Safeguarding Financial Integrity: The Continuing Relevance of the Quincecare Duty
The duty established in the landmark case of Barclays Bank plc v Quincecare Ltd [1] which concerned a bank’s failure to take action when a director defrauded the company’s bank accounts by writing fraudulent cheques, remains a critical weapon in the fight against modern cybercrime for victims trying to recover funds in transactions involving financial institutions.
What is the Quincecare Duty
The Quincecare duty requires that a bank (and by extension financial institutions, professional services firms and investment businesses) must exercise reasonable care when transacting client’s funds. The duty requires a bank (or other business in control of clients’ funds) to refrain from executing a customer’s payment instructions if the bank is on notice of circumstances that suggest the payment instructions may be fraudulent, improper or could cause the customer loss. In the Quincecare case, Barclays Bank was found liable for losses suffered by a company because it failed to detect and prevent fraudulent payments made by its customer’s director. The court ruled that the bank should have exercised reasonable care by questioning the authenticity of the transfer requests and holding off executing the transfers until the bank was certain they were not fraudulent. A similar duty was found in an Australian case pre-dating Quincecare, Ryan v Bank of New South Wales[2], where it was held that a bank must refrain from processing a transaction if, based on a reasonable assessment by a banker, it is evident that the customer would object to the transaction proceeding if the customer had been fully informed of all pertinent details surrounding the transaction which known to the bank at the time of the transfer.
Conflict with a Banks Mandate:
Pursuant to the contract between bank and customer, a bank can be held liable for the loss suffered by a customer if the bank does not complete a transaction directed by the customer as soon as practicable. The bank’s mandate defines the contractual terms of the authority and instructions that may be given by a customer to the bank regarding the management of the customer’s accounts and transactions. The bank’s mandate typically specifies who within an organisation has the authority to issue instructions to the bank (eg: account signatories), what types of transactions they can authorise, and any limits or conditions placed on these transactions.
The Quincecare duty interacts with the bank’s mandate insofar as the bank must ensure that it acts in accordance with the customer’s mandate when processing transactions but also exercise reasonable care when acting on those instructions. If a bank receives payment instructions that are outside the scope of the mandate or appear to be fraudulent, it may give rise to an obligation on the bank to inquire further before executing the transfer instructions. Justice Steyn in Quincecare, interpreted the bank’s dual duties of the duty to execute valid payment orders promptly[3] and the duty to exercise reasonable care in executing such orders, as follows:
- “A bank owes a duty to exercise reasonable skill and care in and about executing the customer’s orders. That duty “must generally speaking be subordinate to the bank’s other conflicting contractual duties”[4].
- However, “If the bank executes an order knowing that it was dishonestly given, shutting its eyes to the obvious fact of the dishonesty, or acting recklessly in failing to make such inquiries as an honest and reasonable man would make, no problem arises: the bank will plainly be liable” [5].
- “A banker must refrain from executing an order if and for as long as the banker is ‘put on inquiry’ in the sense that he has reasonable grounds (although not necessarily proof) for believing that the order is an attempt to misappropriate the funds of the company…”[6]
Key Factors in Assessing the Duty:
Justice Steyn outlined several factors in Quincecare which may give rise to a finding that a bank had reasonable grounds for believing a transaction is an attempted misappropriation or a fraudulent transaction:
- the bank’s knowledge about the signatory;
- the amount involved (e.g. an unusually large amount);
- the need for prompt transfer (without explanation);
- the presence of other unusual features;
- the scope and means for making reasonable inquiries; and
- the location of the receiving bank.[7]
In order to determine whether a bank is on notice of a potentially fraudulent transaction, Steyn J held: “When judging whether a bank has been put on inquiry, it is the external standard of the likely perception of an ordinary prudent banker that is the governing one.”[8]
In Quincecare the fraudulent transfer in question concerned a corporate customer, it was a case where the director misused his authority for his own benefit rather than having an absence of authority. The court held that the bank overlooked that the agent acting fraudulently in furtherance of his own interest did not remove the agent’s ostensible authority being his title as a director of the Company, but it did remove the agent’s actual authority as a signatory to the account.
