Cyber Fraud And Recovery In Hong Kong.

According to South China Morning Post, Hong Kong police intercepted more than HK$3 billion (US$384 million) conned from victims of internet and phone scams both locally and around the world in 2019, which was a 150% increase on the amount stopped the previous year. The Anti-Deception Coordination Centre thwarted 1586 payments to con artists totaling HK$6.33 billion between its opening and June this year. Some of the cash was frozen in bank accounts in Europe and the US with the help of Interpol and overseas law enforcement agencies, before it could be siphoned off to accounts controlled by international fraudsters.
 

Common types of fraud
 

Cyber fraud can cause severe financial loss to business. Below are some common types of fraud:
 

(1) Sale contract scam/corporate scam – Fraudsters impersonate the parties to the contract by using the same email account or similar domain account. For instance, fraudsters counterfeit sellers and send fictitious email to the victim buyers, claiming that the sellers’ bank account has changed and request transfer of funds to other bank accounts which are operated by the fraudsters.
 

(2) CEO scam – Fraudsters pretend to be the senior management officials of the companies and request employees to transfer the company funds to the bank accounts controlled by the fraudsters.
 

(3) Bitcoin fraud – Hackers send phishing emails to obtain the traders’ email and cloud storage credentials and transfer the funds into the hackers’ wallet. Some fraudsters may set up scam website, pose as a trusted investor and ask victims to transfer bitcoin upfront. Due to the decentralised, permissionless and untraceable nature of cryptocurrency exchange, it is often difficult to recover funds lost in bitcoin fraud. Generally, the blockchain analysis of the bitcoin theft by the recognised expert is required to prove the bitcoin flow.
 

(4) In Nico Constantijn Antonius Samara -v- Stive Jean Paul Dan [2019] HKCFI 2718, Hong Kong court has granted a Mareva injunction to cover bitcoin.
 

Action should be taken 
 

Once the victims discover the fraud, they should take below actions swiftly so as to maximise the chance of recovery of the stolen funds.
 

Inform the banks immediately
 

Once the funds have been transferred to the fraudsters’ bank accounts, the fraudsters will remove the funds as quickly as they can, rendering the subsequent recovery of the funds futile. Hence, victims should contact their banks about the fraud incident and request them to notify the recipients’ banks and request cancellation, recall or reversal of the remittance. 
 

Banks can alert each other to the suspected fraudulent activities. They usually freeze the recipients’ bank accounts temporarily pending their internal investigation.
 

In some instances, the recipients’ banks may be willing to return the funds provided that the victims’ banks provide a bank-to-bank indemnity, but this is not always guaranteed. Most banks are reluctant to release funds retained in the recipients’ bank accounts unless there is a court order or judgment compelling them to do so. In such situations, victims should seek assistance from solicitors.  
 

Report to Hong Kong Police – ‘no-consent’ regime
 

As soon as discovering the fraud, victims should also immediately report it to the Hong Kong Police. For overseas victims, they can instruct Hong Kong solicitors to assist them to file a report with the Hong Kong police. Upon receipt of a complaint and assessment of evidence, the Joint Financial Intelligence Unit (JFIU) will issue a letter of ‘no consent’ (LNC) to the bank informing that the JFIU does not consent to dealings in the Hong Kong bank account that received the funds (s. 25A(2)(a), Organized and Serious Crimes Ordinance (Cap. 455)). The police will liaise with the bank and may know how much of the funds remain in the bank account. However, the details of the bank account opening and transaction history will not be disclosed in the absence of a discovery order issued by Hong Kong courts.
 

Nevertheless, the LNC is not an injunction order and it does not operate to withhold or freeze the bank account of the suspect. The bank, in practice, will not deal further with the transaction under the suspected bank account and it has a similar effect of freezing the bank account.
 

Yet the bank retains the final decision as to whether to honour its customers’ instructions or not. 

 

Parties should also note that the JFIU may revoke the LNC at any time under their policy or own measures. If an LNC is issued by the JFIU, it will be reviewed on a monthly basis. If, after three months of issuance of LNC, a restraint order or a civil injunction has not been obtained, the Formation Commander will review the situation on a monthly basis. Normally, the LNC does not operate more than six months. 
 

