Authorised push payment fraud is becoming ever more sophisticated and increasingly prevalent in the UK: during the first half of 2019, Britons lost £207 million in these frauds, up by 40% from the same period last year.
Push payment frauds involve consumers or business employees being tricked into sending a payment under false pretences to a bank account that is controlled by the fraudster. Because payments made using real-time payment schemes are irrevocable, victims are unable to reverse such a payment once they realise that they have been defrauded. Banks argue that if they have received a payment instruction in accordance with the mandate, they are not liable to compensate the customer.
Confirmation of Payee – a protocol to cross-check the payee name entered by the paying party with the name of the account-holder at the receiving bank – has been repeatedly delayed. Its absence has been criticised by consumer rights campaigners, who argue that the banks’ failure to check the payee name is itself negligent on the part of the banks and a substantial cause of the frauds.
Although banking technology continues to develop in advancing security measures to counteract such frauds, so do the systems used to undermine them, leaving millions of customers potentially vulnerable. The question of how banks should reimburse victims for frauds perpetrated on them is still unresolved. A temporary fix was put in place by way of a scheme to compensate victims who were not themselves to blame. The banks’ trade association UK Finance has announced that the fraud fund used to compensate victims will be temporarily extended until the end of March 2020, but there is no certainty that it will continue after that.
A long-term funding solution was expected to have been agreed before talks recently broke down between the banks concerned. One potential solution – a 2.9p levy on all transfers over £30 – was rejected after disagreement. Ultimately, an agreement should be reached in the next few months since there is consensus across the banking and payments sector for a long-term, sustainable compensation funding solution to be established, but there is controversy over how the cost should be borne.
Meanwhile, an alternative route to compensation has opened up through a recent Supreme Court decision in the case of Singularis Holdings Ltd v Daiwa Capital Markets Europe Ltd.
Quincecare duty of care
The Singularis case is surprising to many in the banking industry. To understand why, it is worth examining the details. The duty of care owed by a bank to its customer was set out in the 1992 case, Barclays Bank plc v Quincecare Ltd, which remains the leading case on the subject. Ever since, this has been known as the Quincecare duty of care. Despite the passing of years since the Quincecare decision, the Singularis case is the first time the Quincecare duty has been used to grant compensation for what was otherwise a properly-authorised payment.
In summary, the Quincecare judgment determined that there is an implied term of the contract between a bank and its customer that the bank owes a duty of care not to execute the customer’s order if it knows the order to be dishonestly given, or shuts its eyes to obvious dishonesty, or acts recklessly in failing to make inquiries.
The issue which the Supreme Court had to decide was, as Lady Hale put it, ‘certainly a simple one.’ The appeal by Daiwa (the British subsidiary of a Japanese investment bank), centred on whether a claim against a bank for breach of the Quincecare duty is defeated if the customer is a company, and the fraudulent payment instructions are given by the company’s Chairman and sole shareholder who is the dominating influence over the company’s affairs.
Singularis, a company registered in the Cayman Islands, was set up to manage the personal assets of Mr Maan Al Sanea: he was the sole shareholder, a director, chairman, president and treasurer. The other six directors of Singularis did not exercise any influence over the company’s management: signing powers over the company’s bank accounts rested exclusively with Mr Al Sanea. In 2007, Daiwa provided Singularis with loan financing for the purchase of shares, which were security for the repayment of the loan.
In June 2009, these shares were sold, the loan was repaid, and Daiwa held a cash surplus of $204m for the account of Singularis. Daiwa complied with instructions from Al Sanea to pay out those funds to third parties. But these eight payments were, in fact, a misappropriation of Singularis’ funds and left the company unable to meet the demands of its creditors. In September 2009 the Grand Court of the Cayman Islands made a compulsory winding up order and joint liquidators were appointed.
Almost five years later, in July 2014, Singularis brought a claim against Daiwa for the full amount of the payments on the basis of: (1) dishonest assistance in Mr Al Sanea’s breach of fiduciary duty; and (2) breach of the Quincecare duty of care to Singularis by giving effect to the payment instructions. The High Court dismissed the dishonest assistance claim, but held that there was a clear breach of the Quincecare duty of care to Singularis, with a deduction of 25% by way of contributory negligence. Daiwa’s appeal against the finding of liability on the negligence claim was dismissed. The bank then appealed to the Supreme Court.
The Supreme Court unanimously dismissed Daiwa’s appeal and held that the High Court order should stand. Lady Hale gave the substantive judgment outlining the reasons.
Daiwa’s argument in the appeal was that because Singularis was effectively a one-man company (with Al Sanea being its controlling mind and will), his fraud should be attributed to the company, with the result that its Quincecare claim against Daiwa should fail because of illegality, lack of causation or because of a countervailing claim for deceit.
