Supreme Court decides that a victim of APP fraud cannot bring a claim against their bank for breach of the Quincecare duty

In a much-anticipated judgment handed down on 12 July 2023 (Philipp judgment), the Supreme Court has decided that an individual customer that makes a payment pursuant to an APP fraud cannot bring a claim against their bank for breach of the Quincecare duty. This was on the basis that, although the customer was misled by fraudsters to make the payment, the payment instruction to the bank was still validly authorised and the bank was required to act on that instruction.

Properly understood, the Quincecare duty is underpinned by agency law and the purpose of the duty is not to protect customers from fraud but rather to establish whether a payment instruction is authorised or not. Claims for breach of the Quincecare duty are therefore restricted to claims where the payment instruction comes from an agent of the customer of the bank (e.g. an instruction from an employee or officer of a company or an agent acting on behalf of an individual).

However, an alternative claim alleging that the bank owed a duty to follow up with the receiving bank promptly after the fraud had been discovered and to take steps to recover the payments made was a head of claim that could proceed to a full trial.

The Quincecare duty

The Quincecare duty is the name given to the duty on a bank to refrain from acting on a payment instruction if, and for as long as, it is put on inquiry by having reasonable grounds for believing that the instruction is an attempt to misappropriate the funds of the customer.

Prior caselaw has largely considered situations where the payment instruction came from an agent of the customer of the bank (e.g. where the customer is a corporate, the agent might be a director or employee that is attempting to defraud the corporate customer by misappropriating its funds).

In the Philipp case, the issue arose as to whether an individual (Mrs Philipp) who gave instructions to her bank to make significant payments (having been convinced by APP fraudsters to do so) could also bring a claim for breach of the Quincecare duty.

APP fraud

APP stands for “authorised push payment”. When the customer of a bank is a victim of APP fraud, they have been deceived by a fraudster to instruct their bank to transfer money from their account to an account controlled by the fraudster. The latest figures show that in 2022, there were around 207,000 reported APP fraud cases on personal accounts and losses came to over £485 million. The growth of this type of fraud has been exponential and currently shows no signs of abating.

Facts of the Philipp case

The particular facts of the Philipp case are unusual due to the significant sums involved.

Mrs Philipp became the victim of an APP fraud in March 2018. Mrs Philipp and her husband were deceived by a fraudster known as JW to transfer over £700,000 of their life savings into an account in Mrs Philipp’s name with the defendant bank and then Mrs Philipp instructed the bank to transfer that money, in two payments of £400,000 and £300,000, to separate bank accounts in the United Arab Emirates. The couple believed that in acting on JW’s instructions they were helping the Financial Conduct Authority and the National Crime Agency in moving the money into safe accounts in order to protect it from fraud. However, they were the victims of an elaborate fraud themselves and once the monies were transferred to the UAE accounts they were then paid away to the fraudsters and not recovered.

Following discovery of the fraud, Mrs Philipp alleged there were numerous “red flags” which, in accordance with the Quincecare duty, ought to have put her bank on inquiry leading the bank to refuse to execute the payment instructions despite Mrs Philipp instructing her bank to do so.

High Court decision

At first instance (January 2021), HHJ Russen QC granted summary judgment in favour of the bank on the grounds that Mrs Philipp, as an individual, could not bring a claim for breach of the Quincecare duty as this duty was restricted to payment instructions coming from an agent of the customer.

Court of Appeal decision

Following the first instance judgment, the Consumers Association (Which?) was granted permission to intervene in the appeal. Which? supported Mrs Philipp’s appeal, contending that the court should recognise a duty of care in the circumstances of Mrs Philipp and that it would be illogical to confine it to companies or agents.

In March 2022, the Court of Appeal reversed the first instance decision, deciding:

• The purpose of the Quincecare duty was to protect customers from fraud.
• The Quincecare duty was not restricted to a situation where the payment instruction was being given by an agent but could also, in principle, apply where the instruction to the bank is given by a customer themselves who is the unwitting victim of APP fraud provided the bank was on inquiry that executing the order would result in the customer’s funds being misappropriated.
• It was at least properly arguable that the Quincecare duty could arise on the facts of the Philipp case and the matter ought to go to trial.

It is important to note that the Court of Appeal did not undertake an assessment of the merits of the claim – the appeal related to whether or not the claim ought to have been dismissed by the High Court by way of summary judgment without a full trial. Whether the Quincecare duty in fact arose in the Philipp case (and, if so, whether the bank was in breach of such a duty) were matters to be considered at a full trial.

Supreme Court decision

Before the Supreme Court, trade body UK Finance also intervened on behalf of banks generally (in addition to the Consumers Association).

The Supreme Court reversed the decision of the Court of Appeal in relation to the Quincecare duty but allowed part of the claim to proceed to a full trial:

Quincecare duty as re-shaped by the Supreme Court

• The Court of Appeal’s decision was “inconsistent with first principles of banking law”.
• Whilst APP fraud may be a growing social problem, the question of whether victims should bear the cost of this fraud or whether losses should be passed on to banks were questions of social policy for regulators, government and ultimately Parliament. It was not the role of the courts to formulate such policy nor impose such policy on parties to a contract. The appropriate policy response to APP fraud was therefore outside the scope of these proceedings. However, the court noted certain policy steps that have already been taken to deal with APP fraud via the Contingent Reimbursement Model Code (and new regulations that are due to be implemented) – discussed below.
• The primary duty of a bank was to comply with customer payment instructions in accordance with the bank mandate. It was not for banks to concern themselves with the wisdom or risks of a properly authorised customer payment decision. 
• The so-called “Quincecare duty” imposing a duty on a bank to make inquiries was to ensure that the bank did not make a payment which the customer has not authorised. 
• The correct approach to the Quincecare line of cases was to justify the conclusion in those cases by application of agency law. Where a customer acts by an agent, that authority does not extend to allow the agent to act dishonestly by misappropriating the customer’s funds. An agent acting in this way will lack actual authority to give instructions on behalf of the customer. However, the agent will still have apparent authority as regards the bank unless there are circumstances suggestive of dishonesty apparent to the bank which would cause a reasonable banker to make inquiries before executing the payment instruction. In such circumstances, the bank is under a duty to make inquiries to ascertain whether the instruction given is one that is actually authorised by the customer.
• A payment made without inquiry when a bank is on notice that the payment is being made for the agent’s own purposes is not only a breach of the bank’s duty of care but is also outside the scope of the mandate.
• The “Quincecare duty” is not some special rule of law but simply the application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions.
• The principles are not limited to corporate customers; they apply wherever one person is given authority as an agent to give payment instructions to a bank on behalf of another. For example, where under the mandate for a joint account either account holder has power to bind the other. The duty would also apply where the bank is on notice (by having reasonable grounds for believing) that a customer lacks mental capacity.
• These principles have no application to a situation where the customer is the victim of an APP fraud. In an APP fraud situation, the validity of the instruction is not in doubt. The fact that the customer’s payment instruction was induced by fraud entitles the customer to claim repayment from the fraudster but does not invalidate the instruction or give rise to any claim against the bank.
• Where a bank receives a valid payment instruction which is clear and leaves no room for interpretation as to what is required to carry out the order, the bank’s duty is simply to execute the order by making the payment. An additional duty of care does not arise in those circumstances.

The Supreme Court’s reasoning in Philipp is consistent with a recent decision delivered by Lord Sumption (February 2023) in the Hong Kong Court of Final Appeal (PT Asuransi Tugu Indonesia TBK) which framed the Quincecare duty by reference to agency principles. In that decision, Lord Sumption noted that “the law cannot coherently treat compliance with an authorised instruction as a breach of duty”. 

