Jersey Unreported Judgments

Discovery

[2022]JRC011

Royal Court

(Samedi)

19 January 2022

Before     :

Advocate Matthew John Thompson, Master of the Royal Court.

 

Advocate L. C. Gregory for the Plaintiffs.

Advocate O. J. Passmore for the Defendant.

CONTENTS

		Paras
1.	Introduction	1-2
2.	Background	3-15
3.	Submissions	16-31
4.	Decision	32-51

judgment

the MASTER:

Introduction

1.        This judgment represents my reasons for granting the plaintiffs' application for discovery of the following documents: -

(i)        The defendant's policies and procedures in relation to fraud awareness and Authorised Push Payment Fraud ("APP Fraud");

(ii)       The training undertaken by certain individuals of the defendant in relation to fraud awareness and APP Fraud during a defined period; and

(iii)      Any warnings notices or similar alerts disseminated within the defendant's Jersey branch between specified dates.

2.        The latter order was qualified in relation to the extent of the searches required to be carried out by the defendant.

Background

3.        The following background is taken from the pleadings and a schedule of facts where the parties had sought to identify what factual issues were and were not in dispute.  It is a summary only and is not intended to amount to any definitive findings against either party.

4.        The plaintiffs were customers of the defendant's Jersey branch.  In late 2019 they decided to purchase a property in London and engaged Bedell Cristin to act as their conveyancing lawyers.  The partner responsible was a Mr Jeff O'Boyle.

5.        The plaintiffs paid a deposit in January 2020 to a client account of Bedell Cristin at a bank in Jersey.  The first plaintiff had been provided with details of the client account by Bedell Cristin.

6.        The sale of the property was due to complete on 31^st July 2020.  The balance of the purchase price and disbursements were due on this date.

7.        By an email dated 28^th July 2020 a person or persons unknown purporting to be Mr O'Boyle  ("the fraudster") asked the first plaintiff to send payment of the balance of the purchase price to a bank account identified in an attachment to that email.  The named holder of the bank account was said to be a company called Construction Services Limited and the payee bank identified was HSBC Bank in St Helier.  The first plaintiff therefore instructed the defendant by email to transfer the balance of the purchase price to the bank identified in the email of 28^th July 2020.  That same day before effecting the transfer an employee of the defendant called the first plaintiff to confirm the account details provided by the first plaintiff in reliance on the information given to him by the fraudster. 

8.        On the morning of 30^th July 2020 an employee of the defendant emailed the first plaintiff passing on a query from the defendant's payments team, namely that the beneficiary of the payment was not Bedell Cristin.  The first plaintiff subsequently confirmed this was correct in reliance on the explanation given by the fraudster. 

9.        Later on 30^th July 2020 a second employee of the defendant identified that the account location given to the first defendant did not correspond with the sort code location of the account number itself, which was for HSBC Bank in Leicester.  This discrepancy was brought to the attention of the first plaintiff who suggested that the defendant reply to the sender of an email dated 28^th July 2020.  This employee therefore contacted the sender of the email of 28^th July 2020 who confirmed the account details and payment was then made. 

10.      After payment had been made the email used by the fraudster was noted by the defendant to contain a domain name "bedellcristn" instead of "bedellcristin".

11.      The sequence of events in exchanges of emails had been largely agreed between the parties in the schedule of agreed facts referred to above.  The areas of disagreement relate to what was said in certain conversations between the first plaintiff and various employees of the defendant. These differences are not material for the purposes of this judgment.

12.      The duty pleaded that the defendant is said to owe the plaintiffs is set out at paragraph 4 of the order of justice as follows: -

"4. SCB owed to Mr and Mrs Agarwal contractual and /or customary law duties to act with reasonable skill and care in providing banking services. The standard of care is to be judged by reference to a bank operating in a regulated environment and handling international money transfers, in the context of the known vulnerability of such transfers to fraudulent activity."

