Skip to main content
Article | FI Observer

Combatting fraud – what is a Bank to do?

Financial, Executive and Professional Risks (FINEX)

By Claire Nightingale and Catherine Lewis | December 4, 2020

Should financial institutions be concerned about the scope of their obligations when fraud is suspected?

In this article we discuss the recent decision made of the High Court on the Quincecare duty of care. The decision in Gareth Hamblin and Mary Hamblin v World First Ltd and Moorwand NL Limited (‘Hamblin v World First Ltd and others’) is the first involving application of the Quincecare duty of care to a payment services provider and suggests a development towards a broader application of the duty that arises when a Bank suspects that a payment instruction is fraudulent.1 In this article, we focus on the findings of the court in respect of the Quincecare duty of care and the implications for financial institutions.

In the decision, handed down in September 2020, the English High Court held that it is “reasonably arguable” that a claimant who is not a customer has standing to make a claim against a payment services provider for breach of its Quincecare duty of care. 

The duty of care owed by financial institutions

As a reminder, the Quincecare duty of care arises where the bank or financial institution is “put on enquiry” that a certain payment instruction may not be duly authorised by the customer. For the duty to apply, the bank must have “reasonable grounds” for suspecting that the instruction is an attempt to misappropriate funds from the company/customer. The standard that applies is an objective one of an ordinary and prudent banker.

Developed in the 1992 decision in Barclays Bank Plc v Quincecare, the duty of care was intended to strike a balance between imposing “too burdensome an obligation on banks which hampers the effective transaction of banking business unnecessarily” and guarding “against the facilitation of fraud, exact a reasonable standard of care to combat fraud and to protect bank customers and innocent third parties”. 

One of the issues before the court in Hamblin v World First was whether a claim for breach of Quincecare duty could be brought against a financial institution in circumstances where the customer was an insolvent corporate vehicle, with no registered directors, which had been used as a vehicle for a sophisticated investment fraud. It was not disputed that World First (the “Bank”) had paid out sums that had been credited to the corporate account. Such sums were incapable of recovery. 

On a summary judgment application, His Honour Judge Pelling QC found that the claimants had a “realistically arguable” case that they had standing to allege breach of Quincecare duty. 

The facts

This was a summary judgment and strike out application on the part of the Bank, which argued that the claimants’ claim was bound to fail. The application was heard on the following assumed facts, as alleged by the claimants:

  • The Bank set up an account in the name of the company (the second defendant) on the application of an individual, whose identity had been stolen. The account was set up using (a) a copy of the individual’s passport, and (b) a photograph of the individual holding up his passport, without that individual’s knowledge or consent. The circumstances in which the documentation was obtained are unknown.
  • The company had come under the control of fraudsters prior to opening the account with the Bank and fraudulent investment opportunities, styled as “CEX Markets”, were offered.
  • Fraudulent investment opportunities, styled as “CEX Markets”, were offered by the fraudsters.
  • The first claimant applied to open an investment account with CEX Markets.
  • The claimants transferred sums to a CEX Markets account by way of an account transfer form, which among other things, stated that CEX Markets would hold the sums as a ‘bare trustee’.
  • Over a period of a few months, the claimants transferred a total of £140,000 into the account, which was identified as the company’s account with the Bank.
  • The claimants issued proceedings against the Bank and the company alleging breach of mandate, breach of the Payment Services Regulations 2017 and breach of Quincecare duty of care.  Following the Bank’s application, the court found that the claimants’ had a “realistically arguable” case on all limbs.

Arguable case for breach of Quincecare duty of care

Attribution of knowledge

The Bank’s position was that the claim for breach of the Quincecare duty could not succeed because the duty is owed to the customer, and the customer was controlled by fraudsters. The court found that there was no principle of law that the fraudulent conduct of the directors should be applied to the company. Importantly, and in line with recent authority from the UK Supreme Court, the court’s decision made clear that a corporate entity has a distinct legal personality and the purpose of the duty is to protect the corporate customer from fraudulent misappropriation of its assets.2 Accordingly, the court found that it was at least arguable that the company was the ‘victim’ of the fraud.

