England and Wales Court of Appeal (Civil Division) Decisions

You are here: BAILII >> Databases >> England and Wales Court of Appeal (Civil Division) Decisions >> Philipp v Barclays Bank UK Plc [2022] EWCA Civ 318 (14 March 2022)
URL: http://www.bailii.org/ew/cases/EWCA/Civ/2022/318.html
Cite as: [2022] EWCA Civ 318, [2022] Bus LR 353, [2022] 2 WLR 872, [2022] WLR(D) 121, [2022] QB 578

[New search] [Printable PDF version] [Buy ICLR report: [2022] Bus LR 353] [View ICLR summary: [2022] WLR(D) 121] [Buy ICLR report: [2022] QB 578] [Buy ICLR report: [2022] 2 WLR 872] [Help]

		Neutral Citation Number: [2022] EWCA Civ 318
		Case No: CA-2021-000501 (Formerly A4/2021/0509)

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM High Court Business and Property Courts of
England and Wales, Circuit Commercial Court (QBD)
HHJ Russen QC
CC-2020-BRS-000004

(Formerly A4/2021/0509)
Royal Courts of Justice
Strand, London, WC2A 2LL

14/03/2022

B e f o r e :

THE CHANCELLOR OF THE HIGH COURT
LORD JUSTICE COULSON
and
LORD JUSTICE BIRSS
____________________

Between:

	Fiona Lorraine Philipp	Appellant
	- and -
	Barclays Bank UK PLC	Respondent
	- and –
	The Consumers' Association	Intervening Party

____________________

Hugh Sims QC (instructed by Squire Biggs Law Ltd) for the Appellant
Patrick Goodall QC and Alexia Knight (instructed by TLT LLP) for the Respondent
David McIlroy (instructed by Pennington Manches Cooper LLP) for the Intervening Party

Hearing dates: 8th and 9th February 2022
____________________

HTML VERSION OF JUDGMENT APPROVED
____________________

Lord Justice Birss:

There is a recognised kind of fraud called "APP" fraud. APP stands for "authorised push payment". When the customer of a bank is a victim of APP fraud, they have been deceived by a fraudster to instruct their bank to transfer money from their account into an account controlled by the fraudster. It is called a "push" payment as a contrast with "pull" payments. A push payment occurs when the customer instructs the bank to pay money to someone else, whereas with a pull payment, the receiving party instructs the bank to transfer the money from the payer's account (e.g. by direct debit). APP fraud is referred to as "authorised" because, from the bank's point of view, the payment is authorised by the customer.

The question on this appeal relates generally to the question of whether the bank owes the customer a duty of care in these circumstances. Inevitably a lot depends on exactly what question the court is being asked to decide. I believe that part of what went wrong in the court below is explicable by examining what precisely is the issue to be resolved.

The case arises because the claimant (appellant) Mrs Philipp became the victim of an APP fraud in March 2018. Mrs Philipp is a music teacher and her husband Dr Philipp is a retired consultant occupational and public health physician. The couple were thoroughly deceived by a fraudster known as JW. As a result they moved over £700,000 of their savings into an account in Mrs Philipp's name with the defendant (respondent) bank Barclays and then Mrs Philipp instructed Barclays to transfer that money, in two payments of £400,000 and £300,000, to separate bank accounts in the United Arab Emirates. The couple believed that what they were doing was moving the money into safe accounts in order to protect it from fraud. They had been convinced by JW in a series of calls starting in late February 2018 that they were cooperating with the Financial Conduct Authority and the National Crime Agency to bring fraudsters to justice. Part of the deception involved Dr Philipp telephoning what he thought was the Fraud Department within HSBC Bank Plc and being re-directed to JW. On another occasion JW arranged for a different individual to telephone Dr and Mrs Philipp from what appeared to be the NCA's telephone number shown on the NCA website (which JW had encouraged Dr Philipp to look up on the internet). The caller said he had worked with JW for 9 years and that he was a senior person in the FCA who could be trusted.

The first attempt to transfer funds was on 9^th March 2018 when the couple went into the bank's Thornbury branch. That transfer did not go ahead because the bank had problems with the international payment system. Then on 10^th March Mrs Philipp went into the bank's branch at Broadmead in Bristol. The first transfer was made on that occasion. The second transfer took place on 13^th March when the couple went into the Westbury-on-Trym branch. By the time the fraud was discovered the money had gone. It had represented the bulk of their life savings.

There is an issue of fact about whether any safeguarding questions or scam warnings were given on these occasions. Mrs Philipp says none were given but that is not accepted by the bank.

Mrs Philipp brings this action against the bank for breach of duty. On her behalf it is argued that the bank owed her a duty of care at common law in tort or implied into the contract between her and the bank, or by statute under s13 of the Supply of Goods and Services Act 1982. The duty is characterised as a duty to observe reasonable care and skill in and about executing her instructions. It is also said to be a species of the duty identified by the High Court in Barclays Bank v Quincecare [1992] 4 All ER 363.

Part of Mrs Philipp's case is that by March 2018 the bank ought to have had in place policies and procedures for the purpose of detecting and preventing potential APP fraud and reversing or reclaiming moneys subject to it. The full pleaded case as to what the alleged policies and procedures should be is set out below.

The argument is that there are various features of the payments and of Mrs Philipp's situation which would have alerted an ordinary prudent bank to the problem, with the result that what a bank acting with reasonable skill and care would have done in those circumstances is delayed the transfers and asked questions to get to the bottom of what was going on. The details of what is said ought to have taken place do not matter. They include alerting Mrs Philipp to the risks with "impactful" warnings, possibly arranging for a meeting with the police and Mrs Philipp in the presence of a bank employee, and carrying out further investigations. It is then said that the result ought to have been that the risk of fraud would have been revealed and no payments would have been made. Since the payments in fact went ahead the appellant's case is that that was the result of a breach of duty by the bank, making the bank liable (in tort or contract).

There is a separate point arising from a telephone call from the police to the bank two days after the payments had been made but there is no need on this appeal to examine that any further.

