Don’t Bank on It: Philipp v Barclays Bank UK reaffirms Banks offer limited protection against scams where customers themselves authorise transactions

By Nilan Ekanayake Thomas Coltrona Reid Thornett

21 July 2023

In February 2023, the Australian Bureau of Statistics revealed that two thirds of Australians aged 15 years and over were exposed to a scam in 2021-22. The Australian Competition and Consumer Commission reported that Australians lost more than $3.1 billion to scams in 2022. As would be expected, a large number of these fraudulent transactions were processed through financial institutions.

Pressure has been mounting on Australian banks to do more to prevent scam transactions, and to compensate scam victims when they do fall foul of a scammer and lose their money. This pressure has come not only from consumer groups, but from the financial regulator, the Australian Securities and Investments Commission (ASIC).

In its report published in April 2023, ASIC called for all financial institutions to improve their approaches to handling scams after new ASIC analysis revealed that scam losses for major bank customers exceeded $550m last financial year and impacted more than 31,700 customers. ASIC’s report found that:

• the overall approach to scams strategy and governance of Australia’s major banks was variable and overall less mature than expected;
• the banks had inconsistent and narrow approaches to determining liability;
• scam victims were not always well supported by their bank;
• there were gaps and inconsistencies in how the banks detect and stop scam payments; and
• while there were examples of emerging good practice, steps taken to help prevent customers fall victim to scams varied across banks.

A key finding was that the reimbursement and compensation rate for scam victim’s varied but was low across the individual banks, ranging from 2 to 5%.

This statistic begs the question: do banks have a duty to reimburse scam victims when the loss is of the victims own making?

What obligations does a bank owe its customers?

It is generally understood that banks may owe their customers a duty of care (either in tort or as an implied term of their contracts) to exercise reasonable care and skill in carrying out their banking functions.

A manifestation of this duty is what is known as the Quincecare Duty, as explained by the High Court of England and Wales in Barclays Bank Plc v Quincecare [1992] 4 All ER 363 (Quincecare).

In Quincecare Barclays Bank agreed to lend £400,000 to Quincecare Ltd for the purpose of purchasing four chemist shops. The Chairman of Quincecare caused a sum of about £340,000 to be drawn down and misapplied for dishonest purposes. Barclays then sued Quincecare, as principal debtor, and UniChem, as guarantor, for the loan amount.

Justice Steyn regarded the principal issue of the case as to whether Barclays, in executing the order to transfer the funds (which were misapplied for dishonest purposes), were ‘put on inquiry’ that the Chairman was acting for his own benefit, or in any event, for an unauthorised purpose. Put another way, the issue was whether Barclays owed a duty to Quincecare and UniChem to that effect.

In answering that question, Justice Steyn held (at 376):

‘[I]t is an implied term of the contract between the bank and the customer that the bank will observe reasonable care and skill in and about executing the customer’s orders. Moreover…a banker may in a case such as present be sued in tort as well as contract… It is simply to say that a banker must refrain from executing an order if and for so long as the banker is ‘put on inquiry’ in the sense that he has reasonable grounds (although not necessarily proof) for believing that the order is an attempt to misappropriate the funds of the company.’

Ultimately Justice Steyn concluded that there had been nothing in the history of the matter which should have put the bank on inquiry as to the Chairman’s dishonesty, and therefore Barclays were not in breach of the above duty.

The case is foundation for the principle that banks have a duty of care to be vigilant against misappropriation of funds by directors or agents of their customers.

This so-called ‘Quincecare Duty’ appears to have been adopted in Australia, at least implicitly: see, for example, National Australia Bank Ltd v Meeke [2007] WASC 11, [411] (Justice Jenkins).

Until recently, however, it was generally accepted that the common law did not impose a general duty of care on banks to prevent transactions they believed might be procured by fraud, which had otherwise been properly authorised by their clients.

Enter the UK Courts’ recent deliberation on the duty in Philipp v Barclays Bank UK PLC [2022] EWCA Civ 318 and Philipp v Barclays Bank UK PLC [2023] UKSC 25 (Philipp v Barclays).

Philipp v Barclays – Court of Appeal

Philipp v Barclays was a case about a common kind of scam. Mrs Philipp became a victim of an authorised push payment (APP) scam: a transaction in which a bank’s client is deceived by a fraudster to instruct their bank to transfer money from their account into an account controlled by the fraudster. Mrs Philipp, believing that she was protecting herself from fraud, authorised Barclays Bank to transfer money from her accounts into ‘safe’ accounts in the United Arab Emirates. The safe accounts were controlled by fraudsters.

When Mrs Philipp realised she had become a victim of fraud, she claimed that Barclays owed her a duty of care at common law not to carry out her payment instructions on the basis that Barclays had reasonable grounds to suspect that Mrs Philipp was being defrauded.

