Authorised Push Payment (APP) Fraud

The Quincecare Duty is a continuously developing principle within the UK’s financial sector. It refers to financial institutions’ duties to protect their customers from all forms of fraud on their accounts. The primary basis for understanding the Quincecare Duty is to help strike the right balance between the commitment to protect customers from fraud and limiting instances of imposing burdensome obligations on individual banking institutions.

Within the banking sector, a new phenomenon, namely Authorised Push Payment fraud (APP), has caused disruption. The prevalence of this type of fraud has enhanced the development of the Quincecare Duty. When a customer becomes a victim of APP fraud, they have been deceived into asking their bank to transfer money from their personal accounts to those controlled by fraudsters. The reference of APP as ‘authorised’ is an interesting aspect of this situation, as from the bank’s perspective the transaction is instructed by the customer. Therefore, the development of the Quincecare Duty in Philipp v Barclays Bank Plc [2022] EWCA Civ 318, with particular emphasis on APP fraud, needs to be assessed closely.

Quincecare Duty within APP

The Quincecare Duty finds its origin in Barclays Bank Plc. v. Quincecare Ltd. This duty creates an obligation on individual banks to protect their customers from APP fraud by being ‘put on inquiry’ to investigate any instructions that may be an attempt to misappropriate funds. The renewed interest on the criticality of the Quincecare Duty was prompted, inter alia, by the Supreme Court’s decision in Singularis v. Daiwa. Since the formation of the Quincecare Duty, there has been a significant expansion in fraudulent schemes. Much of this is because fraudsters are exploiting the weaknesses of internet banking mechanisms and are adopting sophisticated methods to respond to the changes.

This situation has exposed both financial institutions and their customers to a higher level of vulnerability to fraud. Some of these institutions encounter significant challenges in their attempts to counter the threats. It is important to understand that there is a current shift from the negative form of duty attributed to Quincecare to a new approach prompting banking institutions to engage in positive action(s). The situation has prompted considerations as to whether the Quincecare Duty should develop in response to such threats, to an extent that customers can expect their banks to protect them from risks. The discussion of this key debate became the focus of APP fraud in the case of Philipp v Barclays Bank Plc.

Development of Quincecare Duty

The recent decision of the Court of Appeal in Philipp considers the scope of the duty on financial institutions to protect their customers from fraud. The case is set to widen the scope of the Quincecare Duty in relation to the obligations individual financial institutions have. Mr. and Mrs. Philipp became victims of APP fraud after being deceived to transfer most of their life savings of £700,000, to a bank account in the UAE, believing that they were moving the money for safety purposes. Mrs. Philipp filed a claim against Barclays, arguing that the bank breached its duty of care. According to her, the bank owed them a Quincecare Duty. Mrs. Philipp stated that the bank should have had procedures and policies to detect and prevent the occurrence of APP fraud. Barclays responded by seeking to strike out the claim arguing that there was no duty of care based on the circumstances and submitted that the victim’s case failed on causation.

In the High Court, Russen J expressed a high level of sympathy for the victim, but also stated that it would be unfair to impose liability on Barclays. The APP fraud committed against Mrs. Philipp demonstrated that such form of liability could only be based on what the judge considered as an impermissible and unprincipled application of the Quincecare Duty. According to Barclays, this form of duty of care would have placed a heavy and impractical burden on banks. Russen J agreed with the bank's position on this issue. The Court of Appeal, however, concluded that a trial was necessary to decide this matter appropriately.

In the Court of Appeal, the court considered the arguments advanced by the parties in the High Court and reconsidered the relevant authorities. Birss LJ dissented from the bank’s submissions apropos the Quincecare Duty does not extend beyond cases where an agent commits a fraud while serving the customer. Birss LJ recognised that while past decisions concerning duty of care consisted of a fraudulent agent’s instructions, he argued that the line of reasoning evident in these contexts are not reliant on a determination of whether the instruction originates from an agent. Instead, Birss LJ stated that it can apply in equal measure in a case where the instruction is provided by the customer to the bank. Furthermore, Birss LJ emphasised that it does not matter whether the customer is the victim of APP fraud.

In Mrs. Philipps’ case, a duty of care could arise in a situation where the customer issued an instruction to the bank to make payment, whereby the customer was indeed the victim of APP fraud. At trial, it was necessary to determine whether there was an actual duty based on the facts of the case. From a critical analysis of this case, the primary reason why the judge at first instance concluded that it would not be appropriate to impose a duty of care on Barclays, was because he considered that the duty identified by Mrs. Philipp would become inapplicable in reality.

Future of Quincecare duty

The outcome of Philipp at trial together with that of JP Morgan Chase Bank NA v Federal Republic of Nigeria will have a fundamental impact on the development of the Quincecare Duty. Birss LJ’s decision in the Philipp case in the Court of Appeal enriched the development of this duty by extending the scope of its application. There is a possibility that Philipp will further contribute to even a wider duty that banking institutions owe to their customers.

The fundamentality of the Quincecare Duty in understanding the obligations of banking institutions in relation to their customers’ interest continues to widen. Indeed, this duty continues to develop as a result of recent court judgments. As discussed, Philipp v Barclays Bank Plc [2022] EWCA Civ 318 is one of the cases that has contributed to the renewed interest in the Quincecare Duty in APP fraud cases.

In the Court of Appeal, Birss LJ expanded the scope of this duty by arguing that it is difficult to restrict the duty of care to circumstances where an agent acting for a banking institution provides an instruction concerning the payment of the customers’ monies. Instead, Birss LJ decided that there is a need to extend the scope of this duty to cases where the customer provides payment instructions.

Such a position contributes to the continued development of the Quincecare Duty in APP fraud cases. The judgment suggests that in determining whether checks and balances will function, courts will consider any voluntarily accepted industry norms or codes. As banking practices change, so will the duty's scope and the precautions that banks must take. Banks must make sure that this is reflected in their procedures.

Tim Brentnall is the senior partner and Mohammed Hussain is a paralegal at Elborne Mitchell LLP elbornes.com