By Lee Shih
Imagine the following scenario. Your accounts staff had been communicating with a long-standing supplier. One day, the supplier sends an email stating that payment should now be made into a different bank account. Your company carries out some checks and in the end, makes the payment.
A few days later, the supplier follows up by email and a phone call. The supplier asks about when payment is to be made as the supplier has been waiting. You realise you have not paid the genuine supplier. Your company has fallen victim to an increasingly common scam: a push payment fraud. Your company paid into a bank account under the control of a fraudster, and the money has now been siphoned away.
A push payment fraud is merely one example of a growing wave of cyber fraud. The fraud may take the form of a hacker compromising your network or email, and then sending fraudulent instructions to your company’s bank to make payment. It may be ransomware, locking down your computer system until the ransom amount is paid. It can be a phishing scam, where the victim is tricked into revealing the bank account username and password. All the money in the bank account is emptied.
In addition, the rise of cryptocurrency gives rise to more instances of fraud. We have had Ponzi schemes involving the multibillion-dollar OneCoin, the PlusToken scheme in China, and the AliCoin syndicate in Malaysia. Cryptocurrency exchanges can be subject to cyberattacks, and there can be theft of cryptocurrency from hot wallets (i.e. cryptocurrency digital wallets connected to the internet).
A victim of fraud can apply for urgent asset recovery measures from the courts to preserve the assets and seek a return of the monies. Legal developments have tried to keep pace with these digital developments and the speed of cross-border fraud.
Preventing Dissipation: Freezing and Proprietary Injunction
There is often a need to move very urgently to obtain orders to preserve any available assets. The court can grant urgent injunction orders without notice to the alleged fraudster, being on an ex parte basis.
The common types of injunction orders are a Mareva freezing injunction and a proprietary injunction. The injunctions will help to preserve the pool of assets until the full determination of the legal action. The legal action itself may take months or more than a year. Hence, it is critical to ensure that there will be assets to recover at the conclusion of the legal action
The court will usually also grant a tag-along (or ancillary) disclosure order. This disclosure order compels the alleged fraudster to disclose all of his or her assets, whether domestically or worldwide.
Unknown Fraudsters: Persons Unknown Jurisdiction
Filing a legal action must mean knowing who to name and who to sue. The difficulty is that cyber fraud will likely involve an anonymous fraudster, hiding behind the computer screen or a fake email address.
With recent legal developments, the victim can act against a “persons unknown” party and apply for injunctions and tracing orders. This action becomes a launching pad to trace the digital transfer of monies or assets and find the real wrongdoer.
Malaysia recently saw its first-ever persons unknown injunction. In the case of Zschimmer & Schwarz, the Malaysian High Court made orders in favour of a German company to injunct and trace monies. The persons unknown had deceived the company into paying funds into a Malaysian bank account.
Other examples of cases involving persons unknown are actions against “persons unknown who holds 96 Bitcoins held in a specified Bitfinex Bitcoin address” or “persons unknown involved in the fraudulent transfer from the Bank of China account to other bank accounts”.
Cryptocurrency: Can the Courts Freeze and Trace Such Assets?
Courts in the Commonwealth have now clarified that cryptocurrency can be treated as ‘property’. This is important so that the victim can secure court orders to freeze and trace such property. There is no Malaysian decision on this point and the Commonwealth decisions will be persuasive.
There is an added dimension of freezing and preserving cryptocurrency – the volatility of cryptocurrency prices. The prices can swing upwards (see the quadrupling in the value of Bitcoin in 2020) or downwards. If a victim gets an order to preserve cryptocurrency for recovery of money paid, there may be wild swings in the value of the frozen cryptocurrency.
Money Trail: Bankers Trust and Third Party Disclosure Orders
An essential part of the legal strategy must be to trace and follow the money trail. This can take the form of tracing the transfer of cryptocurrency deposited via crypto exchanges or digital wallets, or investor monies paid and siphoned out of bank accounts.
The victim can obtain a disclosure order known as a Bankers Trust disclosure order against financial institutions and, by extension, e-wallet or digital wallet providers. Under a court order, there can be the disclosure of documents such as account opening forms, KYC forms, signing mandates, history of fund transfers and bank statements.
A close cousin of the Bankers Trust disclosure order is the Norwich Pharmacal disclosure order. Such an order is made against a third party mixed up in the wrongdoing and can be made to disclose documents or information. The documents and information will assist the victim in bringing legal proceedings against the actual wrongdoers.
You’ve Got Mail: Court Papers Served by Email, Dropbox and WhatsApp
A mandatory step in any court process is that the court papers must be properly served or sent to the party being sued. This is difficult when a fraudster is only contactable online or is hiding behind email addresses or phone numbers.
The Malaysian courts have been flexible in allowing orders to carry out service of court papers digitally. This can be through sending emails, having a Dropbox link, service through sending messages and files through WhatsApp. The important principle is that these methods must bring the court proceedings to the alleged wrongdoer’s attention.
Fraudsters will try to use new methods and new techniques to scam and deceive the intended victim. The law will continue to keep pace and adapt new techniques to allow victims to seek redress.
Lee Shih is the managing partner of the specialist litigation firm, Lim Chee Wee Partnership. He secured Malaysia’s first-ever persons unknown injunction.