Whether Banks may be held liable for third-party fraud in transferring or receiving fund depends in the first instance on the existence of the bank’s duty of care to the victim.
In light of the fraudsters’ sophisticated social engineering capabilities and the rapid, often irreversible nature of instant payment systems, banking fraud incidents such as Authorized Push Payment (“APP”) fraud, has become prevalent globally. Victims of banking fraud often seek to pursue recovery of funds from the sender bank or receiving bank. In this article, we examine the approach of courts in Malaysia and other Commonwealth jurisdictions in response to such claims.
Bank’s duty to its own Customer — Commonwealth Position
When the victim of fraud (who is also the customer of the Bank) had himself instructed the Bank to execute a payment instruction, a Quincecare duty does not apply; instead, the Bank is under a strict duty to make payments from the account in compliance with the customer’s instructions. This was held in the recent case of Philipp v Barclays Bank UK PLC [2024] AC 346.
In that case, the claimant (“Mrs. Philipp”), was a victim of an APP fraud. Mrs Philip was deceived by fraudsters, posing as representatives of the National Crime Agency and the Financial Conduct Authority, into making a payment in the sum of £700,000 to an account in the UAE.
Plaintiff’s claim
Despite Mrs. Philipp having personally attended at the Bank to give instructions for the international transfers, she sued the bank for breaching its Quincecare duty, alleging the Bank’s failure to prevent and detect APP Fraud when she discovered the fraud.
Supreme Court Decision
Overturning the Court of Appeal decision regarding the applicability of the Quincecare duty, the Supreme Court clarified that a bank’s duty does not extend to cases where a customer authorises a transfer under APP fraud; where the victim is deceived into authorising their bank to transfer funds to a fraudulent account. The Supreme Court held, amongst others, that: –
a) a bank’s basic duty under its contract with a customer is to execute payments in accordance with the customers’ instructions. The Supreme Court stressed that this duty is strict and where the customer has authorised the bank to make a payment, it must carry out that instruction promptly without concerning itself with the “wisdom or risks of its customer’s payment decisions”;
b) the true basis of the Quincecare duty was to protect a customer in circumstances where a bank “put on inquiry” that the instructions may not be genuine, for example, if the bank has reasonable grounds to believe that the instructions from an agent of a customer is fraudulent or the customer lacks mental capacity. In such cases, the bank owes a duty to verify the instructions before carrying out such instruction only;