13.      The breaches complained of are summarised at paragraphs 20 to 24 of the order of justice as follows: -

(i)        The defendant was on notice that the payment details given by the first plaintiff were not those of Bedell Cristin's usual client account and were on notice that the payment details given by the first plaintiff did not match the bank's location;

(ii)       It was implausible that Bedell Cristin would have set up a company with a bank account in Leicester called Construction Services Limited and with no reference to Bedell Cristin; 

(iii)      The defendant was said to be further on notice that law firms are obliged to keep client monies separate from their own monies and that client transfers are already made to an account including the words "Client Account"; 

(iv)      The bank failed to verify the account details in a way sufficient to discharge its duty of care;

(v)       The bank had failed to notice that the email addresses were not legitimate Bedell Cristin email addresses;

(vi)      The explanation given from the fraudster confirming the account details was implausible and grammatically unusual;

(vii)     The account details were entirely different to those provided previously for the same transaction by Bedell Cristin in relation to the deposit; and

(viii)    The defendant should have been alert to the risk of fraud given that frauds of this kind were not uncommon, especially in connection with property transactions.

14.      The defendant's answer admitted that a duty of care in contract and tort was owed to exercise reasonable skill and care in executing the plaintiffs ' instructions but denied, if it was alleged, that any wider duty was owed.  The level of the  duty of care was that of an ordinary prudent banker against the background of the defendant's general terms of business.

15.      In relation to the alleged breaches the defendant's case is as follows: -

(i)        It denied it was under any duty to identify the fraud;

(ii)       It denied that the defendant failed to exercise reasonable care and skill in executing the Plaintiffs' instructions (or, insofar as relevant, otherwise in providing banking services);

(iii)      The defendant's primary duty was to give effect to the plaintiffs' instructions;

(iv)      It was denied that the defendant was under a duty to second guess instructions or to protect the plaintiffs from the consequences of their own decisions;

(v)       It was denied that the defendant took responsibility for verifying the account details.  Rather the defendant followed the first plaintiff's instructions to query the account details;

(vi)      The defendant was not under any obligation to conduct a forensic review of emails or to identify the missing 'i' in Bedell Cristin; and

(vii)     Having identified the discrepancy in the account details, the defendant followed the first plaintiff's instructions to query the account details in an email to the person the first plaintiff had himself introduced and represented to SCB as his attorney.

Submissions

16.      Advocate Gregory for the plaintiffs argued that the application was essentially the equivalent to an application for specific discovery where the test was whether the documents existed, whether they were relevant and if they did exist and, if relevant, would it be oppressive to produce the same (see CMC v Forster [2019] JRC 04A at paragraph 78.)

17.      The issue between the parties was one of relevance as there was no dispute that the documents existed and there was no real suggestion that to produce the same would be oppressive.  The date range for the requests in any event had been limited to ensure that the request was not oppressive.

18.      The request was also not oppressive because what was sought were policies and procedures in force in relation to the Jersey Branch only and so the defendant was not required to look across its entire organisation for any relevant policies or procedures.

19.      The adoption of policies and procedures to combat fraud was widespread in the banking world and so was part of a bank's duty to act with reasonable care and skill.  This led the plaintiffs to assert in their skeleton argument that the defendant must have adequate anti-fraud policies and procedures in place to protect its customers and must follow those policies and procedures in order to discharge its duty.  The plaintiffs were seeking disclosure of the policies and procedures to explore at trial by reference to those materials why the defendant's employees did not appreciate the fraudulent nature of the emails in question.

20.      Advocate Gregory relied on a recent Scottish judgment Sekers Fabrics Limited v Clydesdale Bank Plc [2021] CSOH 89, where it was held that it was open to argument and therefore required a trial that a bank owed a duty to exercise reasonable skill and care in dealing with communications before payments were authorised.

21.      It therefore followed the nature of the defendant's fraud policies and procedures and the training of employees was part of the relevant factual matrix when determining the nature and scope of the general duty of care owed.

