Now that the dust has settled on the Supreme Court’s decision in Philipp v Barclays Bank UK PLC [2023] UKSC 25 (“Philipp v Barclays”), we set out below the key takeaways from this landmark decision, which can be summarised as follows:

  • The Supreme Court has unanimously narrowed the scope of the so-called “Quincecare duty”. In particular, it rejected the reasoning of the Court of Appeal that it could apply to a situation where an instruction is given by a customer who is an unwitting victim of authorised push payment (APP) fraud. Lord Leggatt, who gave the sole judgment, with which the other four Lords agreed, even went so far as to doubt whether the “Quincecare duty” existed as a separate doctrine under the law of England & Wales. This reduces the risk to financial institutions of litigation being brought by victims of APP fraud.
  • Properly understood, Lord Leggatt held that the “Quincecare duty” is simply an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions [para 97].
  • Banks have a strict and primary contractual duty to carry out their customers’ authorised payment instructions and prevent the misappropriation of funds. They are not under a duty to prevent APP fraud.
  • There are limits on a bank’s duty to carry out a customer’s authorised payment instructions. For example:
    • an implied condition that a bank cannot be required to carry out an unlawful act (e.g., because it would constitute money laundering); an
    • an implied condition that a bank will act honestly towards its customer
  • Contrary to what is suggested in the Quincecare line of authorities, a bank’s primary duty to execute a valid payment order does not conflict with its duty to exercise reasonable skill and care in relation to executing such orders.
  • The duty to exercise reasonable skill and care only arises where the validity or content of the customer’s instruction is unclear or leaves the bank with a choice about how to carry out the instruction. In such cases, the duty of reasonable skill and care applies to interpreting, ascertaining and acting in accordance with the instructions of the customer. Where the bank receives a valid payment order that is clear and leaves no room for interpretation or choice about what is required to carry it out, the bank’s duty is simply to execute the order by making the requisite payment. The duty of care does not apply.
  • Where a bank has reasonable grounds for believing that a payment instruction given by an agent purportedly on behalf of the customer is an attempt to defraud the customer, it is under a duty to refrain from executing the instruction without first making inquiries to verify that the instruction has actually been authorised by the customer. If the bank executes the instruction without making such inquiries and the instruction proves to have been given without the customer’s authority, the bank will be in breach of that duty [para 97].
  • Similar reasoning would also apply where a bank has reasonable grounds for believing, and so is on notice, that the customer lacks the mental capacity to operate a bank account or manage their financial affairs. The bank’s duty of care may require the bank not to execute its customer’s instructions in such circumstances until further inquiries can be made [para 99].
  • While APP fraud is a growing social problem, the question of who bears the loss (i.e., the victim of such fraud or the banks) is a matter of social policy for regulators, government and, ultimately, Parliament. It is not the role of the courts to formulate such policy.
  •  The Supreme Court did not completely shut down victims of APP fraud from making a claim against a bank. This is because it:
    •  allowed Mrs Philipp’s claim that the bank had been too slow when seeking to recover her funds to continue to trial. Banks and other payment companies should be alive to this and seek to recover funds promptly after being notified of a fraud; and
    • suggested that if a bank receives reliable information from a source, such as the police, suggesting that a customer’s payment instruction has (without the customer’s knowledge) been procured by fraud, it may be right for the bank to refrain from executing the instruction without first alerting the customer to this information and verifying whether the customer wishes to proceed with the transaction.

The facts in Philipp v Barclays

As the Supreme Court noted, the facts of this case were a particularly egregious and extraordinary example of APP fraud. In APP fraud, the victim is induced by fraudulent means to authorise its bank to send a payment to a bank account controlled by the fraudster.

In this case, a fraudster, claiming to be a senior employee of the Financial Conduct Authority, convinced Dr and Mrs Philipp to send £700,000 from Mrs Philipp’s Barclays account to accounts in the UAE in two tranches. During the course of the fraud, the Philipps were warned by the bank and by a police officer that Mrs Philipp’s account had likely been compromised. Unfortunately, this did not cause them to stop as the fraudster had persuaded them not to cooperate with the police. The fraud was so sophisticated that telephone calls made to Dr Philipp appeared, from the number displayed on his mobile phone, to be coming from the telephone number of the National Crime Agency and the mobile number of the police officer.

