The Quincecare duty clarified: Is a bank liable for executing a fraud victim’s payment instruction?

In Philipp v Barclays Bank UK PLC [2023] UKSC 25, the UK Supreme Court demystified the so-called Quincecare duty owed by a bank to its customer. It clarified the scope of the bank’s duty and when it would be liable for executing payment instructions in fraud cases. The clarification will be welcomed in common law jurisdictions including Hong Kong.

The Quincecare duty requires a bank, if put on inquiry, not to execute a payment instruction without checking that the instruction is indeed a valid instruction of the customer to transfer money. Where a customer of sound mind unequivocally authorises and instructs the bank to pay, the bank shall pay, subject to exceptions such as illegality or preventing money laundering. Unless there is an express term, the bank has no duty to refuse making payment because it believes or has reasons to believe the customer has been defrauded.

 

The facts

The Claimant, Mrs Philipps, fell victim to an ‘authorised push payment’ (APP) fraud. Her husband Dr Philipp was contacted in February 2018 by a fraudster who claimed to be working for the UK Financial Conduct Authority in conjunction with the UK National Crime Agency. After a series of telephone calls, they were led to believe that their money needed to be moved to ‘safe accounts’. Therefore they instructed Barclays Bank to transfer GBP700,000 in total to bank accounts in the United Arab Emirates (UAE). That represented the bulk of their life savings.

The transfer was made in two tranches in March 2018. On the first occasion, Mrs Philipp’s instruction was to transfer GBP400,000 to an account in the name of Lambi Petroleum Ltd (a company with which Dr Philipp told the cashier, falsely, that he had had previous dealings). On the second occasion, the instruction was to transfer GBP300,000 to an account in the name of Bonito Systems Ltd. On each occasion, before making the transfer, the Bank telephoned Mrs Philipp to seek her confirmation that she had made the transfer request and wished to proceed with it. Mrs Philipp provided the required confirmation on each occasion. The Bank carried out the instructions and the money was lost.

Following the police’s investigation and contact with the Bank, the Bank froze Mrs Philipp’s account. Mrs Philipp attempted to make a third transfer of GBP250,000 (the remaining balance of the funds received from her husband’s account) to the account in the UAE in the name of Bonito Systems Ltd. The Bank refused. Dr and Mrs Philipp tried, unsuccessfully, to persuade the Bank’s staff to lift the block on her account by claiming (falsely) that they needed to make an urgent payment under a contract which they would lose if the payment was not made on that day.

It was in late March 2018 that Dr and Mrs Philipp finally realised they were victims of a fraud. Mrs Philipp notified the Bank of this on 27 March 2018. Some two months later, the Bank attempted to recall the funds which had been transferred to the UAE, but the attempts were unsuccessful.

Mrs Philipp started proceedings against the Bank in the English Court. She contended that the Bank owed her a duty under its contract with her or under common law not to carry out her payment instructions if, as she alleged, the Bank had reasonable grounds for believing that she was being defrauded.

The Bank applied to summarily dismiss her claim, on the ground that no such duty was owed to her. Judge Russen QC granted summary judgment in favour of the Bank. But the English Court of Appeal allowed Mrs Philipp’s appeal, accepting that in principle the Bank owes that duty to her; whether such a duty arose on the facts in the case shall be decided at trial. The Bank appealed to the UK Supreme Court.

 

The decision

The UK Supreme Court unanimously allowed the Bank’s appeal. It held that the Bank did not owe the alleged duty to Mrs Philipp. It restored the summary judgment in favour of the Bank, but varied it to permit Mrs Philipp to maintain an alternative claim based on the Bank’s alleged failure to act promptly to try to recall the payments after the fraud was discovered.

Lord Leggatt delivered the Court’s Judgment, with whom all other Judges agreed. The Court clarified the so-called Quincecare duty of banks, which emanated from the case Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363. The Court’s analysis of the banks’ contractual duties towards their customers can be summarised as follows:

