UK Supreme Court weighs in on APP scams

The UK Supreme Court in a landmark judgment (Philipp v Barclays Bank UK Plc [2023] UKSC 25) has unanimously held that a bank does not have a common law duty to customers to refrain from acting on their instructions where the bank believes the customer is the victim of an authorised push payment scam.

The judgment brings welcome clarity to the principles to be applied in determining the duty of banks in circumstances of a suspected authorised push payment scam (APP scam) (where a person is tricked into sending money to a fraudster posing as a genuine payee). In particular, the UK Supreme Court held that the so-called ‘Quincecare duty’^[1] – the duty of a bank not to carry out the payment instruction of a customer’s agent if it has reasonable grounds to believe the customer is being defrauded – is part of the general duty of care owed by a bank to act on its customer’s instructions. Accordingly, it does not apply to payment instructions received from the customer itself and accordingly has no application in cases of suspected APP scams.

The UK Supreme Court’s interpretation of the Quincecare duty is consistent with its application in Australian cases and will assist Australian Courts when considering the duty of care owed by banks and the determination of the extent of implied warranties for the purposes of the ASIC Act and the Australian Consumer Law. It will also likely influence the Australian Financial Complaints Authority in dealing with customer complaints in relation to APP scams.

The facts of the case

In 2018, Mrs Philipp and her husband were deceived by fraudsters into instructing Barclays Bank to transfer £700,000 from Mrs Philipp’s bank account to bank accounts in the United Arab Emirates. They visited a branch in person and gave the payment instructions in the belief that what they were doing was moving the money into “safe accounts” to protect them from a fraud. The instructions were carried out by the bank and the money was lost. Mrs Philipp claimed the bank had breached its duty to protect her from the consequences of an APP scam (for example by enquiring why she was contemplating transferring money to a foreign country).^[2]

In January 2021, the High Court granted summary judgment in favour of Barclays Bank and struck out Mrs Philipp’s claim. That decision was overturned by the Court of Appeal in March 2022, which held that the claim should be determined at trial and reasoned that the Quincecare duty applies in any case where the bank is on enquiry that the instruction is an attempt to misappropriate the customer’s funds (not just where the instruction is received from an agent of the customer).^[3] The case was then appealed to the UK Supreme Court.

The decision of the UK Supreme Court

The central issue before the UK Supreme Court was whether a bank owes its customer a duty not to carry out a payment instruction if it believes, or has reasonable grounds to believe, that the customer has been tricked by a third party into authorising the payment. The UK Supreme Court unanimously concluded that no such duty exists and rejected the argument that such a duty should be recognised as an implied term of the contract between bank and customer.^[4]

The Court held that such an argument is inconsistent with the primary duty of a bank to its customer to pay monies in accordance with its mandate. The relationship between the bank and its customer is one of debtor and creditor. Accordingly, if the customer’s account is in credit and unless otherwise expressly agreed, the bank has a strict duty when it receives a payment instruction from its customer to carry out the instruction promptly. Provided the instruction is clear, no inquiries are needed to verify what the bank must do.^[5] It is not for the bank to concern itself with the wisdom or risks of its customer’s payment decisions.^[6]

The scope of the Quincecare duty

The decision of the UK Supreme Court clarifies that the so-called Quincecare duty applies only in cases where the bank receives a payment instruction from an agent of its customer. In circumstances where a bank suspects that the customer is being defrauded by the agent, the bank’s duty to exercise reasonable skill and care in executing its customer’s instructions requires it to make inquiries to ascertain whether the instruction given by the agent is one actually authorised by the customer.^[7]

This reasoning does not apply to cases of APP scams where the customer has authorised and instructed the bank to make the payment.^[8] According to the UK Supreme Court, the Quincecare duty is not “some special or idiosyncratic rule of law” - it is “simply an application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions”.^[9]

Having held that the bank did not breach its duty in executing the payment instruction, the case has now been remitted back to the trial judge to determine Mrs Philipp’s alternative case that the bank breached its duty after the fraud had been discovered in not taking adequate steps to claw back the money which had been lost.

Key takeaways

First, the judgment is an important clarification by the UK Supreme Court of the scope of a bank’s duties to its customers. There is no common law duty on a bank to second-guess the instructions of its customer in order to prevent the customer falling victim to an APP scam. The decision will be influential in Australia for the reasons set out above.

Secondly, the judgment reinforces that the question of who should bear the loss for APP scams is a policy question “for regulators, government and ultimately for Parliament to consider”.^[10]

Recent legislation passed in the UK has established a framework which, when implemented, will require banks to reimburse customers who fall victim to an APP scam in qualifying cases.^[11] In Australia, the current position is that APP scams fall outside the e-Payments Code with the effect that there is no mandatory requirement to reimburse customers.

The issue of APP scams, and scams in general, is an area of continued focus in Australia. For instance, ASIC published a report in April 2023 setting out its expectations for banks regarding the prevention, detection and response to APP scams (see our earlier alert). One of ASIC’s expectations for banks is that there is a bank-wide policy to determining liability for losses associated with scams and a clear approach to the issue of compensating customers who fall victim to scams. The Federal Government has also launched the National Anti-Scam Centre on 1 July 2023 with a key object being to disrupt the work of scammers. It has foreshadowed the introduction of new codes of practice setting out the obligations on banks, telecommunications companies, and social media platforms to combat scams.

The Philipp case reinforces, however, that the allocation of losses incurred through APP scams, and the extent to which losses should remain with customers, is a live policy question.