Modern Development of Quincecare: Philipp v Barclays Bank UK plc [2023] UKSC 25
Quincecare was considered in the 2023 UK Supreme Court decision in Philipp v Barclays Bank, [9] , which affirmed the continued application of the Quincecare duty in the modern banking landscape by applying the duty to the circumstances of an Authorised Push Payment (APP) fraud, where the victim is duped into completing a transaction using their own account and login credentials. In Philipp the victim made transfers in response to telephone instructions of fraudsters who had convinced the victim that criminals were trying to access their accounts (as distinct from being hacked and the transaction being completed by the hacker without the account holder’s involvement).
In Philipp, the claimant, Mrs Philipp had banked with Barclays for decades and was regarded by her bank manager as financially modest. A fraudster who passed off to Mrs Philipp that he was from the “National Crime Agency” convinced Mrs Philipp to transfer £700,000 out of her bank account to two bank accounts in the UAE. Mrs Philipp made a claim against Barclays Bank, alleging the bank breached their Quincecare duty as there were reasonable grounds for the bank to suspect fraud.
It was held in Philipp that whilst there were circumstances which would cause a reasonable banker to make inquiries[10] based on the type of transactions Ms Philipp was making – to overseas investment accounts – however, there was no reason to believe the transfer instruction from Mrs Philipp herself was fraudulent because even though she was operating under a deception, Mrs Philipps physically visited the bank to instruct her account manager to make the payments. Mrs Philipps’ claim was unsuccessful. In Phillip, the bank attempted to warn Mrs Philipp that she may be the victim of a fraud and she refused to heed the bank’s advice.
Whilst the Plaintiff was unsuccessful in Philip, the modern application of the Quincecare duty to APP case where banks typically blame the customer for initiating the transaction, means it is open to a Court to find that if there were enough “red flags” around a transaction, a financial institution should put a hold on a suspicious transaction (even in the face of a direction from the customer to make the payment) or risk being held liable for the customer’s loss.
The Philipp decision significantly expanded the scope of Quincecare in the UK, prompting the Supreme Court to assess its applicability when the customer directly provides instructions, rather than through an agent, even when the customer is not a corporate entity. The ruling also explained the interaction of the bank’s mandate and the consequences for the bank and customer if the transaction was not authorised by the customer by holding:
“Where a bank is “put on inquiry” in the sense of having reasonable grounds for believing that a payment instruction given by an agent purportedly on behalf of the customer is an attempt to defraud the customer, this duty requires the bank to refrain from executing the instruction without first making inquiries to verify that the instruction has actually been authorised by the customer. If the bank executes the instruction without making such inquiries and the instruction proves to have been given without the customer’s authority, the bank will be in breach of duty. It will also in making the payment by acting outside the scope of its own authority from the customer and will therefore not be entitled to debit the payment to the customer’s account.”[11]
The Philipp judgment clarified that a bank’s duty of care and skill cannot independently justify withholding or refusing to execute a valid payment order. If an instruction is authorised by the customer and the mandate leaves no room for discretion, the bank must make the payment and the existence of a duty of care will not excuse the bank from performing the customer’s mandated transfer instruction.[12].
Ryan v Bank of New South Wales [1978] VR 555
Since 1978 Australian Courts have recognised the “Ryan” duty which is similar to the Quincecare duty in the UK. The Ryan duty requires banks to refrain from executing transactions if a reasonable banker, fully considering the circumstances, would know that the customer would not want it to proceed had they been informed of all relevant details of the transaction which were known to the bank. Although the Ryan duty didn’t assist the claimant due to the customer’s participation in assisting the solicitor in a “cheque floating” operation, the Ryan decision sets an important standard for the duty owed by a bank to its customers where red flags existed around a transaction.