The bank applied to strike the case out on the basis that the court could decide without a trial that as a matter of law there was no duty of care in these circumstances. The judge HHJ Russen QC, sitting in the Circuit Commercial Court in the Business and Property Courts in Bristol, accepted the bank's case that it did not owe the duty and so struck out the action. Mrs Philipp appeals with the permission of the judge.

Before the judge the bank also relied on a second ground for striking out, relating to causation. This was on the basis that regrettably Mrs Philipp and her husband had been so thoroughly deceived that they did not trust the police or the bank and were lying to the bank about the purpose of the transfers. Thus even if the steps alleged not to have been taken had been taken by the bank, Mrs Philipp would have gone ahead anyway. The judge decided (judgment paragraph [182]) that even if he rejected the bank's case on duty of care, he would not have decided the causation issue at this stage. It was a matter for trial. There is no appeal from that finding.

The judge summarised the events which happened and the background up to paragraph 71 of the judgment. There is no suggestion he made any error in doing so. Then he addressed the law from paragraph 72. He considered Paget's Law of Banking para 22.52 and then turned to the authorities, starting with Quincecare which recognised what is now called the Quincecare duty. The judge also addressed Lipkin Gorman v Karpnale [1989] 1 WLR 1340 in which May LJ approved Steyn J's decision in Quincecare. Note that Quincecare was decided in 1988 but only reported in 1992. The judge also addressed Tidal Energy v Bank of Scotland [2014] EWCA Civ 1107 which concerned the extent of a bank's obligations when processing a CHAPS payment request. He then turned to Singularis Holdings v Daiwa Capital Markets [2019] UKSC 50 in which Lady Hale summarised the decision in Quincecare at paragraph [1]. I will come back to these cases below.

In his judgment the judge then accurately summarised the parties' arguments from paragraph 84 to 112 and turned to his analysis and conclusions at paragraph 113. The analysis is detailed but the conclusions can be summarised quite briefly. In paragraphs [183] and [184] the judge expressed his conclusion as follows:

"183. One cannot reasonably feel anything other than acute sympathy for Mrs and Dr Philipp who have fallen victim to the dishonesty of JW and any of his partners in crime. They have lost a very significant part of their personal savings to the fraudster.

184. However, it would not be fair, just or reasonable to impose liability on the part of the Bank in respect of the APP fraud perpetrated upon Mrs Philipp. For the reasons expressed above, such liability could only rest upon what I regard to be an unprincipled and impermissible extension of the Quincecare duty."

An important reason why the judge came to that conclusion was that he accepted the bank's submission that the duty contended for by the appellant would be unworkable in practice (paragraph [170]). Similarly he held that it would be commercially unrealistic to expect bank staff to ask the kind of questions contended for by the appellant whenever any payment instruction was authorised by the customer attending the bank in person, regardless of the sum involved (paragraph [171]).

Part of the argument involved references to a "Super-Complaint" made by the Consumers' Association (Which?) to the Payment Systems Regulator (PSR) in September 2016 entitled "Consumer Safeguards in the Market for Push Payments". This Super-Complaint raised the problem of APP fraud. As the judge explains at paragraph [5]:

"A later paper published by the PSR in February 2018 referred to APP fraud as being the second biggest type of fraud reported by UK Finance (the trade association for the UK banking and financial services sector) after card fraud. That paper was produced in anticipation of the banking industry developing a voluntary system for reimbursement for victims of APP fraud which became the Contingent Reimbursement Model Code for Authorised Push Payment Scams ("the CRM Code"). The CRM Code was introduced in late May 2019 and therefore more than a year after the two payments in this case. In any event, the code does not extend to international payments."

Following the judgment, the Consumers' Association (Which?) applied to intervene in this appeal. Permission was given by Males LJ and so a bundle and skeleton argument for the intervener was filed. At the hearing of the appeal, as well as the submissions of Hugh Sims QC for the appellant and Patrick Goodall QC for the respondent, we also heard from David McIlroy for the intervener.

Briefly, on this appeal the appellant submits that it is (at least) properly arguable that a duty of care does arise in this case and that the matter ought to have gone to trial. The duty is a species of the duty arising under s13 or at common law, its existence ought to be seen as a proper application of reasoning which supports the existence of the Quincecare duty or else it should be recognised as a legitimate incremental development of that line of authority.

By contrast the respondent supports the judge and argues that no duty exists in these circumstances as a matter of law. The duty contended for by the appellant is not a species of the recognised duty to use reasonable care and skill in and about the execution of a customer's instructions because that duty only relates to properly interpreting, ascertaining and acting in accordance with those instructions. In the present case Mrs Philipp's instructions were to make the transfer. The Quincecare duty is not relevant because it is only concerned with the proper ascertainment of instructions and arises when the instructions are being given by an agent, usually an agent of a company. If the agent's instructions are vitiated by fraud then the bank has no proper instructions at all, and that is how such a duty, to not do what the bank is apparently instructed to do, can arise. Finally the bank contends that to recognise a duty in this case would impose onerous and unworkable obligations on banks.

The intervener supports the appeal, contending that the court should recognise a duty of care in these circumstances, that the Quincecare duty is unremarkable and that it would be illogical to confine it to companies or agents. The intervener also contends that the bank is wrong to say that the duty would be onerous or unworkable, arguing that by 2018 ordinary banking practice in checking whether customers were victims of fraud was more advanced than was appreciated by the judge. The intervener's bundle included various decisions of the Financial Services Ombudsman (FOS) in APP fraud cases in which the FOS reports that it "upholds about three quarters of customer's 'authorised' scam complaints in the consumer's favour". It is common ground that rather than applying the law, the FOS has a broad discretion in deciding whether or not a bank has acted in a way that is fair and reasonable. The intervener also referred to a voluntary 2017 BSI Code of Practice which sets out guidance and recommendations for banks relating to fraud and financial abuse, including authorised push payment fraud. This includes staff training about understanding risk factors, recognising suspicious transactions and recognising customers in vulnerable circumstances.

