According to the Australian Bureau of Statistics, 2.1 million Australians experienced personal fraud in 2020-21. In 2022, the ACCC said that “Australians lost… more than $2 billion to scams in 2021”.
The problem is, even if the fraudster can be found, the funds are often long-gone and the fraudster cannot satisfy a judgment.
All is not lost. The good news is, under the Quincecare duty, where the fraud involved a payment instruction (given by the victim or a third party) to the victim’s bank, the victim’s bank may be liable to compensate its customer. Suing a bank with deep pockets may be far more fruitful than suing the possibly impecunious fraudster.
This article looks at the Quincecare duty and its application in Australia, which victims of fraud will want to consider when exploring from whom they can recover their loss.
The Quincecare duty
What is the duty?
The Quincecare duty of care was established by the High Court of England and Wales in Barclays Bank Plc v Quincecare Ltd [1992] 4 All ER 363 (Quincecare).
The duty requires a bank to exercise reasonable care and skill in carrying out a customer’s transfer request. In exercising reasonable care and skill, a bank should refrain from executing a transaction if, and for as long as, the bank has reasonable grounds (which can be less than actual proof) for believing that the transaction is an attempt to misappropriate the funds of its customer.
In a recent Hong Kong Final Appeal case, Lord Sumption clarified what reasonable grounds means: PT Asuransi Tugu Pratama Indonesia TBK (formerly known as PT Tugu Pratama Indonesia) v Citibank N.A. [2023] HKCFA 3. The starting point is what is actually known or ought to be known to the bank if it had appreciated the meaning of the information in its hands. If on the face of the facts, the transaction is not improper, there is no requirement that the bank make inquiries. Conversely, if there are features of the transaction apparent to the bank that indicate wrongdoing or fraud, an inquiry must be undertaken.
A non-exhaustive list of factors which may give rise to a bank having reasonable grounds for believing a transaction is an attempt to misappropriate funds include: the standing of the customer, the bank’s knowledge of the signatory, the amount involved (eg an unusually large amount), the need for prompt transfer, the presence of unusual features, the scope and means for making reasonable inquiries and the location of the receiving bank.
The focus of the inquiry is about the bank’s belief, and concerns whether the bank had been placed on notice of fraud relating to the specific instruction.
Legal basis for the duty
The duty arises in the context of a banker-customer relationship, under an implied term of the contract or under the law of negligence. In the UK, the duty under contract and in negligence is coextensive.
In relation to an instruction to pay, the relationship between the bank and the customer is one of agent and principal.
Does the Quincecare duty apply in Australia?
There are several Australian cases which suggest the Quincecare duty (or a variant thereof) exists in Australian law. For example, in Sansom v Westpac Banking Corporation (1995) NSW ConvR 55-733, the New South Wales Court of Appeal cited Quincecare to answer the question of whether Westpac was in breach of its duty (in negligence) to its customer. The test applied in Sansom was whether the bank knew of facts which themselves would, to a reasonable banker, tell of fraud or irregularity.
There is another case referring to Quincecare (also based in negligence), which applied the Sansom test stated above, further supporting the existence of a Quincecare-type duty in Australia: National Australia Bank Ltd v Meeke [2007] WASC 11.
Unlike in the UK, there is authority which suggests that the bank’s duty in contract is not coextensive with a duty of care in negligence: National Australia Bank Ltd v Nemur Varity Pty Ltd [2002] VSCA 18]. Practically, this may not make any significant difference although there is a possibility that the quantum of damages may be impacted.
Does the duty apply where the customer itself provided the instruction?
In England, the scope of the Quincecare duty may extend to situations where the bank was given instructions by the customer itself, and not merely by an agent or purported agent of the customer (such as a CFO) who acts without authority: Philipp v Barclays Bank UK Plc [2022] EWCA Civ 318. That said, at the time of writing this article, the Philipp case is awaiting judgment from the Supreme Court (being the UK’s highest court).
APP fraud
The fact that the scope of the Quincecare duty extends to instructions provided to a bank by its customer is good news for victims of authorised push payment (APP) fraud.
APP fraud involves fraudsters tricking victims into willingly making payments to them, usually, through some form of impersonation. In Australia, this type of fraud is ever-increasing.
These scams are very difficult to remedy, as the funds are usually transferred by the customer willingly to an unknown overseas account where the fraudster takes it and vanishes. Where a victim cannot recover its loss from the fraudster, in the light of the decision in Philipp which extends the Quincecare duty to instructions provided by the customer itself, action against the victim’s bank may provide the best chance of recovery.
To whom is the duty owed?
Recent authority suggests that where there is a banker-customer relationship, only the customer can recover and not a third party. In other words, the duty is owed to the account holder only (both personal and business customers).
This relationship can also arise in more contemporary banking arrangements, such as one between network developers and the users of bitcoin software: Tulip Trading Ltd v Bitcoin Association for BSV [2023] EWCA Civ 83. It requires that the developers are a clearly identified class that makes decisions and exercises power on behalf of their customers, in relation to the customers’ property entrusted to the developers.
