable skill and care only arises where the validity or content of the customer’s instruction is unclear or leaves the bank with a choice about how to carry out the instruction. In such cases, the duty of reasonable skill and care applies to interpreting, ascertaining and acting in accordance with the instructions of the customer. Where the bank receives a valid payment order that is clear and leaves no room for interpretation or choice about what is required to carry it out, the bank’s duty is simply to execute the order by making the requisite payment. The duty of care does not apply.
• Where a bank has reasonable grounds for believing that a payment instruction given by an agent purportedly on behalf of the customer is an attempt to defraud the customer, it is under a duty to refrain from executing the instruction without first making inquiries to verify that the instruction has actually been authorised by the customer. If the bank executes the instruction without making such inquiries and the instruction proves to have been given without the customer’s authority, the bank will be in breach of that duty [para 97].
• Similar reasoning would also apply where a bank has reasonable grounds for believing, and so is on notice, that the customer lacks the mental capacity to operate a bank account or manage their financial affairs. The bank’s duty of care may require the bank not to execute its customer’s instructions in such circumstances until further inquiries can be made [para 99].
• While APP fraud is a growing social problem, the question of who bears the loss (i.e., the victim of such fraud or the banks) is a matter of social policy for regulators, government and, ultimately, Parliament. It is not the role of the courts to formulate such policy.
•  The Supreme Court did not completely shut down victims of APP fraud from making a claim against a bank. This is because it:
  •  allowed Mrs Philipp’s claim that the bank had been too slow when seeking to recover her funds to continue to trial. Banks and other payment companies should be alive to this and seek to recover funds promptly after being notified of a fraud; and
  • suggested that if a bank receives reliable information from a source, such as the police, suggesting that a customer’s payment instruction has (without the customer’s knowledge) been procured by fraud, it may be right for the bank to refrain from executing the instruction without first alerting the customer to this information and verifying whether the customer wishes to proceed with the transaction.

The facts in Philipp v Barclays

As the Supreme Court noted, the facts of this case were a particularly egregious and extraordinary example of APP fraud. In APP fraud, the victim is induced by fraudulent means to authorise its bank to send a payment to a bank account controlled by the fraudster.

In this case, a fraudster, claiming to be a senior employee of the Financial Conduct Authority, convinced Dr and Mrs Philipp to send £700,000 from Mrs Philipp’s Barclays account to accounts in the UAE in two tranches. During the course of the fraud, the Philipps were warned by the bank and by a police officer that Mrs Philipp’s account had likely been compromised. Unfortunately, this did not cause them to stop as the fraudster had persuaded them not to cooperate with the police. The fraud was so sophisticated that telephone calls made to Dr Philipp appeared, from the number displayed on his mobile phone, to be coming from the telephone number of the National Crime Agency and the mobile number of the police officer.

Mrs Philipp tried to make a third payment to the fraudster, but this did not take place as Barclays had frozen her account pending a review. Shortly thereafter, and following a third visit from the police officer, Dr and Mrs Phillipp finally came to realise that they had been the victims of a fraud. The bank was unable to recover any funds.

Mrs Philipp issued proceedings against Barclays claiming that the bank owed her a duty under its contract with her or under common law not to carry out her payment instructions if it had reasonable grounds for believing she was being defrauded.

The law on the “Quincecare duty” to date

In a series of recent cases (many of which have gone to the Supreme Court), the Courts of England & Wales have considered the scope of banks’² duty of care not to execute a payment instruction given by an agent where there are reasonable grounds for believing that the instruction is an attempt to misappropriate the customer’s funds. Such cases have often involved the misappropriation of company funds by agents of a company (e.g., directors) and found that banks have a duty to make enquiries or to refuse to make payments where there are reasonable grounds to suspect that the agent is seeking to misappropriate company funds.

Mrs Philipp sought to expand that duty to cover payments made in APP fraud where it is the customer who is giving the instructions and not an agent. Barclays successfully applied for summary judgment at first instance on the basis that as a matter of law, it did not owe Mrs Philipp the alleged duty. This was overturned by the Court of Appeal, which held that there was an arguable case that Barclays owed such a duty to Mrs Philipp. Barclays appealed to the Supreme Court.

The judgment in Philipp v Barclays (the “Judgment”)

The past few years have seen a renaissance of the “Quincecare duty”. Numerous high-profile cases have reached the appellate courts, and a lively debate has sprung up over whether the “Quincecare duty” is sufficiently broad that it requires banks to refuse to carry out payment instructions that they believe are part of an APP fraud being perpetrated on their customer (as in this case).

Following the Supreme Court’s Judgment, that debate is essentially over, and the Court has robustly held that the duty does not extend to APP fraud. A striking feature of the Judgment is Lord Leggatt’s criticism of previous decisions. According to him, the reasoning in Quincecare itself is “flawed” [para 61]; its approach, and the approach of the Court of Appeal in Philipp v Barclays, “does not withstand scrutiny” [para 62]; the Court of Appeal’s judgment “is inconsistent with the first principles of banking law” [para 3]; and the attempt in Quincecare to justify the duty “went down a wrong track because it proceeded from a false premise. This obscured the true basis for the duty” [para 68].

The Judgment is an attempt to reposition the “Quincecare duty” in its proper place. The duty is not some special or idiosyncratic rule of law. Properly understood, it is simply an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions [para 97].

Where a bank has reasonable grounds for believing that a payment instruction given by an agent purportedly on behalf of the customer is an attempt to defraud the customer, it is under a duty to refrain from executing the instruction without first making inquiries to verify that the instruction has actually been authorised by the customer. If the bank executes the instruction without making such inquiries and the instruction proves to have been given without the customer’s authority, the bank will be in breach of that duty. These principles are not limited to corporate customers and apply, for example, to joint accounts [paras 97-99].

Similar reasoning would also apply where a bank has reasonable grounds for believing, and so is on notice, that the customer lacks the mental capacity to operate a bank account or manage their financial affairs. The bank’s duty of care may require the bank not to execute its customer’s instructions in such circumstances until further inquiries can be made [para 99].

The above principles have no application to a situation where the customer is a victim of APP fraud. In this situation, the validity of the instruction is not in doubt. Provided the instruction is clear and given by the customer personally, no inquiries are needed to clarify or verify what the bank must do. The bank’s duty is to execute the instruction, and any refusal or failure to do so will usually be a breach of duty by the bank [para 100].