Assessment

The correct approach in law to applications for summary judgment is well established. At paragraphs [22]-[23] the judge accurately referred to the principles identified in EasyAir Ltd v Opal Telecom Ltd [2009] EWHC 339 (Ch). These make clear the warning against carrying out a mini trial but also recognise that if a short point of law arises which can be decided because all the evidence necessary to decide it is before the court then the court can do so. The judge also recognised (at [24]) the citation by the appellant of AK Investment CJSC v Kyrgyz Mobil Tel Ltd [2012] 1 WLR 1804, at [84] in which the Privy Council held that (i) it is not normally appropriate to use a summary procedure for the determination of controversial questions of law and (ii) that it is generally desirable that such issues of law are decided on the basis of actual rather than hypothetical facts and with the benefit of detailed argument and mature consideration. I will return to this after addressing the issue of the duty of care itself.

The place to start is paragraph 1 of the 2019 judgment of Lady Hale in Singularis in which the effect of Steyn J's judgment in Quincecare was summarised, as follows:

"In Barclays Bank v Quincecare [1992] 4 All ER 363, Steyn J held that it was an implied term of the contract between a bank and its customer that the bank would use reasonable skill and care in and about executing the customer's orders; this was subject to the conflicting duty to execute those orders promptly so as to avoid causing financial loss to the customer; but there would be liability if the bank executed the order knowing it to be dishonestly given, or shut its eyes to the obvious fact of the dishonesty, or acted recklessly in failing to make such inquiries as an honest and reasonable man would make; and the bank should refrain from executing an order if and for so long as it was put on inquiry by having reasonable grounds for believing that the order was an attempt to misappropriate funds."

By the time the case had reached the Supreme Court the incidence of the Quincecare duty was not in issue. At trial Rose J had held that the bank Daiwa had breached its Quincecare duty on the facts because it had executed transfers of money out of a company's account, which were approved by the individual with authority to give instructions to make such payments, in circumstances in which any reasonable banker would have realised there were many obvious, even glaring, signs that he was perpetrating a fraud on the company. The finding of breach was incontrovertible and the issues before the Court of Appeal and Supreme Court were whether the bank had any defence to the claim. The higher courts rejected those defences. As Lady Hale put it in her conclusion at para 39:

"Daiwa should have realised that something suspicious was going on and suspended payment until it had made reasonable enquiries to satisfy itself that the payments were properly to be made. The company (and through the company its creditors) has been the victim of Daiwa's negligence."

One of the defence arguments rejected was a submission about causation. At paragraphs 22 and 23 Lady Hale considered the judgment of Lord Hoffmann in Reeves v Comr of Police of the Metropolis [2000] 1 AC 360, 368 which draws a distinction between protecting people from harm caused to them by third parties, and harm they inflict on themselves, albeit noting that there were rare cases of the latter in which such a duty is owed. Lady Hale then explained that Quincecare was just such a case:

"23. […] the purpose of the Quincecare duty is to protect a bank's customers from the harm caused by people for whom the customer is, one way or another, responsible. Hence Mr Crow argues that the loss was caused, not by the dishonesty, but by Daiwa's breach of its duty of care. Had it not been for that breach, the money would still have been in the company's account and available to the liquidators and creditors. This was not a case where the company's act came after Daiwa's breach of duty (unlike Reeves, where the prisoner's suicide came after the police's breach of duty). The fraudulent instruction to Daiwa gave rise to the duty of care which the bank breached, thus causing the loss."

Another of the arguments rejected was a submission about attribution of the acts of the individual to the company. At paragraph 35 on attribution Lady Hale said:

"The context of this case is the breach by the company's investment bank and broker of its Quincecare duty of care towards the company. The purpose of that duty is to protect the company against just the sort of misappropriation of its funds as took place here. By definition, this is done by a trusted agent of the company who is authorised to withdraw its money from the account. To attribute the fraud of that person to the company would be, as the judge put it, to "denude the duty of any value in cases where it is most needed" (para 184). If the appellant's argument were to be accepted in a case such as this, there would in reality be no Quincecare duty of care or its breach would cease to have consequences. This would be a retrograde step."

Before us the respondent places emphasis on these two passages (paragraph 23 and 35) in support of the submission that the Quincecare duty is limited to cases in which there is fraud by an agent acting for the customer, because in such a case the fraud meant that there was in truth no authorisation by the customer for the transfer. Therefore, it is submitted, Quincecare does not extend to cases like the present one in which the customer themselves is authorising the transfer, albeit they are doing so as an unwitting victim of fraud and in the belief that the money will go to a safe account, when in truth they will lose it because it will go to the fraudster.

Our attention was also drawn to paragraph 37 in which Lady Hale identified and rejected a submission by the bank in that case that the law should not treat a company more favourably than an individual. So, it might be thought this could undermine one of the arguments of the appellant (and the intervener) before this court that the rejection of a duty of care in the present case would mean that companies will be treated more favourably than individuals.

I reject these submissions. I believe the error at the core of the respondent's case is a simple one. It is undeniable that the factual circumstances of the major cases in which what is now called the Quincecare duty has been considered have involved instructions from a fraudulent agent acting for a company or firm. That is true of the two earlier cases about rubber companies: Selangor United Rubber Estates Ltd v Cradock (No 3) [1968] 1 WLR 1555 (Ungoed Thomas J) and Karak Rubber Co Ltd v Burden (No 2) [1972] 1 WLR 602 (Brightman J); it is true of Lipkin Gorman, which involved the solicitor with gambling debts; and it is true of Singularis itself. Therefore, for example, statements about the purpose of the duty have to be seen in the context of the case in which they were made. However what matters is the reasoning in these cases. That reasoning, addressed below, leads to the conclusion that despite the importance of the bank's duty to execute orders promptly, nevertheless the bank does indeed have another duty which operates in tension with that primary duty, such that the bank may be required to refrain from executing an order if and for so long as the circumstances would put an ordinary prudent banker on inquiry. What that amounts to is the existence of "reasonable grounds for believing that the order was an attempt to misappropriate funds" (per Lady Hale in Singularis paragraph 1).

The reasoning in those cases is quite simple. The starting point is the correct identification of the relationship between the customer and the bank in the context of an instruction to pay. The answer is that the bank is the agent for the customer as principal (see e.g. Steyn J in Quincecare at p375 h-j, citing Westminster Bank v Hilton (1926) 43 TLR 124 (HL)). This is not in dispute. Next, one asks a question about the state of affairs if the banker knew that the relevant instruction was an attempt to misappropriate funds. In such a case the obvious answer was that a bank which executed that instruction in those circumstances would be liable. NB, this question is posed irrespective of any question of constructive trusteeship. The issue is about whether the bank, which has a primary duty to execute a payment instruction, and also a duty to use reasonable skill and care in and about executing the customer's orders, would be liable for breach of that latter duty (see Ungoed Thomas J in Selangor at p1608-E to p1609-D, Brightman J in Karak at p628-H to 629-H, Steyn J in Quincecare at p376-d to p377-a, May LJ in Lipkin Gorman at p1356-C to G ^[1], and paragraph 1 of Lady Hale's judgment in Singularis itself). Once that second step is accepted, the final question is then - what lesser state of knowledge will put the bank under a legal obligation? The answer that was given by Steyn J in Quincecare and approved by May LJ in Lipkin Gorman and now expressed by the Supreme Court in Singularis is that if the circumstances were such that an ordinary prudent banker would be "on inquiry" then the duty arises. The duty is not to execute the order while on inquiry, and to make inquiries. The objective standard is expressed in different ways in different cases but they are equivalent: the ordinary prudent banker, the reasonable bank manager, and the honest and reasonable banker are the same person.

It is worth noting that the purpose of the duty identified by this logic is to protect the customer. Although from the bank's point of view one can see that in the cases of instructions by agents, the duty also works for the benefit of the bank to save it from liability caused by acting without instructions, that is not the reason the duty exists. It does not exist to protect the bank.

Crucially the line of reasoning identified does not depend on whether the instruction is being given by an agent. It is capable of applying with equal force to a case in which the instruction to the bank is given by a customer themselves who is the unwitting victim of APP fraud provided the circumstances are such that the bank is on inquiry that executing the order would result in the customer's funds being misappropriated.

Recognising this logic, the position of the respondent bank on this appeal is to attack the application of the second step above to this case. Before this court the respondent submitted that even if a bank actually knew that a customer's instruction to pay was a mistake by that customer resulting from the fact that they were the unwitting victim of APP fraud, nevertheless the bank's only duty to the customer would be to execute the order. In other words while of course it can be said that the customer did intend to instruct the bank to execute the transfer, even though the bank knew that the customer was doing this under the misapprehension induced by fraud that the transfer was to a safe account when in fact it was to a fraudster's account, the respondent's case is that the bank's only relevant duty to the customer was to pay. The bank sought to soften this with the submission that the payment would not actually be made in such a case but only because of the bank's regulatory or anti-money laundering obligations.

I do not accept that submission. That a bank in such a case would be liable for breach of duty if it executed the order is, in my judgment, at its lowest properly arguable.

As I have explained, part of the argument on this aspect involved reference to the anti-money laundering rules. The point is that in the example the anti-money laundering regulations would likely impose a duty on the bank to report such a transaction. The respondent's point was that that obligation is not a duty the bank owes to the customer, and in fact there are a number of duties banks owe to regulators which they do not owe to customers and the breach of which does not necessarily give rise to liability to a customer. I accept the general proposition, but it does not help. The fact that the bank can be in a situation in which it owes a duty to a regulator which it does not owe to a customer does not answer the question.

The most convincing reason why a bank in the relevant example might not be liable would be if one accepted that the bank's service offered to the customer really was an "execution only" service, and so in effect the respondent submitted on this appeal. However that submission is wrong. The duty to exercise reasonable skill and care, and the duty to execute, are regularly described as being conflicting duties, although it may be more useful to say that they operate in tension. Either way the point is that the cases clearly recognise that the bank's duty to execute the customer's instruction is not absolute but is subject to its duty of care when carrying out those instructions. As Parker LJ put it in Lipkin Gorman at p1376 A-C, the very many cases on the subject, which contain statements such as that a paying bank must pay under its mandate save in extreme cases, or that a bank is not obliged to play amateur detective, are just observations on the particular facts arising in those cases. How, in a given case, the tension between these two duties is resolved will depend on the particular facts. Parker LJ's conclusion, in the context of the facts of Lipkin Gorman, was stated at p1378-B as:

"The question must be whether, if a reasonable and honest banker knew of the relevant facts, he would have considered that there was a serious or real possibility, albeit not amounting to a probability, that its customer might be being defrauded, […]. That, at least, the customer must establish. If it is established, then in my view a reasonable banker would be in breach of duty if he continued to pay cheques without inquiry."

The respondent emphasised that it was not obliged to question or advise on the commercial wisdom or otherwise of a particular transaction, and referred to the judgment of May LJ in Lipkin Gorman on this point. At 1356 May LJ said this:

"The relationship between the parties is contractual. The principal obligation is upon the bank to honour its customers' cheques in accordance with its mandate on instructions. There is nothing in such a contract, express or implied, which could require a banker to consider the commercial wisdom or otherwise of the particular transaction. Nor is there normally any express term in the contract requiring the banker to exercise any degree of care in deciding whether to honour a customer's cheque which his instructions require him to pay. In my opinion any implied term requiring the banker to exercise care must be limited. To a substantial extent the banker's obligation under such a contract is largely automatic or mechanical. Presented with a cheque drawn in accordance with the terms of that contract, the banker must honour it save in what I would expect to be exceptional circumstances."

The respondent emphasised May LJ's reference to the bank's obligation being "largely automatic", however that is not the end of the matter. May LJ then turned to what I have identified as the second step in the reasoning, as follows:

"Mr. Sumption on behalf of the Bank accepted that an objective test had to be applied and that accordingly there had to be some limits of the Bank's entitlement to treat its mandate as absolute. However, he contended that the circumstances in which this was so would be very limited indeed. He accepted that there would be implied into the mandate a term that it should not be given effect to if the relevant transaction was patently dishonest. In so far as any duty to enquire before paying a cheque drawn in accordance with the mandate was concerned, he submitted that this duty could only arise when the transaction on its face was dishonest, but could have an honest explanation if appropriate enquiry was made. Counsel accepted that if a bank knows of facts which a reasonable bank manager would think were probably dishonest then enquiry would be appropriate." [p1356 C-D]

Although based on a concession by counsel, like May LJ I believe that concession was correct. Notably it is expressed in terms wide enough to cover the present case.

Then, May LJ said the following, which is the passage in which he approved of Quincecare itself:

"For my part I would hesitate to try to lay down any detailed rules in this context. In the simple case of a current account in credit the basic obligation on the banker is to pay his customer's cheques in accordance with his mandate. Having in mind the vast numbers of cheques which are presented for payment every day in this country, whether over a bank counter or through the clearing bank, it is in my opinion only when the circumstances are such that any reasonable cashier would hesitate to pay a cheque at once and refer it to his or her superior, and when any reasonable superior would hesitate to authorise payment without enquiry, that a cheque should not be paid immediately upon presentation and such enquiry made. Further, it would I think be only in rare circumstances, and only when any reasonable bank manager would do the same, that a manager should instruct his staff to refer all or some of his customers' cheques to him before they are paid. In this analysis I have respectfully derived substantial assistance from the material parts of the unreported judgment of Steyn J. in [Quincecare]."

The important point is that the bank's obligation is not simply and always to execute every payment instruction of whatever kind unthinkingly. The factual circumstances of a cashier handling cheques in the late 1980s do not need to be compared to that of the respondent's employee in March 2018 in a local branch faced with Mrs Philipp seeking to transfer a huge sum of money out of her account to a payee overseas. An examination of the latter would depend on evidence about banking practice in 2018.

I turn to focus on Verjee v CIBC Bank [2001] Lloyds Rep Bank 279. This is a decision of Hart J which came after Quincecare itself. Although not binding on this court, it was suggested that here Hart J had distinguished Quincecare on the basis that it was concerned with customers who were companies whereas the case before him was about a cheque apparently signed by the account holder. The action was an application to set aside a statutory demand served by a bank against a customer requiring payment of a debt owed by the customer to the bank. The debt arose because the bank had honoured a cheque signed by the customer. The customer claimed that the bank had breached its duty of care owed to him by honouring the cheque in circumstances which, the customer contended, should have put the bank on inquiry that there was something wrong and if they had made inquiries they would have realised that even though it was his genuine signature, he had not actually authorised the payment. The reasons why not, which involved blank cheques allegedly being misused, do not matter. The customer's case failed. Hart J did indeed characterise Quincecare as being concerned with instructions on behalf of companies, but tellingly he did not then conclude that it followed that if the customer was an individual, and even if the bank was on inquiry, it had no duty to do anything.

At p282 Hart J identified the general duty of a banker in relation to cheques as being a duty to pay (assuming there were sufficient funds and so on) and cited Goff J in Barclays Bank v Simms [1980] QB 677 at p 680 for that. However, Hart J then continued as follows:

"It seems to me that if that [Barclays Bank v Simms] is a correct statement of the law it is really conclusive of this case, unless it can be said that there was something in the circumstances which were or should have been present to the bank's mind when the cheque was presented, which should have given it pause for thought.

On the face of it there was, by virtue of the presentation of the cheque, a request for an overdraft in that amount which the bank could choose whether or not to accede to. On analysis it seems to me that the only circumstance that Mr Verjee really relies upon as showing that the bank was somehow in breach of its duty of care to him in deciding to accede to that request, is the fact that he had not previously, in respect of this account, made such a request. But that, it seems to me, is quite insufficient to put the bank on notice that there was something sufficiently odd about the request to suggest the possibility that some fraud was being committed in connection with the cheque."

Thus Hart J's judgment explicitly contemplates that the banker's duty when presented with an instruction to pay made by an individual customer is not unqualified. The point in Verjee was simply that the circumstances were not such as to put the bank on inquiry.

In this appeal reference was made in argument to two passages in Paget's Law of Banking 15^th ed. They are paragraph 22.51, concerning the bank's general contractual duty to the customer, and then paragraph 22.52 concerning the bank's duty in negligence to its customer. The latter passage, set out by the judge at paragraph [72], is uncontroversial. It refers to the agency relationship between the bank and customer when the bank is executing the customer's instructions and summarises the Quincecare duty as a duty to observe reasonable skill and care in and about executing the customer's orders. However, as part of its case that a bank's service is in effect an execution only service, before this court the respondent contended that parts of the earlier passage (22.51) were wrong.

Paragraph 22.51 provides as follows:

"(b) The bank's general contractual duty to the customer

22.51 The bank is under a duty to obey the customer's mandate. Where the bank acts outside the mandate, eg transmitting a payment message to the wrong bank, to the wrong payee, or in the wrong amount, it cannot debit its customer's account.

The doctrine of strict compliance, which applies to documentary credit transactions, has been held not to apply to a customer's instruction to transfer funds. Where payment is not made at all, or is made only after a delay, the originator's bank does not act outside its mandate. In such cases the originator's bank will only be liable for the customer's consequential loss where this is caused by its own negligence or that of its employees or agents."

The respondent did not criticise the first sub-paragraph nor the first sentence of the second sub-paragraph. However it submitted that the latter part of the second sub-paragraph, for which Paget cites no authority, is wrong because when a customer gives an instruction to the bank to pay the bank is required to make the payment and would be liable if it delayed the payment or did not make it at all. The logic of it is that the Quincecare duty, as interpreted narrowly by the respondent bank as limited to cases of instructions by agents, is therefore not really an exception to the proposition that a bank must always obey the customer's instruction. The argument is that if the agent's instruction is an attempt by the agent to misappropriate its principal's funds, as in Quincecare, the bank does not in fact have an instruction from the true customer at all and therefore is not in breach of a genuine instruction by delaying and making inquiries or refusing it altogether.

The researches of counsel indicated that the passage has been in Paget since at least 2003, but no authority has ever been given for it. There was also a suggestion that Tidal Energy (Lord Dyson paragraph 57) supported the passage but I do not believe that is quite right. What Lord Dyson was addressing in Tidal Energy was that a customer instructing the bank to make a payment via a particular payment system (CHAPS) was taken to be instructing the bank to do so in accordance with that system's rules and usages.

The respondent's submission about Paget has the merit of consistency, in recognising that, as stated, Paget paragraph 22.51 is not consistent with the respondent's case because it is not limited to cases of instructions by agents. However, in the end, for the reasons I have already explained, I believe that the respondent's case about the scope of the Quincecare duty is wrong and further consideration of Paget paragraph 22.51 does not matter.