In the 2019 Australian case of Farah Custodians Pty Ltd v Commissioner of Taxation (No 2) [2019] FCA 1076, it was argued by analogy that the Australian Tax Office (ATO) owed a Quincecare-type duty to a taxpayer who had been defrauded by its tax agent. The court rejected the analogy, in particular noting that the relationship between a bank and its customer is usually contractual and would ordinarily include an implied term that the bank would observe reasonable skill and care in executing the customer’s instruction. A similar contractual relationship between the ATO and a taxpayer did not exist.
Breach of the duty
Where the bank has reasonable grounds for believing that funds are being misappropriated and fails to make inquiries about the legitimacy of the transfer but rather executes it, the bank may be liable to compensate the customer for its loss.
Often, the critical issue is whether the bank had reasonable grounds for believing funds were being misappropriated. The table below contains example cases from which guidance can be drawn.
Barclays Bank Plc v Quincecare Ltd [1992] 4 All ER 363: High Court of England & Wales
Outcome: Bank did not breach duty – Establish Quincecare duty
Arguments for bank being put on inquiry:
- The bank did not check to confirm that the solicitors were really acting on behalf of Quincecare
Arguments against bank being put on inquiry:
- The fraudster had been known at the relevant bank branch for about 16 months before the fraudulent transfer
- He had gained the trust of the bank’s employees
- He would have lied to the bank to avoid unnecessary questions
- The size of the transaction was not unusual for the alleged purpose
Facts:
- Mr Stiller approached Barclays Bank under the guise of Manygill Ltd for a loan which he said would be used to purchase 4 chemist shops
- Barclays was prepared to make the loan, as long as a new company was incorporated to buy the properties and be the borrower
- Mr Stiller incorporated Quincecare and became its chairman
- Barclays lent £400,000 to Quincecare. At the request of Mr Stiller, Quincecare transferred £344,000 to a firm of solicitors falsely represented to the bank as acting for Quincecare in relation to the chemist transactions
- In fact, the solicitors were not involved in the transactions
- At the request of Mr Stiller, the solicitors transferred the monies lent to Quincecare to Mr Stiller’s US bank account. Mr Stiller misappropriated the funds
- When the loan was not repaid, Barclays Bank sued Quincecare and its guarantor
- Quincecare argued that it was not liable to Barclays Bank because the bank itself breached its duty in allowing the funds to be transferred to the solicitors
Sansom v Westpac Banking Corporation (1996) 7 BPR 14,615: Court of Appeal of New South Wales
Outcome: Bank did not breach duty – Establish existence of a duty in Australia
Arguments for bank being put on inquiry:
- The bank accepted the husband’s signature without witnessing it
- The bank knew that the overdraft was increasing rapidly
- Westpac did know that the overdraft was increasing rapidly but it had no reason to suppose that Mr Sansom was not aware of this.
- Mr and Mrs Sansom had a joint account and so was under no duty to make any inquiries
Facts:
- Sansom and his wife opened a joint bank account with overdraft facilities, which they were jointly and severally liable for
- The wife later forged her husband’s signature to apply for three mortgages and incurred a large debt on the overdraft without her husband’s consent or knowledge
Singularis Holdings Ltd (in liquidation) v Daiwa Capital Markets Europe Ltd [2019] UKSC 50: Supreme Court of the United Kingdom
Outcome: Bank did breach duty
Arguments for bank being put on inquiry:
- At the time of the payments Singularis was almost insolvent
- The payments were made to companies that were owned by Mr Al Sanea
- The bank had raised concerns about Singularis’ financial position, as well as the freezing of Mr Al-Sanea’s personal assets
- The bank’s head of compliance sent an internal e-mail stating: we need to ensure we maintain appropriate oversight of both further deposits and requests for payments … We should therefore ensure that any funds received relate to normal business activities
- The company was contributorily negligent for allowing Mr Al Sanea the breadth of control he did
Facts:
- Singularis Holdings Ltd was a personal asset holding company for Mr Maan Al Sanea, who was a director and shareholder of Singularis
- Singularis held a bank account with Daiwa Capital Markets Europe Ltd
- Between 12 June and 27 July 2009, Mr Al Sanea gave eight separate instructions to Daiwa to make payments totaling approximately US$204 million out of Singularis’ account
- The payments were all made to other companies which were owned and controlled by Mr Al Sanea
Philipp v Barclays Bank UK Plc [2022] EWCA Civ 318: Court of Appeal of England & Wales
Outcome: Duty can exist even when instruction originated from the customer
Arguments for bank being put on inquiry:
- In 2018, at the time of the transactions, a voluntary code of practice (the 2017 BSI Code of Practice) set out guidance for banks relating to fraud and financial abuse, including APP fraud
- The quantity being transferred was far greater than what Mrs Philipp had historically transferred
- The payee was a petroleum company in the UAE
- Mrs Philipp was attending a branch which was not her own and she was attempting to move money which had only been recently transferred into her account
- The instructions were provided by the customer herself and not an agent of the customer
- The need for prompt transfer
Facts:
- This case concerned APP fraud
- The claimant, Mrs Philipp, had banked with Barclays for many years and was described as financially ‘modest’
- The fraudster, who pretended that he was from the National Crime Agency, convinced her husband, Mr Philipp, to transfer the balance of his investment portfolio to Mrs Philipp. The fraudster then further instructed Mrs Philipp to transfer £700,000 out of her bank account to two bank accounts in the UAE
- Mrs Philipp sued Barclays Bank alleging it had breached its Quincecare duty of care to her. She claimed there were reasonable grounds for suspecting fraud and the bank failed to make inquiries or prevent the transaction
Federal Republic of Nigeria v JPMorgan Chase Bank, N.A: [2022] EWHC 1447: High Court of England & Wales
Outcome: Bank did not breach duty; bank was not put on inquiry for 2011 payment; bank was put on inquiry for 2013 payment but was not grossly negligent
Arguments for bank being put on inquiry:
- Malabu (the payee) was closely associated with the former oil minister who was convicted in France of money laundering in an unrelated transaction
- Malabu and members of the Nigerian Government transferred certain sums for their own benefit
- Articles published around 2013 regarding corruption occurring in Nigeria, although vague
- Investigations of Nigerian officials between 2012 and 2013
- The relevant transaction in 2011 appeared bona fide, despite the “unattractive” characteristics of the payee
- There was a purported commercial reason for the large size of the transaction, with no conflicting evidence
Facts:
- Malabu had settled a claim and requested to be paid the settlement sum through Nigeria. Nigeria opened a bank account with JP Morgan Bank to facilitate the transaction
- Following a change of government, Nigeria alleged that it had been defrauded by Malabu and past Nigerian officials. It sued JP Morgan Bank, arguing that the bank had been put on inquiry of the relevant fraud and breached their Quincecare duty by not making further inquiries
- A term in the contract made it that JP Morgan Bank had to be grossly negligent for it to breach its duty
PT Asuransi Tugu Pratama Indonesia TBK (formerly known as PT Tugu Pratama Indonesia) v Citibank N.A. [2023] HKCFA 3: Court of Final Appeal of Hong Kong
Outcome: Bank put on notice in relation to the unauthorised payments (excepting the first two)
- Payments of such large sums from a corporate account to its officers personally are unlikely to have been for the benefit of the company
- There were 26 payments, suggestive of a pattern of improper management
- If the amounts paid to the officers are disregarded, the closure of the account was not detrimental to the company
- Commercial rationale for the closure of the account
Facts:
- Three officers of Tugu Pratama Indonesia opened an account with Citibank, which authorised any two of them to operate the account
- 26 amounts were paid out from the account to four Tugu officers for their personal use
- Two of the Tugu officers who had authorisation then instructed Citibank to shut down the account after all funds had been transferred out
- Tugu alleged that all 26 transfers to the Tugu officers were fraudulent as well as the instruction to close the account
Practical takeaways
- The Quincecare duty is relevant is Australia, principally in the context of a banking relationship
- The Quincecare duty could extend to third party companies that assist businesses in accepting payments, such as PayPal. It might also apply to crypto-exchanges, although this is fact specific and depends on the terms of the contract and the developer-customer relationship
- Suing a bank, which may have deep pockets, may be the most fruitful avenue to recovery in cases of misappropriation of the customer’s funds or instructions tainted by fraud
- The law, as it stands, supports the notion that customers who willingly transfer funds to fraudsters may recover from their bank under the same duty. Victims of APP fraud will have a better chance of recovery if they can prove that the transaction was of a size that is large for the customer and the payee was a first-time payee (who possibly resides in another jurisdiction)
- While banks have been exonerated in most reported cases where a breach of the Quincecare duty has been alleged, each case turns on its own facts. As compliance requirements, fraud detection programs and AI improves, there may be greater scope for demonstrating that the bank was in fact put on notice
- Banks have a duty to have proper systems and controls in place. If it cannot be demonstrated that the bank breached the Quincecare duty, there may be other potential claims such as a claim arising from a bank’s failure to implement an adequate transaction monitoring program to identify suspicious transactions
- It is important to check the terms of the contract. A contract between the bank and its customer might lawfully exclude or modify the duty, changing the standard of proof from negligence to gross negligence. However, careful consideration has to be given to any exclusion or modification
- The Quincecare duty will always be in tension with the general duty of banks to execute instructions promptly. If, and for so long as, the bank was put on inquiry by having reasonable grounds for believing that the order was an attempt to misappropriate funds, the Quincecare duty will override the duty to make transfers promptly
- The duty applies to both corporate and retail banking customers
Further Information
For more information about recovering assets, and prosecuting or defending fraud claims, please contact Trevor Withane: