Supreme Court clarifies Quincecare once and for all

Introduction

On 12 July 2023, the Supreme Court handed down a landmark judgment in Fiona Lorraine Philipp v Barclays Bank UK PLC concluding that the Quincecare duty established in 1988 is not applicable to victims of authorised push payment fraud. In a unanimous decision, eagerly awaited by the banking industry, the Court explains that the reasoning that led to the Quincecare duty and, which has been the subject of debate for 35 years, was fundamentally flawed and could have been decided using basic principles of agency. This decision provides both clarity and certainty as to the relationship between a bank and its customer when a bank receives an authorised payment instruction. 

In this article we look at the journey to the Supreme Court, and the legal basis on which the Supreme Court reached its decision.

The Facts

Mrs Philipp was the victim of a sophisticated impersonation fraud. In 2018 a fraudster pretending to be from the FCA in conjunction with the NCA persuaded her to transfer her and her husband’s savings from HSBC to what the fraudster told her were “safe accounts”.

Although the Police had warned her that she might be the victim of a fraud, Mrs Philipp nevertheless attended two Barclays’ branches and authorised Barclays to transfer £700,000 in two separate payments, to accounts in the UAE for which details were provided to her by the fraudster. On each occasion Mrs Philipp confirmed more than once that she wished to proceed with the transactions.

The scale of the fraud only became apparent some weeks later. After forceful intervention from their friends, Dr and Mrs Philipp eventually engaged with the Police and thereafter complained to Barclays seeking to recover the lost funds.

The Claim

In 2020, Mrs Philipp issued proceedings in the High Court alleging that Barclays had breached its duty of care to her. Relying on the so-called Quincecare duty, she said the Bank was on inquiry as to the potential fraud, and that it had a positive duty to ask her additional questions, block her account and prevent her loss. She said Barclays had failed to comply with its duty of care to protect her from the consequences of making the transfers. Had it done so, she would not have made them. 

Until then the Quincecare duty had been established as a negative duty to refrain from executing a payment instruction if and for so long a banker was on inquiry that the payment instruction is an attempt to misappropriate the customer’s funds. All of the Quincecare line of cases to that point had involved an internal fraud by an officer of the company misusing their authority.

Barclays applied to strike out the claim on the basis that there was no duty as contended for by Mrs Philipp, because the Quincecare duty was limited to the scenario where a bank suspects an internal fraud by an agent of the customer and does not extend to a customer giving a direct instruction to their own bank. Where the payment is authorised, a bank’s duty is to act in accordance with its customer’s instructions and to honour the mandate. 

The High Court Judgment

In its decision of 18 January 2021, the High Court struck out Mrs Philipp’s claim, finding that Barclays did not owe her a duty of care to effectively second guess her instructions, nor was Barclays obliged to ask further questions of Mrs Philipp and potentially prevent her payments being made. 

However, given the significance of the issue, the judge granted Mrs Philipp permission to appeal to the Court of Appeal. The Consumers’ Association Which? intervened in the appeal on public interest grounds. It said the High Court decision did not reflect the realities of the situation facing APP fraud victims or banking industry standards and practice.

The Court of Appeal Judgment 

In the Court of Appeal, Mrs Philipp alleged that the duty arose either (i) by way of an extension of the Quincecare duty; (ii) as part of the Bank’s implied duty to exercise reasonable skill and care in executing instructions; and/or (iii) as part of a broader duty that the Court should create by way of an extension to existing case law.

In a surprising decision of 14 March 2022, the Court of Appeal found that as a matter of law the Quincecare duty had much wider application and entailed a positive duty on a bank applicable to all customers, when it has reasonable grounds for believing an order is an attempt to misappropriate funds, to make further inquiries and refrain from making payment while it does so. 

The fundamental basis for the Court of Appeal’s decision was Steyn J’s reasoning in Quincecare. Although the Court of Appeal acknowledged that all of the earlier  Quincecare cases had involved an agent misusing their authority, it found there was no reason in principle why that reasoning should not apply equally to an instruction from a personal customer herself acting under the influence of an external fraudster. For the Court of Appeal, the key theme in all the Quincecare cases was ‘an attempt to misappropriate funds’ belonging to the customer. 

The Court of Appeal said that a bank has a primary duty to execute a payment instruction from its customer and a secondary duty to use reasonable skill and care in and about execution of that instruction, which operates in tension with the primary duty. It is that tension that provides the opportunity for a bank to refrain from executing an instruction, even when properly authorised, if and for so long as the circumstances would put an ordinary prudent banker on inquiry that the instruction is an attempt to misappropriate funds of the customer.

It concluded that it is not always the case that a bank should simply execute a payment instruction and how the tension between the primary and secondary duty is resolved will depend on the particular facts and evidence about banking practice, all of which would be examined at a full trial. 

The decision was a significant departure from the narrow scope of the Quincecare duty and, rather than providing certainty and clarity it left much open to interpretation as to the extent and breadth of the duty.

Barclays appealed for permission to appeal the decision.  

The Supreme Court Appeal

Barclays obtained permission to appeal from the Supreme Court. UK Finance, the collective voice for the banking and finance industry, intervened in support of Barclays’ position. Which? also intervened to support the position of Mrs Philipp. Given the importance to both the banking industry and consumers, the hearing was expedited and heard on 1 and 2 February 2023. 