The court found that there was no principle of law that the fraudulent conduct of the directors should be applied to the company.

Standing of the claimants

Although the ‘victim’ of the fraud was the company, whose funds had been misappropriated, this claim was brought by the claimants who had transferred sums on the understanding that they were participating in an investment opportunity.

On the assumed facts before the court, it was held that the claimants had an arguable case that they had standing to bring a claim on the basis that they were beneficiaries of a trust where the trustee (the company) had committed a breach of trust.3

Does the decision mean there is an increased exposure for FIs?

It is important not to overstate the impact of this case. This was a summary judgment application based on assumed facts. The test the court had to apply was whether the claimants had a realistically arguable case. It will be for the trial judge to determine, based on the factual evidence surrounding the transaction, whether the Quincecare duty owed to the company, as the victim of the fraud, also extends to the claimants.

Given the amount in dispute (£140,000), there is a chance that the case will settle before trial. If this is the case, we may have to wait substantially longer for another case to determine the issue.

That being said, financial transactions have developed significantly in the three decades since Barclays Bank v Quincecare. During this time, there has been a dramatic shift to online banking and electronic payment verification. Financial institutions have had to develop technology swiftly to keep up with customer demand for speedy, efficient and hassle-free transactions. Banks must balance a fine line between ensuring secure verification mechanisms are in place, with the demand for instantaneous transactions.

The Quincecare duty of care was developed in the context of current accounts, and this latest decision concerned a payment service provider. There has also been a recent decision in the context of depository accounts (in JP Morgan Chase v The Federal Republic of Nigeria4). Accordingly, while the scope of the duty of care is arguably unchanged it is likely we can expect to see customers seeking to apply the duty of care to a broad range of financial transactions.

Key messages for financial institutions

As quickly as banks develop new technology, fraudsters are there to exploit it. The increase in attempted frauds requires a bank to factor the exposure in all levels of its risk management programme – through staff awareness and training, to robust insurance to mitigate against financial loss.

As quickly as banks develop new technology, fraudsters are there to exploit it.

We are also in an environment of heightened customer awareness and activity. Well-informed and active customers are increasingly seeking to hold banks (and other service providers) to account. Customers (or even beneficiaries of a trust as in Hamblin v World First Ltd and others) who suffers loss as a result of fraudsters will look to their bank for compensations for their loss.

We anticipate that, following the high-profile decision in Singularis last year, financial institutions will have reviewed their contractual terms and sought to limit their exposure for breach of the Quincecare duty of care. The recent case indicates that claims may be anticipated to increase.

Banks and other financial institutions can therefore expect to see continued claims when transactions go wrong. Whether there is a final judgment on these facts to clarify the scope of the Quincecare duty of care to a wider pool of potential claimants remains to be seen.

Generally speaking, if a financial institution is in breach of a duty of care it may be able to make a claim under its professional indemnity insurance arrangements. Care should be taken to review those arrangements to cover a wide range of duties, noting that, as this matter shows duties may be owed to third parties. Speak to your broker about your professional indemnity insurance programme to ensure it meets your needs.

This article was written in conjunction with Catherine Lewis, Associate, Reed Smith.


1 Gareth Hamblin and Marilyn Hamblin v World First Limited and Moorwand NL Limited [2020] EWHC 2383 (Comm).

2 See Singularis Holdings Ltd v Daiwa Capital Markets [2019] UKSC 50.

3 The basis for this is the decision in Hayim v Citibank NA [1987] AC 730 (PC).

4 [2019] EWCA Civ 1641.


Global Head of FINEX Financial Institutions Claims Advocacy & TPL

Associate, Reed Smith


GB Head of FINEX Financial Institutions

Susan Finbow
Global Head of FINEX Financial Institutions

Related Capabilities

Contact Us