Physical Address
Kampala, Uganda
Fraud risk remains one of the key risks impacting the financial services industry in Uganda and beyond. As the economy and technology develop, the threats of fraud also continue to increase and become more sophisticated.
The fact that fraud occasions loss to both a bank and a customer cannot be overemphasized. A key lingering question, however, is the apportionment of the liability for fraud between a bank and a customer. The number of cases in which customers seek to hold banks liable in instances when they lose money on account of fraud is on the rise and as a result, courts have had to consider the scope of the duty of a bank in such instances.
This article considers the UK Supreme Court decision in Philip V Barclays Bank UK PLC (the “Phillip case“)that dealt with the scope of the duty owed by banks to their customers in instances of fraud.
The UK Supreme Court Decision in the Phillip Case
In the Phillip case, a customer of the bank was a victim of fraud in which they lost £700,000. The customer was tricked by a third-party fraudster into instructing the bank to transfer the money into accounts in the United Arab Emirates and the money was lost. Following the loss, the customer sued the bank on account of a breach of its duty not to execute her payment instructions because the bank had reasonable grounds for believing she was being defrauded.
The customer sought to hold the bank liable based on a previous decision in Barclays Bank Plc V Quincecare, in which the principle of the “Quincecare duty” was first enunciated. This principle is to the effect that a bank has a duty to refrain from executing a payment instruction given by an agent of its customer without making inquiries if the bank has reasonable grounds to believe that the agent is defrauding the customer.
The UK Supreme Court found that the circumstances warranting the application of the principle in Quincecare were different from those in the Phillip case. In Quincecare, the fraud was perpetrated by the customer’s chairman. As such, the consideration of the bank would have been whether the chairman had the authority to make a payment instruction on behalf of the customer and had no intent of defrauding the customer.
The Phillip case was different because it was the customer themselves that made the payment instruction, and the bank was, therefore, duty-bound to honor the instructions of the customer. In the premises, the bank had no duty to inquire into whether the customer was being defrauded because this duty is subordinate to the duty of the bank to honor payment instructions from the customer promptly.
Implications of the Phillip Case
The principles enunciated in the Phillip case recalibrate the duty of the customer and the bank in instances of fraud. The principles appear to be as follows:
- The duty of the bank to honor payment instructions from a customer remains primary and strict. Once the instruction is made by the customer, the bank has no duty to inquire into the risks of the customer’s payment decision – except where the contract expressly states as such.
- In instances where an agent acting on behalf of a customer makes a payment instruction and the bank has reasonable grounds to believe that the payment instruction is an attempt to defraud the customer, the bank has a duty to refrain from executing that instruction without making further inquiries.
In essence, the court concluded that the decision in Quincecare is limited to situations where an agent is acting or purports to act on behalf of a customer. Where the customer makes the payment instruction themselves, the bank has no duty to be concerned with whether the customer is being defrauded or not.
This nature of fraud was categorized as authorized push payment fraud (“APP fraud”), where the fraudster tricks a customer into making a payment instruction to a destination of the fraudster’s choice.
Recent Trends in Uganda
The finding in the Philip case is noteworthy, as somewhat similar cases are emerging in the Uganda context. In Aida Atiku V Centenary Rural Development Bank Limited, a case that concerned the liability of a bank in instances of unauthorized digital payment instructions, the court reasoned that the risk of loss in digital transactions is borne by a customer if the bank establishes that it has in place viable security measures to guard against unauthorized digital payment instructions. The court further noted that the duty to prevent unauthorized payment instructions was not purely borne by the bank but by the customer as well, by keeping their banking information such as PINs and passwords safe. (Previous opinion on this case can be found: Atiku)
It may therefore be argued that a general trend is emerging regarding the scope of the duty of a bank in instances of fraud. This trend is to the effect that a customer has a clear duty to play in averting fraud. Where there is a lapse in vigilance on the part of the customer, the courts may be hesitant to impute the liability for a loss on the bank. Liability for fraud would only be borne by a bank where it is evident that it has failed in its duties as laid down in the Atiku and Phillip cases.
Conclusion
Fraud risk, in all its forms and shapes, will remain a key concern for both banks and customers and the financial services industry in general. As legislation, policy and the courts continue to provide solutions to fraud risk, it is evident that averting fraud will require a collective effort by the industry players, the public sector, and customers.
Disclaimer: “The views and opinions expressed on the site are personal and do not represent the official position of Stanbic Uganda and Khulani Capital.”
