Supreme Court, July 2023, only where validity of instruction is unclear bank to use Duty of Care

Under the new ruling, when a bank receives a valid payment request with no room for interpretation or choice, the bank must execute the order. That means if the owner of the bank account authorises a clear payment instruction to the bank it has to be paid. The emphasis is clearly on the payer knowing the payee. 

In 2022 UK APP fraud was £500 million of which £200 million was reimbursed.  Going forward, with no changes, there will be virtually NO bank reimbursement as APP fraud now sits with their customers: the banking industry profits.

The good news for UK victims of APP frauds is the social policy of regulators, government and Parliament is in the works. The Financial Services and Markets Act 2023, received The Royal Assent on 29 June 2023, provides (in section 72) for a mandatory reimbursement scheme.  The policy is for the payer and payee banks to reimburse the victims for the full amount within 48 hours. This Duty of Care covers customers who instruct bank account payments. This covers 86% UK adults who use at least one form of remote banking.

The incoming mandatory reimbursement is to cover only consumers, charities and SMEs for domestic APP fraud, with payments in sterling only.  Companies with incomes of plus £5 million per year are not covered. In addition all international payments, for example sterling to euro, from any bank accounts are also not covered. 

Applying this rationale to the case in Philipp v Barclays, the validity of the instruction was not in doubt because the customer herself gave the payment instruction. The bank was therefore required to execute the payment. UK Banks have now been mandated to install Confirmation of Payee (CoP) alongside the payee's sort code and account number to prevent fraud within the UK.

In the case, fraudsters were able to get a call to the bank's genuine number diverted to them. They were able to make up any number they wanted to appear as the caller's number when calling the victim. Leading the victims to believe were being contacted by law-abiding people when they were not. This is still happening today and again good social policy is required by the telecom industry.

Authorised Push Payment (APP) scams happen when someone is tricked into sending money to a fraudster posing as a genuine payee. In Mrs Philipp’s case, she and her husband were deceived by criminals into instructing Barclays Bank to transfer £700,000 to bank accounts in the United Arab Emirates. The instruction was carried out and the money was gone. Attempts to recall the funds were unsuccessful which is true in over 98% of APP frauds. 

Recovery is very low because fraudsters and their mules move the money being scammed almost instantly. The scammed amount is broken down, leave 10% for the mule, and different amounts sent across the mule network before exiting the Country via an international payment. 

E-commerce continues to expand access and value exponentially while at the same time banks encourage real time activities e.g. closing bank branches and using AI. The need to know more about the payee by the payer before money is moved is crucial.

The Supreme Court verdict has added to knowing who is being paid regardless of country. Going forward the payer needs to check:

A)   Does the payee bank have CoP

B)   Can the payer bank validate International Bank Account ownership of the payee

C)   Are the mobile numbers verified in real time

D)   Is the person alive and verified by biometrics before payment

The good news is once the true information is confirmed, the chances of having a misdirected payment or being scammed from the bank account drop to virtually zero.

Video: APP Fraud explained in under 3 minutes: http://www.request-to-pay.co.uk

Further reading:

https://www.lawgazette.co.uk/news/quincecare-duty-supreme-court-closes-door-on-fraud-claims/5116633.article

https://www.ashfords.co.uk/insights/articles/supreme-court-restores-quincecare-duty-position-in-the-closely-watched-case-of-philipp-v-barclays-bank-uk-plc