The Supreme Court's judgment in Philipp v Barclays: key takeaways for financial institutions executing customer payments

The Supreme Court has handed down its seminal judgment in Philipp v Barclays Bank UK plc [2023] UKSC 25, considering the application of the so-called Quincecare duty to the victim of an “authorised push payment” (APP) fraud. In an APP fraud, the victim is induced by fraudulent means to deliberately authorise their bank to send a payment to a bank account controlled by the fraudster.

The claimant in the present case alleged that the bank owed her a duty under contract or at common law not to carry out her payment instructions, if the bank had reasonable grounds for believing that she was being defrauded. The Supreme Court unanimously allowed the appeal and granted summary judgment in favour of the bank, holding that it was not arguable that the bank owed the duty alleged to the claimant (although it granted permission for the claimant to maintain an alternative claim, based on the bank's alleged failure to take adequate steps after it was alerted to the fraud).

The implications of the Supreme Court's decision will extend much further than the APP fraud scenario. It provides much-needed clarity in respect of the so-called Quincecare duty, which will be relevant to all firms executing customer payments, and which has caused a significant degree of controversy and confusion in recent years. The key takeaways from the judgment are as follows:

• Duty of reasonable skill and care. A bank owes a general duty to act with reasonable skill and care when processing customer payments, but this is limited and applies only to "interpreting, ascertaining, and acting in accordance with the instructions” of the customer.
• Scope of the so-called Quincecare duty. The so-called Quincecare duty is simply an application of the general duty above and arises specifically where an agent of the customer purports to give a payment instruction. Where a bank has reasonable grounds for believing that a payment instruction given by an agent of the customer is an attempt to defraud the customer, the so-called Quincecare duty requires the bank to make inquiries to verify that the instruction has actually been authorised and to refrain from executing the payment in the meantime.
• No conflict with mandate. The so-called Quincecare duty does not conflict with the bank's strict duty to comply with its mandate, ie to carry out payment instructions promptly. This is because the duty of reasonable skill and care (and therefore the so-called Quincecare duty) will only arise where there are questions about the validity of the payment mandate. As such, the duty cannot arise in an APP fraud context, because by definition the mandate is validly made by the victim of the fraud.
• Not limited to corporate customers. The so-called Quincecare duty is not limited to corporate customers and will apply wherever one person is given authority to give payment instructions to a bank on behalf of another (eg in the context of a joint account), but only where the payment request is not valid.
• Breach of duty gives rise to a debt claim. If a bank has debited an account in breach of duty and therefore without authority, then the customer is entitled to disregard the debit and require the account to be reconstituted. This could have practical consequences for any future litigation.

We consider the decision in more detail below.

Background

The background to this decision is more fully set out in our blog post on the Court of Appeal's decision.

In summary, the claimant was the victim of an APP fraud. As part of an elaborate deception by a third-party fraudster, the claimant transferred £700,000 in two separate tranches from her account with the defendant bank (the Bank) to international bank accounts, in the belief that the money would be safe and that she was assisting an investigation by the Financial Conduct Authority and the National Crime Agency.

The claimant brought a claim against the Bank to recover the loss she suffered by making the two payments, alleging that the Bank owed and breached a Quincecare duty of care to protect her from the consequences of the payments.

The Bank denied the claim and brought an application for strike out / reverse summary judgment, arguing that it did not owe a legal duty of the kind alleged by the claimant and that (even if such a duty was owed and breached) the claimant’s case on causation was fanciful.

High Court decision

In summary, the High Court struck out the claim, finding that the Bank did not owe the Quincecare duty in respect of the APP fraud perpetrated upon the claimant. The High Court’s reasoning is discussed in our previous blog post.

In the view of the High Court, the existing authorities limited the Quincecare duty to protecting corporate customers or unincorporated associations such as partnerships (ie where the instruction to the bank has been given by a trusted agent of the customer). The High Court confirmed that the Quincecare duty did not extend to individual customers, and it was not persuaded to extend the Quincecare duty to protect an individual customer in the context of an APP fraud, as to do so would be contrary to the principles underpinning the duty.

