Australian victims of APP fraud may have clarity on the scope of their bank’s liability

The UK Supreme Court has handed down its judgment finding that the Quincecare duty for banks does not extend to transactions authorised by the customer: Philipp v Barclays Bank UK PLC [2023] UKSC 25 (Philipp). This judgment is likely to be relevant in Australia and hold persuasive value in Australian courts.

This means that if a customer has been the victim of a fraudulent scheme and willingly transfers proceeds to another account, the customer cannot recover its loss from the bank that facilitated the transaction. This will no doubt be concerning to victims of fraud who may be left without a remedy if the fraudster cannot be located or there are no assets to recover.

Whilst this is disappointing for consumers, there is some good news for individual victims of APP (authorised push payment) fraud.

First, the Supreme Court clarified that despite the factual background of the previous cases, the Quincecare duty is not just limited to cases involving corporate customers.

Secondly, the customer may be able to sue its bank for breach of duty if the bank was slow in recalling the funds after being made aware of the fraud.

Thirdly, when a bank has knowledge of circumstances not known to its customer and “a reasonable banker properly applying his mind to the situation knew that…[the customer] would not desire their orders be carried out if they were aware of the circumstances known to the bank”, the bank may breach its duty of care if it complied with the instruction (Ryan v Bank of New South Wales [1978] VR 555). This may provide another avenue for the customer to recover.  

What is the Quincecare duty?

The Quincecare duty of care was established by the High Court of England and Wales in Barclays Bank Plc v Quincecare Ltd [1992] 4 All ER 363 (Quincecare), and has been cited in several cases in Australia. For a look at the treatment of the Quincecare duty in Australia, the UK and Hong Kong please see our previous article.

In summary, the Quincecare duty requires a bank to exercise reasonable care and skill in carrying out a transfer request authorised by a customer’s agent. In exercising reasonable care and skill, a bank should refrain from executing a transaction if, and for as long as, the bank has reasonable grounds (which can be less than actual proof) for believing that the agent is attempting to defraud the customer.

Background to Philipp

This case concerned APP fraud. APP fraud occurs when the fraudster, usually under a fake identity, convinces the victim to transfer money to the fraudster, as opposed to (for example) a director or another agent defrauding its company (the principal) by making a transfer to its personal account.

The claimant, Mrs Philipp, had banked with Barclays for many years and was described as financially “modest”.

The fraudster, who pretended that he was from the National Crime Agency, convinced her husband, Dr Philipp, to transfer the balance of his investment portfolio to Mrs Philipp. The fraudster then further instructed Mrs Philipp to transfer £700,000 out of her bank account to two bank accounts in the UAE. She made two separate transactions – one amounting to £400,000 and another amounting to £300,000.

Mrs Philipp then visited the bank once more and sought to make a third transfer. Her instruction was to pay £250,000 (being the remaining balance of funds received from her husband’s investment account) to the account in the UAE. However, she was not able to because, 4 days prior, the police had contacted the bank informing it that Mrs Philipp was the victim of a large-scale fraud and the bank had immediately frozen the account.

Around two months later, Barclays attempted to recall the funds which had been transferred to the UAE account, but these attempts were unfruitful.

After Mrs and Dr Philipp realised they were the victims of an APP fraud, they commenced legal action against Barclays, alleging it had breached its Quincecare duty of care to her. She claimed that Barclays had reasonable grounds for suspecting fraud and the bank failed to make inquiries or prevent the transactions.

Litigation history

In the first instance, the High Court delivered a summary judgment that found the Quincecare duty did not extend to requiring a bank to refuse to carry out a customer’s instructions where the instructions were not given fraudulently (ie the person who was giving the instructions was doing so honestly). In this case, and in cases of APP fraud generally, the customer is giving honest instructions to the bank.

The Court of Appeal reversed the High Court’s judgment and found that, in theory, the duty could apply where the bank was put on notice of the attempted misappropriation. However, the Court of Appeal did not determine whether such a duty existed (and was breached) on the particular facts of this case. The case was sent back to the High Court for to be reheard.

Barclays appealed to the Supreme Court, staying the proceedings in the High Court.

The Supreme Court case

Mrs Philipp’s arguments

Mrs Philipp argued that the reasoning in the line of Quincecare cases is not dependent on the instruction being given by an agent and can be equally applied to an instruction given by a customer who is a victim of APP fraud where the bank has notice of the fraud. Alternatively, she (the claimant) submitted that the Quincecare duty is simply one aspect of the bank’s duty, implied in the contract between bank and customer, to exercise reasonable skill and care in and about executing the customer’s orders.

