Overview
On 12 July 2023, the UK Supreme Court delivered a landmark decision on the so-called “Quincecare duty” owed by banks to their customers.
In a unanimous judgment in favour of Barclays Bank, the UK’s highest Court held that banks did not owe customers a duty of care in fraud cases where transactions were authorised by the customers directly. As Lord Leggatt said in his judgment: “It is not for the bank to concern itself with the wisdom or risks of its customer’s payment decisions”.
This important clarification will be welcomed by financial institutions, particularly as the level of online fraud continues to soar. However, there are a number of other claims that are currently before the courts that will still be watched with interest, as will this present case as it is remitted to the High Court to decide arguments about the scope of any duty to attempt to claw back payments once a fraud has come to light.
The Supreme Court’s decision also follows the recent passing of the Financial Services and Markets Act 2023, which provides for a mandatory reimbursement scheme, albeit limited to certain payment types within the United Kingdom. In practical terms, therefore, claimants may look to this legislative framework for any claims in the future, rather than seek redress under any contractual or common law duty owed by their bank.
In Depth
THE SUPREME COURT’S DECISION
By way of factual background, the claimant, Mrs Philipp, and her husband Dr Philipp, were subjected to a common type of bank fraud referred to as “authorised push payment” (APP) fraud, which resulted in them losing their life savings amounting to £700,000. APP fraud requires a victim to authorise a bank payment under inducement from a fraudulent third party to a bank account controlled by the fraudster. This is normally done by a fraudster calling a victim and pretending to be a bank employee or a member of a local regulatory authority who is trying to prevent an ongoing fraud in the customer’s bank account, and then inducing them to move their money to another “safe account” under the fraudster’s control.
Dr and Mrs Philipp were subjected to a number of calls from different fraudsters purporting to be part of the National Crime Agency and Financial Conduct Authority. They were induced to believe that their banks were facilitating fraud on their accounts and that the police had no standing on the matter, to the extent that when visited by police regarding the ongoing fraud being committed against them, they refused to engage with them. As a result, they twice attended a Barclays branch in person to facilitate two international transactions to bank accounts in the United Arab Emirates which the fraudsters had persuaded them were safe. Once the fraud was uncovered, requests were made to return the funds to them. These were unsuccessful, and they lost £700,000 of their life savings.
The central issue in this case was whether a bank owes its customers a duty not to carry out payment instructions if the bank has reasonable grounds for believing that the customer is being defrauded.
The Supreme Court held that no such duty exists.
WHAT ARE A BANK’S BASIC DUTIES?
Money held in a bank account is held as money owed to the customer, and the bank is therefore obliged to act on the customer’s instructions in order to reduce this debt1, to do so promptly and not to enquire as to the purpose of the transaction or enquire as to the commercial wisdom of a client2.
When considering a bank’s duty in contract, a duty is implied under section 13 of the Supply of Goods and Services Act 1982 and section 49 of the Consumer Rights Act 2015 to carry out the services with reasonable care and skill. This duty, however, only extends to how a service is carried out, or, in the face of ambiguity surrounding the instructions received from the customer, to take reasonable steps to resolve that ambiguity and allow the transaction to be processed. The Supreme Court did accept that a bank could, in its terms and conditions, include a provision that could allow it to assume a duty to protect the customer from suspected fraud and, as a result, refuse to execute an authorised payment.
IN WHAT CASES MUST A BANK GO AGAINST ITS BASIC DUTIES?
The main limit on a bank’s basic duty to carry out a customer’s payment instructions is when the bank is being instructed to act in a manner considered to be unlawful. An obvious example of this is section 328 of the Proceeds of Crime Act 2002 which prevents the transfer of funds that it suspects would facilitate the use of criminal property without first obtaining authorisation.
However, the key duty, and one that Mrs Philipp relied upon heavily in her claim, is the Quincecare duty which was established in Barclays v Quincecare Limited3. That case established that a bank has a duty not to execute a payment instruction given by an agent of its customer without making inquiries if there are reasonable grounds for believing that the agent is attempting to defraud the customer in a transaction.
WHAT DID THE SUPREME COURT DECIDE?
