Court of Appeal confirms scope of banks' duty to take reasonable care to protect their customers from fraud: Philipp v Barclays Bank UK PLC & Anor [2022] EWCA Civ 318

Overview

The Court of Appeal's recent decision sheds significant light on banks' liability for failing to exercise reasonable skill and care in executing the instructions of their customers. Reversing the ruling of the High Court, the Court of Appeal made clear that the "Quincecare duty" arises not only when it is the customer's agent who fraudulently instructs the bank to transfer the customer's money, but can also arise when the customer themselves, as the victim of a fraud, instructs the bank to do so. The Court of Appeal overturned the summary judgment in the bank's favour, and remitted the case to the High Court for trial. The question of what measures the bank should have had in place to prevent a fraud of this kind can only be determined at trial.

Background

Mrs Philipp, a music teacher, and her husband Dr Philipp, a retired physician, were deceived by a fraudster, JW, out of the bulk of their life savings. JW instructed them to transfer £700,000 into an account in Mrs Philipp's name with Barclays Bank. Shortly thereafter, acting on JW's suggestion, Mrs Philipp went in person to a Barclays' branch and instructed Barclays to transfer £400,000 of that money to a bank account in the United Arab Emirates. Three days later, she went in person to a different Barclays' branch and instructed them to transfer the remaining £300,000 to another bank account in the United Arab Emirates. The Philipps had been convinced by JW that this was necessary to protect their money from fraud. By the time the Philipps realised they had been defrauded, they were unable to recover their money.

APP fraud

What happened to Mrs Philipp is known as "APP" fraud. APP stands for "authorised push payment". A "push" payment means the customer instructs the bank to pay someone else (rather than a "pull" payment where the receiving party instructs the bank to transfer money from the payer's account). It is "authorised" because, from the bank's point of view, it is authorised by the customer.

Mrs Philipp brought an action against Barclays for breaching its duty to exercise reasonable care and skill in and about executing her instructions. She argued that the bank should have had in place policies and procedures to detect and prevent potential APP fraud and to reverse such payments when they were made. She claimed that the circumstances in which she instructed the bank to make the transfers would have alerted an ordinary prudent bank to the possibility of fraud. A bank acting with reasonable care and skill would have delayed the transfers and investigated. The bank had therefore breached the duty identified by the High Court in Barclays Bank v Quincecare [1992] 4 All ER 363 ("the Quincecare duty").

In the High Court, the bank applied for summary judgment on the basis that the Court could decide, without the need for a trial, that as a matter of law there could be no duty of care owed in these circumstances. The High Court accepted the bank's case. Mrs Philipp appealed with permission of the judge.

Decision

The Court of Appeal allowed the appeal, holding:

As a matter of law, the Quincecare duty does not depend on the fact the bank is instructed to transfer money by an agent of the customer of the bank. It was therefore at least possible in principle that a relevant duty of care could arise in the case of a customer instructing their bank to make a payment when that customer is the victim of APP fraud.
Whether such a duty applied in this case, including the important question of whether the duty would be unworkable or onerous, is a question that cannot be decided without a trial. Summary judgment in the bank's favour had been wrongly entered and should be set aside.

What is the Quincecare Duty?

The Quincecare duty holds that it is an implied term of the contract between a bank and its customer that the bank will use reasonable skill and care in and about executing the customer's orders. This presents a tension with another duty of the bank: to execute a customer's orders promptly. The bank will be liable if it executes an order knowing it to be dishonestly given, or has shut its eyes to the obvious fact of the dishonesty, or has acted recklessly in failing to make such inquiries as an honest and reasonable banker would make in the circumstances. If the "ordinary prudent banker" would be put on inquiry that the instructions may facilitate a fraud, then the bank's duty is to not execute the order until it has made those inquiries.

Issue 1: Does the Quincecare duty apply when the instruction comes from the customer themselves?

The previous major cases applying the Quincecare duty have involved an agent of the bank's customer (such as a director of the customer company) fraudulently instructing the bank to transfer money in an attempt to misappropriate funds. For example, in Singularis Holdings v Daiwa Capital Markets [2019] UKSC 50, a director of the company had instructed the bank to transfer money from the company account to third parties. The Supreme Court held that the bank should have realised that something suspicious was going on and suspended payment until it had made reasonable enquiries to satisfy itself that the payments were properly to be made.

