What actually happened?
As a brief recap, the facts are as follows. In 2018, two of Barclays' customers, Mrs Fiona Philipp and Dr Robin Philipp fell victim to a fraudster and requested the bank to transfer the majority of their life savings (totalling £700,000) to bank accounts held in the United Arab Emirates. They had been deceived into believing that they were cooperating with the National Crime Agency and Financial Conduct Authority, and therefore were transferring the funds in the belief that their savings would be further protected from fraud. Calls and police visits were made to Dr and Mrs Philipp in order to confirm that they wished to proceed with the transfers, and on each occasion Mrs Philipp had provided the required confirmation (even visiting a branch in person one time in order to confirm her instructions).
By the time that Dr and Mrs Philipp realised that they had been the victims of a fraud, it was too late and attempts to recover the funds were unsuccessful. Mrs Philipp sued Barclays, claiming that the bank owed her a duty to refrain from executing her payment instructions if they had grounds to believe that there were fraudulent intentions behind the payment requests - relying on the so-called 'Quincecare' duty, as established in Barclays Bank plc v Quincecare Limited (for a more thorough explanation on this duty, please see my colleague Ross Caldwell's article here).
Prior to the UK Supreme Court's decision, the Court of Appeal had held in the Philipps' favour, deciding that a Quincecare duty could arise in the case of an individual customer instructing the bank to make payment when that customer is a victim of APP Fraud. Importantly the Court of Appeal had ruled that the existence of this duty does not depend on whether the bank is instructed by an agent of the customer or by the customer themselves.
The Supreme Court's decision
The Supreme Court has now unanimously rejected the Court of Appeal's reasoning, distinguishing that the Quincecare duty lies primarily within agency law - it can only apply where an agent has either negligently, or in bad faith, instructed a fraudulent payment on behalf of the customer. It therefore cannot arise where the customer has "unequivocally authorised and instructed the bank to make the payment"; there is no 'anti-negligence' duty on the bank to second-guess whether there is an element of fraud behind the instruction. As mentioned above, Mrs Philipp's instructions were clear - despite prior warnings she had taken active steps to instruct and authorise the bank to make the payments, so the rationale of the Quincecare duty could not apply in her case.
The Quincecare duty does inherently create tension between the bank's duty to act on its customer's instructions, versus the duty to take reasonable care in carrying out those instructions. In light of this, the court emphasised that the primary duty of the bank is the former option. Whilst it did not disregard the importance of a bank's duty to take reasonable skill and care and in protecting its customers, it was highlighted that a bank's main duty towards customers is the duty to make prompt payment given in accordance with express instructions. By following Mrs Philipp's instructions Barclays had complied with this primary duty, further contributing to the court's decision not to diverge from the current understanding of the duties owed under a bank-customer contract.
The court also took care to emphasise that there are in fact changes being implemented right now within the Financial Services and Markets Act 2023 (and led by the Payment Systems Regulator) which aims to enhance fraud protection for individuals who fall victim to APP fraud. Since the core issue of this case is already subject to governmental intervention, the court distinguished its unique constitutional position as another key reason for why it would be wrong to expand the current scope of the duty.
Comments
Firstly, the outcome of this decision will serve as a relief for many financial institutions and PSPs. An extension of the scope of the Quincecare duty, as was set out in the Court of Appeal's decision, would have likely created significant operational burdens - every transaction or payment instruction may well have had to be investigated for traces of APP Fraud. By narrowing the duty to specific instances where an agent of the customer is giving the payment instruction, and where the bank has reasonable grounds for believing that it may be an attempt to defraud the customer, the court has limited the application of the duty to cases of APP fraud.
However, this is not to say that the decision completely negates the ongoing burden on financial institutions to protect its customers from fraud. Fraudulent techniques will continue to evolve and APP fraud continues to pose a serious threat - last year over £1.2 billion was stolen by criminals through both authorised and unauthorised fraud. This has resulted in APP fraud being a key focus area for regulators and as mentioned above, the Financial Services and Markets Act 2023 (which received Royal Assent on 29 June 2023) now makes provision for the introduction of a mandatory reimbursement scheme - this is expected to come into force in 2024, albeit it will not apply to international payments or cryptoasset transfers.
As a result, whilst the Supreme Court's decision can be seen as a welcome clarification in terms of the legal claims that can be brought in relation to APP fraud, it certainly does not signal the end of the Quincecare duty, or the responsibility of financial institutions to ensure that appropriate mechanisms have been put in place to protect their customers. In fact, with the upcoming reforms it may well be the case that institutions will need to brace for an increase in their financial burdens in respect of APP fraud.
