Given the complex nature of APP fraud, the case highlights the difficult balance to be struck when assessing a bank's liability in these situations. The decision is likely to be appealed to the Supreme Court, and its outcome will have significant implications for both financial institutions and their customers in cases of fraud.
Facts of the case
APP fraud is an increasingly common and insidious type of financial crime. An APP is one where the customer instructs the bank to pay to someone else - billions of these instructions are made to financial institutions daily across the globe. In APP fraud cases, a fraudster deceives a customer to instruct their bank to transfer money into an account which the fraudster will have access to.
The claimant in the case, Mrs Philipp, a music teacher and her husband Dr Philipp, a retired public health physician were duped by a fraudster and requested Barclays bank to transfer the majority of their life savings into bank accounts held in the United Arab Emirates. They were deceived into thinking that they were communicating with the FCA and national crime agency, and were told that by transferring the two payments - one of £400,000 and the other of £300,000 - their savings would be protected from fraud. The deceit was sophisticated, as many of these types of cases can be, and by the time the fraudulent nature of the transfers had been detected, the money had gone.
Mrs Philipp raised an action against the bank for a breach of duty of care. She argued that the bank owed a duty of care at both common law and contractually, as established in the case of Barclays v Quincecare Limited. She submitted that there should have been procedures in place to detect the fraudulent nature of the payment instruction, and if there had been sufficient investigations into the transfer request, the fraudulent nature of the requests would have been detected and the money would not have been transferred.
What is the Quincecare duty?
As my colleague Ross Caldwell has touched upon in his previous article on the topic, the Quincecare duty originates from the decision in Barclays Bank plc v Quincecare Limited. In this case, the Court held that banks owe a legal duty to exercise reasonable care in and about executing a customer's order to transfer money. It was held that a bank must refrain from executing an order if the banker is 'put on inquiry', in the sense that he or she has reasonable grounds for believing that the order is an attempt to misappropriate the funds of the customer. Importantly, it is worth noting that in this case the duty was owed in relation to a customer that was a company, rather than an individual.
High Court Decision
In January 2021, Barclays applied to strike out Mrs Philipp's duty of care claim. The High Court granted in favour of Barclays on the basis that the Quincecare duty was restricted to cases where the attempted misappropriation of the customer's funds was by an agent of the customer (e.g. a director acting on behalf of a company). In Judge Russen's view, if the duty went beyond this defined scoped, there was a risk it would be interfere with the bank's primary duty to act of the customer's instructions, therefore creating 'unduly onerous and commercially unrealistic' obligations on the bank.
Court of Appeal Decision
Mrs Philipp appealed the High Court decision, and the Court of Appeal ruled in her favour, reversing the High Court summary judgment. The Court of Appeal held that the Quincecare duty does not depend on whether the bank is instructed by an agent of the bank's customer. The Court held that this element had arisen merely due to the facts of the Quincecare case, rather any fundamental composition of the duty itself. Indeed, the Court highlighted that at its core, the Quincecare duty existed to protect the customer, and this did not depend on whether the instruction is given by an agent or an individual.
In relation to the argument that imposing the Quincecare duty in these circumstances would be onerous and unworkable for the bank, the Court argued that this issue could not be decided without a trial. The Court highlighted that there was evidence to suggest that the relevant duty of care would not have been onerous as a reasonably prudent bank would have adequate measures in place to detect and potentially prevent APP fraud in line with the banking practices in place in 2018 when the fraud took place.
The judgment concluded that there is, at least in principle, a possibility that a duty of care can arise in the case of an individual customer instructing the bank to make a payment when that customer is the victim of APP fraud. To decide if the duty does arise in specific cases, the facts and evidence must be assessed in full. Therefore, the Court concluded that the appeal should be allowed and the case should go to trial.
Comment
Whilst the final decision on this case will ultimately be decided by the Supreme Court, there are some important issues to reflect on from these two opposing decisions from the High Court and the Court of Appeal.
Firstly, the extension of the scope of the Quincecare duty would undoubtably create considerably heightened operational standards for financial institutions to abide by. It has the potential to mean that every transaction that appears to be out of a customer's usual spending habits should be investigated in light of APP fraud. When considering the number of instantaneous or automated payments that are processed daily, there is no doubt that this could be challenging. A customer may buy an expensive laptop one day, and this could be considered unusual in light of a customer's day to day spending habits. However, is it enough to put a Bank 'on inquiry'? And if it is, does this mean that in these type of transactions, a Bank's duty to act quickly on a customer's payment instructions should be put on hold until further investigations are carried out?
However, on the other hand, with the growing focus on enhanced data collection and the increasing use of customer biometrics, financial institutions may find it difficult to argue they do not have these fraud detection capabilities. Today banks can use technology to detect how we type in our passcode, or hold our phone in order to verify our identity when processing transactions. Data analytical tools have become key for banks in order to promote new products to customers, and to argue they are not able to use them to also monitor what is an unusual payment instruction from a customer could be a difficult corner to fight.
The outcome of this case will contribute to wider discussions in relation to when a banker should be 'on inquiry' about a potentially fraudulent instruction. At the moment this very question is being raised in a High Court in London in the case of Federal Republic of Nigeria v JP Morgan Chase where Nigeria is arguing that JP Morgan were grossly negligent for transferring $900 million to a company controlled by a former Nigerian minister with a money-laundering conviction, despite numerous suggestions that the transactions were fraudulent. The Supreme Court decision in Stanford International Bank Ltd (SIB) v HSBC Bank plc on whether a bank's Quincecare duty protects an insolvent customer's creditors is also expected this year.
These cases highlight the acute tension between a bank's duty to act on customer payment instructions and the duty to exercise reasonable care in carrying out instructions. As fraudulent techniques continue to evolve, it is essential that financial institutions adapt too to protect their customers. The Philipp case provides an excellent opportunity for financial instructions to review and improve their APP fraud measures. However, whether the appeal to the Supreme Court will result in a Quincecare duty for all customers remains to be seen.