By contrast, in this case it was Mrs Philipp, the customer herself, who instructed the bank to transfer the money. Barclays argued that the Quincecare duty could not apply in these circumstances because it only arises when the instructions to the bank are given by an agent. The bank's argument was that if the agent's instructions are a fraud, then the bank has no proper instructions at all, and that is how the duty arises. Where it is the customer who gives the instructions, the bank argued that its only duty was to execute those instructions.

Lord Justice Birss, writing for the Court of Appeal, did not accept the bank's arguments. While the previous cases had involved agents, the reasoning in those cases applied equally to cases without agents. Birss LJ explained that reasoning as follows:

The starting point is to identify the relationship between the customer and the bank in the context of an instruction to pay: the bank is the agent for the customer as principal.
The next question is to ask what if the banker knew that the relevant instruction was an attempt to misappropriate funds? A bank that executed that instruction in those circumstances would be liable.
The final question is then what lesser state of knowledge will put the bank under a legal obligation? The answer is that if the circumstances were such that an ordinary prudent banker would be "on inquiry", then the duty arises.

Birss LJ noted that the purpose of this duty is to protect the customer, not the bank. The reasoning does not depend on whether the instruction comes from an agent, and applies equally to a case where the instruction comes from a customer, provided the circumstances are such that the bank is on inquiry that executing the order may result in the customer's funds being misappropriated. The bank's duty to execute the customer's instruction is not absolute; it is subject to its duty of care when carrying out those instructions. How the tension between those two duties will be resolved will depend on the facts of the case.

Issue 2: Would such a duty on banks be onerous and unworkable?

Barclays argued that this kind of duty of care would impose an onerous and unworkable burden on banks. In the High Court, the Judge had accepted the bank's argument on this point, and in the Court of Appeal both Mrs Philipp and the Consumers' Association 'Which?', as intervener, argued that the Judge was wrong. The Court of Appeal concluded that this issue could not have been properly decided without a trial. There was evidence to show that it was at least arguable that the duty of care would be neither unworkable nor onerous in terms of banking practice as it was in March 2018, when the fraud occurred. Among that evidence was the existence at that time of at least one voluntary code of practice, which provided evidence of what was feasible for banks at the time.

In arguing that the duty would be onerous and unworkable, Barclays asked how the duty could possibly work in the context of the huge number of banking transactions executed every day and the speed of many of these transactions, such as in the BACS and Faster Payment systems. Birss LJ did not accept this as a relevant concern, because the Quincecare duty is conditioned on whatever ordinary banking practice is at the relevant time: "A finding that the facts of Mrs Philipp's case would, when considered alongside ordinary banking practice in March 2018, have put an ordinary prudent banker on inquiry about APP fraud, simply does not mean that the circumstances associated with any one of the many millions of low value BACS transfers would do so."

Comment

This is a significant decision on the scope of the Quincecare duty, which has made clear that the duty is a wider one than some may have previously thought. The duty can potentially arise whenever a banker has been put on inquiry that the customer may be the victim of fraud, regardless of who the instruction comes from.

In light of the Court of Appeal's decision, banks may wish to review their anti-fraud and safeguarding processes, including training to help staff to identify situations where the customers instructing them may be the victim of a fraud. Importantly, as Birss LJ noted, the Quincecare duty is conditioned on whatever ordinary banking practice is at the relevant time by the standard of the ordinary reasonable banker. We will have to await the judgment following trial to find out what that standard was in respect of APP fraud in 2018, when Mrs Philipp instructed Barclays to transfer the money, and therefore what measures Barclays would have had to have in place to comply with any duty owed. However, the decision does indicate that courts will look to any voluntarily adopted industry standards or codes as evidence of whether checks and balances will be workable or not. The scope of the duty – and what safeguards a bank must put in place - will continue to evolve as banking practice evolves. Banks will need to ensure that their processes reflect this.