In Philipp (Respondent) v. Barclays Bank UK PLC (Appellant)¹, the UK Supreme Court recently handed down a decision concerning when a bank’s Quincecare duty would arise in the case of an “authorised push payment” (APP) fraud.

A Quincecare duty is a duty owed by a bank to its customer to refrain from executing a payment order when the bank is put on inquiry in the sense that it has reasonable grounds for believing that the order is an attempt to misappropriate funds of the customer. The duty co-exists in contract (as an implied term) and tort (as a duty of care).

The UK Supreme Court confirmed that such duty requires the existence of an agent acting on the customer’s behalf, and the bank having reasonable grounds for believing that the agent is defrauding the customer, unless the bank expressly agrees to extend that duty.

Background

In 2018, the Respondent fell victim to an APP fraud and was deceived into instructing the Appellant to transfer £700,000 to the fraudsters’ bank accounts in the United Arab Emirates.

An APP fraud happens when the victim is induced by fraudulent means to instruct their bank to transfer money from their account to a bank account controlled by a fraudster. This is to be distinguished from an unauthorised payment made without the customer’s consent.

The question considered by the UK Supreme Court was whether or not the bank owed a duty to the Respondent not to execute her payment order if the bank was put on inquiry, by having reasonable grounds for believing that she was being defrauded.

Ruling of the court

The court provided significant clarity by reaffirming the conditions for a Quincecare duty to arise between a bank and its customer, being where the bank has reasonable grounds to believe that an agent (e.g. an authorised signatory of the customer’s account) was defrauding the customer into making a payment. The bank’s Quincecare duty did not arise here, lacking the existence of an agent, and it was the case that Barclays Bank had obtained express authorisation from the customer to undertake the transfer payment (albeit induced by fraud).

Provided the customer’s instruction is clear, and the instruction given has the customer’s authority, no inquiry from the bank is needed to verify what the bank is authorised and required to do. Unless otherwise expressly agreed, the bank’s duty is to execute the customer’s instruction promptly without concerning itself with the risks and wisdom of such instruction, and failure to do so will be a breach of duty. The court also confirmed that the Quincecare duty applies whenever one person is given authority to sign cheques or give other payment instructions to a bank on behalf of another, including where an account holder of a joint account or a named signatory of corporate customers give payment instructions to the bank.

The court also held that a bank can by express agreement contract to undertake responsibility to refuse carrying out a payment instruction if the bank believes (or has reasonable grounds to believe) that the customer is being defrauded into authorising the payment. In this case, Barclays Bank had not agreed to any express terms to this effect and therefore the Quincecare duty did not arise.

In effect, the Supreme Court reversed the UK Court of Appeal’s judgment in Philipp v. Barclays Bank UK PLC [2022] EWCA Civ 318, which had accepted that the existence of an agent giving payment instruction was not necessary for a Quincecare duty to arise. This alleviates risk concerns stemming from the potential broadening of the Quincecare duty and settles the question of whether its scope will continue to expand in respect of financial institutions handling customers’ payments.

It is worth noting that the Respondent’s alternative claim (i.e. the bank’s duty arising from an alleged failure to act promptly to recall the payments made after the fraud was discovered) remains unsettled and is left to be decided at trial. If found in the Respondent’s favour, the bank’s duty may extend to that of recalling sums transferred by the victim upon the bank’s knowledge of fraud.

Relevance to Hong Kong

The Hong Kong Court of Final Appeal made an earlier ruling which indicated the Hong Kong court’s approach to similar matters. In PT Asuransi Tugu Pratama Indonesia TBK v. Citibank NA,² the court’s findings regarding the Quincecare duty were in line with the approach ultimately taken by the Supreme Court in Philipp v. Barclays Bank UK PLC.

In PT v. Citibank, the appellant succeeded in its appeal against a bank in respect of funds in excess of US$51 million which were paid out from an account held with the respondent bank, on the instructions of the appellant’s agents who had acted dishonestly.

Crucially, Lord Sumption sitting as a Non-Permanent Judge of the CFA upheld the agency requirement, confirming that the Quincecare duty applies to a situation where instructions made to a bank were given by the customer’s agent. Additionally, the Quincecare duty was clarified as involving the same standard of care as that owed by an agent to a principal, in respect of whether the bank could reasonably rely on the apparent authority of the customer’s agent; or otherwise had reasonable grounds to believe that the agent was acting to misappropriate the customer’s funds.

This reflects a continuation of the line of authorities in Hong Kong, which has effectively restricted the expansion of the scope of a bank’s Quincecare duty. For example, in Luk Wing Yan v. CMB Wing Lung Bank Ltd [2021] HKCFI 279, the plaintiff was defrauded by an employee of the defendant bank to transfer HK$35 million to the latter’s account. The employee was subsequently convicted and imprisoned for fraud, but the court in that case refused to recognise that the bank’s Quincecare duty arose in such circumstances where the victim had instructed and authorised the transfer payment, even if that payment was induced by fraud from a third party. To do so, in the court’s view, would be a “significant extension” of the scope of the Quincecare duty.

Key takeaways

The Supreme Court case clarifies that the duty of a bank to exercise reasonable skill and care when executing a payment order (and make reasonable inquiries) only arises where the validity or content of the customer’s instruction is unclear or leaves the bank with a choice as to how to carry out the instruction. This reflects the court’s rigorous application of the conditions required for a Quincecare duty to arise (where the bank must make inquiries to verify that the payment has been authorised by the customer):

• a payment instruction undertaken by an agent of the customer in circumstances which give rise to reasonable grounds to believe that the agent is defrauding the customer; or
• where the bank has expressly agreed to undertake the responsibility not to comply with a payment instruction given by the customer if the bank believes (or has reasonable grounds to believe) that the customer has been tricked by a third party into authorising the payment.

Otherwise, the bank is not required to act as an amateur detective and must promptly carry out a customer’s unequivocal instruction to make payments from the customer’s account so long as it is in credit.

This decision limits the exposure of financial institutions to liability arising from payments made by a customer as a result of APP fraud if clearly and expressly authorised by the customer. The Supreme Court’s decision is in line with earlier rulings in Hong Kong and will likely be followed by subsequent Hong Kong courts when faced with similar factual scenarios in APP fraud cases.

Additional note: In times when there is an increase and prevalence of cyber fraud, the authors will continue to monitor closely and report in due course on the outcome of the important discussion remitted in this case to the English High Court for determination at trial as to whether the courts are indeed willing to extend a Bank’s duty by holding it responsible in circumstances where a bank fails to act promptly to recall payments after fraud has been discovered.

For our commentary on the Quincecare duty in the insolvency context, see here.

Acknowledgements to intern Maxx Wo for his contribution to this article.

1. [2023] UKSC 25.↩
2. [2023] HKCFA 3.↩