High Court confirms current scope of Quincecare duty is limited to protecting corporate customers and does not extend to individuals

In a recent decision, the High Court has granted reverse summary judgment in favour of a defendant bank on the basis that the so-called Quincecare duty of care did not operate in the context of an authorised push payment (APP) fraud, where a third party fraudster tricked the bank’s customer willingly to instruct the bank to transfer large sums out of her account, which were then misappropriated: Philipp v Barclays Bank UK plc [2021] EWHC 10 (Comm).

The judgment is the latest in a line of judgments concerning the parameters of the Quincecare duty, which arises where a bank has received a payment mandate from an authorised signatory of its customer, and executed the order, in circumstances where (allegedly) there were red flags to suggest that the order was an attempt to misappropriate the funds of the customer. This recent decision is important and helpful for financial institutions, because it confirms that existing authorities limit the Quincecare duty to protect corporate customers or unincorporated associations such as partnerships (i.e. where the instruction to the bank has been given by a trusted agent of the customer). The decision confirms that the Quincecare duty does not currently extend to individual customers. On the facts of the present case, the court was not persuaded to extend the Quincecare duty to protect an individual customer in the context of an APP fraud, saying to do so would be contrary to the principles underpinning the duty.

There has been an unfortunate proliferation of APP frauds over recent years which has seen a staggering increase in the accompanying sums that individuals are therefore out of pocket. While this decision closes one avenue by which banks were said to be liable for compensating victims, it will only be of relevance when the circumstances of the fraud cause it to fall outside of the voluntary Contingent Reimbursement Model Code, which seeks to compensate victims of APP frauds and is funded by banks for this purpose.

Background

In March 2018, the claimant was the victim of an APP fraud. As part of an elaborate deception by a third party fraudster, the claimant transferred £700,000 in two separate tranches from her account with the defendant bank (Bank) to international bank accounts, in the belief that the money would be safe and that she was assisting an investigation by the Financial Conduct Authority (FCA) and the National Crime Agency (NCA).

The claimant brought a claim against the Bank to recover damages for the loss she suffered by making the two payments, alleging that the Bank owed and breached a duty of care to protect her from the consequences of the payments. In this context, the claimant relied upon the Quincecare duty of care (first established in Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 343), saying that the extent of protection afforded to a customer through a bank’s observance of the Quincecare duty, required the Bank to have certain policies and procedures in place by March 2018 for the purpose of:

• Detecting potential APP fraud;
• Preventing potential APP fraud;
• Stopping potential APP fraud; and
• Stopping or reversing or reclaiming monies the subject of a potential APP fraud.

The claimant brought an alternative case based upon loss of a chance, on the basis that if the international transfers had at least been delayed by the Bank, she would have had the chance of recovering the monies before they reached the hands of the fraudster.

The Bank denied the claim and brought an application for strike out / reverse summary judgment, arguing that it did not owe a legal duty of the kind alleged by the claimant and that (even if such a duty was owed and breached) the claimant’s case on causation was fanciful.

Decision

The court held that that Bank did not owe the claimant a duty of care in respect of the APP fraud and granted summary judgment in favour of the Bank.

Suitability for summary judgment

The application turned upon the interpretation of the Bank’s alleged duty of care, i.e. whether or not the Bank should, in March 2018, have had in place a system for detecting and preventing the APP fraud perpetrated upon the claimant. The court was satisfied that this was a case giving rise to a short point of law or construction, and that the factual platform was sufficiently clear and stable, to enable it to grasp the nettle and decide the matter before the costs of the litigation increased further (applying the seventh proposition in EasyAir Ltd v Opal Telecom Ltd [2009] EWHC 339 (Ch)).

Scope and nature of the Quincecare duty of care

The difference between the parties arose from the extent of protection afforded to a customer through a bank’s observance of the Quincecare duty. This duty was first encapsulated in the decision from Steyn J in the case of the same name, in which he said as follows:

“…a banker must refrain from executing an order if and for so long as the banker is "put on inquiry" in the sense that he has reasonable grounds (although not necessarily proof) for believing that the order is an attempt to misappropriate funds of the company…And the external standard of the likely perception of the ordinary prudent banker is the governing one."

The question for the court was whether or not the Quincecare duty owed by the Bank required it to have in place the policies and procedures alleged in the particulars of claim, for the purpose of detecting and preventing the APP fraud or for recovering any monies transferred by the claimant as a result of it.

In this context, the court made three important observations about the nature of the Quincecare duty from previous authorities including Quincecare itself, Lipkin Gorman v Karpnale Ltd  [1987] 1 WLR 987 and Singularis Holdings Ltd (In Official Liquidation) v Daiwa Capital Markets Europe Ltd [2019] UKSC 50, as follows:

1. The purpose of the Quincecare duty is to protect a bank’s customer from the misappropriation of funds, carried out by a trusted agent of the customer who is authorised to withdraw its money from the account.
2. The Quincecare duty is subordinate to the bank’s contractual duty to act upon a valid instruction (whether the payment of cheques, acting on oral/written instructions to transfer monies, or automated bank payment methods). The Quincecare duty is both ancillary and subject to that primary duty.
3. The operative standard of the ordinary prudent banker enables a claimant customer to hold a defendant bank to objective (or industry) standards of honesty; it is not a test based on subjective dishonesty or “lack of probity” on the bank’s part (see Singularis).

The court found that it was clear from all three previous authorities that the particulars of claim amounted to an invitation to the court to extend the scope of the Quincecare duty beyond its established boundaries. Central to this conclusion was the court’s acceptance that the existing authorities limited the Quincecare duty to cases of attempted misappropriation by an agent of the customer. It emphasised that the present case concerned an authorised push payment fraud, i.e. the claimant herself gave authorisation for the international payments to be made and so there was no agent involved.

Suggested extension of the Quincecare duty

The case therefore raised a novel point of law, as to whether the Quincecare duty should be extended in the context of APP fraud.

The court adopted the approach in Gorham v British Telecommunications plc [2000] 1 W.L.R 2129, considering whether the alleged duty could be established through a process of appropriate incremental development of the common law by reference to circumstances not addressed in earlier cases considering the duty. The court confirmed that it would approach the question of incremental development of the Quincecare duty as follows:

• While expert evidence might be required to assist the court in deciding whether the Bank fell short in the performance of its duties to the claimant, the court would not be assisted by expert evidence on the question of what those duties were – expert evidence was therefore irrelevant to the Bank’s application.
• Various materials were published in relation to APP fraud prior to March 2018, but these materials did not support the conclusion that the Bank owed the claimant the duties alleged.
• The decision as to the true scope and nature of the Quincecare duty turned, therefore, upon an analysis of the principles underpinning it.

Accordingly, the court proceeded to consider the principles underpinning the Quincecare duty, as articulated at numbered paragraphs 1-3 in the scope of duty section above.

(i) Purpose of the duty: corporate customers vs individuals

In the court’s view, the observations of Lady Hale in Singularis (in particular on corporate attribution and causation) about the purpose of the duty, did not sit comfortably with the extension of the Quincecare duty to an individual customer. The Supreme Court said nothing about a bank protecting an individual customer (and her monies) from her own intentional decision. Considering the factual context of Singularis, the court observed that “even a sole shareholder can steal from the company for whom he is a signatory at the bank” but the claimant in this case “could not steal from herself”.

It commented that, where the bank's customer is an individual (and not a corporation or unincorporated association which is dependent upon individual representatives and signatories who have the potential to go rogue), the customer's authority to make the payment is not only apparent but must also be taken by the bank to be real and genuine. As between the individual and the bank, the payment instruction will be no less real and genuine in relation to the intended destination of the customer's funds because it has been induced by deceit.

The court highlighted another contrast between the position of an individual vs corporate customer, considering the effect on how legal title passes. In the present case, the claimant gave valid instructions to the Bank to make the transfers (albeit those instructions were procured by fraud), and therefore they remained valid in legally passing title to the monies to the fraudster. In contrast, where an agent of the bank's customer misappropriates the customer's monies, then a constructive trust will be deemed to have arisen at the moment of receipt (provided legal title to the funds can be asserted).

(ii) Duty subordinate/ancillary to primary duty to act on customer’s instruction

Concerning the interaction between a bank’s mandate to comply with customer instructions and its Quincecare duty, the court held that it should resist the claimant’s attempt to elevate the Quincecare duty to a position where it ceased to be ancillary or subordinate to a bank’s primary duty of acting upon its customer’s instructions. To do so, would “emasculate the primary duty”, by a supposedly subordinate duty assuming a heightened set of obligations. The court said that such an outcome should be avoided as it would “involve the triumph of unduly onerous and commercially unrealistic policing obligations over the bank's basic obligation to act upon its customer's instructions”.

The court further noted that banks “cannot be expected to carry out such urgent detective work, or treated as a gatekeeper or guardian in relation to the commercial wisdom of the customer's decision and the payment instructions which result”.

(iii) No clear framework for extended duty to operate within

Additionally, the court considered that no clear framework existed by which such an extended duty could in practice sensibly operate. It noted that the Quincecare duty concerns the general concept that a bank will adhere to the “standards of honest and reasonable conduct in being alive to suspected fraud”, which Steyn J himself noted was not “too high a standard”.

The court held that the Quincecare duty is inherently a creature shaped by the conception of knowledge (actual or constructive) and not a negligent failure to adhere to an amorphous “code” of which the terms are not clearly defined. If the duty was to be extended beyond that general concept, it would have to be by reference to: “industry-recognised rules from which a bank could identify the particular circumstances in which it should not act (or act immediately) upon its customer's genuine instructions”.

Loss of a chance

Given the court’s finding that the legal duty asserted did not arise, it was not necessary to consider the claimant’s anterior arguments, including her claim for loss of a chance in recovering the monies from the UAE; one which the court accepted could not have been determined summarily.

Note: In March 2021, the High Court allowed the claimant's application for permission to appeal to the Court of Appeal. The Court of Appeal hearing has been floated for 8 or 9 February 2022.