In its judgment handed down on 12 July 2023, the Supreme Court provided important clarity on the scope of this duty. The Supreme Court held that the Quincecare duty is not a special duty or rule of law: “Properly understood, it is simply an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions”4.
Where a bank has reasonable grounds to believe that a payment instruction given by an agent purportedly on behalf of the customer is an attempt to defraud the customer, the Quincecare duty “requires the bank to refrain from executing the instruction without first making inquiries to verify that the instruction has actually been authorised by the customer. If the bank executes the instruction without making such inquiries and the instruction proves to have been given without the customer’s authority, the bank will be in breach of duty”5.
However, the Supreme Court held that these principles have no application where (as in Mrs Philipp’s case) the customer is a victim of APP fraud. The Court held that: “In this situation the validity of the instruction is not in doubt. Provided the instruction is clear and is given by the customer personally or by an agent acting with apparent authority, no inquiries are needed to clarify or verify what the bank must do. The bank’s duty is to execute the instruction and any refusal or failure to do so will prima facie be a breach of duty by the bank”6.
As a result, Barclays’ appeal was allowed, and Mrs Philipp’s case insofar as it is based on the allegation that Barclays owed her a duty not to execute her payment instructions was dismissed. However, the claim has been remitted to the High Court to decide Mrs Philipps’ alternative case that Barclays was in breach of duty in not taking adequate steps to attempt to recover the money transferred to the United Arab Emirates. We await the outcome of this.
WHAT IS THE IMPACT OF THE SUPREME COURT’S DECISION?
As Lord Leggatt said in his judgement: “The type of fraud which occurred here is a growing social problem and can undoubtedly cause great hardship to its victims, as the sad facts of this case make all too clear. Whether victims of such frauds should be left to bear the loss themselves or whether losses should be redistributed by requiring banks which have made or received the payments on behalf of customers to reimburse victims of such crimes is a question of social policy for regulators, government and ultimately for Parliament to consider…”7.
Naturally, any reasonable person would sympathise with Mrs and Dr Philipp’s position. However, the clarity given by the Supreme Court on the applicability of the Quincecare duty to APP fraud cases is welcomed. As the Court observed, it is ultimately the responsibility of the legislature to formulate the policy in such cases (and, as noted above, this is the subject of new legislation); it is not the Court’s role to “impose on the parties to a contract an obligation to which they have not consented and cannot reasonably be presumed to have consented since it is inconsistent with the normal and established allocation of risk and responsibility under contracts of the relevant type”8.
The Supreme Court has now clarified that the Quincecare duty is founded in agency law, not negligence. As such, where a customer gives an instruction themselves, there is no scope for a negligence duty to exist which requires the bank to second-guess whether the payment instruction is being given by the customer pursuant to a fraud. However, where the instruction comes from a customer’s agent, the bank is only under a duty to verify the agent’s authority once on notice that the agent may not have it. If a bank, on notice of an agent’s possible lack of authority, executes a payment instruction without making further enquiries, it will be acting in breach of its duty to exercise reasonable skill and care in executing a customer’s instruction. As the agent will not have the customer’s actual authority if it is acting dishonestly, the payment instruction will not bind the customer in any event. That is the legal basis for the Quincecare duty. But in this case, it was the customer that unequivocally authorised the bank to make the payment—because of this, there was no obligation on the bank to second-guess what it was being asked to do; its duty was to execute the instruction.
Whilst this clarification is helpful, it does not answer the question as to the scope of the necessary further enquiries that a bank needs to make when its instructions come through an agent. Lord Leggatt rejected in his judgment what has been seen as the “optimal default rule for a bank”, to “always follow the instructions of the customer’s authorised agent unless it actually knows and understands (or is wilfully blind to the fact) that the agent is acting dishonestly…”. Instead, the principle of apparent authority should apply to banks, which reflects the accommodation reached by English commercial law between not subjecting persons to transactions to which they have not agreed and protecting the expectations of parties who have relied on someone purporting to act for such a person: “A bank that relies unreasonably on an agent’s authority despite notice of matters that would have caused a reasonable banker to make inquiries cannot legitimately expect (in the absence of express agreement) to be immune from liability”9.
Accordingly, although the scope of the Quincecare duty may have narrowed with this Supreme Court judgment, as noted above, financial institutions will continue to watch this space with interest.