The alternative claim

At first instance, Mrs Philipp’s claim was dismissed in its entirety. The Court of Appeal reversed that decision and allowed the full claim to proceed to trial. The Supreme Court decision has prevented the breach of Quincecare duty claim from proceeding but allowed Mrs Philipp to pursue her alternative head of claim to trial.

The alternative claim alleged that the bank owed a duty to follow up with the UAE receiving bank promptly after the fraud had been discovered and take steps to recover the payments made and that the bank acted in breach of this duty causing Mrs Philipp to lose a substantial chance of getting any of her money back.  The assessment of this head of claim will involve a detailed factual analysis as to what steps were taken by the bank following discovery of the fraud and likely expert evidence as to what steps a reasonable and prudent bank would have been expected to take in 2018 in this situation. The Supreme Court noted that the likelihood of the monies being successfully recovered from the UAE seemed “slim”, but this was not a head of claim that could be determined on a summary basis without a full trial.

Key takeaways

1. There have been a number of cases over the last few years regarding the boundaries of the Quincecare duty. The Supreme Court decision provides a comprehensive summary of the genesis of what has become known as the Quincecare duty and explains why the duty is confined to situations where payment instructions are given by agents (which will most commonly arise where corporate customers are giving payment instructions rather than individual customers). Importantly, the court confirmed that the purpose of the duty is not to protect customers from fraud but rather to establish whether a payment instruction is authorised or not. Payment instructions that are properly authorised (even if procured by fraud) will not engage the duty. Limiting the boundaries in this way will be welcomed by banks.
2. As regards future claims for breach of the Quincecare duty:
   1. These will still be available and pursued where it is alleged that a bank was on notice of an agent attempting to misappropriate customer funds.
   2. There remains limited judicial commentary as to how far banks are expected to go once “on inquiry”. It has long been recognised that banks are not obliged to become “amateur detectives” in this context and the Supreme Court confirmed that courts would need to recognise the demands of modern-day banking practices such as the vast numbers of transactions processed by banks and the speed at which most banking business is expected to be conducted which will all impact on what the duty of reasonable skill and care requires. Much will depend on the facts of each case, the features of the customer, the bank’s knowledge of the agent giving instructions, the amount involved, the need for prompt transfer, the presence of unusual features and the scope and means for making reasonable inquiries. It is therefore clear that these claims will be highly fact sensitive and will require expert evidence as to the standards expected of banks at the relevant time. These claims will therefore not be amenable to summary judgment and will need to be determined at trial.
   3. Bank terms and conditions should include terms that allow the bank to make inquiries where they have concerns as to whether an agent is properly authorised to make the payment and exclude liability, so far as possible, for any delays in processing payments whilst reasonable inquiries are being made.
3. As regards the ability for individual customers to recover payments made as a result of APP fraud outside of the Quincecare duty:
   1. The Supreme Court noted that since 2019 there has been a voluntary code providing for a framework for reimbursement for APP fraud victims (the Contingent Reimbursement Model Code for Authorised Push Payment Scams - the CRM Code). The Payment Systems Regulator is currently consulting on new regulations that would require all Payment System Providers (banks, building societies and smaller payment firms) to reimburse consumers, microenterprises and charities that fall victim to APP fraud in all cases other than where the customer is involved in the fraud or has been grossly negligent. The detail of the new scheme remains under consultation with the aim of it being introduced in 2024. This will therefore provide a route for many individual victims of APP fraud to recover their funds – although it will not apply to international payments such as those in Philipp and details around the maximum level of reimbursement remain under discussion.
   2. Individual customers also have the right to refer complaints to the Financial Ombudsman Service. In this context, complainants may try and leverage the new Consumer Duty and the requirement for firms to avoid causing foreseeable harm to retail customers.
   3. The Supreme Court decision in Philipp leaves open the possibility for individuals to bring a claim in respect of the actions of the paying bank after the fraud is discovered. However, such claims will be highly fact specific, and it is likely that these will only be viable (at least via the English High Court) in circumstances such as Philipp where the payments made were substantial.