22.      The decision in Phillip v Barclay's Bank UK Plc [2021] EWHC 10 was not relevant for the reasons set out at paragraph 22 of Sekers because the issue in the Phillips was whether or not the defendant had in place a system for detecting and preventing an APP Fraud.  Advocate Gregory was clear that she was not making such an assertion, consistent with her order of justice albeit her skeleton argument at paragraph 18(a) suggested otherwise.

23.      She did contend in oral argument that there had been an assumption of responsibility but accepted that had not been pleaded.  While a draft was produced over the lunchtime adjournment, as the defendant had no time to consider the same I ruled that such an application should be dealt with by way of separate summons.  Ultimately, the proposed amendments were agreed but I reached my decision on the basis of the unamended order of justice.

24.      In response, Advocate Passmore firstly criticised the plaintiffs for taking a different view having previously agreed that any evidence the parties might adduce on the agreed of statement facts would be in the form of affidavit evidence only.

25.      Secondly, the category of documents sought were not relevant to any issue in dispute on the parties' pleaded cases because the plaintiffs were not arguing that the defendant was under a duty to have in place APP Fraud policies and procedures.

26.      This was not a case where the Quincecare duty arose (see Barclays Bank Plc v Quincecare Ltd [1992] 4 All E.R. 363) because that duty was limited to circumstances where a bank was on notice of enquiry that an unauthorised agent of a customer was seeking to misappropriate a customer's funds and therefore that the instruction to debit an account was in fact unauthorised.  The Quincecare duty of care did not therefore impose positive obligations on a bank to address and combat fraud.

27.      He sought to distinguish the Sekers case on the basis that it related to a different duty, namely to exercise reasonable care and skill in communications with a customer which was different from a failure to identify fraud.

28.      The nature of the case being brought was a failure to advise on the risk of fraud.

29.      If I was against Advocate Passmore in respect of his primary submissions, he expressed concern about the proportionately of what was sought if searches had to be made across the entirety of the bank rather than in respect of a specified individual's email account within Jersey.

30.      Advocate Gregory in reply argued that the matters pleaded at paragraphs 20 to 24 of the order of justice summarised above should have placed a bank on enquiry that the transaction might be questionable.  In other words, there was a duty of care owed and an arguable breach of that duty of care prior to the transaction being processed which justified the discovery.

31.      In respect of the argument that the parties had agreed to affidavit evidence only, paragraph 5 of the Act of Court of 1^st July 2021 dealing with discovery and the filing of affidavit evidence also contained a provision allowing the parties to fix a date for a further directions hearing to deal with any further discovery issues.  This followed an express reservation of rights made by Advocate Baker at the hearing on 14^th June 2021 about requiring discovery of policies and procedure.  It was not therefore too late for the court to order discovery to be provided.

Decision

32.      Both counsel were agreed on the relevant test to be applied which I summarised in CMC v Forster at paragraph 78 as follows: -

"78.    In respect of the relevant legal principles on a specific discovery application, there is no dispute between the parties on the applicable tests I have to apply: do the documents exist, are they relevant, and if they exist and are relevant would it be oppressive to produce the same or not.  I applied these principles in Vilsmeier v AI Airports Int. Ltd & PI Power Int. Ltd [2014] JRC 101 at paragraph 9 as follows:-

9.        Generally the test on a specific discovery application is well settled.  The leading case is Victor Hanby Associates Limited v Oliver [1990] JLR337.  The relevant principles in Hanby were cited more recently in Trust Corporation Limited & Ors v Barclays Private Bank and Trust Limited [2007] JRC043.  In summary on a specific discovery application the applicant is required to show:-

(i)        There is a prima facie that the defendant has, or has had, documents which have not been disclosed;

(ii)       Where there is a prima facie case of non-disclosure, the documents in question must be relevant to matters in issue in the case.  Relevance is determined, primarily, by reference to the issues pleaded;

(iii)      If a prima facie case of possession and relevance is made out, the court has to consider whether an order for specific discovery is necessary for disposing fairly of the case.""