I will also mention briefly the Scottish first instance decision of Sekers Fabrics v Clydesdale Bank [2021] CSOH 89 (Lord Clark). In this claim the customer was seeking damages against the bank for negligence. The bank applied for summary judgment in its favour but Lord Clark dismissed that application. The judgment of Judge Russen in the present case was referred to. Although the appellant contended that the decision assisted the appeal, as I read Lord Clark's judgment his view (paragraph [22]) was that there were relevant factual differences between the case before him and the case now before this court and so that judgment was not relevant. Nevertheless, it is fair to note that Lord Clark did reject a submission to him that the Quincecare duty should be extended beyond so called "internal fraud" (internal fraud meant fraud arising from an agent of a customer). As I have already explained, it is true that the main cases on this, Quincecare, Lipkin Gorman and Singularis are all concerned with fraud by agents of a customer, but for the reasons set out above, I believe the reasoning in those cases is not limited to those circumstances and can be properly applied on a wider basis.

Finally, in Hong Kong the decision in Luk Wing Yan v CMB Wing Lung Bank Ltd, Coleman J, 5^th March 2021 [2021] HKCFI 279 followed Judge Russen's judgment and held that the Quincecare duty was limited to cases of agents. It was not submitted to us that the reasoning there illuminated any further considerations aside from the ones already put to us. I mention the judgment simply to acknowledge it.

In conclusion, an examination of the reasoning in the cases on the Quincecare duty shows that their logic does not depend on the fact that the bank is instructed by an agent. On the contrary it is ample support for the conclusion that it is reasonably arguable that that duty would arise in any case when a bank was on inquiry that the order was an attempt to misappropriate funds. However before reaching a conclusion there are three other matters which should be addressed: the workability of the duty, the pleadings, and how this case fits into the law on novel duties of care.

(i) Onerous and unworkable?

An important submission of the bank in the court below was that the duty of care contended for would represent an onerous and unworkable burden on banks. The appellant argued to the contrary. Part of the appellant's case before the judge involved the submission of a report of an expert Nigel Brigden, which expressed the view that at the relevant time a reasonably prudent bank would have had adequate measures in place to detect and where reasonably possible prevent APP fraud (paragraph 5.5). Mr Brigden also said that these measures would overlap to some degree with the measures a bank would in any event have in place to detect money laundering.

The judge accepted the bank's argument that the duty would be onerous and unworkable. He was concerned that, as he saw it, there was no clear framework of rules by reference to which the duty might operate, nor any clearly recognised banking code of practice.

Before this court the appellant and respondent repeated the arguments as they were before the judge. The intervener also submitted that the judge was in error in accepting the bank's case that the duty would be unworkable and onerous, arguing that the relevant duty of care would not be onerous because it would reflect current banking practice.

In my judgment this issue could not have been decided without a trial. There is ample evidence, including the report of Mr Brigden and the other material which was before the judge, to make it arguable that the duty of care contended for would be neither unworkable nor onerous in terms of banking practice in March 2018. That evidence is further supported by the new material filed by the intervener.

The existence at the time of at least one voluntary code of practice (the BSI code), lends force to the submission that a duty of care which was triggered by circumstances which would put an ordinary prudent banker on inquiry is practical. So too does the existence of the CRM code. The fact the CRM code came later than March 2018 does not negate that suggestion either, nor does the fact that the CRM code did not apply to transactions paying overseas. The issue is not whether any given voluntary code of practice in fact would have applied in this case. The significance of these codes was as evidence of what is feasible.

The bank has not yet had to file evidence or give anything other than initial disclosure on the issue. The issue clearly involved disputed facts and was not capable of being resolved in a summary way. This point alone is enough to indicate that the court below erred in accepting the absence of the duty of care without a trial.

Related to this the bank had argued (and the judge accepted at paragraph 160) that to impose a duty in the present case would be to hold the bank to a higher standard than the standard of care expressed in Quincecare, which is that of the ordinary prudent banker. I do not accept this either. As the then Chancellor, Sir Geoffrey Vos, put it in paragraph 63 of his judgment in Singularis in the Court of Appeal ([2018] EWCA Civ 84), the Quincecare duty is a carefully calibrated one. That reference to the calibration of the duty reflects Steyn J's careful balancing of countervailing policy considerations at p376-c to 377-a of Quincecare itself. The core of that reasoning was as follows:

"The law should not impose too burdensome an obligation on bankers, which hampers the effective transacting of banking business unnecessarily. On the other hand, the law should guard against the facilitation of fraud, and exact a reasonable standard of care in order to combat fraud and to protect bank customers and innocent third parties. To hold that a bank is only liable when it has displayed a lack of probity would be much too restrictive an approach. On the other hand, to impose liability whenever speculation might suggest dishonesty would impose wholly impractical standards on bankers. In my judgment the sensible compromise, which strikes a fair balance between competing considerations, is simply to say that a banker must refrain from executing an order if and for so long as the banker is "put on inquiry" in the sense that he has reasonable grounds (although not necessarily proof) for believing that the order is an attempt to misappropriate funds of the company [citation of Alliott J in Lipkin Gorman]. And the external standard of the likely perception of the ordinary prudent banker is the governing one."

[my emphasis]

In this regard I also draw attention to the point made by Steyn J in the passage above that the bank's liability is not confined to cases in which it lacks probity. Parker LJ made the same point in Lipkin Gorman at p1377 D-E (noted at first instance by Rose J at paragraph 166 of Singularis ([2017] EWHC 257 (Ch)). However the judge in the present case, e.g. at paragraphs 128 and 129, appears to have taken paragraph 1 of Lady Hale's judgment in Singularis as a conclusion that the Quincecare duty itself was concerned with reckless disregard for a standard of conduct, a want of probity, rather than negligence. I believe that is a misreading of paragraph 1 of Singularis, which expressly provides that a bank should refrain from executing the order if it was put on inquiry "by having reasonable grounds for believing" that the order was an attempt to misappropriate funds, in other words applying a standard of the law of negligence. It would also make the summary paragraph in Singularis out of step with the earlier cases it was summarising.

Unworkable in the particular context of BACS and other payment systems?

