Return of the APP Hydra: Quincecare liability rears its head again

In a decision that is likely to be of concern to all payment service providers (PSPs) and of interest to all consumers who have fallen victim to authorised push payment (APP) fraud, the Court of Appeal has allowed an appeal against the High Court's summary judgment in Philipp v Barclays Bank UK plc (see our previous Insight). The High Court decided that there could be no PSP liability where the APP arose from the customer's own instructions. The Court of Appeal has overturned this decision, deciding that, in principle, such a duty could arise and the case should therefore proceed to trial. 

APP fraud

An APP fraud arises where a fraudster tricks a payer, often an individual consumer or a micro-enterprise, to instruct their PSP to send money from their account to an account controlled by the fraudster. This means that, from the PSP's perspective, the payment is "legitimate" as it was authorised by the customer, but the reality is that the customer has been scammed.

The Quincecare duty

The Quincecare duty of care requires PSPs to refrain from executing a payment instruction from a customer if they have reasonable grounds to believe that the instruction arises from a fraud. 

In the Philipp case, Barclays clearly had concerns as they had challenged the customer several times on the reasons for the transaction. Barclays applied for summary judgment and the High Court concluded, based on the guidance from previous cases, that the duty was limited to protecting corporate customers or unincorporated associations such as partnerships, where the instruction had been given by an agent of the customer.

Mrs Philipp appealed and the Court of Appeal allowed the appeal, deciding that the Quincecare duty did not necessarily require instructions to have come from an agent, and concluding it was arguable that the duty could arise in any case when a bank had reasonable grounds to believe that there was a fraud, including where the instructions came from the customer themselves. 

The appeal was only on that point of law, with the outcome being that the High Court's summary judgment decision has now been overturned. There has not yet been any substantive determination of whether such a duty arises on the actual facts of the case and it has now been sent back to the High Court for trial. The outcome of that decision could be significant.

Significant financial impact

In the first half of 2021, APP fraud cases topped £355 million (up 71% compared to the first half of 2020) per UK Finance figures, overtaking card fraud losses for the first time.

Although the biggest banks signed up to an APP voluntary banking code in 2019, providing for refunds to customers unless they were "grossly negligent", less than 45% of losses get refunded each year. Against this backdrop, the Payment Systems Regulator (PSR) is consulting on a package of measures to tackle APP fraud and protect victims, including a requirement for PSPs to publish data on scam, reimbursement and repatriation levels (CP21/10, November 2021). The PSR also supports the government's intention to "legislate to address any barriers to regulatory action at the earliest opportunity”.

PSPs should be aware of the risk that, if Mrs Philipp is successful at trial, there could be a potential "floodgates moment" for victims of APP fraud to seek redress from their PSP. 

A significant number of APP fraud cases are dealt with by the Financial Ombudsman Service (FOS) which is a free and independent service for consumers to resolve complaints with financial institutions, without having to pursue expensive litigation. Although the sums involved in the Philipp case were significant, most APP frauds will involve much smaller sums. Therefore, PSPs will need to consider whether it would be more cost effective to refund customers with smaller APP fraud claims in order to avoid litigation and/or incurring the £750 FOS case fee payable by firms on all complaints, regardless of the outcome.

The FCA's new consumer duty 

The FCA's new consumer duty is in the final stages of consultation with new rules due to be published by the end of July 2022. In particular, it requires that firms should "avoid causing foreseeable harm" to retail customers. You can find out more about the consumer duty in a recent webinar presented by Osborne Clarke experts.   

If the Quincecare duty also bites, so that PSPs are liable if they have "reasonable grounds" to believe that a fraud has arisen, there is a real risk that – for certain classes of customers – PSPs could be caught by both the regulatory and legal frameworks. It is possible firms may look to limit or exclude the duty under their terms and conditions with customers, particularly in a business-to-business context; attempting to limit or exclude the duty when dealing with consumers is likely to be very difficult and susceptible to challenge.

Osborne Clarke comment

As we have noted previously, the Quincecare duty presents specific challenges to fintechs.

In light of the possible development of the Quincecare duty and in advance of the new consumer duty coming into force, PSPs should take steps to ensure that their systems and controls to detect red flags associated with a customer's payment instructions are sufficiently robust.    

If you would like to discuss these issues further, please contact one of our experts listed below or your usual Osborne Clarke contact.