She therefore sought to expand the scope of the Quincecare Duty beyond cases involving rogue agents to cases in which the bank has been given proper instructions by the customer themselves.

At first instance, the High Court found in favour of Barclays on the basis that the Quincecare Duty did not and could not, as a matter of principle, extend to include situations such as APP fraud.

In contrast, three justices of the Court of Appeal of England and Wales unanimously reversed the High Court’s decision, concluding that the Quincecare Duty could, in the right circumstances, extend to include situations of APP fraud.

Lord Justice Birss observed that ‘the right way of looking at this case is that the Quincecare Duty is not limited to agents but applies in any case in which the bank is on inquiry that the instruction is an attempt to misappropriate funds’: [76].

His Lordship also observed that a bank’s duty to execute a valid payment order operates in tension with the bank’s duty to exercise reasonable skill and care. There must be a fair balance struck between these competing policy considerations.

The decision had the potential to significantly increase the burden on banks to undertake investigations and query transactions where there were concerns about fraud. Unsurprisingly, Barclays appealed to the Supreme Court.

Philipps v Barclays – UK Supreme Court

On 12 July 2023 in the Supreme Court, the five Lords unanimously allowed Barclays’ appeal and overturned the Court of Appeal’s decision.

Lord Leggatt, with whom the other Law Lords agreed, concluded as follows:

1. The Quincecare Duty was limited to its facts. That is, the duty arises in cases involving fraud by an agent of the client, where the agent has been otherwise granted authority to transfer funds. The rationale behind such a duty is based on a bank’s obligation to take reasonable care to ensure that a transfer request was in fact the request of the client.
2. The relationship between customer and bank is one of contract, as modified by statutory regulation. There is no room to imply a general duty requiring a bank to protect a customer from fraud. In fact, such a duty may be inconsistent with the bank’s duty to execute valid payment orders with due expedition.
3. Accordingly, the bank’s duty to take reasonable care is subordinate to, and does not conflict with, the bank’s duty to execute a valid payment order. The duty to take reasonable care only arises where a client’s instruction leaves the bank with residual discretion as to how the instruction is carried out. That duty does not arise in circumstances where there is a valid payment order.

So what does this all mean?

The Supreme Court’s decision has confirmed the operation and limits of the Quincecare Duty as follows:

1. If a bank receives a payment instruction directly from the customer that is, at face value, clear and unambiguous, then the bank is obliged to give effect to that instruction and has no obligation to make inquiries.
2.  If the bank receives a payment instruction from an agent of a customer and the bank has reasonable grounds to suspect the agent is intending to defraud the customer, then the Quincecare Duty imposes an obligation on the bank to make inquiries to verify the legitimacy of instruction before giving effect to that instruction.

The Quincecare Duty will not ordinarily apply where the customer has directly authorised the transaction.

Current Reform

While the results in the courts may be disappointing for consumers, the UK Parliament is charging ahead with legislative changes that will force banks to compensate scam victims. Under the laws, both sending and receiving banks will split the cost of reimbursing scam victims for losses arising as a result of a scam transaction utilising the ‘Faster Payment’ system, unless the scam victim acted fraudulently or with gross negligence. The changes will not apply to civil disputes, cash sent via other payment systems or international payments.

The aim of these reforms is to incentivise banks to stop fraud happening, because they will wear the costs when it does happen. The hope is that this will reduce scam losses and incidents of fraud, which is the experience of at least one UK bank which already adopted similar measures ahead of the legislative changes.

The Australian Banking Association (ABA) has lobbied against introducing similar legislative requirements, arguing that it would actually entice criminals to target Australians more often by creating a ‘honeypot’ effect, and that there were better ways to create incentives for banks. Instead, the ABA has developed a new digital platform, called the ‘Fraud Reporting Exchange’. However, it seems that the Federal Government disagrees with the ABA’s position.

On 11 July 2023, Financial Services Minister Stephen Jones stated, ‘when you look at what the UK does, we’ll probably look at something which travels in the same direction’. He also said that a tough new code of practice for banks was being developed, with public consultation to begin soon; he expected the code would make compensation payable to victims when banks did not meet their obligations. This is the strongest indication to date that Australia may follow the same regulatory pathway as the UK.

However, until these laws are implemented, scam victims are unlikely to find much solace in Australian courts. The refusal of the UK Supreme Court to extend the application of the Quincecare Duty means that it is unlikely that any extended duty will be imported into Australia, and any consumer protection reform in this space will need to come from government.

Disclaimer: The information published in this article is of a general nature and should not be construed as legal advice. Whilst we aim to provide timely, relevant and accurate information, the law may change and circumstances may differ. You should not therefore act in reliance on it without first obtaining specific legal advice.