Who carries the can when bank depositors are scammed?

As New Zealand steps further into the world of digital and open banking, banks are wrestling with the need to process customers’ payment transactions promptly, against the backdrop of increasingly frequent and varied banking scams.

The much-anticipated decision from the UK Supreme Court in the Philipp v Barclays Bank UK plc¹ litigation provides some clarity for banks, while highlighting the need for a concerted and considered policy approach to the growing problem of bank customers losing much or all of their life savings to these scams.

In this Brief Counsel, we outline the impact of the UK Supreme Court decision for New Zealand banks. We also discuss how New Zealand might strike the balance between the interests of banks and depositors in responding to scams at a policy level, and highlight some other recent international decisions of note concerning banks and the “Quincecare duty”.

The context

The Court of Appeal had held it was arguable that a bank is under a duty not to carry out a customer’s instructions to transfer funds if it has reasonable grounds to believe that the customer is being defrauded.²

The Supreme Court overruled this, finding that it was inconsistent with a bank’s “basic” and “strict” duty to carry out its customers’ payment instructions.³

The Supreme Court judgment

The Supreme Court ruled that:⁴

The Quincecare duty arises only in circumstances where the bank is “put on inquiry” (in the sense of having reasonable grounds for believing) that a payment instruction it has received from an agent may not be a valid instruction from the customer;
In such a case the bank must refrain from executing the instruction without first verifying that the customer has authorised it;
That principle applies to any situation where an agent acts for a principal, not just in respect of corporate customers. For example, it will apply where under a mandate for a joint account, either account holder has power to bind the other;
Where there is no question as to the validity of the client’s payment instruction, the bank must carry out the instruction promptly. It is not for the bank to concern itself with the wisdom or riskiness of its customer’s payment decisions.

The decision emphasises the primacy of the contract between banker and customer (rather than wider policy considerations) as the source of the bank’s duties.

The Philipp case

As we wrote last year, the Quincecare case and subsequent decisions established that a bank must not execute a customer’s order to pay if it is “put on inquiry”.⁵ That means having reasonable grounds (although not necessarily proof) for believing that an order placed by an agent of its customer is an attempt to misappropriate the funds of the customer.

The plaintiffs in the Philipp case sought to extend this duty to the circumstances of authorised push payment (APP) fraud. The relevant instructions were given not by a defrauding agent of the client, but by the client, Mrs Philipp, who was unwittingly transferring her money away as part of a fraud.

Mrs Philipp transferred approximately £700,000 to criminals who had convinced her they were officials acting as part of a UK National Crime Agency investigation. There was no question that Mrs Philipp herself gave instructions to Barclays to make the transfers. She did so despite the local police coming to the Philipps’ home to tell her and her husband that they were likely being defrauded.

The UK Court of Appeal accepted Mrs Philipp’s argument that, in principle, the bank owed her a duty not to carry out her payment instructions if it had reasonable grounds for believing that she was being defrauded. The Court held the question was one of weighing competing policy considerations to find a balance between a bank’s primary duty to execute a valid payment order, and a bank’s duty to exercise reasonable skill and care when executing such an order.

The Supreme Court decision

The Supreme Court overturned the Court of Appeal’s decision, saying:

The courts are not the right institution to make large-scale policy decisions regarding allocating the costs of the “growing social problem” of bank frauds. Those are matters for legislators and regulators;
Rather, the courts’ job is to interpret the contractual arrangements between the parties. Whether the bank owes a duty depends on what the parties have actually agreed;
As with any contract for the supply of services in the course of a business, there is a term implied by law in the mandate that the bank must carry out the services with reasonable care and skill;
However, that applies only insofar as the mandate gives the bank any latitude in how the relevant services are carried out. This includes a situation where the customer’s instructions are unclear, in which case there is a duty on the bank to clarify the instructions;
But where a bank receives a valid payment order from the customer which leaves no room for interpretation, the bank’s duty is simply to execute the order as instructed. (The main implied limit is where the order would lead to the bank acting unlawfully, namely by dishonestly assisting in a breach of trust or by breaching anti-money laundering laws);
In those circumstances, there is no “competing” duty to exercise reasonable skill and care;
The Quincecare cases have all concerned agents using their apparent authority to defraud their own principals. They are cases where the bank is put on inquiry that the instruction it has received, purportedly from the customer, may not in fact be valid, and is under an obligation to ensure that it does not make a payment that the customer has not authorised;
Where there can be no question that the bank has received a valid instruction from the customer, as in Philipp, the Quincecare duty has no application.