33.      This is the test I have applied.

34.      The central question, therefore, as counsel agreed, was whether or not the documents requested are relevant to the issues between the parties.  Relevance is normally determined by reference to the pleaded cases of the parties.

35.      The fact that by the Act of Court of 14^th June 2021 (amended under the slip rule on 1^st July 2021),  the parties agreed to exchange affidavit evidence in relation to various primary facts as set out in the order does not preclude the plaintiffs from bring this application.

36.      This is firstly because paragraph 5 of the same Act of Court contemplated a further directions hearing to deal with any further discovery issues.  This paragraph followed on from an express reservation of rights made by Advocate Baker to bring such an application because at that hearing he suggested that discovery should extend to documents concerning the defendant's internal knowledge and practices relating to APP Fraud.

37.      Secondly, to preclude such an application, simply because the parties had agreed affidavit evidence in my judgment was inconsistent with the overriding objective which includes dealing with cases justly and fairly as well as expeditiously and proportionately.  In this case the present application did not affect the overall timetable set for this case.  The plaintiffs were also entitled to ask for such documents to ensure they were on an equal footing and could advance their case in way they wished to do so.  The fact that primary facts were to be proved by affidavit evidence focussing on areas of disagreement was not a bar to request for discovery seeking material to test the affidavits filed and explore in cross-examination the explanations given by employees and the areas of disagreement between the parties.

38.      Turning now to the question of relevance, this is to be judged by reference to the pleadings which I have summarised above.  In my judgment the way the plaintiffs have mainly pleaded their case is based on a failure to act with reasonable skill and care as set out at paragraph 4 of the order of justice.  The breaches relied upon are those set out at paragraphs 20 to 24 of the order of justice.

39.      I do not consider that the plaintiffs are arguing that the defendant was under a duty to have in place policies and procedures to prevent fraud.  Paragraph 19 of the order of justice states that in failing to identify the fraud the defendant breached its contractual customary law duty of care by failing to exercise reasonable care and skill.  While the distinction between a duty to have polices in place and a breach of a general duty of care by not following procedures may be subtle, it is one that can properly be advanced and may be an important distinction in determination of this claim.

40.      The case of Phillip v Barclay's Bank UK Plc was ultimately about whether or not Barclay's Bank was under a duty to have in place Anti-APP Fraud policies and procedures.  This was clear from paragraph 61 of the particulars of claim in that case quoted at paragraph 75 of the judgment.  This led HH Judge Russen, QC to state the following at paragraph 130: -

"In my judgment, it is therefore clear from all three decisions that the averments in paragraph 61 of the PoC do amount to an invitation to the court to extend the scope of the Quincecare duty beyond its established boundaries. They postulate the need to have in place certain anti-APP policies and procedures as if there were banking rules or standards requiring such. Quincecare establishes that speculation and amateur detective work on the part of a bank have no place in fixing a bank, objectively, with knowledge or belief sufficient to put a payment instruction on hold. Through the obligations asserted in paragraph 61 of the PoC, Mrs Philipp does seek to impose upon the Bank certain professional standards of detective and investigative work, including potential liaison with the police, aimed at establishing whether or not a payment which potentially may have been made in furtherance of an APP fraud really is suspect."

41.      In relation to the request to produce relevant policies and procedures the Judge at paragraph 151 stated the following: -

"151. The decisions in Kennedy v Cordia and Morley v RBS demonstrate that the existence or otherwise of any internal anti-APP policy or manual adopted by the Bank by March 2018 (and worthy of disclosure and interrogation at a trial) can be of no significance to the outcome of the present claim unless Mrs Philipp can first demonstrate the existence of a legal duty which is properly reflected in the obligations alleged in paragraph 61 of the PoC. Like any expert evidence as to the wider practice and standards of banks in the area, such evidence of individual bank practice cannot be used to create the legal duty of care, nor inform the standard of conduct required by it, if one does not otherwise exist." (underlining added)

42.      The following conclusions were then set out at paragraphs 157 to 161 as follows: -

"157. I believe the suggested extension of the duty to support the averments in paragraph 61 of the PoC faces two fundamental problems.

