Philipp v Barclays UKSC Judgment: APP Fraud and Consumer Protection

Executive Summary

The Supreme Court (the “UKSC”) has handed down its judgment for the appeal in Philipp v Barclays Bank UK Plc [2023] UKSC 25, and held in favour of Barclays Bank (the “Bank”) that it had not been under a duty to refuse to execute the instructions validly made by Mrs Philipp, even if these were made whilst unknowingly a victim of APP fraud. 

The judgment, whilst difficult for the Respondent and other victims of similar frauds, will no doubt come as a relief to financial institutions and Payment Service Providers (“PSPs”) who may have faced a slew of Quincecare-style breach of duty claims in relation to transactions and payments otherwise procured through APP fraud. We summarise the key points of this important judgment below and provide an in-depth analysis into the rationale behind this decision and its potential impact on the future regulatory environment in the financial services sector at large.

Important Factors to Consider in the Judgment

1. The Quincecare Duty: As per the judgment, the Quincecare duty is simply to “interpret, ascertain and act in accordance with its customer’s instructions”. Where a bank has reasonable grounds to doubt the authenticity of the customer’s instruction and is therefore “put on inquiry” it should verify the instruction with the customer. Where a bank fails to do so and makes a payment that did not have the authority of the customer, then it will be in breach of its duty to act with reasonable skill and care.

2. Limit of the Duty to Act on Customer Instruction: Where there are legitimate doubts as to a customer’s mental capacity to make valid instructions, or where other factors (such as any consequent illegal activity taking place) as a result of the instruction, then banks should refrain from executing customer instructions and should conduct further inquiries.

3. Customer Intention: Whilst fraud gives the victim the right to set aside the transaction and entitles them to recovery from the fraudster, crucially, it does not provide the customer with a right of recovery against a bank where a clear instruction to make a payment has been given by the customer.

4. Banks’ Terms of Business: The Bank had a contractual right in its standard terms of business with Mrs Philipp to refuse instructions where the transactions were obtained through fraud or deception. Crucially, this did not impose a duty on the Bank to refuse the instruction on which it would have had to act.

5. Litigation Risk Arising from Inaction in Recovery of Funds: The Bank may have been slow to attempt to recall the payments made by the Philipps to the fraudulent accounts following the gap between notification from Mrs Philipp to the Bank on 27 March and the steps taken to try and recover the funds on or around 31 May. The UKSC has held that the loss of a chance recovery claim against the Bank is still a course of action that is open to Mrs Philipp and has not been closed off as a result of this judgment.

Regulatory Issues and Developments

1. There are currently very limited protections offered to victims of APP fraud. Whilst some changes are coming, they will not be comprehensive and many larger businesses that become victims of APP fraud will not be protected.

2. The existing 2019 Contingent Reimbursement Model Code, designed to provide consumers with some protections against APP frauds is voluntary and there are only around 10 industry participants.

3. 72 of the upcoming Financial Services and Markets Act 2023 is designed to provide reimbursement protections to victims of APP fraud by imposing a 50:50 compensation split between banks who send and receive fraudulent payments. However, this will only cover certain consumers, charities and “micro-enterprises”. Most larger businesses will remain unprotected.

Authorised Push Payment Fraud

The Philipps were the victims of a sophisticated and sustained over a period of several weeks. APP fraud is one of the most common and significant frauds currently experienced. For context, UK Finance’s Annual Fraud Report explained that £485 million of the £1.2 billion lost to fraud was attributable to APP scams, accounting for just over 40% of all known frauds. APP fraud involves the deception of a legitimate account holder to transfer the funds which they have control over to fraudulent accounts. The fraudulent transferred funds are then mixed into other accounts and layered into the wider financial payments system by the fraudster. This often makes tracing the obtained fraudulently very difficult. We have written previously on this case (here), the significance of APP fraud (here), and recent regulatory developments (here).

The Facts

The fraudulent activity began in February 2018 when Dr Philipp was contacted by the fraudster who claimed to be from the Financial Conduct Authority investigating a fraud in collaboration with the National Crime Agency. The fraudster claimed that the investigation focused on HSBC and investment firm Tilney, where Dr. Philipp and his wife held a substantial savings. Over the course of a series of telephone calls, the Philipps were deceived to transfer the funds they held in their accounts to “safe accounts”. The fraud was of a level of sophistication that the calls involved appeared to be coming from genuine numbers at the National Crime Agency and the Police.

On 5 March, Dr Philipp had £950,000 transferred from his Tilney investment account to his wife’s current account with the Bank. This was the same day as the Police visited the Philipps to warn of a suspected fraud being perpetrated against them. Under the directions of the fraudster, on both 10 March and 13 March Mrs Philipp attended a branch of the Bank in person together with Dr Philipp and to instruct that a payment be made to a bank account in the UAE. Her first instruction was to send £400,000 to an account in the name of Lambi Petroleum Ltd. Dr Philipp told the cashier at the Bank that he had previous dealings with this entity following directions from the fraudsters. The second instruction given was for the transfer of £300,000 to an account in the name of Bonito Systems Ltd. On each instruction and prior to making the transfer, the Bank telephoned Mrs Philipp to seek confirmation that she had in fact made the instruction to transfer and intended to proceed. Mrs Philipp affirmed both of her instructions and the Bank duly made the payments.