The Philipp litigation is not over yet, as an alternative claim that Barclays did not do enough to recover the relevant funds continues. However, although the Supreme Court did not strike out that claim, it did note that, even if prompt action had been taken, the likelihood that the funds would have been recovered “seems slim”.

Chapman Tripp comment

The Quincecare duty lives on, but its scope and underlying principles are now much more clearly defined. The banking focus can properly be on having processes and policies in place to ensure that, where there are reasonable grounds to doubt that an agent is giving genuine payment instructions from its principal, adequate inquiries are made.

This is particularly relevant as New Zealand increases digital banking and takes its first steps toward open banking. The speed and automation of third-party payment initiation will create concern as well as convenience. Banks need to understand when they might have reasonable grounds to doubt a payment initiation, and what they can do about that practically (or even legally, as the exposure draft Customer and Product Data Bill currently gives very little room to delay or deny an instruction).

Although to date there have been few instances of the New Zealand courts having to consider the legal principles in this area, the Philipp decision will no doubt be highly persuasive here when a case arises. The UK Supreme Court’s emphasis on the primacy of the contract between banker and customer broadly reflects the New Zealand Supreme Court’s approach in Westpac New Zealand Ltd v MAP and Associates Ltd.⁶

In that case the Court decided that a bank, as a matter of contract, has a strict duty to act in terms of its customers’ instructions except where doing so would involve dishonestly assisting a breach of trust. Westpac could have expressly contracted for protection from liability for breach of mandate if it had a reasonable belief or suspicion that implementing client instructions would give rise to a dishonest assistance claim. But because Westpac did not do so, it had no defence to a claim from breach of mandate when it could not show that a breach of trust would actually have occurred if it followed client instructions.

Difficult questions remain

On the other hand, the Supreme Court decision leaves unresolved the very real problem of justice for bank customers who may authorise the transfer of large sums of money on the strength of highly sophisticated scams, the number of which is increasing rapidly and the effects of which can be financially devastating.

The Government’s Computer Emergency Response Team received reports of scams totalling $6m in the first quarter of this year, up 66% from the same period in 2022, and Consumer NZ estimates New Zealanders might be losing $200m per year to scams.

The Philipp Supreme Court did not discount the seriousness of the problem. But its reasoning was informed, at least to some extent, by regulatory interventions in the UK to address the issue. These include:

A voluntary reimbursement code for payment providers adopted in 2019 (which includes APP fraud in certain cases – though not where involving international transfers);⁷ and
A mandatory reimbursement scheme recently legislated by the UK Parliament,⁸ which allows the Payment Systems Regulator to impose a requirement for reimbursement on payment service providers in such “qualifying cases” as the Regulator considers should be eligible. There are various limitations on payment and customer type.

Which raises the question, what might be done in New Zealand to strike the balance between the interests of banks and depositors? Presently, the Code of Banking Practice provides only for reimbursement for unauthorised fraudulent transactions. Short of a mandatory reimbursement scheme imposed by regulators, which raises questions of moral hazard, other possibilities from overseas include:

An initiative in the UK to reduce the incidence of APP fraud by requiring that banks match account numbers to the names of account holders on payment instructions. If the account is held in a name that bears no resemblance to that in the instructions, an alert is raised with the customer.
A digital Fraud Reporting Exchange, a real-time inter-bank fraud detection system which has been developed by Australian banks, to fast-track reporting and intelligence sharing between payment providers, with the aim of improving the odds of funds being traced and returned to customers.

The New Zealand banking system is in the process of modernising, with the implementation of open banking and, eventually, real-time payments. In this new banking world, a well-designed fraud prevention scheme with buy-in from the banks will benefit both bank and depositor. Reflecting this, fraud prevention is a key cornerstone of the design of the API Centre standards and Payment NZ’s real-time payments work.

Other recent international decisions on the Quincecare duty

The Philipp decision reflects an international trend by which courts have limited the application of the Quincecare duty in various circumstances. Though these decisions are yet to become part of the New Zealand legal landscape, like Philipp they may prove persuasive when similar facts arise. They have provided that:

A bank does not owe a Quincecare duty to a person who is not a customer in a contractual relationship with the bank, but who is merely the beneficial owner of funds held in the customer’s account;⁹
Even when the other elements of the duty are made out, it appears there will be limited scope for liquidators to bring claims against a bank that has carried out instructions to make what amount to preferential payments to the customer’s creditors. If the effect of the payments is to reduce the client company’s overall indebtedness, then there is no relevant loss to the company.¹⁰

On the other hand, a recent decision delivered by Lord Sumption in the Hong Kong Court of Final Appeal (cited in, and consistent with, Philipp) has the potential to create a plaintiff-friendly precedent for those who do have a valid Quincecare-type claim.

In PT Asuransi Tugu Pratama Indonesia TBK v Citibank NA, the Court held that a Quincecare-type claim could be brought not only as a claim for breach of duty, but also as a claim in debt.¹¹ The reasoning was that where a bank acts on the unauthorised payment instructions of a fraudulent agent, the debit entries are of no effect, and the bank is liable to reverse them.

Although that may seem a rather technical distinction, if a plaintiff has a choice to bring a Quincecare-type claim as a debt claim, there are two important implications for defending the claim:

There will probably be little scope for the defence of contributory negligence, by which a bank might otherwise try to sheet home some of the losses to a negligent-but-defrauded customer;
A claim in negligence runs from the date of the breach. But a claim in debt runs from the day a demand is made. Accordingly, limitation periods may not start running for Quincecare-type debt claims until well after the date of any wrongdoing, increasing the period of time for which banks have exposure to liability for historical acts.

1. Philipp v Barclays Bank UK PLC [2023] UKSC 25.
2. Philipp v Barclays Bank UK plc [2022] EWCA Civ 318, [2022] QB 578.
3. Philipp v Barclays Bank UK PLC [2023] UKSC 25.
4. See particularly at [97]-[100].
5. Barclays Bank Plc v Quincecare [1992] 4 All ER 363 (QB).
6. Westpac New Zealand Ltd v MAP and Associates Ltd [2011] NZSC 89, [2011] 3 NZLR 751.
7. Contingent Reimbursement Model Code.
8. Financial Services and Markets Act 2023.

9. Per the Privy Council in JP SPC 4 v Royal Bank of Scotland International Ltd [2022] UKPC 18, [2023] AC 461. Prior to this decision, this argument has been raised in New Zealand, but only in the context of a strike-out decision in the Ross Asset Management litigation against ANZ bank – the High Court ruling it would not strike out a claim that such a duty did exist, but would leave the question open for determination at trial (which never came to pass, as the proceeding settled): Scott v ANZ Bank New Zealand Ltd [2020] NZHC 906, [2020] 3 NZLR 145 at [157]-[159].
10. Per the UK Supreme Court in Stanford International Bank Ltd (in liq) v HSBC Bank plc [2022] UKSC 34.
11. PT Asuransi Tugu Pratama Indonesia TBK (formerly known as PT Tugu Pratama Indonesia) v Citibank NA [2023] HKCFA 3.