HK case law sheds light on phishing scams

0
289

In an era in which cybercrime targeting Web servers, mobile and the internet of things (IoT) devices is so rampant, enterprises and individuals are dealing with phishing email messages, websites, and phone calls on a daily basis. This article discusses how the Hong Kong courts approach contested proceedings arising from “CEO email scams”, in which fraudsters impersonate senior executives of companies to send emails and trick staff to transfer funds to them, and what is the most efficient way to recover the lost funds.

THE ‘FRAUD’ EXCEPTION

When a victim of “CEO email scams” seeks relief from a Hong Kong court, this is often because the lost funds have been transferred to a Hong Kong bank account. For those victims who successfully freeze the lost funds, by way of a police freezing order or a mareva injunction, commencing legal proceedings against the account holder in Hong Kong is the most natural way of retrieving the lost funds. Typically, the account holder would not respond to the proceedings and a default judgment will be obtained against it.

In some cases, these account holders come forward and contest the proceedings by alleging that they are entitled to retain the funds in the account. In such an event, the victim, who apparently is eager to obtain a favourable judgment without going through a full trial (and thereby incurring more legal costs), will face a conundrum of the inapplicability of obtaining summary judgment under order 14 of the Rules of the High Court (cap 4A).

An application for summary judgment under order 14 can be made in cases where the defendant has no defence to the plaintiff’s claim. Obtaining a summary judgment saves the plaintiff from wastage of time and costs in pursuing the matter to a full trial. However, order 14, rule 1(2)(b) expressly excludes this procedure where the plaintiff is making an allegation of fraud.

In 2016, the Court of Appeal laid down the relevant principles for applying the fraud exception in summary judgment applications in Zimmer Sweden AB v KPN Hong Kong Ltd [2016]. The plaintiff, a Swedish company, brought proceedings against the first and second defendants, alleging the plaintiff’s finance manager was deceived by fraudulent misrepresentations as to the recipient’s identity into transferring funds to a bank account of a company, K, in Lithuania. The funds were then remitted to a Hong Kong bank account of the first defendant (the KPN sum) and the first defendant later transferred part of the funds to a Hong Kong bank account of the second defendant.

The defendants’ case was that they had received the KPN sum as payment in a bona fide transaction for goods it had sourced from suppliers and on-sold to K. The defendants resisted the summary judgment application by relying on the ground that order 14 is inapplicable as the fraud exception was engaged. The summary judgment application was dismissed by the first instance judge. The plaintiff appealed to the Court of Appeal.

The Court of Appeal laid down the relevant principles in relation to the application of the fraud exception:

1. The question to be asked was “did the action include a claim for which an allegation of fraud would have to be made by the plaintiff in order to establish or maintain that claim?” If the answer was in the affirmative, the fraud exception was engaged and the court had no jurisdiction to hear the application, even if the plaintiff sought to hive off that claim from another (e.g., for dishonoured cheques) for which summary judgment would not been available;

2. Originally a claim might be established without alleging fraud, but the nature of the defence might be such that in rebuttal the plaintiff would have to allege fraud, in which case the fraud exception would be engaged;

3. The Hong Kong courts had adopted a wide/liberal meaning of the fraud exception, namely it would be engaged where what was alleged was an intentional or reckless dishonest act (or omission) done with the purpose of deceiving.

Applying these principles, the Court of Appeal ruled that the fraud exception was engaged. The court had to look beyond the statement of claim and consider the subsequent pleadings and affidavits to discern the substance of the plaintiff’s case at the time of the order 14 application hearing. The defendants’ defence would provide a complete defence to the plaintiff’s claims.

In order to maintain its claims, the plaintiff had alleged that the transaction was a sham, and even if the plaintiff had not asserted that the defendants were parties to the fraud practised in Sweden to obtain the money, it had clearly asserted that the defendants were parties to a fraud to keep the money transferred to them, which was the subject matter of its claims. The plaintiff’s appeal was dismissed.

Notwithstanding the Court of Appeal’s decision, Justice of Appeal, Lam VP, opined in his judgment that the fraud exception no longer sits well with the modern litigation landscape and stated that he would make recommendation to the relevant rules committees to consider the appropriateness of keeping this exception.

ANALYSIS OF RECENT CASES

Recently, Deputy High Court Judge Saunders handed down a judgment, on 21 June 2017, in Laerdal Medical Limited v Hong Kong Haocheng International Trade Limited, distinguishing the Zimmer case and refused to apply the fraud exception.

The facts of Laerdal are as follows:

1. The plaintiff mistakenly transferred funds, €496,000 (US$585,000) to the Defendant as a result of an email fraud perpetrated on the plaintiff;

2. The plaintiff and the defendant had no business relationship whatsoever;

3. The defendant’s defence was that it had some other business transaction with a third party, and when it received €496,000 it mistakenly believed that the funds were received pursuant to that other business transaction. By having acted in that belief, the defendant claimed that it is entitled to retain €496,000.

