News

Partner Paul Brehony and Senior Associate Kate Gee examine the ruling in Fiona Lorraine Philipp v Barclays Bank UK PLC and discuss how it is a deceptively important case that checks the recent development of the Quincecare duty.

Paul and Kate’s article was published in Law360, 24 February 2021, and can be found here.

Summary

The Quincecare duty, a common law duty established in 1992 (Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363), requires a bank to use reasonable care and skill in executing payment instructions on behalf of customers. A bank must refrain from executing a payment instruction if and for as long as it was put on enquiry (i.e. it has reasonable grounds to believe) that that the payment may be fraudulent. At the outset, that was not intended to be a high standard, and the court in Quincecare recognised that a bank is normally entitled to assume that a director of a corporate customer is not a fraudster. A number of recent claimant-friendly decisions have considered and broadened a bank’s Quincecare duty – but the judgement in Fiona Lorraine Philipp v Barclays Bank UK PLC [2021] EWHC 10 (Comm)) suggests a turn in the tide. This case held that the Quincecare duty does not extend to authorised push payments (APPs or APP fraud), where a customer is tricked into making a payment, genuinely authorised as between bank and customer, but made to a third-party fraudster.

This is an important development that checks the recent expansion of the Quincecare duty, albeit the decision was not a surprise on the facts of the case. The duty was originally designed to protect corporate customers, and this decision confirms that the Quincecare duty does not extend to dealings between the bank and its customers who are natural persons (absent third-party involvement), where instructions given are properly authorised.

The facts

The facts are straightforward. In 2018, Mrs Philipp and her husband, Dr Philipp, were approached by a fraudster, who was posing as a Financial Conduct Authority employee working with the National Crime Agency. Having convinced them that a fraud was occurring at Dr Philipp’s bank, and at the firm where his savings were invested, he persuaded them to transfer Dr Philipp’s savings into “safe accounts” and to inform no one in order to avoid prejudicing the investigation.

Dr Philipp duly transferred £950,000 to his wife’s account at Barclays. Even though a police officer visited the couple on the same day as the transfer was made to advise that they may be victims of a fraud, they refused to deal with her, so convincing had the fraudster been. At different Barclays branches, Mrs Philipp and her husband gave separate instructions – in person – for two payments of £400,000 and £300,000 to be paid into accounts in the United Arab Emirates, the details of which had been provided by the fraudster. Both person and in follow up phone calls, the bank carried out identity checks and confirmed with Mrs Philipp that she was authorised to, and wanted to, make the payments. Those payments were made. A third payment of £250,000 was later stopped by Barclays when the couple eventually realised that they were being defrauded.

Relying on the Quincecare duty, Mrs Philipps brought proceedings alleging that Barclays had breached its duty of care to her, that the bank should have asked her more questions, identified the circumstances as a “red flag” and blocked her account, preventing the loss of the £700,000. Barclays applied to strike out the claim.

The findings

Since 1992, the Quincecare duty has rarely been relied upon by individual customers, because it was originally designed only with corporate customers in mind. Accordingly, the attempt by Mrs Philipp to extend the duty in a case involving APP fraud – where the payment was genuinely authorised by the customer herself – was always going to be an uphill battle. Mrs Philipp would have had to convince the Court first to extend the Quincecare duty to individual customers, and then to find that Barclays had breached that duty in circumstances of an APP fraud.

There is of course an obvious tension between how a bank’s mandate to comply with its customer instructions should sit with its Quincecare duty, as a bank must be able to carry out legitimate, authorised instructions from its customers with confidence. Mrs Philipp argued that the bank’s Quincecare duty required it to have in place suitable safeguarding procedures to identify the red flags which would detect and prevent APP fraud, for example the authorisation of large payments to new international recipients, made within a short time frame. Barclays submitted that it had no duty to protect Mrs Philipp from the consequences of her own instructions, when genuinely made, even where those instructions were (unknown to it) induced by fraud.

In Quincecare, the Court found that the bank’s fiduciary duty to its customer “was an implied term of the contract between the bank and the customer that the bank would observe reasonable skill and care” when executing a customer’s instructions. In Philipp v Barclays, the Court held that this implied term would be breached by a bank if it: executed a customer’s instructions, knowing that they were dishonestly given, or shut its eyes to the fact that they were given dishonestly; acted recklessly in failing to make appropriate enquiries into those instructions that an honest and reasonable person would make; or executed them when it had reasonable grounds for believing that they were an attempt to misappropriate funds.