The claimant stated that the bank had been put on notice of the suspicious and fraudulent aspects of the transaction, and a reasonable bank in Barclays’ position would not have made the transfer without making further inquiries. In arguing that the bank was put on notice, the claimant pointed to the following factors:

1. The amount of money being transferred was far greater than what Mrs Philipp had historically transferred.
2. The nominated payee was a petroleum company in the UAE and a first-time payee. It would be difficult to come up with a commercial reason for why Mrs Philipp would be making a large transfer to such an account.
3. Mrs Philipp was also attempting to move money which had been recently transferred to her (the sum being the balance of her husband’s investment portfolio).

Bank’s arguments

Barclays argued that the instructions were provided by the customer herself and not an agent of the customer. Previously, where the courts have found a breach of the Quincecare duty, the transfer instruction had always come from an agent of the customer in a corporate setting – for example, the director of a company.

The bank also emphasised the inconsistency between the need for prompt transfers that customers would generally expect from their financial institution and the need to make further inquiries if put on notice, which would delay customers’ transfer requests.

Supreme Court decision

The judgment delivered by Lord Leggatt (with whom Lord Reed, Lord Hodge, Lord Sales and Lord Hamblen agreed) held that the Quincecare duty does not extend to situations where the instruction was validly given by the customer.

Misappropriation

Lord Leggatt found that the claimant’s characterisation of the transaction as a “misappropriation” of funds is a “distortion of [the] language” used in the original Quincecare case. (at [59]).

A customer who is tricked into transferring its funds to a third party is disposing of the money according to its own wishes. It is not a misappropriation (at [60]).

Conflicting duties of care

The flaw in Quincecare was that Steyn J regarded the bank’s duty of care as “potentially conflicting with its duty to execute its customer’s payment instruction.” This is incorrect, because the duty to exercise reasonable care and skill in its response to the customer’s instruction only arises where:

1. the validity or the content of the instruction is unclear; or
2. the instruction leaves the bank with different choices about how the instruction should be carried out (at [63]).

The Quincecare duty is generally “subordinate” to the bank’s other duties.

The duty to exercise care and skill does not provide a basis for not executing a customer’s transfer instruction. As Lord Leggatt highlighted at [64]: “It is impossible to derive from a duty to observe reasonable skill and care in and about executing a customer’s order a duty not to execute the customer’s order.”

The Supreme Court went further stating that, in the absence of an expressly or impliedly agreed exception to the primary duty of executing the customer’s payment instruction promptly, a payment order must be executed. To refuse to execute a payment would expose the bank to a claim by the customer for breach of its mandate to effectively execute the customer’s instructions.

Lord Leggatt also criticised Steyn J’s decision to rely on “policy considerations” after finding a “perceived conflict which does not in reality exist”. Lord Leggatt emphasised that whether and what proportion of the loss incurred by APP fraud should fall upon the customer and how much should be incurred by the bank involved is a matter for Parliament to decide.

As he stated at [67], “A duty to combat fraud or to protect customers (let alone innocent third parties) against fraud is not an ordinary incident of the contractual relationship between a bank and its customer.”

Dishonest agents

Steyn J in Quincecare had assumed that the bank received a valid and proper order by the director who was acting dishonestly and attempting to defraud the customer.

The Supreme Court found that an agent’s actual authority cannot include an authority to act fraudulently against the principal (at [71]). Contrary to Lord Steyn’s statement, the legal principle accepted in both the United Kingdom and Australia is that every authority conferred upon an agent, whether it has been expressly or impliedly granted “must be taken to be subject to a condition that the authority is to be exercised honestly and on behalf of the principal.” In the absence of that condition, there is no authority and any action taken by the purported agent is void (unless in special circumstances dealing with innocent parties who rely upon the agent’s apparent authority): Lysaght Bros & Co Ltd v Falk (1905) 2 CLR 421, 439.

When an agent is placed into its place of authority by the principal and carries out an act that falls within a class of acts it was given authority to do, the agent has apparent authority. For example, when a director is given the authority to withdraw funds from the company bank account, but does so in a fraudulent way and improperly profits from the fraud against the company, the director has apparent authority rather than actual authority (at [82]).

Where an agent of a customer has apparent authority, the customer (who is the principal) is bound to any transactions that the agent enters into with the bank (a third party) as if the agent had the authority to do the act in question.