The police again visited the Philipps on 15 March to warn of the suspected fraud and the Philipps, still deceived, said they did not want the Police involved. The following day, the Police contacted the liaison officer at the Bank notifying them of a suspected large-scale fraud operation emanating from the UAE involving the Philipps and others. The Bank acted to immediately freeze the account on 16 March. On 19 March, the Philipps again gave instructions for a third transfer to take place for £250,000, again to Bonito Systems Ltd, which was the remaining balance of the funds from the Tilney investment account. On being told by the Bank’s representatives that their account had been frozen, the fraudster instructed Mrs Philipp to then telephone the Bank’s fraud department to try and unfreeze the account. Under the direction of the fraudsters, the Philipps attempted to persuade the Bank’s fraud department to unfreeze their account by claiming that they required an urgent payment to be made that day in order to obtain a business opportunity. The third visit of the Police on 26 March finally caused the Philipps to become aware of the deception that they were under, and Mrs Philipp informed the bank of the fraud perpetuated against them on 27 March. Two months’ later at a date on or after 31 May, the Bank attempted to recall the fraudulently transferred funds back from the accounts in the UAE and were unsuccessful. The Philipps therefore lost a total of £700,000 in the first two transfers made to the UAE accounts.

Judgment In-Depth Analysis

The Meaning of the Quincecare Duty

One of the central features of this case has been the clarification of the meaning of the Quincecare duty, which arose from a previously decided case, and essentially arises where a bank is put on notice that a payment instruction may be an attempt to fraudulently misappropriate funds from a legitimate account holder. In such circumstances, a bank is under a duty not to execute the instruction pending further inquiries to satisfy itself that the transfer is not being fraudulently made.

The previous understanding of how the Quincecare duty operated is that banks needed to balance two conflicting obligations “in tension” with each other: (i) to execute legitimate payments on behalf of customers; and (ii) to exercise reasonable skill and care when making these transactions and to conduct further inquiries in certain circumstances. The UKSC has now clarified in this judgment that these two obligations are distinct and do not conflict with one another. Banks only have a discretion in applying the customer’s instructions if these instructions are unclear or leave the bank with a choice as to how to carry out the instruction. Where a bank receives a clear and unambiguous instruction, the duty does not apply. Therefore, the UKSC distinguished this case against the previous Quincecare judgment (which involved checking whether customer had instructed an agent to act for it). A bank is simply to carry out the instruction without further inquiry. 

A bank is ultimately a debtor of the customer and is required to hold the funds deposited by the customer on its behalf and deal with them effectively when instructed, either by the customer or by an agent acting with apparent authority. Therefore, a bank’s primary duty is the effective execution of an authorised instruction. The duty of skill and care here is for a bank to ensure that it does not make payments erroneously which the customer has not authorised. One of the primary differentiating factors in this case is that both Dr Philipp and Mrs Philipp both gave positive and unequivocal instructions to make the payments to the fraudulent accounts. They may not have realised that they were being deceived, however, they gave clear and positive instructions which were followed. The Bank carried out these instructions where there was no ambiguity or choice in the execution of those instructions and therefore complied with its duty. It was not required to hold the payments pending further inquiries because it

The Intention of the Customer

The UKSC held even if a customer’s belief in a set of circumstances is founded on something which has been created by fraud, as is the case with so many APP frauds which rely on gaining the confidence and trust of their victims, that this does not make the customer’s belief any less genuine. In this case, even though the fraudster had fraudulently procured the trust of the Philipps and induced them by this fraud to give instructions for these transfers, the Philipps nonetheless genuinely held the intention that they needed to make these payments. As was quoted in the judgment from the Shogun Finance Ltd v Hudson judgment, “fraud does not negative intention”. Instead, the presence of fraud gives the victim of it the right to set aside the transaction and entitles them to recovery from the fraudster. It does not provide the right to recovery against a bank where a clear instruction to make a payment was given by the customer.

The Limit of the Duty to Act on Customer Instructions

The judgment clarifies that there are still limits on a bank’s duty to execute valid customer payment instructions. For instance, banks are obligated not to engage in executions where: (i) that instruction would result in unlawful activity; (ii) the bank would be acting dishonestly towards its customer; (iii) the mental capacity of the customer was in question; or (iv) execution would be otherwise impracticable. If banks are made aware of fraudulent activity involving customer accounts, then it would be right for a bank to refrain from conducting further transactions on the customer’s behalf and to start engaging in further inquiries.