Part of the respondent's case that the duty would be onerous and unworkable is to ask rhetorically how the duty alleged by the appellant could possibly work in the context of the huge number of banking transactions executed every day and particularly having regard to the speed of many of these transactions. Reference was made by example to the speed of transfer obligations on banks in the BACS and Faster Payment systems. The argument involves submitting that even if it would seem reasonable to impose a duty in a case like that of Mrs Philipp, if in law there is a duty of care then it will apply across the board and thereby undermine the bank's ability to transact its customers' business in a timely fashion.

I do not accept this as a relevant concern. The key is the careful calibration of the Quincecare duty itself. It is a duty conditioned by whatever ordinary banking practice is at the relevant time. A finding that the facts of Mrs Philipp's case would, when considered alongside ordinary banking practice in March 2018, have put an ordinary prudent banker on inquiry about APP fraud, simply does not mean that the circumstances associated with any one of the many millions of low value BACS transfers would do so.

(ii) The pleadings

The judge attached significance to paragraph 61 of the Particulars of Claim (set out below). He rejected the argument, repeated on appeal, that it is actually concerned with standard of care rather than duty and, in some paragraphs, the judgment is expressed as a conclusion that the duty of care which is rejected is the one advanced in that paragraph.

The Particulars of Claim has a section starting at paragraph 56 entitled "duties", then a section entitled "breaches" which contains two long paragraphs 63 and 64, followed finally by a section on "Causation and losses" starting at paragraph 65.

In the "duties" section, paragraphs 56 – 58 plead:

"56. When executing Mrs Philipp's instructions to make funds transfers Barclays acted as her agent, and as such owed her a duty, at common law, as a term to be implied into the current account and/or agency contract and/or tort, and/or pursuant to section 13 of the Supply of Goods and Services Act 1982, to observe reasonable care in and about executing her instructions.

57. Further, and in particular, it would constitute a breach of such duties if Barclays executed the order of Mrs Philipp having failed to make such inquiries as an honest and reasonable man would make.

58. Further, Barclays were under a duty to refrain from executing an order of Mrs Philipp if and for so long as it was put on inquiry, by having reasonable grounds for believing that the order was an attempt to misappropriate funds from Mrs Philipp."

I must say I think paragraph 57 in this trio is not well drafted in that it could be said to confuse the obligation to make inquiries which a reasonable banker would make if they were or ought to be on inquiry, which is Quincecare, with an obligation simply to make those same inquiries in any circumstances, which is a different issue.

Paragraphs 59 and 60 then make the point that APP fraud was well known to banks such as Barclays in March 2018, and then paragraph 61 is as follows:

"61. In the premises, in order to discharge its duties of reasonable skill and care as pleaded above, Barclays should have had the following policies and procedures in place by March 2018 which included:

(a) For the purpose of detecting potential APP fraud:

(i) Transactional data and customer behaviour analytics incorporating, where appropriate, the use of fraud data and typologies to identify payments that are at higher risk of being affected by an APP fraud;

(ii) Training employees on how to identify indicators of circumstances around and leading to transactions that are at higher risk of facilitating APP fraud;

(b) For the purpose of preventing potential APP fraud:

(i) Measures to identify people who were vulnerable to APP fraud;

(ii) Where an APP fraud or scam risk has been identified, reasonable steps to gather in further information in order to assess the risk, and provide their customers with impactful warnings, including additional measures whether the customer may be considered to be vulnerable;

(c) For the purpose of stopping potential APP fraud:

(i) Where there is or should be concern that a payment may be affected an APP fraud, take action to delay the payment while the matter is investigated;

(ii) Appropriate investigative steps include, where appropriate, seeking written confirmation as to the rationale for the transaction, including from any third party professionals involved, and invoking protocols which it is inferred are in place with the Police to enable further information to be gained from the Police, and investigating recent account activity; and

(d) For the purpose of stopping or reversing or reclaiming monies the subject of a potential APP fraud:

(i) Where there is or should be concern that a payment may be affected by an APP fraud, take action to delay the payment while the matter is investigated;

(ii) Communicating and/or writing to the recipient bank seeking assurances from them that monies will be held or frozen pending any review."

In the Defence the respondent admits paragraph 56 subject to what are for present purposes irrelevant qualifications. Paragraph 57 is denied, and paragraph 58 is admitted in the following terms:

"Paragraph 58 is admitted, in so far as the test is whether an ordinary and reasonable banker would have had reasonable grounds for believing that the order was an attempt to misappropriate Mrs Philipp's funds. It is denied, if it is alleged, that there was an absolute obligation, even in those circumstances, not to execute the Transfers."

Paragraph 61 of the Particulars of Claim is then denied. The Defence makes further points about the detail but they are not germane to the issues on this appeal.

Reading paragraph 61 of the Particulars of Claim in isolation I sympathise with the judge's view. However read in the context of the whole section on duties, I believe it is better to characterise paragraph 61 as being concerned with what ordinary banking practice at the relevant time was in the fulfilment of the duties pleaded in the earlier paragraphs, in other words it is addressed to standard rather than duty per se. Further support for that view is that there is no other paragraph in the Particulars of Claim which sets out the appellant's case on what ordinary banking practice was at the time.

This also illustrates why it was a misstep to attempt to decide on the allegations in paragraph 61 on a summary basis. What policies and procedures banks in fact would have had in place in March 2018 is a question of fact to be decided on the evidence, not a matter of law. For the sake of argument, if it was established that in fact ordinary prudent bankers did have such policies and procedures in place in March 2018, that would tend to undermine the finding by the judge that such activity was unworkable.

If anything, this also goes to show that in cases of this sort, duty of care and standard of care are intertwined, and it is not easy to examine one without the other. All the more reason not to deal with this on summary judgment.

