What is a bank's liability to compensate victims of APP fraud?What is APP fraud?APP fraud (or Authorised Push Payment fraud) occurs when a victim is persuaded to voluntarily transfer funds from their own account to another bank account, which is either controlled by a fraudster or to which the fraudster has access. It is called ‘authorised’ because, from the bank’s perspective, the payment has been authorised by the customer. In October 2016, the Consumer’s Association ‘Which?’ made a super-complaint to the Payment Services Regulator, raising the prevalence of APP fraud and concerns regarding consumer safeguards.By 2021, losses to APP scams totalled £583.2m, a 39% increase on the previous year.APP fraud and a bank’s ‘Quincecare duty’Deriving its name from the 30-year-old case of Barclays Bank v Quincecare Limited, the Quincecare duty is an implied contractual term between the bank and its customer that it will exercise reasonable skill and care when executing the customer’s orders. The case considered a bank’s liability for executing banking instructions provided by the customer’s agent, which resulted in the misappropriation of funds from the customer.Quincecare Limited wished to purchase four chemists and ‘X’ approached the bank, which agreed to provide a £400,000 loan to fund these purchases provided that money was loaned to a new company into which X and the new directors had injected a total of £50,000 capital. The bank insisted on a guarantor for the £400,000 loan (‘A Ltd’). ‘X’ instructed the bank that these conditions had been complied with and asked the bank to transfer the loan funds to a firm of solicitors who he said were acting for the new company. Unknown to the bank, these solicitors had previously been instructed by X to send the funds to X’s bank account in America. The solicitors believed this to be a legitimate transaction and complied with X’s instruction, whereupon the funds were misappropriated by X and almost entirely lost. The bank sued Quincecare Limited and A Ltd, who counterclaimed against the bank for breach of duty.Steyn J. held that it is an implied term of the contract between the bank and its customer that it will exercise ‘reasonable skill and care in and about executing the customer’s orders’. What did this mean in practice, when a bank believes it has a co-existing duty to carry out an instruction? Where a bank executed an order knowing that it had been dishonestly given, or acted recklessly in failing to make such inquiries that an honest and reasonable person would make, it was plainly liable to the customer for losses as a result of executing the transaction. But Steyn J. recognised that such cases were unlikely to arise in practice and closer practical consideration was required. He considered that the law should not lend itself to the facilitation of fraud but on the one hand, only to impose liability when there has been a lack of probity by the bank would be too restrictive, whilst on the other to impose liability where there might speculatively be dishonesty would be wholly impractical. Steyn J. settled on a pragmatic formation of the bank’s duty:“In my judgment the sensible compromise, which strikes a fair balance between competing considerations, is simply to say that a banker must refrain from executing an order if and for as long as the banker is 'put on inquiry' in the sense that he has reasonable grounds (although not necessarily proof) for believing that the order is an attempt to misappropriate the funds of the company.”Various other cases have considered the scope of the Quincecare duty. In Singularis Holdings v Daiwa Capital Markets , the Supreme Court upheld the trial judge’s conclusion that the bank could not rely on the “illegality” defence in a claim for breach of its Quincecare duty, because to attribute the director’s misconduct to the company would defeat the essence of the duty. In RBS International v JP SPC 4 the bank’s direct customer was a corporate vehicle through which litigation funding was advanced to solicitors firms as part of a scheme. The claimant was the beneficial owner of those funds, which were misappropriated by the customer. The claimant sued the bank alleging that it owed the claimant, who was not the bank’s customer, a duty to exercise reasonable skill and care to prevent the fraudulent misappropriate of those funds. The Privy Council disagreed, holding that the Quincecare duty only extended to the bank’s customers and not to third parties.Of more immediate relevance to victims of APP fraud, the Court of Appeal in Philipp v Barclays Bank expanded the potential liability of banks to their customers under the Quincecare duty. In this case, a fraudster convinced the account holder herself to make two authorised push payments to accounts in the UAE. The claimant brought proceedings against the bank, which the bank successfully applied to strike out on the basis that although the Quincecare duty applies where the customer’s agent provides instructions in an attempt to misappropriate funds, the duty does not apply where the customer themselves provides the instructions.The Court of Appeal disagreed, stating that the purpose of the Quincecare duty is to protect the customer. Birss L.J. rejected the bank’s contention that it was required to execute the customer’s order even if the bank knew that