Wadham BCL Candidate Joseph Khaw's critical response to Philipp v Barclays Bank UK Plc in the UK Supreme Court

The article follows from the recent decision of the UK Supreme Court in Philipp v Barclays Bank UK Plc [2023] UKSC 25, where the Court held that the so-called Quincecare duty does not arise in authorised push-payment (“APP”) fraud. The Quincecare duty arises when a bank is put on inquiry that a payment instruction from a customer’s own agent may be fraudulent, a type of fraud known as ‘internal fraud’. Per Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363, the bank then owes a duty to the customer to refrain from executing the payment instruction by debiting the customer’s account. If it fails to do so, the bank is liable to compensate the customer for the loss caused by their breach of duty.

Barclays returned to the stand in Philipp, where the claimants were deceived into authorising a transfer of £700,000 into the fraudster’s bank account, an example of so-called APP fraud. Unlike internal fraud, in an APP fraud the customers themselves make the disbursement request. The claimants alleged that Barclays Bank had breached their Quincecare duty by complying with the fraudulently-induced payment instruction. Their claim was dismissed by the High Court on the grounds that it would be onerous and unreasonable for the bank to accept liability, and conflict with the primary duty of banks to execute payment instructions promptly. The duty would be confined to the internal fraud context in Quincecare.

This was reversed by the Court of Appeal, which found that the reasoning Quincecare-type cases is not confined to situations in which the instruction is given by a customer’s agent, but is capable of being applied with ‘equal force’ where an instruction is given by the customer themselves, with the Court stating that the question of whether such a duty in fact arose can only be decided at a trial.

Barclays appealed to the Supreme Court, which unanimously allowed the appeal. The Court held that liability for APP fraud is a question for policymakers that the Court should refrain from intervening in. Indeed, in cases of domestic APP fraud, the Financial Services and Markets Act 2023 now provides for reimbursement.

The authors contest the Supreme Court’s characterisation of the juridical basis for the Quincecare duty, which they argue constitutes novel reasoning rather than following from ‘orthodox principles of banking and finance law’, as the Court claimed. They analyse the ‘traditional understanding’ of the duty developed in Quincecare, and the subsequent case of Selangor United Rubber Estates Ltd v Craddock (No 3) [1968] All ER 1073. The Supreme Court relied on Selangor as advancing a different conception of the Quincecare duty. The authors argue that what these cases have in common, before Philipp, is that they distinguish between a bank making an unauthorised payment by exceeding its mandate, and making an authorised payment in breach of its Quincecare duty.

By contrast, the Supreme Court argued that this understanding rested on the ‘false premise’ that a customer’s agent’s authority was unaffected by the agent’s dishonesty, with Lord Leggatt asserting that ‘[a]uthority to act as an agent includes only authority to act honestly in pursuit of the interests of the principal’. As such, in internal fraud cases, where the customer’s agent issues a payment instruction in fraud of the customer and the bank pays without making reasonable inquiries under the Quincecare duty, the court held that the bank makes an unauthorised payment, and as such is not entitled to debit the payment from the customer’s account.

The result of this analysis is that the Supreme Court found no contradiction between the duty of the bank to execute payment instructions promptly, and the Quincecare duty in the internal fraud context. On this view, the Quincecare duty is an ‘execution only’ duty ‘analogous to the duty to exercise reasonable skill and care to perform obligations that are ambiguous or allow latitude in performance’. From this, the Court reasoned, the payment instructions are undoubtedly that of the customer – and the duty to refrain from executing a valid instruction would conflict with the strict duty to promptly comply with payment instructions.

The authors claim that “the superficial elegance of the Supreme Court’s reasoning belies flaws in the analysis”, and that the duty can only be understood as a “special or idiosyncratic term” implied in law (using the Supreme Court’s own terms). In their view, the duty does not flow from either orthodox principles of banking and agency law, as asserted by the Court, nor can it be justified by policy considerations. As such, the Court failed to justify both the existence and limited scope of the duty in the first place.

They first contend that, contra Lord Leggatt, the traditional understanding of the Quincecare duty was not premised on ‘a mistaken assumption about the effect of dishonesty on an agent’s authority’, but rather that neither the agent’s honesty nor actual or apparent authority are default conditions for the validity of the agent’s payment instructions. Instead, whether a bank’s payment is authorised and binding on the customer turns on the construction of the customer’s mandate. Unless an agent’s actual or apparent authority are conditions of validity for the mandate ‘they are neither here nor there to the bank’s actual authority to make payment on the customer’s behalf’.

However, the Supreme Court took the view that unless expressly provided, “a mandate should [not] be construed as authorising the bank to follow instructions which the agent has neither actual nor apparent authority to give”. This effectively recognised a default term implied in law into customers’ mandates to their banks.

The authors find scant basis for implying such a term in the first place. While the Court held that such a term extends from the principle of apparent authority, the authors claim this puts “the cart before the horse”, because the purpose of construing the mandate is to determine whether the customer agrees to be bound to a payment by the bank.

The authors conclude by reflecting on the implications of Philipp, both for APP fraud and the operation of the Quincecare duty. First, they recognise the possibility that there may be other common law avenues for holding banks liable for APP fraud cases, for instance, as suggested by Lord Leggatt, where a bank receives reliable information from a source that a customer’s payment instruction has been procured by fraud and yet proceeds with payment without making necessary inquiries.

Second, the authors argue the recharacterisation of payment in breach of the Quincecare duty as ‘unauthorised’ has remedial implications. Pre-Philipp, where a bank made an authorised payment in breach of its Quincecare duty, its liability is to compensate for loss caused by the breach. Furthermore, given that the Quincecare duty is recognised in both contract and negligence, contributory negligence was recognised as a defence to the bank’s liability.

Post-Philipp, a payment in breach of the duty is unauthorised and cannot be debited from the customer’s account, as the bank’s debt to the customer remains undiminished. Thus, insofar as the bank has wrongly debited their account, the customer is entitled to have their account ‘reconstituted’ without proving causation. A defence of contributory negligence cannot be relied on by the bank because it is not a defence to a debt claim.

Third, the recharacterisation of the liability of the bank as a debt has practical consequences for an action’s limitation. As recognised by Lord Sumption NPJ in PT Asuransi Tugu Pratama Indonesia TBK v Citibank NA [2023] HKCFA 3, banks have an obligation to pay at the point of a customer’s demand, triggering a cause in action in debt. A bank account may thus be indefinitely dormant without affecting the customer’s right to eventually demand the balance.