The High Court granted the claimant permission to appeal to the Court of Appeal.

Court of Appeal decision

The Court of Appeal allowed the claimant's appeal, finding that summary judgment in favour of the Bank was wrongly entered and should be set aside. The Court of Appeal's reasoning is discussed in our previous blog post.

In summary, the Court of Appeal found, as a point of law, that the Quincecare duty is not limited to the situation where instructions have been given by an agent/authorised signatory on behalf of the customer of the bank. The Court of Appeal accepted that the factual circumstances of the major cases in which the Quincecare duty has been considered to date, all involved instructions from a fraudulent agent acting for a company or firm. However, in the Court of Appeal’s view, statements about the purpose of the duty should be seen in the context of the cases in which they were made, and what mattered was the reasoning behind the duty given in those cases.

Crucially, the Court of Appeal found that the line of reasoning in the authorities: (a) did not depend on whether the instruction was being given by an agent of the customer; (b) was not limited to the factual circumstances of those cases; and (c) could properly be applied on a wider basis. Accordingly, as a matter of law, the Court of Appeal held that the Quincecare duty did not depend on the fact that the bank was instructed by an agent of the customer. It said this was the only legal conclusion necessary to resolve the appeal.

Given its findings on the scope of the Quincecare duty, the Court of Appeal held that it was at least possible (in principle) that a relevant duty of care could arise in the case of a customer instructing their bank to make a payment when that customer is the victim of APP fraud. In the Court of Appeal's view, the right occasion on which to decide whether such a duty in fact arose in this case was at trial. It noted that whether this case would succeed at trial or not would depend on the evidence and findings of fact about ordinary banking practice, both in terms of what would put an ordinary prudent banker on inquiry, and, if they were, what such a banker would then have done about it.

The Supreme Court granted the Bank's application for permission to appeal.

Grounds of Appeal

The Bank's grounds of appeal were as follows:

1. Does the Quincecare duty have any application in a case where the relevant payment instruction was not issued to the bank by an agent of the bank’s customer?
2. If not, should either: (i) the Quincecare duty be extended so as to include the obligations contended for by the claimant in relation to APP fraud, or (ii) the law recognise or impose such obligations on a paying bank as incidents of its duty to exercise reasonable skill and care in and about executing an instruction?
3. Should the court determine issues 1 and/or 2 above on a summary judgment and/or strike-out application?

Supreme Court decision

The Supreme Court allowed the Bank’s appeal and restored the High Court's order granting summary judgment in favour of the Bank. However, the Supreme Court varied that order to permit the claimant to maintain an alternative claim, not addressed by the Court of Appeal, based on the Bank's alleged failure to act promptly to try to recall the payments after the fraud was discovered (although the Supreme Court noted that the likelihood of such recovery "seems slim").

We consider below the key elements of the judgment which are likely to be of broader relevance for banks and other payment service providers.

First principles of banking law

In the Supreme Court's judgment, the Court of Appeal was wrong to accept the claimant's argument that (in principle), a bank owes an implied contractual duty to its customer of the kind alleged. It held that this conclusion was inconsistent with first principles of banking law.

In particular, the Supreme Court highlighted that a bank's duty to comply with its mandate is strict (unless otherwise agreed). Where a customer has authorised and instructed its bank to make a payment, the bank must carry out the instruction promptly. It is not for the bank to concern itself with the wisdom or risks of its customer’s payment decisions (see Bodenham v Hoskins (1852) 21 LJ Ch 864).

The reasoning in Quincecare

In the view of the Supreme Court, the reasoning in Quincecare (and followed by the Court of Appeal) did not withstand scrutiny and was flawed. It identified two key stages to the reasoning in Steyn J's analysis of the bank's duty in Quincecare itself, which are considered in turn below.

1. Conflicting contractual duties

Steyn J depicted the bank as owing two conflicting contractual duties to its customer:

• the bank's duty to execute a valid order to transfer money promptly; and
• the bank's duty to exercise reasonable care in and about executing a customer's order to transfer money.

The Supreme Court held that there could not be a conflict between the contractual duty to execute a valid order on the one hand, and the duty to exercise reasonable skill and care in and about executing that order on the other.

