One year on from the seminal Supreme Court decision in Philipp v Barclays [2023] UKSC 25, the English courts are still grappling with payment processing claims brought by both victims of authorised push payment (APP) fraud and companies subject to an internal fraud by an authorised signatory who has gone rogue.

From the recalibration of payment processing duties to the exploration of novel causes of action, this article offers a snapshot of the current state of payment processing claims in a post-Philipp v Barclays world, offering insights into this rapidly changing area of law.

Recalibration of payment processing duties in Philipp v Barclays

A brief recap on Philipp, which is often mischaracterised. It should be seen as a recalibration of the duties owed by financial institutions processing customer payments, underlining the importance of compliance with a customer's mandate, and making payment promptly when instructed. Naturally, banks owe customers a duty of reasonable skill and care when carrying out this process, but that duty is limited and narrowly confined to interpreting, ascertaining and acting in accordance with a customer's instructions. So, if a payment instruction is valid and clear, the bank must pay the funds away, and the duty (importantly) is not even engaged.

This is the crux of why the Supreme Court struck out Mrs Philipp's claim: the fraud perpetrated on her sat in the background to her valid instruction to her bank. For this reason, any APP fraud claims for breach of the general duty of reasonable skill and care will also fail.

So what then is the so-called Quincecare duty?

Eagle-eyed readers will note the absence of the word 'Quincecare' in the previous section. The Supreme Court in Philipp explained that the so-called Quincecare duty is not a special duty conflicting with the bank's mandate. Rather it is simply an application of the duty of reasonable skill and care when processing customer payments. When does it apply? When the payment instruction is given by the authorised signatory of a corporate customer. Accordingly, this application of the duty was not in play in the Philipp case, which concerned an individual account.

No doubt we will continue to see claims against banks in the classic rogue-agent scenario (as per Singularis Holdings Ltd v Daiwa Capital Markets Europe Ltd [2019] UKSC 50), although future claims may be analysed through a slightly different lens. The question in these corporate cases will be whether the authorised signatory had actual authority or, if the agent was acting fraudulently, whether the bank was negligent in not recognising that the agent was exceeding the scope of their apparent authority. In terms of what this means for future 'rogue agent' cases, the factual investigation will likely be similar to pre-Philipp authorities, but the legal principles at play will likely involve greater emphasis on the importance of the customer's mandate, and focus on the interplay of agency law principles and professional negligence.

Payment processing duties in the context of APP fraud

Returning to soaring APP scams, the Supreme Court in Philipp was alive to the social problem, but said that reimbursement for victims is a question for regulators and government - it is not the role of the courts. And indeed, we now have the new mandatory reimbursement requirement coming into force in October of this year, so payment service providers (PSPs) will still be on the hook for future APP fraud claims up to £415k. However, notwithstanding the regulator's intervention to indemnify APP fraud victims, the courts have seen further attempts to bring APP fraud-related claims based on novel and innovative causes of action. There are three interesting examples to highlight.

The first example involves an APP fraud victim's argument that both the sending bank (holding the account of the victim) and the receiving bank (holding the account of the fraudster) owed a novel 'retrieval' duty to take steps to recover funds after being alerted to a fraud. In CCP Graduate School v NatWest & Santander [2024] EWHC 581 (KB), the High Court refused to strike out the claim against the receiving bank. In the absence of any limitation argument (which prevented an equivalent claim against the sending bank), the court found the retrieval duty was arguable, given the Supreme Court's decision to allow Mrs Philipp's alternative claim to proceed on this ground. CCP does not sit very well with the new mandatory reimbursement requirement mentioned above, which will apply to both sending and receiving PSPs and the bank has been granted permission to appeal. Mapping this claim across to the classic rogue-agent scenario, it could also be argued that the retrieval duty applies in the corporate context, and so we might see so-called Quincecare duty claims coupled with a retrieval duty claim in the future.

Another APP fraud victim has argued that a receiving PSP owed a duty of care directly to him when processing the payment request (Larsson v Revolut [2024] EWHC 1287 (Ch)) (contrast to CCP, which considered a subsequent duty to recover funds after the payment was processed). By coincidence, the victim was also a customer of the receiving PSP (although that genuine account was not part of the fraudulent scheme). However, the court confirmed the so-called Quincecare duty (and presumably therefore the general duty of reasonable skill and care) does not extend to third parties.

Finally, there have been attempts to bring unjust enrichment claims against receiving PSPs, with conflicting results at first instance (Tecnimont Arabia Ltd v National Westminster Bank plc [2022] EWHC 1172 (Comm) and Terna Energy Trading DOO v Revolut Ltd [2024] EWHC 1419 (Comm)). Interestingly, in the more recent of these two claims, the court held that the receiving bank was 'enriched' even though the funds received from the claimant were matched by an immediate balancing liability on the PSP to its own customer. The Court of Appeal should have the opportunity to resolve this conflict, as permission to appeal has been granted.

Conclusion

Philipp brought clarity to the calibration of payment processing duties owed by financial services firms and closed the door to APP fraud victims bringing civil claims for breach of those duties. However, this has not deterred claimants from seeking compensation via the courts, pursuing novel and innovative causes of action against both sending and receiving PSPs. With numerous first instance judgments considering different causes of action and some conflicting High Court authority, appellate guidance is much needed – once again – to bring clarity to this busy area of banking litigation.

 

Ceri Morgan is membership secretary of the London Solicitors Litigation Association and professional support consultant at Herbert Smith Freehills

 

 

Topics