APP fraud – extent of the Quincecare duty

In the recent High Court decision in Philipp -v- Barclays Bank UK plc [2021] EWHC 10 (Comm) (18 January 2021), HHJ Russen QC refused to extend the Quincecare duty of care in circumstances where an individual had authorised payment instructions to their bank despite the same being induced by a fraudster.

Background

The claimant was the victim of an authorised push payment (APP) fraud and remitted international payments from her bank account held with the defendant to a fraudster. The fraudster had deceived the claimant and her husband, Dr Philipp, into making the payments in the belief that her monies would be safe and that she was assisting an investigation conducted by the Financial Conduct Authority and the National Crime Agency.

In late February 2018, the claimant and Dr Philipp came into initial contact with the fraudster. The fraudster informed Dr Philipp that staff dealing with his HSBC bank account and Tilney, with whom he held investments, were conducting fraudulent activity. The fraudster purported that these identified funds should be immediately transferred into ‘safe accounts’ until their investigations were completed and arrests made.

In March 2018, Dr Philipp arranged to transfer the sum of £950,000 into the claimant’s bank account held with the defendant and with the immediate intention to protect these funds. Both the claimant and Dr Philipp, prior to the funds being transferred, had received a visit from their local police and were put on notice that they had been identified as possible victims of fraud. The fraudster had been made aware of the police visit in advance and warned both the claimant and Dr Philipp to remain silent and not to risk compromising the Financial Conduct Authority’s and the National Crime Agency’s investigations.

The claimant following the fraudster’s instructions attended the defendant’s branches on two separate occasions and requested their staff to process international transfers totalling the sum of £700,000 to bank accounts held in the UAE. The claimant repeated to the defendant’s staff on both occasions and subsequent telephone calls that she wished to proceed with the transactions despite continued warnings from the police regarding a potential fraud.

The claimant and Dr Philipp, after processing both payments, discussed matters with their friends and were convinced to speak with the police further. Both the claimant and Dr Philipp realised they had been the victims of APP fraud and requested that the defendant attempt to recover the funds from the UAE bank accounts on her behalf. However, after several chasers and a lack of co-operation from the UAE bank the defendant ceased all recovery action.

Proceedings and the defendant’s application

The claimant commenced proceedings against the defendant claiming damages and seeking to hold the bank liable for her losses sustained by processing the two payments. The claimant pleaded that the defendant had breached its alleged Quincecare duty of care towards her as it was on inquiry as to the potential fraud and should have protected her from the consequences of the payments. The claimant considered that the defendant had an obligation to question her about the validity of both payments and should have had in place appropriate APP fraud detection and prevention policies.

The claimant also presented an alternative case regarding an alleged loss of chance and pleaded that if the two payments had been delayed by the defendant she would have been afforded the opportunity to recover the funds before they reached the fraudster.

The defendant’s position was that the claimant’s claim was misconceived and filed an Application for Summary Judgment and/or Strike Out upon the basis of no reasonable grounds for bringing the claim and/or no real prospect of success. The defendant’s case was that the alleged Quincecare duty of care to protect the claimant from the consequences of her authorised payments, relying on the belief of being fraudulently induced, was not recognised in law and conflicted with their establish duty to comply with a customer’s mandate in respect of an individual.

In Barclays Bank PLC -v- Quincecare Ltd [1992] 4 All ER 363, Steyn J laid down the well-established principle that a banker must refrain from executing an order if they are ‘put on inquiry’ in the sense that they have reasonable grounds (although not necessarily proof) for believing that an order is an attempt to misappropriate funds of the company. Steyn J commented that the external standard of the likely perception of the ordinary prudent banker is the governing one. In these circumstances, the claimant had to persuade the court that the Quincecare duty of care extended to her as an individual, as opposed to a corporate customer in the established prior case law, and where she had directly instructed the bank.

Judgment

The court struck out the claimant’s claim and approved the defendant’s application ruling that the Quincecare duty of care did not extend to protect the claimant from the consequences of her genuine instructions.

HHJ Russen QC was convinced that the Quincecare duty of care should remain confined to circumstances where suspicion has been raised by the attempted misappropriation of funds by the customer’s agent, ie in which the agent’s payment instructions are genuinely fraudulent. HHJ Russen QC accepted that where the customer is an individual, the customer’s authority to give the payment instruction to the bank is apparent and must be taken by the bank to be real and genuine. Unfortunately, for the claimant this did not change, because both payments had been fraudulently induced.

HHJ Russen QC felt that the requested extension to the Quincecare duty of care for individuals faced two fundamental issues. The first was that it sought to elevate the duty subordinate or ancillary to the bank’s primary duty to act on the customer’s mandate. The second related obstacle was that there was no clear framework of rules by reference to which the duty, as extended, might sensibly operate. An extension of the duty, as claimed by the claimant, would have to be based on an industry-recognised set of rules.

The court concluded that the defendant had no legal obligation to second-guess the claimant’s instructions and to decide otherwise would require the bank to assume the role of an amateur detective. The judgment confirms that the Quincecare duty of care is limited to cases where the suspicion has been raised by attempted misappropriation of the customer’s funds by an agent of the customer and in the majority of cases this duty will protect corporate clients from the actions of their agents.

Implications

This is clearly a welcome decision for banks and financial institutions from individuals that have been the victims of APP fraud and are seeking to present claims against them for the reimbursement of lost funds.

The decision reaffirms that the banks’ primary duty in dealing with payment instructions from individuals is to follow the customer’s mandate and as expressed by HHJ Russen QC in his judgment they ‘cannot be expected to carry out urgent detective work, or treated as a gatekeeper or guardian in relation to the commercial wisdom of the customer’s decision’.

The Quincecare duty of care remains a common law duty which rests on the general concept of a bank adhering to standards of honest and reasonable conduct in being alive to suspected fraud. The case law confirms that the benchmark is expressed by reference to the standards of the ordinary prudent banker and the court in the present case was not prepared to impose a higher set of standards which dictate that, in certain defined circumstances, the bank is obliged to question the customer’s genuine instructions.

It should be observed that since the date of both payments, the banking industry has created a mechanism to compensate victims of APP fraud. HHJ Russen QC referenced in his judgment that a voluntary system to reimburse victims of APP fraud, the Contingent Reimbursement Model Code for Authorised Push Payment Scams, was introduced in late May 2019. In respect of the claimant’s circumstances, the voluntary scheme was not in force at the time and does not extend to international payments.