158. The first is that it seeks to elevate the duty, which the decided cases have confirmed, is subordinate or ancillary to the bank's primary duty to act on the customer's instruction as to how the monies in his account should be spent, to a point where too much doubt would be cast over the effectiveness of those instructions. This would emasculate the primary duty and involve the supposedly subordinate duty carrying with it a higher level of obligation (essentially one of second-guessing the instruction) than Steyn J was prepared to contemplate.

159, The second related obstacle is that there is no clear framework of rules by reference to which the duty, as extended, might sensibly operate. In the context of suspected misappropriation of monies by an agent of the customer it is entirely appropriate to use the more general language directed at knowing or reckless disregard of commercially accepted standards of conduct and to hold a bank accountable where it falls below them; albeit for a breach of the Quincecare duty rather than for any dishonest assistance on its part (a point highlighted by the failure of the parallel claim for dishonest assistance advanced in Singularis). But where the duty is said to involve second-guessing the customer's own outwardly genuine instruction, the raising of the suggested safeguarding questions would in my judgment have to be supported by some form of clearly recognised banking code defining the circumstances in which the need for such questions would be triggered.

160. The Quincecare duty is a common law duty which rests upon the more general concept of a bank adhering to standards of honest and reasonable conduct in being alive to suspected fraud. Accordingly, the benchmark is expressed in quite general terms by reference to the standards of the ordinary prudent banker, which Steyn J expressly noted was not too high a standard. I do not accept that the Quincecare duty can properly be used to impose a higher (or more specific) set of standards which dictate that, in certain defined circumstances, the bank is obliged to question the customer's instructions. It is a duty of care framed by concepts of knowledge (actual or constructive) rather than further negligence in failing to follow the rules of some code. If a bank is to be held to the standards of something equivalent to a code for intervention - for present purposes, in the case of suspected APP fraud - then it needs to know its terms. There was no such code in March 2018 and the observation of May LJ in Lipkin Gorman is a clear indication that judges in later cases should not proceed as if a set of detailed rules had been laid down.

161. In my judgment, the observations of Lady Hale in Singularis about the purpose of the duty (in the context of both causation and corporate attribution) have no resonance where the cause of the customer's loss is her own desire to make the payments to their intended recipients. The Supreme Court said nothing about a bank protecting an individual customer (and her monies) from her own intentional decision. If the Quincecare duty was to be supported by matters going beyond the honest and reasonable conduct of the ordinary prudent banker then in my judgment it would have to be by reference to some form of industry-recognised rules from which a bank could identify the particular circumstances in which it should not act (or act immediately) upon its customer's genuine instructions."

43.      To the extent that the plaintiffs seek to argue otherwise, as hinted at paragraph 18 of Advocate Gregory's skeleton argument, or possibly by implication in the plaintiffs' reply, the plaintiffs should not be permitted to argue such a claim at trial.  Rather the question for trial is whether the defendant breached the duty of care alleged to be owed set out in paragraph 4 of the order of justice and not that the defendant should have had in place policies and procedures to prevent fraud.

44.      The court's final conclusions in Philips were set out at paragraphs 172 and 174 and 180 as follows: -

"172. It is because the Bank cannot be expected to carry out such urgent detective work, or treated as a gatekeeper or guardian in relation to the commercial wisdom of the customer's decision and the payment instructions which result, that the duty cannot in my judgment extend to the obligations alleged by Mrs Philipp. A duty which carried with it the need for the Bank to have had in place in March 2018 procedures aimed at potentially protecting its customer from her own decisions would involve the Bank being under just the type of unduly burdensome obligation eschewed by Steyn J in Quincecare.

174. There is in my judgment no proper basis for imposing liability upon a bank in respect of alleged omissions which, viewed from the perspective of the purpose behind the suggested duty to act, really relate to testing the genuineness of the recipient of the monies rather than the genuineness of the instruction to pay the monies."

