English High Court holds it ‘arguable’ that banks owe duty of care to protect against APP fraud

About this case:

• Citation:
  [2022] EWCA Civ 318
• Judgment:
  External link
• Court:
  England and Wales High Court
• Judge:
  Birss LJ

Fiona Philipp, the appellant, argued that Barclays Bank owed her a duty of care to be alert to the possibility of APP fraud, referred to in 2018 as the second biggest type of fraud reported by the trade association for the UK banking sector. The Consumers’ Association (Which?) also appeared as an intervening party.

The appeal was heard by the Chancellor of the High Court, Sir Julian Flaux, sitting with Lord Justice Coulson and Lord Justice Birss. Hugh Sims QC appeared for the appellant and Patrick Goodall QC and Alexia Knight for the respondent.

Unworkable in practice

In 2018, the appellant and her husband were persuaded by a fraudster claiming to work for the Fraud Department at HSBC to make two payments of £400,000 and £300,000 to two separate accounts in the United Arab Emirates, ostensibly for protection. Both transfers were made by the appellant at Barclays branches, one in Broadmead and the other in Westbury-on-Trym. By the time the fraud was discovered the money, the bulk of the couple’s life savings, had vanished.

It was the appellant’s position that no safeguarding questions or scam warnings were given on either occasion she had gone in-branch to transfer money, which the respondent denied. She argued that the bank ought to have had procedures in place for the purpose of detecting and preventing potential APP fraud and reclaiming monies subject to it, and thus it was liable either in tort or in contract.

The respondent applied to strike the case out on the ground that the court could decide without a trial that there was no duty of care in these circumstances as a matter of law. A commercial judge accepted the bank’s case that no duty was owed, as the duty contended for by the appellant, involving the use of “impactful” warnings and possible police involvement, was unworkable in practice.

Counsel for the appellant submitted that it was properly arguable that a duty of care, derived from the duty outlined in Barclays Bank v Quincecare (1992) arose in the case and thus the matter should have gone to trial. On the other hand, the respondent argued that such a duty was not a species of the recognised duty to use reasonable care and skill in the execution of a customer’s instructions, in this case limited to the making of the transfer.

Properly arguable

In his judgment, with which the other two judges agreed, Birss LJ noted: “While of course it can be said that the customer did intend to instruct the bank to execute the transfer, even though the bank knew that the customer was doing this under the misapprehension induced by fraud that the transfer was to a safe account when in fact it was to a fraudster’s account, the respondent’s case is that the bank’s only relevant duty to the customer was to pay.”

He continued: “The bank sought to soften this with the submission that the payment would not actually be made in such a case but only because of the bank’s regulatory or anti-money laundering obligations. I do not accept that submission. That a bank in such a case would be liable for breach of duty if it executed the order is, in my judgment, at its lowest properly arguable.”

Addressing whether the duty contended for was unworkable, Birss LJ said: “This issue could not have been decided without a trial. There is ample evidence to make it arguable that the duty of care contended for would be neither unworkable nor onerous in terms of banking practice in March 2018. That evidence is further supported by the new material filed by the intervener.”

He went on to say: “The key is the careful calibration of the Quincecare duty itself. It is a duty conditioned by whatever ordinary banking practice is at the relevant time. A finding that the facts of Mrs Philipp’s case would, when considered alongside ordinary banking practice in March 2018, have put an ordinary prudent banker on inquiry about APP fraud, simply does not mean that the circumstances associated with any one of the many millions of low value BACS transfers would do so.”

Birss LJ concluded: “The duty of care identified in Quincecare, which is a duty on a bank to make inquiries and refrain from acting on a payment instruction in the meantime, does not depend on the fact that the bank is instructed by an agent of the customer of the bank. That is the only legal conclusion necessary to resolve this appeal. It follows from it that it is, therefore, at least possible in principle that a relevant duty of care could arise in the case of a customer instructing their bank to make a payment when that customer is the victim of APP fraud. [The] right occasion on which to decide whether such a duty in fact arises in this case is at trial.”

For these reasons, the court allowed the appeal and invited the parties to file submissions on the form of order in due course.