• In ordinary circumstances, a bank is not a trustee or fiduciary of money deposited by a customer, but simply a debtor. The bank’s principal obligation is to discharge its debt to the customer when called upon to do so. In making such payments, the bank acts as the customer’s agent. Unless otherwise agreed, the bank has a strict duty to comply with its mandate from the customer. ([28] – [30])
• There are exceptions to the bank’s duty to carry out the customer’s payment instruction. The main implied limit on the bank’s duty is that the bank cannot be obliged to act unlawfully, for example, if instructed by a customer to act in breach of trust. Another form of illegality which limits the bank’s duty is to prevent money laundering, in accordance with legislation. The Court referred to these as the bank’s right not to incur liability. ([31] – [33])
• There is an implied term in the contract between the bank and the customer that the bank must carry out its services with reasonable care and skill. ([34] – [37])
• The Court criticised the reasoning in Quincecare, in which Steyn J depicted the bank as owing two conflicting contractual duties to its customer: On one hand to execute a valid order to transfer money promptly, and on the other to exercise reasonable care in and about executing a customer’s order to transfer money. Steyn J said, in order to reconcile these conflicting duties, a balance should be struck between countervailing policy considerations. ([55] – [57])
• Lord Leggatt opined that there is no conflict between the bank’s duty of care to verify the agent’s authority and its duty to execute a valid order to transfer money promptly. The duty of care requires the bank, if put on inquiry, not to act without checking that the order is indeed a valid order of the customer to transfer money. ([91])
• Properly understood, the Quincecare duty is simply the application of the general duty of care owed by a bank to ‘interpret, ascertain and act in accordance with its customer’s instructions’. Where a bank is put on inquiry (in the sense of having reasonable grounds for believing that a payment instruction given by an agent purportedly on behalf of the customer is an attempt to defraud the customer), this duty requires the bank to refrain from executing the instruction without first making inquiries to verify that the instruction has actually been authorised by the customer. Otherwise, if the instruction proves to have been given without the customer’s authority, the bank will be in breach of duty. ([97])
• The Quincecare duty applies to both corporate and individual customers. It applies to checking a company agent’s authority to sign cheques or give other payment instructions for the company. It also applies if the bank believes an individual customer lacks mental capacity to operate a bank account or manages her financial affairs. ([98] – [99])
• The Quincecare duty has no application to a fraud situation such as this case. The validity of the customer’s instruction is not in doubt. Provided the instruction is clear and is given by the customer personally or by an agent acting with apparent authority, no inquiries are needed to clarify or verify what the bank must do. The bank’s duty is to execute the instruction and any refusal or failure to do so will prima facie be a breach of duty by the bank. The fact that the customer’s payment instruction was induced by fraud does not invalidate the instruction or give rise to any claim against the bank. The customer’s recourse is to claim repayment from the fraudster. ([100] – [105])

 

Comment – The Quincecare duty in Hong Kong

The Quincecare approach has been followed in Hong Kong, recently cited by the Court of Final Appeal in PT Tugu Pratama Indonesia v Citibank NA [2023] HKCFA 3. Lord Sumption NPJ referred to Quincecare as the leading authority for 'the classic statement of a bank’s duty of skill and care in executing his customer’s instructions’, also cited in subsequent cases (at [18] – [20]).

In Luk Wing Yan v CMB Wing Lung Bank Limited [2021] HKCFI 279, Coleman J rejected an individual customer’s claim against the bank for executing her payment instruction in a fraud perpetuated by the bank’s employee. In that case, the bank’s fraudulent employee induced the customer to pay around HKD35 million into the employee’s account, under the employee’s pretext of high-return ‘internal’ investments made available by the bank to its staff. The customer received around HKD11.3 million as the alleged investment return, but the rest of her ‘investment’ (around HKD23.8 million) was completely lost. The customer personally attended the bank’s branches to make the transfers from her savings account to the employee’s account. Coleman J rejected the customer’s claim against the bank for vicarious liability for its employee. He accepted that the bank could not have intended to authorize its employee to offer such ‘internal’ investment to a customer. Hence, the bank made no representation to offer the investment to her. The employee had no apparent authority to bind the bank. The customer did not rely on any such authority, and could not reasonably do so.

Turning to the Quincecare duty claim, Coleman J opined that, considering the first instance decision in Philipp v Barclays, the Bank owed no duty ‘to test the genuineness of the recipient of the monies rather than the genuineness of the instruction to pay the monies’ (at [178]). This analysis is in line with Lord Leggatt’s statement of the law, which is expected to be adopted in Hong Kong.

The Philipp decision will be welcomed by banks, given the prevalence of cyber fraud cases. That said, banks should remain vigilant in handling payment instructions especially cases involving fraud. If the customer lacks mental capacity (for example, due to old age), and the bank is ‘put on notice / inquiry’, the Quincecare duty may require the bank to make suitable inquiries before executing her payment instruction. For corporate customers, the bank should ascertain the account operator has proper authority to act on behalf of the company.

Notably, Mrs Philipp is permitted to pursue her alternative claim for Barclays’ alleged failure to take adequate steps to attempt to recover the money transferred to the UAE. Banks and other interested groups should watch this space.