Lady Hale agreed with Rose J, the original trial judge, that whether or not Mr Al Sanea’s fraud was attributed to the company, those defences would fail in any event. She outlined her reasoning under several headings in response to the arguments put forward by Daiwa.
The first issue was illegality which Daiwa relied on: Mr Al Sanea’s provision of false documents in relation to the payments and his breach of fiduciary duty towards Singularis.
Lady Hale agreed with the finding of the trial judge, namely that fiduciary duties are intended to protect a company from becoming the victim of the wrongful exercise of power by the company’s officers. That purpose would not be enhanced by preventing the company’s recovery of the money wrongfully removed from its account.
She noted that the Quincecare duty strikes a careful balance between the interests of the customer and those of the bank and denying the claim would not enhance the integrity of the law. Her judgment concluded that denial of the claim would undermine the public interest in requiring banks to play an important part in uncovering financial crime and money laundering.
It would also be an unfair and disproportionate response to any wrongdoing on the part of Singularis: the power to make a deduction for contributory negligence enables the court to make a more appropriate adjustment. Lady Hale agreed that the trial judge’s conclusion on this issue was correct, whether or not the fraud was attributed to the company.
On causation, Daiwa argued that if the fraud was attributed to the company, its loss was caused by its own fault and not that of the bank. However, Lady Hale’s judgment stated that the purpose of the Quincecare duty is to protect the bank’s customers from harm caused by people for whom the customer is responsible. The fraudulent instruction to Daiwa gave rise to the duty of care which Daiwa breached, thereby causing the loss.
On the issue of countervailing claim in deceit, this was deemed by Lady Hale to be a variant of the causation argument. It was held that Daiwa’s breach of duty, and not Mr Al Sanea’s misrepresentations, was the cause of Daiwa’s exposure to the claim for Singularis’ loss.
Lady Hale further held that Mr Al Sanea’s fraud should not, however, be attributed to the company for the purposes of the Quincecare claim. The basic principle was that a properly incorporated company has an identity and a legal personality separate from that of its shareholders and directors. The company has to act through the medium of real human beings, but the acts of those persons are only treated as the acts and intentions of the company in circumstances specified by its constitution, or the ordinary rules of agency and vicarious liability, or other particular rules of law.
In upholding the original decision, as the trial judge noted, the answer to any question of whether to attribute the knowledge of a fraudulent director to the company is always to be found in consideration of the context and purpose for which the attribution is relevant. The context in this case is the breach of Daiwa’s Quincecare duty of care. To attribute the fraud of a trusted agent of the company to the company would ‘denude the duty of any value’ in cases where it is most needed and be a retrograde step.
Having dismissed the arguments put forward by Daiwa, the Supreme Court unanimously upheld the High Court decision: “Daiwa should have realised that something suspicious was going on and suspended payment until it had made reasonable enquiries to satisfy itself that the payments were properly to be made.” Had Daiwa done that, the court suggested, it would have immediately concluded that the payments were fraudulent.
Judgment lays foundation for compensation changes
By removing any uncertainty, The Supreme Court’s judgment in the Singularis case has laid the foundations for compensation changes: it confirms that negligent banks are now responsible even if payments are authorised as per the customer’s mandate.
The case does not give banks any guidance about how, in practice, they should resolve the conflict between the Quinecare duty and their duty to give effect to the customer’s proper instructions. In Singularis, it is not clear what enquiries the bank could have made before executing the transfer which would have confirmed or removed a suspicion, given that the only person they could refer to was Mr Al Sanea himself. Translating that to the consumer level and automated banking, what characteristics of a payment should be deemed to give rise to a suspicion? Perhaps any large payment to a new payee? And what steps must be taken – is a bank obliged to make personal contact with the customer in every case, and check that they are not being defrauded? Might the courts say that the failure to implement Confirmation of Payee – so that consumers are asked to name the payee but there is no check on whether the receiving account is in that name – is itself negligent on the part of the banks?
The ruling has an impact both upon banks and their defrauded customers. It potentially opens the door to thousands of claims by victims of push payment fraud if they can demonstrate that the bank was negligent in accepting the customer’s instructions. Importantly, it places liability on the customer’s bank, not the recipient bank. It might reinforce the argument of new entrants such as Monzo who have objected to funding compensation by a transaction levy, suggesting that it moves the cost away from the big banks where most of the fraud occurs, and disincentivises security improvements such as Confirmation of Payee or checking suspicious payments as the Quincecare duty requires.
Summary published in FT Advisor – 20.1.2020