The Supreme Court referred to Selangor United Rubber Estates Ltd v Cradock (No 3) [1968] 1 WLR 1555, decided prior to Quincecare. In Selangor, the High Court concluded that the bank's duty to use reasonable skill and care "applies to interpreting, ascertaining, and acting in accordance with the instructions of a customer".

On this basis, the duty to exercise reasonable skill and care arises only where the validity or content of the customer’s instruction is unclear or leaves the bank with a choice about how to carry out the instruction. If the payment order is valid, the duty to exercise reasonable skill and care will not apply and so there can be no conflict.

2. Balancing these competing considerations

The Supreme Court noted that Steyn J's attempt to reconcile these (apparently) conflicting duties, by striking a balance between the countervailing policy considerations behind them, was a second flaw in the analysis. Steyn J had no principled way in which to reconcile the conflicting contractual duties, because that conflict did not in reality exist.

Proper scope of the so-called Quincecare duty

In the view of the Supreme Court, the “Quincecare duty” is not some "special or idiosyncratic" rule of law. Rather, it is an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions.

The judgment provides some helpful guidance on the scope of the duty in this context:

• The general duty of skill and care “applies to interpreting, ascertaining, and acting in accordance with the instructions” of the customer. This means that the general duty only arises where the validity or content of the customer’s instruction is unclear or leaves the bank with a choice about how to carry out the instruction. Where the bank receives a valid payment order which is clear and leaves no room for interpretation or choice about what is required in order to carry out the order, the bank’s duty is simply to execute the order by making the requisite payment. The duty of care does not apply.
• The so-called Quincecare duty sits under the umbrella of the general duty of care and arises specifically where an agent of the customer purports to give a payment instruction. Where a bank has reasonable grounds for believing that a payment instruction given by an agent of the customer is an attempt to defraud the customer, the so-called Quincecare duty requires the bank to make inquiries to verify that the instruction has actually been authorised and to refrain from executing the payment in the meantime. This aligns with agency law principles, which provide that an agent's apparent authority will protect a third party only where that third party's reliance on the representation of apparent authority is reasonable.
• The so-called Quincecare duty is not limited to corporate customers and will apply wherever one person is given authority to sign cheques or give other payment instructions to a bank on behalf of another (eg a joint account where one account holder has power to bind the other).
• Similar reasoning will apply where a bank is on notice, in the sense of having reasonable grounds for believing, that the customer lacks mental capacity to operate a bank account or manage their financial affairs (as illustrated by the decision of the Singapore Court of Appeal in Hsu Ann Mei v Oversea-Chinese Banking Corp Ltd [2011] SGCA 3).
• Where a payment is made outside the scope of a bank's mandate, the bank is not entitled to debit the amount to the customer’s account and so the claim will be in debt. This may have practical consequences for future litigation.
• The duty of a bank to carry out its customer’s valid payment instructions is not without limit (for example, it is an implied condition of the mandate that the bank cannot be required to carry out an unlawful act and there is an implied condition that a bank will act honestly towards its customer). The Supreme Court considered the possibility of a further implied limitation, following the Australian case of Ryan v Bank of New South Wales [1978] VR 555, 579, but it was not necessary for the purpose of deciding the present appeal to express any concluded view on this point.

Applying the principles of these duties to the present case

The Supreme Court held that the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions has no application where a customer is a victim of APP fraud, because the validity of the instruction is not in doubt.

Provided the instruction is clear and is given by the customer personally or by an agent acting with apparent authority, no inquiries are needed to clarify or verify what the bank must do. The bank’s duty is to execute the instruction and any refusal or failure to do so will prima facie be a breach of duty by the bank.

Accordingly, on the facts of the present case, the Supreme Court allowed the Bank's appeal.

However, it refused summary judgment in relation to the claimant's alternative loss of a chance claim, based on the Bank's alleged breach of duty, after the fraud had been discovered, in not taking adequate steps to recover the money which had been transferred to the United Arab Emirates (although the Supreme Court noted that the likelihood of such recovery "seems slim").