The limit of apparent authority is where the third party who engaged with the agent has notice that the agent is acting without actual authority. The correct statement of law is that when the third party bank has notice, it cannot rely upon the apparent authority of the customer’s agent if it failed to make inquiries that a reasonable person in the bank’s position would have made to verify the agent’s authority. 

Quincecare subsumed under general duties of banks

Put simply, the so-called Quincecare duty is an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions. This includes a duty to refrain from executing an instruction without ensuring that it has been authorised by the customer when the bank is “put on inquiry” that the payment instruction was given by an agent acting fraudulently. 

The Quincecare duty would not be useful to victims of APP fraud such as Mrs Philipp as the validity of her instruction was not in debate. Fraud does not “negate” intention and Mrs Philipp had a clear intention to make the transfer. The existence of fraud can only vitiate her agreement with the fraudster and allow her to recover from the fraudster, being the perpetrator of the fraud.

To execute an instruction without making reasonable inquiries may also mean that the bank has breached its mandate to the customer and was not entitled to debit funds from the customer’s account. In practice, this means that the customer would not need to prove that further inquiries by the bank would have revealed the agent’s deception and/or avoided the loss for the customer to be able to claim damages equal to the transfer amount.

The “Ryan” duty

The Supreme Court explicitly endorsed the duty accepted in Australia in Ryan v Bank of New South Wales [1978] VR 555 (at [107]), that a bank may breach its duty if a reasonable banker properly applying its mind to the situation knew that its customer would want the order be carried out if they were aware of the circumstances known to the bank. This was found to not assist the claimant in this case because the large and unprecedented amount of money received by Mrs Phillip and then transferred by her, the fact that the payee was a UAE company and was a first-time payee were all known to Mrs Philipp.

Some good news in the claimant’s fall-back argument – recalling payments

The Supreme Court reversed the High Court’s summary judgment in relation to Mrs Philipp’s alternative case. Whether Barclays owed a duty to take immediate steps to recall the payment after being made aware of the fraud and whether it breached that duty by waiting some 2 months are fact-dependent and will be decided by a lower court. If the bank did breach that duty, there may be a pathway for Mrs Phillip to recover some of her loss.

Practical takeaways

• The Quincecare duty is not some idiosyncratic or special rule of law. It finds its roots in the contract between customer and bank and the general duty to interpret, ascertain and act in accordance with its customer’s instructions. This includes the duty to ensure that any instructions from a purported agent are made with the actual authority of the customer where the bank is “put on inquiry” of features that suggest the agent is attempting to defraud the customer.
• In litigating a claim against a bank where there is an allegation it was put on notice, careful thought must be given to discovery to identify what the bank actually knew.
• Victims of APP fraud may be better off relying upon the “Ryan duty” which finds its origins in Australian case law – and is currently under-utilised. They would need to prove that there were factors known to the bank and outside of their own knowledge that would lead a reasonable person in the bank’s position to refrain from executing the transaction. While untested, this could include features of the payee account, such as if it were flagged by an internal system of a bank as being “suspicious”.
• The understanding that the Quincecare duty is secondary to the primary duty that a bank has to execute its customer’s instructions promptly, and the express warning that a bank can be liable to its customer if it refrains from executing a transaction, may mean that banks become more eager to carry out customers instructions promptly. This could result in an increase of APP fraud being successfully perpetrated.
• The Supreme Court has left open the door for victims of APP fraud to allege that their bank breached its duty of care by not promptly recalling funds that were transferred to the fraudster once it was aware of the fraud. This may prove to be a fruitful avenue for recovery, and banks should be wary and act fast when they are made aware of any fraud perpetrated on their customers.
• The redefining of the Quincecare duty and how it relates to bank mandates means that customers who have been defrauded by their agent would not need to put on evidence that reasonable inquiries by their bank would have led to a different outcome. All they would need to show is that the bank was on notice of the agent not possessing actual or apparent authority.

The UK has now introduced new powers for the Payment Systems Regulator and mandatory reimbursement for victims of fraud through the Financial Services & Markets Act, although this only applies to those using the faster payments system and is unlikely to come into effect until 2024. The Bank of England is also planning to introduce a similar reimbursement requirement in respect of CHAPS payments (which is a sterling same-day system that is used to settle high-value wholesale payments). Unfortunately, neither will cover international payments, which unfortunately may leave many, like Mrs Philipp, without redress. The Australian Financial Services Minister, Stephen Jones, has indicated that Australia may bring in similar laws.