The central issue to be decided was: does the Quincecare duty have any application to an instruction properly authorised by a customer, and if not, should the Quincecare duty be extended to include the obligations contended for by Mrs Philipp in relation to APP fraud or should the law recognise or impose such obligations on a paying bank as part of its duty to exercise reasonable skill and care in about executing an instruction?

The Supreme Court Judgment 

In a unanimous decision, with the leading judgment given by Lord Leggatt on 12 July 2023, the Supreme Court overturned the Court of Appeal’s decision to extend Quincecare. It found the Court of Appeal’s decision to be inconsistent with first principles of banking law; that the basic and strict contractual duty of a bank is to comply with its customer’s instructions promptly, not to concern itself with the wisdom or risks of its customer’s payment decisions.

In its considered judgment, the Supreme Court provides a comprehensive analysis of the regulatory landscape in relation to APP fraud. It acknowledges that APP fraud is a growing problem, and the question of reimbursement from paying or receiving banks is a question of social policy for regulators, government and Parliament, but not a question for the Courts. The issue before the Court was the extent of the Bank’s responsibilities under its contract with the customer. 

The Judgment explains why the Court of Appeal was mis-led by the way Steyn J framed the original Quincecare judgment, which had two fundamental flaws in its reasoning: 

• The first is the statement that a bank’s primary duty to act in accordance with the mandate conflicts with the implied duty to take reasonable skill and care in processing that instruction. In fact, that subordinate duty only arises where the validity or content of the customer’s instruction is unclear or leaves the bank with a choice about how to carry out the instruction. 
• The second was Steyn J’s reliance on policy considerations to reconcile conflicting contractual duties. That was not, in the Supreme Court’s view, an appropriate method for identifying the duties owed by parties pursuant to a contract. 

However, just because the reasoning in Quincecare was based on a false premise, that does not mean the conclusion in that case was wrong. The attempt by Steyn J to justify the duty went down a wrong track because it was based on those two fundamental flaws, which obscured the true basis for the duty: the effect of dishonesty on an agent’s authority. The Supreme Court concludes that Steyn J was wrong to assume that a dishonest agent can provide a valid and proper payment instruction. Once that assumption was reversed, the principle is clear:

1. Authority given by a customer to an agent does not include authority to act dishonestly in pursuit of the agent’s own interests and in fraud of the customer.

2. It follows that if an agent acts dishonestly, he lacks actual authority from the customer.  

3. If there are circumstances which suggest dishonesty, then a reasonable banker will make inquiries to verify the agent’s authority and check that the payment instruction is in fact authorised. 

4. If a bank fails to make inquiries in that situation, the instruction will not bind the customer because the payment is unauthorised. 

This meant the legal conclusion in Quincecare can be justified through basic principles of agency law. The reason a bank owes a duty to make inquiries is to ensure that it does not make a payment which the customer has not authorised. It is simply an application of the general implied duty of care owed by a bank to ascertain and act in accordance with its customer’s instructions. There is no conflict between the bank’s duty of care to verify the agent’s authority and its duty to execute a valid order to transfer money promptly. 

The Quincecare duty has therefore been reduced to an application of basic agency principles: “Where a bank is “put on inquiry” in the sense of having reasonable grounds for believing that a payment instruction given by an agent purportedly on behalf of the customer is an attempt to defraud the customer, this duty requires the bank to refrain from executing the instruction without first making inquiries to verify that the instruction has actually been authorised by the customer” (emphasis added). If the bank executes the instruction without making such inquiries and the instruction was given without the customer’s authority, the bank will be in breach of duty, and its customer mandate. 

The Supreme Court makes clear that this principle can apply to personal customers (acting through an agent), but it has no application to a victim of APP fraud, where the validity of the instruction is not in doubt. Provided the instruction is clear and is given by the customer personally or by an agent acting with apparent authority, no inquiries are needed to clarify or verify what the bank must do. The bank’s duty is to execute the instruction and any refusal or failure to do so will be a breach of mandate by the bank. The implied duty to act with reasonable care and skill simply does not arise.

The judgment also explains that a customer’s intention is irrelevant. This is particularly important because in APP scams, victims typically believe that funds are being sent to a third party for a legitimate purpose, or that transactions are being cancelled such that funds are not being sent at all. The fact that a payment was induced by fraud does not invalidate the instruction or give rise to any claim against a bank.

What does this mean?

The Supreme Court makes clear that “the duty of a bank which has come to be referred to as the “Quincecare duty” is not, as that epithet might suggest, some special or idiosyncratic rule of law”. It is simply, where it arises at all, an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions.

This is a welcome decision for the banking industry, providing both clarity and certainty as to the obligations of a bank when it receives an authorised payment instruction from its customer, particularly given that the implied duty of reasonable skill and care has been significantly paired back to only arising in circumstances where the instruction is unclear. It sets out in clear terms that where there is any scope for that implied duty, it is directed at the effective execution of the instruction.

Whilst in this case there remains a claim in relation to the steps taken by Barclays to recall the funds upon being notified of the fraud, the Supreme Court noted that even if prompt action had been taken, the prospect of successfully reclaiming funds seems “slim”. As is often the case with APP fraud, fraudsters typically dissipate funds as soon as they are received, and in this case Barclays was not notified of the fraud until 14 days after the payments had been made. 

Victims of APP fraud will now be almost entirely reliant on the legislative framework for recovery of any funds lost as a result of a scam, with such a framework being the responsibility of Parliament and Regulators, not the Court.