Quincecare qualified? – Paul Brehony and Simon Fawell

Two recent decisions of the English High Court (in Tecnimont Arabia Limited v NatWest) and UK Privy Council (in RBS International v JP SPC4) have made clear that, despite the recent expansion in the so-called 'Quincecare Duty' owed by banks to protect their customers from fraud, it remains difficult for fraud victims to claim successfully against the fraudster's bank.

As a recap, the Quincecare Duty derives from the eponymous Barclays v Quincecare judgment from 1988 (although not reported until 1992) and will be breached where a bank executes payment instructions when 'on inquiry' (i.e. a reasonable banker would have grounds to believe) that the instruction may be fraudulent without first taking steps to satisfy itself that the proposed payment is legitimate. Where there has been a breach, the victim of the fraud in question will be able to claim its losses from the bank.

After years of relative inactivity, the Quincecare Duty has once again become a hot topic. Most notably, the Court of Appeal decision in Philipp v Barclays from March this year effectively widened the scope of the duty beyond where it was previously thought to sit. In that case, the Court of Appeal found that the Quincecare Duty was not restricted to circumstances in which the individual authorising payment did so fraudulently (i.e. the bad actor was internal to a corporate victim and/or its agents) but, instead, could also apply to circumstances where a payment was authorised mistakenly as a result of third party fraud (i.e. the bad actor was external to the victim).

While the practical implications of Philipp v Barclays have yet to be explored fully, not least because the standard of a "reasonable banker" has yet to be considered in detail by the courts, the decision corresponded to the general direction of travel in which banks and other large corporates are being placed under increasing pressure from government and regulators to be vigilant of potential frauds and protect their customers accordingly. This prevailing mood was reaffirmed by a UK Government statement published on 10 May 2022 which set out its intention to introduce legislation tightening the requirements on payment providers to reimburse customers who are the victims of APP (Authorised Push Payment) frauds.

Notwithstanding this, the recent decisions in Tecnimont and in RBS have confirmed that, while the Quincecare Duty may provide fraud victims with a route to recovery from their own banks, the duty on banks does not extend beyond their own customers and it remains extremely difficult for victims of fraud to recover the sums lost from the fraudster's bank rather than their own.

The first of the two rulings to be handed down was that of a heavyweight Privy Council Board in RBS which confirmed that a bank's Quincecare Duty does not extend beyond its own customers and, in the Board's view, was not ripe for extension in that regard. The case concerned a claim by a fund who paid monies into an RBS account in the name of SIOM, described in the fund's Offering Memoranda as the Loan Originator/Manager responsible for disposition and investment of fund moneys. SIOM misappropriated the funds prompting a claim from the fund that RBS owed it a Quincecare-style duty on the basis that the fund was the beneficial owner of the moneys and that RBS was aware of that when it paid the funds out of SIOM's account.

The Privy Council Board found the preceding case law to be clear that the Quincecare Duty arose from the bank's implied contractual duty to its customer to exercise due skill and care when acting upon payment instructions. The bank provided its services not for the benefit of the fund but for the benefit of its customer, SIOM. Accordingly, the bank could not be said to have undertaken a duty of care to the fund.

The fund also argued that, if the bank's Quincecare duty did not already arise in the circumstances, recognition of that duty would represent an appropriate incremental development from existing case law. The Privy Council Board disagreed, noting in particular that the duty contended for would be breached by an omission on the bank's part to protect the fund from fraud and not by a positive act by the bank. In such circumstances, a duty should only be imposed where the defendant has some special level of control over the source of the danger or had assumed a responsibility to protect the claimant from harm. In this instance the bank had no special level of control over SIOM and had not assumed the required responsibility to protect.

In Tecnimont, the claimant took a slightly different approach, pursuing claims against the fraudster's bank for knowing receipt and unjust enrichment, both of which were rejected. The knowing receipt claim was dealt with shortly on the bases that (i) the funds mistakenly transferred by the claimant were not trust property when received; and (ii) the bank received the deposit for its customer and not for its own account. The unjust enrichment claim was rejected because a payment passing through the international banking system was insufficiently direct to constitute enrichment "at the claimant's expense" (a ruling that has potentially wide ranging ramifications for all unjust enrichment claims arising from cross border transactions). The court also ruled that, even if an unjust enrichment claim had been available, the bank would have had a valid 'change of position' defence as, although there were moments where the bank may have been put on inquiry regarding a potential fraud, its conduct was at no point such that it would be unjust to permit it to rely on the change of position defence. These rulings are not the end of the road for victims of fraud seeking to recover from the fraudster's bank where it allowed onward dissipation of the ill-gotten gains despite a potential fraud being flagged. The rulings do, however, close off some of the potential avenues and highlight the difficulties victims face in claiming from the fraudsters' banks. There are other potential argument that could (and will) be put forward but, for the moment, victims of fraud are better looking to their own bank under the Quincecare duty (and, of course, to the fraudster if they can be found!).