the customer had been induced by fraud to provide the instruction. In those circumstances, the bank had at least arguably breached its duty to protect the customer, because the bank’s duty to execute the customer’s instruction is not absolute. The bank must do more than unthinkingly execute every payment instruction of whatever kind; the duty arises in any case where the bank is ‘on inquiry’ that the order was an attempt to misappropriate funds. Whether a bank is ‘on inquiry’ will vary according to the facts but the Court did not go on to provide any real practical guidance regarding this issue. While it held that the sizeable transfers in issue (£700,000 in total) could not be compared to the ‘many millions’ of low value BACS transactions that take place, it gave no further clues as to what would put the bank on inquiry—that was a question of fact for the trial judge to consider. The Supreme Court has granted permission to appeal.The Claimant’s pleaded breach of the bank’s duty focused on the bank’s failure in 2018 to implement analytics tools which would identify payments at higher risk, failure to train staff in ‘red flags’, failure to gather information necessary to assess risk, failure to implement measures to delay the payment or investigate the nature of the payment, and failure to implement measures to stop or reverse payments that have been authorised. All of these were said by the Court of Appeal to amount to allegations of ‘ordinary banking practice’ at the relevant time in 2018. Given the age of the relevant transaction, and the progress that has since been made, the significance of this judgment to victims of APP fraud may soon be of only academic interest.CRM—a damp squib?Regulation 90(1) of the Payment Services Regulations 2017, SI 2017/752 (PSRs 2017) currently provides that a payment order executed in accordance with the unique identifier is deemed to have been correctly executed; the Payment Systems Regulator (PSR) has identified Regulation 90(1) as presenting a legislative roadblock to mandating reimbursement to APP fraud victims.The PSR has worked with the banking industry to better prevent APP fraud and to reimburse customers who have been the victim of such fraud. A voluntary reimbursement scheme, the Contingent Reimbursement Model (CRM) Code – was rolled out in 2019 to which ten banking groups are currently signed up. Subject to certain important exceptions which the bank considers applicable (which broadly relate to customers ignoring effective warnings given by the bank, the customer not having a reasonable basis for believing the genuineness of the transaction or otherwise acting grossly negligently), the CRM Code is designed to reimburse customers who either intended to transfer funds to another person but were deceived into transferring the funds to a different person, or who transferred funds to another person for what they believed were legitimate purposes but which were in fact fraudulent. However, the Code does not appear to be working: although the scheme covers approximately 90% of all banking transactions, the level of reimbursement remains below 50%.Although it welcomed the introduction of the CRM Code, HM Treasury wanted to work with the PSR to go further still to protect victims of fraud. On 10 May 2022, the Government published its approach to APP fraud reimbursement, stating:“The government intends to enable PSR regulatory action by clarifying that the PSR may use its existing regulatory powers, as set out in the Financial Services (Banking Reform) Act, to require reimbursement in cases of APP scams in designated payment systems, including Faster Payments. The government intends to introduce this legislative amendment when Parliamentary time allows as part of the Financial Services and Markets Bill.”Hope on the horizon?In July 2022, the Government did indeed publish the Financial Services and Markets Bill 2022-2023, which at the time of writing is at its Third Reading. Clause 64 of the Bill provides a mechanism whereby the Payment Services Regulator (PSR) can exercise its regulatory functions to require banks to be liable for reimbursement of fraudulent transactions conducted over the Faster Payments Scheme. Regulation 90 of the PSR 2017 will be amended to add Regulation 90(6), which clarifies that nothing in Regulation 90(1) precludes a bank from being liable where the payment order was executed as a result of fraud or dishonesty. The Explanatory Notes to the Bill explain that Government expressly had reimbursement of funds to victims of APP fraud in contemplation.In September 2022, the PSR published its consultation CP22/4 on regulatory changes to require mandatory reimbursement by banks of all sums over £100 lost as a result of APP fraud. A policy statement is expected in Q1 2023 with final regulatory requirements, consistent with statutory deadlines, expected in Q2 2023. The consultation responds in part to the duty proposed in the draft Bill that the PSR publishes draft regulatory requirements within two months of the legislation coming into force, and imposes a finalised regulatory requirement within six months.Hopefully, these reforms will not only result in improved procedures by the banks to prevent APP fraud from occurring in the first place, but will reimburse all but those who are grossly negligent with their funds.