4. Judge Saunders ruled that the defendant admitted that it had no business relationship with the plaintiff by not pleading in the defence anything in response to the relevant paragraph in the Statement of Claim. The same position is confirmed by the defendant’s counsel in oral submissions.

Judge Saunders ruled that the fraud exception was not engaged in the present case. He ruled that the plaintiff need not establish that the fraud was perpetrated on it in order to establish its claim against the defendant. It is sufficient for the plaintiff simply to establish that the defendant received the sum of €496,000 without any proper authority.

The defendant’s admission that there was no business or personal relationship between the two companies to explain or justify the payment is sufficient to establish that the sum was received without any proper authority. (Zimmer Sweden AB v KPN Hong Kong Ltd [2016] distinguished, Universal Capital Bank v Hong Kong Heya Co Ltd[2016] applied.)

The court also refused to accept the defence that it was a bona fide purchaser without notice for consideration to receive the amount of money as the defendant has a right to recover the sum from the third party. Judgment was granted in favour of the plaintiff.

Laerdal followed the reasoning in Universal Capital Bank v Hong Kong Heya Co Ltd [2016]. In the Universal case, the plaintiff is a bank with its head office in Montenegro. It was deceived by a fraudulent email into transferring €410,650.14 to Hang Seng Bank in Hong Kong. The money was transferred to an account in the name of a company, Hong Kong Huisen International. The euros were converted into HK$4,238,729.93 and on the following day HK$2 million was transferred to the defendant’s account at HSBC.

The defendant claimed that it had no knowledge of the source of these funds. The manager of the defendant had simply been asked by a friend to remit the money, in RMB equivalent, to an account in China. The plaintiff’s case was that money was taken from them by fraud but they did not need to, and did not, allege fraud against the defendant company. The manager of the defendant may or may not have been a party to the fraud, but whether he was or was not does not matter because the plaintiff was prepared to confine its claim against the defendant for unjust enrichment to which, the plaintiff submitted, there was no credible defence.

The judge ruled that the fraud exception in order 14, rule 1(2)(b) did not create a bar to the plaintiff’s application for summary judgment, for the following reasons:

1. No allegation of fraud was made against the defendant or its manager;

2. Although, as agreed by the plaintiff and conceded by the counsel for the defendant, the movement of the money out of Montenegro and into the PRC was a plain and obvious scam, the legal route being taken by the plaintiff to recover its money does not necessarily involve any party to that scam. The plaintiff sought recovery from the defendant, not its manager;

3. While it is true that the Hong Kong courts have adopted a fairly wide and liberal interpretation of “fraud” when considering the application of order 14, rule 1(2)(b), it should not be applied automatically merely because there are allegations of fraud or dishonesty in the bigger picture. The question remains, does the underlying allegation of fraud (which did exist in this case) on which the claim is based (which it was not in this case) constitute an allegation of fraud against the defendant? It seems that the answer to this question in this case is in the negative.

Although the fraud exception did not apply, finally the court gave conditional leave to the defendant to defend because its defence could not be dismissed as “incredible” at that stage.

Based on the decisions in Laerdal and Universal, does it mean that victims of email fraud can get around the fraud exception and short circuit potentially long-winded legal proceedings by way of an order 14 application?

It may well be the case that the plaintiffs in Laerdal and Universal did not need to allege fraud in order to establish their claims against the respective defendants. However, one also has to consider if the nature of the defence might be such that in rebuttal, the plaintiff would have to allege fraud, in which case, according to Zimmer, the fraud exception would be engaged.

In both Laerdal and Universal, the defendants alleged that they were bona fide purchasers and recipients of the fraudulent payments. However, the court was not able to accept the explanation. Their respective judgments cast doubts on the credibility of the defence.

In Laerdal, the court found that nobody reading the banking receipt could have thought that the payment came from the third party as alleged by the defendant. It was also quite an extraordinary coincidence that the fraudulent payment precisely matched the amount remaining due to the defendant by the alleged third party. In Universal, the court took the view that the defence was low in substance and suspicious.

It would appear that the court has taken a pragmatic approach in dealing with these cases, which are obviously scams, as denying summary judgment would not be doing justice. Laerdal and Universal set encouraging precedents for victims of email fraud, but the leeway the court has in terms of not invoking the fraud exception is a narrow one. One has to be careful how to rebut the defence in order not to invoke the fraud exception. And the facts of each case will determine the applicability of Laerdal and Universal.

Gloria Leung is a senior associate at King & Wood Mallesons in Hong Kong