" 180. In conclusion and for all these reasons, expressed at some length in an effort to do justice to the comprehensive and skilled arguments of both counsel, I find the limits of the Quincecare duty are clear enough for me to be satisfied, on the present application, that the duty does not support a legal obligation to have had in place any of the suggested policies and procedures alleged in paragraph 61 of the PoC. I am not persuaded that the duty extends beyond the situation of attempted misappropriation of the customer's funds by an agent of the customer."

45.      In relation to the Quincecare duty, as both counsel accepted, this duty does not arise in this case because, as noted in Sekers, the Quincecare duty relates to internal fraud (see paragraph 21).

46.      What the present case is about in my judgment is analogous to the issues explored in Sekers.  At paragraph 23 of that decision, Lord Clark concluded as follows: -

"[23] For the reasons given, it is open to argument that in the present circumstances the bank owed a duty to exercise reasonable skill and care in dealing with the communications before payment was authorised..."

47.      I regard the plaintiffs' complaints of breach at paragraphs 20 to 24 of the order of justice as also amounting to an argument that the defendant failed in its duty to exercise reasonable skill and care in dealing with communications before payment was authorised.  The matters complained of all occurred prior to the bank processing the payment and so the complaint in essence is that the defendant should have raised further concerns before processing the plaintiff's instructions.  In reaching this conclusion, I am not discounting the defendant's argument that ultimately it gave effect to the plaintiffs' instructions and that also it is protected against any liability by its general terms and conditions.  Those arguments are however matters for trial.

48.      I was therefore satisfied that the defendant's policies and procedures were relevant to whether or not the defendant's employees exercised reasonable care and skill.  In my judgment the plaintiffs are entitled to test what the defendant's employees did or did not do by reference to their own policies and procedures and what was expected of individual employees by the defendant as their employer.  An exploration of this issue does not mean that a breach of any internal procedures will necessarily mean that a breach of the duty of care alleged by the plaintiffs has occurred.  What conclusions are ultimately reached will be a matter for the Jurats at trial. What provision of the relevant policies and procedures will mean however is that the Jurats have the full circumstances before them and will be able to evaluate the actions of the defendant's employees against the background of what they were expected to do by their employer.

49.      I did not accept there was a distinction between a duty to exercise reasonable care and skill and a duty to prevent fraud in the way contended for by the defendant.  A failure to detect fraud (as distinct from being under a legal duty to have in place policies and procedures to do so) may be a breach of the duty to exercise reasonable care and skill at least in relation to communications prior to giving effect to customer's instruction.  Whether it does so in this case is clearly arguable and is therefore a matter for trial.

50.      As the documents sought by the plaintiffs clearly existed the only other issue that arose was the question of proportionality, I therefore ordered that the obligation to provide any warning notices or similar alerts dissimilated within the defendant between 1^st July 2018 and 1^st August 2020 relating to APP fraud was limited to searching the email accounts of the individuals who dealt with the plaintiffs, and any email accounts of anyone discharging compliance functions within or for the Jersey branch of the defendant.  I did not regard the requirement to carry out these searches as disproportionate or oppressive. 

51.      Without these qualifications the extent of the search obligations did run the risk of creating an unfair and an inappropriate burden having regard to the amount of the claim because it would have involved searches across all employees of the Jersey branch and also searches in other parts of the defendant where warnings or alerts were sent to Jersey.  If warnings or searches were not identified from either those dealing with compliance functions for the Jersey Branch or the employees affected, then they were also unlikely to form part of the relevant procedures or guidance known to the employees concerned.

Authorities

CMC v Forster [2019] JRC 04A. 

Sekers Fabrics Limited v Clydesdale Bank Plc [2021] CSOH 89. 

Phillip v Barclay's Bank UK Plc [2021] EWHC 10. 

Barclays Bank Plc v Quincecare Ltd [1992] 4 All E.R. 363