44% of all payment fraud in the UK is in the form of authorised push payment fraud (APP Fraud), making it the single biggest source of payment fraud.
APP fraud occurs when a victim is induced into transferring money to a bank account controlled by a fraudulent third party by convincing them that funds are being sent to the intended payee / a legitimate party. Common scams which are becoming all too familiar include messages from HMRC requiring immediate payment of an outstanding bill, notifications of a "fraud" having taken place on the victim's bank account requiring a transfer to a "safe account", or the "Hi Mum, it's me" messages posing as a son or daughter requiring an urgent supply of funds.
On 12 July 2023, the Supreme Court handed down judgment in the case of Fiona Philipp v Barclays Bank UK PLC [2023] UKSC 25. This case has brought back to the fore the question of the duty of care owed by banks to their customers to protect them against fraud. In what will be seen as a victory for financial institutions, the decision in Philipp narrows the duty owed by banks, reduces the liability banks face when fraud occurs (particularly APP fraud) and leaves the onus on customers to avoid being caught by fraud.
Background
Philipp v Barclays revisits the duty of care owed by banks, originally established in the case of Barclays Bank PLC v Quincecare Ltd [1992] 4 All ER 363. In Quincecare, the Court held that a bank's duty of reasonable care and skill extended to ensuring that it did not execute payment instructions from directors or company agents where it had reasonable grounds to believe that the payment was an attempt to misappropriate the account holder's funds.
Following Quincecare, the duty was upheld in later cases and the future landscape appeared to be set for further expansion. For example, in Singularis Holdings Ltd (in Official Liquidation) v Daiwa Capital Markets Europe Ltd [2019] UKSC 50, the bank was found to have breached its Quincecare duty, following a sole shareholder fraudulently paying out funds held for a corporate customer. Lady Hale concluded that the appellant investment bank and brokerage firm "should have realised that something suspicious was going on and suspended payment until it had made reasonable enquiries to satisfy itself that the payments were properly to be made" (paragraph 39).
More recently, however, the Courts have showed some signs of rowing back on the scope of a bank's Quincecare duty. Although orbiter, in Stanford International Bank Ltd v HSBC Bank PLC [2022] UKSC 34, Lord Sales (in his dissenting judgment) remarked that the Quincecare duty "should be kept within narrow bounds, lest it interfere unduly with the conduct of commerce" (paragraph 132). In addition, attempts to extend a bank's Quincecare duty to a party who was not a customer of the bank failed, in the Privy Council case of JP SPC 4 v Royal Bank of Scotland International Ltd [2022] UKPC 18.
Philipp v Barclays
The Facts
In May 2018, Dr and Mrs Philipp were deceived by a fraudster (claiming to work for the Financial Conduct Authority and in conjunction with the National Crime Agency) into transferring £700,000 across two payments into an account in the United Arab Emirates. Dr and Mrs Philipp had been led to believe that the account holding their life savings had been compromised and their money needed to be moved to "safe accounts".
The unfortunate nature of the fraud and the sophistication of the scam meant that the bank queried the payments and Dr and Mrs Philipp provided their authorisation on each occasion including once confirming (falsely) that they had had previous dealings with one of the recipients.
It was only after several visits from the police that Dr and Mrs Philipp came to appreciate the extent of the fraud. The bank was notified, and a third payment of £250,000 was fortunately blocked (despite Dr and Mrs Philipp's initial persistence that the payment needed to be made). As is often the case, attempts by the bank to recall the funds transferred to the UAE were unsuccessful.
Mrs Philipp issued proceedings against Barclays for breach of its contractual and/or common law duty of care to exercise reasonable diligence and care in circumstances where it had reasonable grounds for believing a fraud was occurring.
Case History
Barclays applied for summary judgment, seeking to dismiss the case on the basis that it did not owe Mrs Philipp the alleged duty of care. Judge Russen QC, sitting as a judge of the High Court, granted judgment in favour of the bank. The Court held that the Quincecare duty could not be extended in a case where an individual had given valid payment instructions, with which the bank complied, albeit that the instructions themselves had been procured by a fraud. To impose such a duty would "involve the Bank being under just the type of unduly burdensome obligation eschewed by Steyn J in Quincecare" (paragraph 172, [2021] EWHC 10 (Comm)).
The Court of Appeal disagreed with this approach and allowed Mrs Philipp's appeal. In the leading judgment, Lord Justice Birss held that in principle, a bank owes a Quincecare duty to individual customers and therefore the Philipp matter should be decided at trial. If this principle had ultimately been maintained at trial, it would have significantly expanded the Quincecare duty, leaving banks liable to its customers in cases of APP fraud and would open the floodgates for future litigation.
Supreme Court Judgment
However, this was not the end of the Quincecare story…
Barclays appealed to the Supreme Court, and in the judgment which was handed down on 12 July 2023, the Supreme Court unanimously disagreed with the Court of Appeal's approach and restored the High Court's order for summary judgment in favour of Barclays.
The Supreme Court agreed with the bank, noting that the case put forward by Mrs Philipps was a "distortion" of the language used in Quincecare. Lord Leggatt stated:
A customer who is tricked by a fraudster into instructing her bank to make a payment is not attempting to misappropriate funds. She is attempting to cause the bank to transfer funds which are hers to dispose of in accordance with her own wishes. The consequence of executing the customer’s instruction may be that the funds are misappropriated by a third party. But that is a different factual situation from the one considered in Quincecare … (paragraph 59).
In summary, the Court held that clear instructions given by a customer (either an individual or an agent with apparent authority) were valid instructions on which the bank was obliged to act. In cases of APP fraud, the validity of instructions are not in question, even if the underlying basis for the instructions were procured by fraud and the bank's duty of reasonable care and skill does not extend to any further reasonable enquiries. In fact, any attempt to refuse to comply with valid instructions (for example, for suspicions of fraud) would be a prima facie breach of the bank's duty.
Statutory Change on the Horizon?
As highlighted by Lord Leggatt in his judgment, the extent to which victims of fraud should be left to bear the financial burden is a matter of social policy for the government and regulators to decide.
The Payment Services Regulations 2017 set out a customer's rights and the obligations on banks and other "payment service providers", including the requirement on a payment service provider to reimburse a payer the amount of an unauthorised transaction (regulation 76(2)). However, this does not extend to refunds for customers in cases of APP and other fraud.
In 2019, the Contingent Reimbursement Model Code was introduced, a voluntary code of practice for payment services providers. Whilst this Code does provide for the reimbursement of victims of fraud, it does not apply to international payments and, to date, has only been adopted by 10 payment services providers.
In June 2023, the Financial Services and Markets Act became law, further extending the statutory protection against fraud. This Act introduces a mandatory reimbursement scheme for fraud victims in limited "qualifying cases". In particular, the scheme excludes international payments and does not apply to larger corporates.
Conclusion
In recent years, there has been a huge increase in APP fraud in the UK. This has led to significant financial loss that is almost impossible to recover from the fraudsters themselves, owing to the difficultly of identifying and locating them.
The recent Supreme Court decision in Philipp v Barclays has shut down the avenue for recourse against banks for customers who have fallen victim to APP fraud. The onus remains on customers to take great care in protecting themselves against fraudulent activity. Whilst there is some glimmer of hope for statutory protection, this only benefits victims of UK based fraud.