In this case, Mrs Philipp gave clear instructions as to the identity of the accounts to be paid, the amounts in question and the jurisdiction in which these accounts were held. Even though these, along with the fact that the Philipps had no previous history of dealing with these accounts, were argued as circumstances which should have put the Bank on inquiry, the Bank was not in a position to reasonably doubt these instructions which were clear and precise. The Bank was not notified that there was a fraud until the Police informed the Bank liaison officer of the fraud on 16 March, which was the point at which it did then act reasonably to immediately freeze Mrs Philipps’ account.

Banks’ Standard Terms of Business

The Bank’s standard terms which formed part of the contract between it and Mrs Philipp included the following:

“When we do not have to follow your instructions…

• we reasonably think that a payment into or out of an account is connected to fraud or any other criminal activity, including where the funds are being obtained through deception”.

The presence of this clause would have enabled the Bank to refuse to carry out Mrs Philipp’s final payment instruction on 19 March following the contact made by the Police with the Bank’s liaison officer to notify the Bank of the fraud. However, whilst the Bank had the contractual right to refuse to make the payment, crucially, this is not the same as the Bank being under a duty to decline to make the payment.

On a counter-factual point, without this clause, it may have been open to Mrs Philipp to bring a claim against the Bank for loss if it had refused to comply with her instruction. 

The Delayed Recovery Action and Possible Future Claim

A separate claim that the UKSC has kept open for Mrs Philipp is a loss of chance claim relating to the Bank’s slow actions to recover the transferred funds following notification by the Police of the fraud.

On 16 March, the Bank immediately froze Mrs Philipp’s account following the Police notification. However, it was not until a date on or after the 31 May, around a two and a half months later that the Bank attempted to engage in recovery and recall of the payments made. The time gap between these dates has left the Bank open to this follow-on claim. The UKSC held that it was not reasonable for the Bank to engage in payment recalls until at least 27 March, which was the date on which Mrs Philipp notified the Bank of the fraud.

The Bank refused to make the third transfer to the fraudulent UAE account due to the freeze on Mrs Philipp’s account on 19 March and was also further entitled to refuse the instruction based on the contractual point discussed above. However, it was not under a duty and did not have the authority to reverse the two preceding payment instructions made by Mrs Philipp. Indeed, Mrs Philipp attempted to persuade the Bank’s fraud department to unfreeze her account so as not to lose an immediate contractual opportunity, something which was itself a false claim.

The Bank should have sought instructions from Mrs Philipp on 27 March when she made contact notifying it of the fraud to clarify whether Mrs Philipp wanted to Bank to pursue payment recalls for the two previous payments. Even if it was doubtful that the funds could have been recovered at this point, the Bank did not do so. The UKSC therefore modified the previous Order to refuse summary judgment on the loss of a chance claim that the Bank breached its duty to take adequate steps to attempt to recover the two preceding transfers between 27 March and 31 May.

Significance and Wider Implications

The UKSC recognised that this judgment does not assist the Philipps, who unfortunately have lost a significant sum of their savings as a result of being targeted by a sophisticated APP fraud operation. The judgment acknowledges that there are real public policy questions which need answering urgently in order to protect others from falling victim to APP fraud and other scams which are often quick to take in the confidence of their victims by putting them under significant psychological pressure to act quickly to make large payments. This is not limited to individuals, but can also cause corporate entities significant losses, as demonstrated in the recent Tecnimont Arabia Ltd v National Westminster Bank judgment from 2022 (here). 

The 2019 Contingent Reimbursement Model Code, designed to provide consumers with some protections against APP frauds (of which the Bank is a participant) is only a voluntary framework and counts some 10 entities as signatories. There are obvious questions over its scope and efficacy.

s.72 of the brand-new Financial Services and Markets Act 2023 is designed to impose liability where a customer instruction is made subsequent to fraud and dishonesty. The provision requires the Payment Systems Regulator (the “PSR”) to impose a reimbursement requirement for qualifying cases. However, only transactions made using the Faster Payment Scheme are currently included in this and this is further confined to consumers, charities and “micro-enterprises”. Most larger businesses are not included. A 50:50 compensation allocation is proposed to be split between sending and receiving banks. It is also important to note that actions arising under this regime will not be directly enforceable by bank customers leaving their only recourse to be through this channel.

Lessons:

1. Individuals will need to carefully check all unexpected contacts that are made with them regarding their bank accounts and requests to move large sums of money at short notice. Staying calm and conducting thorough due diligence are paramount. These lessons also apply equally to large corporates and their employees.

2. Banks and other PSPs must ensure that they have processes in place to isolate and freeze compromised accounts and ensure that they join this up with a clear checklist to seek instructions from customers and recall payments linked to fraudulent activity as soon as possible.

3. Keep a watchful eye on the upcoming mandatory reimbursement requirements for APP frauds spearheaded by the PSR.

APP fraud and other similar scams are pervasive. It will require a joined-up effort of PSPs, financial institutions, regulators and policy makers to work together at an international level to proactively design regulations and systems which make the international financial payments environment a difficult place to conduct financial crime by creating multiple tripwires to catch fraudulent activity at source. Some progress towards these standards is being made. More work is yet required.