Mrs Philipp tried to make a third payment to the fraudster, but this did not take place as Barclays had frozen her account pending a review. Shortly thereafter, and following a third visit from the police officer, Dr and Mrs Phillipp finally came to realise that they had been the victims of a fraud. The bank was unable to recover any funds.

Mrs Philipp issued proceedings against Barclays claiming that the bank owed her a duty under its contract with her or under common law not to carry out her payment instructions if it had reasonable grounds for believing she was being defrauded.

The law on the “Quincecare duty” to date

In a series of recent cases (many of which have gone to the Supreme Court), the Courts of England & Wales have considered the scope of banks’ duty of care not to execute a payment instruction given by an agent where there are reasonable grounds for believing that the instruction is an attempt to misappropriate the customer’s funds. Such cases have often involved the misappropriation of company funds by agents of a company (e.g., directors) and found that banks have a duty to make enquiries or to refuse to make payments where there are reasonable grounds to suspect that the agent is seeking to misappropriate company funds.

Mrs Philipp sought to expand that duty to cover payments made in APP fraud where it is the customer who is giving the instructions and not an agent. Barclays successfully applied for summary judgment at first instance on the basis that as a matter of law, it did not owe Mrs Philipp the alleged duty. This was overturned by the Court of Appeal, which held that there was an arguable case that Barclays owed such a duty to Mrs Philipp. Barclays appealed to the Supreme Court.

The judgment in Philipp v Barclays (the “Judgment”)

The past few years have seen a renaissance of the “Quincecare duty”. Numerous high-profile cases have reached the appellate courts, and a lively debate has sprung up over whether the “Quincecare duty” is sufficiently broad that it requires banks to refuse to carry out payment instructions that they believe are part of an APP fraud being perpetrated on their customer (as in this case).

Following the Supreme Court’s Judgment, that debate is essentially over, and the Court has robustly held that the duty does not extend to APP fraud. A striking feature of the Judgment is Lord Leggatt’s criticism of previous decisions. According to him, the reasoning in Quincecare itself is “flawed” [para 61]; its approach, and the approach of the Court of Appeal in Philipp v Barclays, “does not withstand scrutiny” [para 62]; the Court of Appeal’s judgment “is inconsistent with the first principles of banking law” [para 3]; and the attempt in Quincecare to justify the duty “went down a wrong track because it proceeded from a false premise. This obscured the true basis for the duty” [para 68].

The Judgment is an attempt to reposition the “Quincecare duty” in its proper place. The duty is not some special or idiosyncratic rule of law. Properly understood, it is simply an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions [para 97].

Where a bank has reasonable grounds for believing that a payment instruction given by an agent purportedly on behalf of the customer is an attempt to defraud the customer, it is under a duty to refrain from executing the instruction without first making inquiries to verify that the instruction has actually been authorised by the customer. If the bank executes the instruction without making such inquiries and the instruction proves to have been given without the customer’s authority, the bank will be in breach of that duty. These principles are not limited to corporate customers and apply, for example, to joint accounts [paras 97-99].

Similar reasoning would also apply where a bank has reasonable grounds for believing, and so is on notice, that the customer lacks the mental capacity to operate a bank account or manage their financial affairs. The bank’s duty of care may require the bank not to execute its customer’s instructions in such circumstances until further inquiries can be made [para 99].

The above principles have no application to a situation where the customer is a victim of APP fraud. In this situation, the validity of the instruction is not in doubt. Provided the instruction is clear and given by the customer personally, no inquiries are needed to clarify or verify what the bank must do. The bank’s duty is to execute the instruction, and any refusal or failure to do so will usually be a breach of duty by the bank [para 100].

In Quincecare and subsequent judgments, much of the focus was on the law of negligence; specifically, the extent to which a bank’s duty to act with reasonable skill and care prohibited it from making certain payments. This, the Judgment suggests, was a mistake. The relationship between a bank and its customer is first and foremost a contractual relationship. Any duty to act with reasonable skill and care arises out of that, and “only arises where the validity or content of the customer’s instruction is unclear or leaves the bank with a choice about how to carry out the instruction” [para 63].Examples of this include:

  • where a bank suspects that a payment authorised by an agent of the customer (i.e., a director of a company) is made outside their authority in order to misappropriate funds to themself (unclear validity);
  • where a customer has sent their bank instructions, but those instructions lack specific details regarding who to pay, or have been garbled in transit (unclear content); or
  • where a payment instruction is made but no payment system is specified, giving the bank freedom to choose the method of transfer (e.g., CHAPS, Faster Payments or BACS) (choice).

The duty extends only to “interpreting, ascertaining, and acting in accordance with the instructions” of the customer [para 63]. Where necessary and possible, this includes contacting the customer to verify and/or clarify their instructions. Seen in this light, the “Quincecare duty” is not a distinct legal doctrine at all: it is simply the application of basic laws of contract, negligence and agency to the bank-customer relationship.

Payments in APP fraud do not fit into any of these categories. This is because a bank’s duty to make a payment when faced with a valid payment instruction is a strict one. The only contractually valid course of action open to it is to make the payment.There can be no duty to act with reasonable skill and care where there is only one course of action available. If the bank makes the payment, it acts in accordance with the contract. If it does not, it breaches it.

A (valiant) argument raised in this case was that Mrs Philipp’s instructions to pay the funds were, in effect, the misappropriation of the couple’s funds and so the bank’s duty was engaged on that ground. The Court gave this argument short shrift, stating that “a customer who is tricked by a fraudster into instructing her bank to make a payment is not attempting to misappropriate funds” [para 59]. What Mrs Philipp was attempting to do was cause the bank to transfer her funds in accordance with her own wishes. The consequence of executing her instructions was that the funds were misappropriated by the fraudster. However, that is different from the previous Quincecare line of authorities where theperson purportedly giving instructions on the customer’s behalf is attempting to misappropriate funds from the customer.

Where now for APP claims against banks?

There are two undecided points in Philipp v Barclays that could provide grounds for future claims against banks by victims of APP fraud.

Firstly, it was argued that a bank should not make a payment where it has knowledge of something that the customer does not and that it believes would make the customer not want to make the payment [paras 106-110]. For example, if the bank is told by the police that a destination account is being used for fraud. This point was not decided in this case as Lord Legatt observed that everything known to the bank was also known to Mrs Philipp.

Secondly, Mrs Philipp argued in the alternative that the bank breached a duty to act with reasonable skill and care by not acting promptly to seek to recover the funds once told that there was a fraud [paras 115-119]. In this case, the bank froze Mrs Philipp’s account on 16 March 2018. Mrs Philipp accepted that there had been a fraud and advised the bank as much on 27 March 2018. However, it was not until two months later (around 31 May 2018) that the bank first sought to recover the funds from the UAE bank.

While the Court did not decide this point, it did hold that the loss of a chance to recover money from the UAE should not have been summarily dismissed, so this will be a matter to be determined at trial.

Mrs Philipp sought to argue that this duty came into being when the bank realised that there was a fraud (i.e., on 16 March). The Court found that this was incorrect and that any period must run from when she instructed the bank that there was a fraud (i.e., on 27 March) [para 117]: the bank has no power to unilaterally reverse payments that it was obliged to make.

Mrs Philipp did not explicitly request that the payments be reversed. However, it might be that the bank had a duty to clarify her instructions by asking her if she would like them to do so.

The Court noted, however, that such claims may fail on causation grounds: for example, fraudsters routinely disperse their gains quickly and even a timely request may be too late.

Finally, the Payment Systems Regulator has recently announced new regulations that will, in certain situations, regulate the repayment of sums lost to APP fraud by the banks involved. The proposed scheme is limited to (i) payment orders executed over the Faster Payments Scheme, and (ii) consumers, charities and ‘micro-enterprises’ (larger businesses are not included). The scheme also provides a 50-50 allocation of losses between the sending and receiving banks. It is not proposed that the regulatory obligations arising under the scheme will be directly enforceable by bank customers. However, regulatory relief, rather than complex common law duty of care claims, is likely to be the first step taken by the majority of victims of APP fraud.