UK Supreme Court decision on £700k APP fraud provides 'certainty' for payment services providers

A UK Supreme Court decision on interpreting the duty of care to customers around payment services and so-called authorised push payment, or APP fraud, has been welcomed as providing considerable certainty for payment services providers, according to coverage of the case by legal experts.

The ruling came in the case of Phillip vs Barclays Bank, regarding a case in which the appellant was duped into sending £700,000 pounds via two transactions to separate bank accounts in the United Arab Emirates - representing the bulk of her and her husband's life savings.

While a lower court found in favour of Barclays Bank, on appeal the case went through the UK system to reach the Supreme Court because of the crucial need for interpretation of a long-standing principle regarding duty of care to customers, known as the Quincecare duty. The interpretation by the Supreme Court was handed down on 12 July 2023.

Walker Morris LLP has commented in Lexology that the case "finally resolves the issue of whether this duty applies where customers authorise transactions as the result of fraud committed against them."

"The Supreme Court ruling that the Quincecare duty does not operate in the context of APP fraud where the customer has unequivocally given the payment instruction (even if this was caused by fraud) will be welcome for payment services firms because:

The Court of Appeal had previously accepted Mrs Philipp's argument that, in principle, this so-called duty could be owed in the context of APP fraud even though there was no dispute that the customer had authorised the transaction and instructed the bank to make the relevant payments.
If upheld, this decision would have led to considerable uncertainty as to the practical steps necessary for a payment service provider to take to avoid a potential liability."

"The basic position of banker and customer is (for now, at least: see below) restored. It is clear that:

So long as a customer's account is in credit, the firm's ordinary obligation, when instructed by its customer to make a payment from the account, is to carry out the instruction and make the payment. Unless otherwise agreed, the firm must execute the instruction and do so promptly. It is not for the firm to consider the wisdom or risks of its customer's payment decisions.
If a payment instruction is given by the customer's agent, who is acting fraudulently, the firm would still generally be entitled to rely on the ostensible authority of the agent unless it has reasonable grounds to suspect that the instruction is an attempt to defraud the customer and is therefore given without the customer's authority.
These issues do not arise where there is no agent involved or any question about the absence of authority from the customer. In those circumstances, the firm's duty is to execute the instruction promptly. Any refusal or failure to do so will be a breach of the ordinary obligation of the firm."

However, despite this particular ruling, it is not the end of the story as far as APP fraud is concerned. As law firm Cleary Gottlieb notes in its review of the case outcome: "The Supreme Court has left it to regulators and lawmakers to address APP fraud and legislative and regulatory reforms are already underway."

"The recently-passed Financial Services and Markets Act 2023 enables the UK's Payment Services Regulator (PSR) to introduce a new reimbursement requirement that will require payment service providers to reimburse eligible customers who fall victim to APP fraud when making payments via the UK's Faster Payments System (FPS). The FPS processes most internet and telephone banking payments in the UK, and as noted by the PSR, APP fraud most commonly occurs in relation to Faster Payments. The reimbursement requirement will apply to payment service providers that support Faster Payments (which includes most high-street banks and building societies), and in most circumstances the cost of reimbursement will be shared 50:50 between the sending and receiving payment service providers. Customers eligible for reimbursement will include consumers, microenterprises and charities. The PSR is now consulting on certain aspects of the new reimbursement requirement, which is due to come into force in 2024."

Details of the FSMA 2023 are available here: https://www.legislation.gov.uk/ukpga/2023/29/contents/enacted