HHJ Russen QC, sitting as a Judge of the High Court, struck out the claim and accepted Barclays’ argument that Quincecare did not extend to a duty to protect Mrs Philipp from the consequences of her own decisions, where her instructions were valid and not fraudulently given. The decision therefore confirms that the Quincecare duty remains subordinate to a bank’s primary duty of acting upon its customer’s instructions, when properly authorised.

The court held that banks “cannot be expected to carry out such urgent detective work, or treated as a gatekeeper or guardian in relation to the commercial wisdom of the customer’s decision and the payment instructions which result”. Further, there was “no proper basis for imposing liability upon a bank in respect of alleged omissions which, viewed from the perspective of the purpose behind the suggested duty to act, really relate to testing the genuineness of the recipient of the monies rather than the genuineness of the instruction to pay the monies (whatever the circumstances behind that instruction may be […])”.

In addition, the court considered that no clear framework existed by which such an extended duty could, in practice, operate sensibly. This confirms that the Quincecare duty concerns the general concept that a bank will adhere to the “standards of honest and reasonable conduct in being alive to suspected fraud”, which was not “too high a standard” (as noted by Steyn J himself in the original Quincecare judgment). Rather, the Quincecare duty is inherently driven by knowledge (actual or constructive), and not by a negligent failure to adhere to an amorphous “code”, the terms of which are not known or clearly defined. If the duty were to be extended beyond that general concept, it would have to be by reference either to statute or to “industry-recognised rules from which a bank could identify the particular circumstances in which it should not act (or act immediately) upon its customer’s genuine instructions”. Notably, when addressing this, the Court did not consider whether a financial institution’s own code of practice should – or could – properly form part of any proposed parameters, and it remains to be seen whether that will be considered in the future.

What next for the Quincecare duty?

The Quincecare duty has been the subject of several recent high profile decisions, most notably Singularis Holdings Ltd (In Official Liquidation) v Daiwa Capital Markets Europe Ltd (Singularis) [2020] 1 All ER 383. The judgment in Philipp v Barclays may be illustrative of the Court’s reluctance to extend the duty in other contexts absent statutory or industry guidance or direction. However, the decided cases to date have pivoted the duty off a specific transaction(s) which should have put the bank ‘on enquiry’, rather than accumulated account pathology, customer conduct or specific red flags. Nevertheless, individual customer protection remains a hot topic, and following the FCA consultation ‘FS19/2: a duty of care and potential alternative approaches’ which is anticipated in Spring this year, we may see a revised duty of care emerge in the financial services sector. Whilst the raison d’etre of the consultation is to enhance consumer protection, the early indicators are that a “one size fits all” approach, such as a new duty of care, may not win the argument, but rather a recalibration (along with more effective use) of the existing Principles and regulatory framework. For example, the existing Principles require firms to conduct their business with integrity (Principle 1), with due skill, care and diligence (Principle 2), pay due regard to the interest of customers and to treat them fairly (Principle 6). Interestingly, similar duties sit within Senior Managers and Certification Regime which also applies to banks. It is further widely reported that the FCA will seek to introduce a private right of action for consumers for breaches of these principles. The consultation continues.

The next significant potential development in the Quincecare duty on the horizon are the appeals in Stanford Bank -v- HSBC, reportedly due to be heard next month (and due for trial in October). The appeals are expected to provide clarity on the scope of the duty (i) when a Bank deals with an insolvent customer, specifically, when making redemption payments to deposit holders after the duty had allegedly arisen, whether such payments out could amount to proper loss); and (ii) the thorny issue of whether corporate knowledge can be aggregated for the purposes of a dishonest assistance claim in circumstances of alleged systemic failings of sufficient seriousness to amount to corporate institutional recklessness.

This present decision does not purport to confine “being alive to suspected fraud” by reference to any specific transaction(s) or provide any code of conduct that a financial institution should follow when dealing with its customers. As such, it leaves the door open to potential future litigation involving sophisticated fraudsters targeting commercial entities or banks executing a customer’s payment instructions without fully confirming their veracity. Certainly, the appeal of bringing a Quincecare claim against a bank with its deep pockets and often capable of being sued within the jurisdiction, as opposed to against an unknown fraudster, will continue.