The Ryan duty was endorsed in the Philipp decision as stated at [107], “The possibility of a further implied limitation is suggested by the Australian case of Ryan v Bank of New South Wales [1978] VR 555, 579, where McGarvie J pointed out that there can be circumstances in which a person who has a duty to execute an order given by another person would not reasonably be expected to comply literally with the order”. At [108] Lord Leggatt held “Applying this principle to the situation where a bank receives a payment instruction, McGarvie J held that the bank should not comply with the instruction “if a reasonable banker properly applying his mind to the situation would know that the [account holders] would not desire their orders to be carried out if they were aware of the circumstances known to the bank”:
Although the Ryan duty did not assist Mrs Philipp even though the bank was aware of the significant and unprecedented amount of money received and transferred by her, along with the fact that the recipient was a first-time payee holding an overseas bank account, the specific reference to Ryan in the UK Supreme Court in 2023, affirms its ongoing relevance in modern banking (and electronic funds transfers of client’s funds by professionals).
In Ryan it was held by McGarvie J: “if a reasonable banker properly applying his mind to the situation would know that the [account holders] would not desire their orders to be carried out if they were aware of the circumstances known to the bank”.[13]
In Ryan, due to the Plaintiff participating in the cheque floating transactions with the defalcating solicitor, the bank’s knowledge of a potential fraud being committed was beside the point because the Court concluded: “The reasonable bank manager properly applying his mind to the situation would have known that if all circumstances known to him were known by the plaintiffs, the plaintiffs would still desire those cheques to be paid”.[14]
Role of the Quincecare Duty in Australian Jurisprudence
The Quincecare duty, has also been explicitly applied in Australia through cases such as Sansom v Westpac Banking Corporation (1995) and National Australia Bank v Meeke [2007]. While its full application is yet to prevail in successfully indemnifying an applicant in Australia, its development and relevance in banking mandates signify a significant shift in legal standards.
In Sansom, the New South Wales Court of Appeal referenced the Quincecare duty to determine if Westpac breached its duty of care to its customer. The court examined whether the bank had knowledge of facts that would reasonably indicate fraud or irregularity[15]. Similarly, in National Australia Bank v Meeke, Jenkins J acknowledged the Quincecare duty, stating that a bank’s duty to make inquiries is triggered only when alerted to a risk of fraud. The court held that the bank did not breach its duty of care as there were no such alerts present.[16]
The evolution of the Quincecare duty in Australian jurisprudence provides relief for individuals defrauded as rather than requiring proof that the bank’s reasonable inquiries could have altered the outcome, the focus shifts to demonstrating that the bank should have been aware of red flags indicating fraud or irregularity and stopped the transaction. This shift in burden alleviates the evidentiary burden on the defrauded party and underscores the duty of banks to remain vigilant in detecting and preventing fraudulent activity.
The Quincecare duty remains a formidable weapon in the recovery of funds in cybercrime cases where the financial institution did not exercise reasonable care in the face of red flags surrounding the transaction. The duty places an obligation on financial institutions to exercise due care when handling clients’ funds, particularly in cases involving suspected fraud or irregularities and includes online transactions.
[1] Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 39.
[2] Ryan v Bank of New South Wales [1978] VR 555.
[3] Bodenham v Hoskins (1852) 21 LJ Ch 864.
[4] Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363, at p. 376.
[5] Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363, at p. 376.
[6] Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363, at p. 376.
[7] Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363, at p. 377.
[8] Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363, p 376.
[9] Philipp v Barclays Bank UK plc [2023] UKSC 25.
[10] Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 39, 377 [a-b].
[11] Philipp v Barclays Bank UK Plc [2022] EWCA Civ 318 at [97].
[12] Philipp v Barclays Bank UK Plc [2022] EWCA Civ 318.
[13] Ryan v Bank of New South Wales [1978] VR 555 at [107].
[14] Ryan v Bank of New South Wales [1978] VR 555 at [588].
[15] Sansom v Westpac Banking Corporation (1995) NSW ConvR 55-733.
[16] National Australia Bank v Meeke [2007] WASC 11 at [453].