Is Quincecare retired or restrained by the UK Supreme Court's unanimous decision?

The Supreme Court has given its unanimous decision in Philipp v Barclays Bank UK plc, overturning the Court of Appeal ruling that had the potential to broaden the scope of the Quincecare duty of care and which followed an earlier High Court summary judgment. The decision will be seen as a victory for banks and other payment service providers (PSPs) whose customers are faced with authorised push payment (APP) fraud.

However, the Supreme Court took pains to set its decision – and the legal scope of the duties owed by PSPs – in the context of the existing and forthcoming regulatory obligations on PSPs, which will soon make reimbursement for losses mandatory for consumers in all but exceptional cases.

The APP fraud

An APP fraud occurs when a fraudster tricks the payer into instructing their PSP to send money from their account to an account controlled by the fraudster. From the PSP's perspective, the payment is "legitimate": it was authorised by the customer, whether in person, by use of passwords, two-factor authentication or otherwise. However, in making the payment, the customer has been scammed.

In this case, Mrs Philipp was tricked into authorising two large overseas payments to a fraudster in the belief she was acting on instructions from the Financial Conduct Authority (FCA) and the National Crime Agency. She gave those instructions in person at bank branches. Both in the branch and via follow up phone calls, the bank carried out identity verification procedures and confirmed with the customer that she was authorised to make the payments and wanted to do so.

Nonetheless, Mrs Philipp argued that the bank had failed to identify certain "red flags" – large transactions to new international payees in quick succession – such as to raise a Quincecare duty from the bank not to execute her instructions.

The Quincecare duty

In summary, the Quincecare duty of care has traditionally been interpreted as requiring PSPs to refrain from executing a payment instruction from a customer if they have reasonable grounds to believe that the instruction arises from a fraud. This creates an inherent tension (if not contradiction) between the bank's duty to act on its customer's instructions to execute the instructions and the Quincecare duty not to act on those instructions in certain circumstances.

The bank had applied to strike out Mrs Philipp's claim on the basis that the Quincecare duty is confined to corporates, arises only where an agent of the customer purports to give the instructions and does not arise where the customer themselves provides a legitimate, authorised instruction. It said that imposing a duty in the circumstances argued by Mrs Philipp would constitute an unjustified expansion of the scope of the duty.

The court agreed and summarily dismissed the claim. The Court of Appeal found that the Quincecare duty could, in principle, arise in any case when a bank had reasonable grounds to believe that there was a fraud, including where the instructions came from the customer themselves.

The Supreme Court decision

The Supreme Court unanimously allowed the appeal.

In a robust decision, it, clearly set out the scope of the Quincecare duty as arising only where the payment has not been authorised by the customer. The duty therefore does not arise and it cannot be relied on where a customer has "unequivocally authorised and instructed the bank to make the payment" even under a fraud. It held that that the Cour of Appeal's decision was inconsistent with "first principles of banking law": namely (in the absence of an express contractual term to the contrary), that a bank must make payments promptly in compliance with a customer's instructions (where the customer has sufficient funds to make that payment).

A bank's duty to exercise reasonable skill and care only arises "where the validity or content of the customer's instruction is unclear or leaves the bank with a choice about how to carry out the instruction". Here the customer's instruction were unambiguous. The customer was aware of all the red flags, which she had alleged should have put the bank on inquiry.

The Supreme Court concluded that the "Quincecare duty is not, as that epithet might suggest, some special or idiosyncratic rule of law". It is just part of a general duty of care owed by banks to act in accordance with customers' instructions and generally is relevant only wherever one person is given authority to give instructions to the bank on behalf of the customer (and the bank has reasonable grounds for believing that that person might be defrauding the customer). Similar considerations would apply where there are reasonable grounds for believing that a customer lacks mental capacity. But it has no application to APP frauds.

The PSR's approach

The Supreme Court's decision is a welcome clarification of the law both for PSPs and consumers (albeit with relief and disappointment respectively).  However, the position under regulation by the Payment Systems Regulator (PSR) is just about to change once again.

APP fraud is and has for some time been a significant issue. According to figures published recently by UK Finance, APP fraud cases reached £485.2m in total in 2022 and the volume of cases grew by 6% compared to 2021.

Faced with the growth of APP fraud, the PSR has been consulting for some time on how to protect consumers who are the victims. However, these efforts have been constrained by a lack of legislative basis for the PSR to put mandatory rules in place.

The Financial Services and Markets Act 2023 (which received Royal Assent last month) now provides that statutory basis. In anticipation, the PSR recently announced that it is introducing a new reimbursement requirement for APP fraud within the Faster Payments Service system (the majority of APP fraud is enacted with a faster payment).

Broadly, this will require payment firms to reimburse all in-scope customers (consumers, microenterprises and charities) who fall victim to APP fraud in most cases, share the cost of reimbursing victims 50:50 between sending and receiving payment firms, and provide additional protections for vulnerable customers. Royal Assent for the Financial Services and Markets Act 2023 (which makes provision for the introduction of a mandatory reimbursement scheme) was received on 29 June 2023.

It is expected that the new reimbursement requirement will come into force in 2024. However, it will not apply to international payments or payments between fiat and cryptoassets platforms.

Furthermore, the FCA's new Consumer Duty comes into force from 31 July 2023 and requires firms to avoid causing foreseeable harm. It remains to be seen how that will impact on the steps firms take to protect their consumers from harm.

Osborne Clarke comment

The Supreme Court decision will bring certainty to legal claims in relation to APP fraud. However, it does not mean the end of the Quincecare duty or PSP's obligations to ensure that the instructions it receives are actually given on behalf of its customer. 

Furthermore, the forthcoming regulatory obligations on PSPs in respect of APP fraud are likely to increase their financial burden in respect of APP fraud.