Taking the first transaction as an example. One way of advancing the case for the appellant which ultimately matters, is in two parts. First is to say that certain simple facts were manifest and would in March 2018 have put an ordinary prudent banker on inquiry that the payment being sought was in fact an attempt to misappropriate Mrs Philipp's funds and that she was likely to be the victim of APP fraud. These facts included the account history of Mrs Philipp, the fact that Mrs Philipp was attending in person at a branch which was not her own, the fact she was seeking to transfer an enormous and, in the context of her account, unprecedented sum of money, the fact that the money had only been moved into Mrs Philipp's account a matter of days beforehand, and the fact that the payee was Lambi Petroleum Ltd in the UAE. The second part of the case is to assert that given those facts, an ordinary prudent banker acting with reasonable skill and care would have taken steps to delay the payment and made further inquiries in the meantime. Ultimately if that had happened (which it did not) the payment would not have been made and Mrs Philipp would not have lost the money.

In terms of paragraph 61 of the Particulars of Claim, paragraphs 61(a) and (b)(i) are in effect pleas about the standards of ordinary banking practice in March 2018 which, it is said, would have put an ordinary prudent banker on inquiry in the present case. Then paragraphs 61(b)(ii) and 61(c) and (d) are pleas about what, again as a matter of ordinary banking practice, such a bank which was on inquiry would have done.

Whether this case succeeds at trial or not will depend on the evidence and findings of fact at trial about ordinary banking practice both in terms of what would put an ordinary prudent banker on inquiry and what such a banker would then have done about it if they were. Of course one can always pose a question of duty in the abstract, but another way of looking at this is to say that the relevant duty to do something or refrain from doing something (make inquiries and/or refrain from paying out in the meantime) only kicks in when the circumstances are such that the ordinary prudent banker is put on inquiry. Put that way it is manifest that one cannot decide whether there was actually a duty in this case until one examines the question of fact as to what facts were manifest at the time, and also what facts an ordinary prudent banker would have expected to be aware of. This again illustrates why this case ought not be decided on a summary basis.

Paragraph 171 of the judgment indicates that the judge believed the appellant's case was, or at least had to be, that the duty of care contended for would require staff to question any payment instruction which was authorised by the customer attending the bank in person, regardless of the sum involved. However, that approach presupposes the answer to the factual question of what the bank in this case did actually know about Mrs Philipp and her transaction at the relevant time and presupposes answers to the question of what ordinary banking standards actually were.

I think the judge believed that the whole of the appellant's case came down to an argument that the duty of care in question was a duty on the bank to put itself on inquiry of APP fraud for every payment instruction of any sort in any circumstances. He rejected that. However, as I have tried to show, even if some aspects of the appellant's case are put that way (such as perhaps paragraph 57 of the Particulars of Claim), it is ultimately the wrong question or at least not the only question in issue. Deciding it does not dispose of this action. If, as I believe is at least properly arguable, the law does require a banker to observe the objective standards of what an ordinary prudent banker would do if they were on inquiry that an instruction may be vitiated by APP fraud, then the primary questions in this case are about what facts would put an ordinary prudent banker on inquiry in the first place, and what further inquiries and steps would that ordinary prudent banker have undertaken. In other words, the question the judge asked, perhaps as a result of the way the appellant's case was in part put, led to the wrong answer.

(iii) Novel duty of care?

One aspect of this case was the submission that allowing the appeal would involve either identifying a novel duty of care or at least an unwarranted extension of the Quincecare duty, beyond the limits of the right approach to the development of the law of duties of care. However I would hold that the relevant duty of care in this case, which I have found to be arguable, would be one established by the application of established principles of law (c.f. Robinson v Chief Constable of West Yorkshire Police [2018] UKSC 4 at [30]) rather than being a case in which the court was being asked to identify a duty outside an area of recognised duty of care. That is because the right way of looking at this case is that the Quincecare duty is not limited to agents but applies in any case in which the bank is on inquiry that the instruction is an attempt to misappropriate funds. In Nigeria v JP Morgan Chase Bank NA [2019] EWCA Civ 1641 at paragraph 40, Rose LJ explained that the Quincecare duty itself was one aspect of a bank's overall duty to exercise reasonable skill and care in the services it provides. Also, at first instance in the same case ([2019] EWHC 347 (Comm)) Andrew Burrows QC at paragraph 30 noted that recognising the duty of inquiry aspect of the Quincecare duty, would be in line with sound policy because "in the fight to combat fraud, banks with the relevant reasonable grounds for belief should not sit back and do nothing". The observations of both of these learned judges apply with equal force if the Quincecare duty is not limited in the manner contended for by the bank in the present case.

Conclusion

One of the warnings in EasyAir is to avoid conducting a mini trial. Regrettably I think the judge, encouraged no doubt by the way the case was argued persuasively by the respondent, allowed himself to be drawn into exactly that, particularly on the issue of the onerousness or workability of the duty of care contended for. Although the incidence of a duty of care is a matter of law, when duty and standard of care are so closely related as they are here and, in addition, when the court is being asked to decide whether to develop the law or not, these ought to be indicators that the best course is to bring the matter to trial rather than decide aspects of these points on a summary basis. The case bears out the warning in Kyrgyz Mobile that questions of law of this sort are best decided on the basis of actual facts rather than by a summary procedure.

I would allow the appeal. I express my conclusions in two parts. I hold that as a matter of law the duty of care identified in Quincecare, which is a duty on a bank to make inquiries and refrain from acting on a payment instruction in the meantime, does not depend on the fact that the bank is instructed by an agent of the customer of the bank. That is the only legal conclusion necessary to resolve this appeal. It follows from it that it is, therefore, at least possible in principle that a relevant duty of care could arise in the case of a customer instructing their bank to make a payment when that customer is the victim of APP fraud. The second part of my conclusions is that the right occasion on which to decide whether such a duty in fact arises in this case is at trial. Summary judgment in favour of the respondent bank was wrongly entered and should be set aside.

The parties should file written submissions on the form of order in due course. One matter which the submissions ought to address is what directions this court should make about the trial, for example whether perhaps this court should direct that the trial be before a High Court judge sitting in the Bristol Circuit Commercial Court.

Lord Justice Coulson:

I agree.

The Chancellor:

I also agree.

Note 1 In Lipkin Gorman at p1355-H May LJ criticised passages from Selangor and Karak as stating the common law duty of care too highly. They are the same passages I have referred to but I do so to highlight the chain of reasoning itself, rather than the end point reached in those cases. May LJ employed that same chain of reasoning (and it was employed by Steyn J inQuincecare, which May LJ approved). [Back]