Ultimately, it is the financial institution that decides whether to freeze the suspected bank account or follow its customers’ instruction despite their suspicion and the disclosure, since LNC is not a court order (see Interush Ltd -v- Commissioner of Police [2015] 4 HKLRD 706, paras. 50–52).  As such, victims are strongly advised to promptly instruct solicitors to take civil action and apply for injunction order and disclosure order.  

 

We have recently assisted the clients to recover the funds fraudulently transferred to a bank account in the UK. We communicated with the recipient bank and the UK police and the UK bank had temporarily frozen the recipient’s bank account. We have successfully obtained a disclosure order against the bank within two weeks. Eventually, the clients were able to recover the full amount of funds.  
 

For overseas victims, we have been in good communication with Hong Kong Cyber Security and Technology Crime Bureau and overseas police forces to gather all the investigation documents together.
 

Mareva injunction and Proprietary injunction
 

Mareva injunction
 

As soon as the victims are aware of the fraudulent transfers, they should apply for an injunction order to prevent the recipients from dissipating the assets before a judgment is obtained against them.    
 

To apply for a Mareva injunction, the plaintiff shall show to the court that:
 

• there is a good arguable case on a substantive claim against the defendant;
   

• the defendant has assets within Hong Kong;
   

• the balance of convenience is in favour of granting this injunction order; and
   

• there is a real risk of dissipation or secretion of assets by the defendant before the court can make the final judgment at the coming trial.
   

Proprietary injunction

 

A proprietary injunction is to preserve assets to which the plaintiff has a proprietary claim. If the plaintiff has been induced to transfer funds by fraud, the recipient may hold such funds on constructive trust for the plaintiff. As compared with the Mareva injunction, the threshold for obtaining a proprietary injunction is lower than obtaining a Mareva injunction that the plaintiff only has to show a serious issue to be tried on the merits. There is no need to prove there is a real risk of dissipation of assets by the defendant as is required for a Mareva injunction (see Pacific Rainbow International Inc -v- Shenzhen Wolverine Tech Ltd [2017] HKEC 869, paras. 37–39).
 

Disclosure Order
 

Disclosure in aid of the Mareva injunction
 

The standard form of the Mareva injunction allows the court to order the defendant to disclose his assets, including the value, location, and details of all these assets, so as to allow the plaintiff to know the existence, nature and location of assets (see Practice Direction 11.2 for Mareva Injunctions and Anton Piller Orders). However, this information does not reveal whether the defendant has dissipated the assets, and if so, the whereabouts of the assets. In this circumstance, the plaintiff may have to apply for a bankers trust order against the defendant’s bank.  
 

Bankers Trust Order against the third party bank
 

Under s. 21 of the Evidence Ordinance (Cap. 8), a party may apply to the court for an order that the bank to provide copies of entries in banker’s record for inspection or copying. This allows the plaintiff to trace the funds deposited to the wrongdoer’s bank account.
 

The plaintiff may make this application either with or without summoning the bank or any other party and shall serve the summons on the bank three clear days before the same is to be obeyed, unless the court or judge directs otherwise. The Hong Kong courts have observed that the bank in general adopts a neutral stance on the production of documents. 
 

Given that the bank is an innocent third party to the fraud, the bank is entitled to its costs of the disclosure application on an indemnity basis. The bank is entitled to reimbursement of its usual administrative fees and photocopying charges in producing the bank entries and legal costs of the application and compliance of the order when the bank seeks legal opinion (see Edward Arthur Banner and another -v- Great Union Electronic Technology Limited, HCA 514/2013).  
 

Norwich Pharmacal order
 

If the victims do not know the identity of the wrongdoer, they can apply to the court for an order against a third-party respondent (such as the bank) to disclose information of the wrongdoer to the victims. 
 

Civil action against the fraudster
 

In email fraud case, the identity of the wrongdoer is often unknown. Moreover, the recipient of the fund may or may not be the actual wrongdoer. The threshold to plead fraud is high and it should be pleaded where there is adequate evidence. In addition, when the plaintiff’s claim bases on an allegation of fraud, summary judgment (ie judgment without full trial on the basis that the defendant has no defence) is not available. This is known as ‘fraud exception’ (see O. 14, r. 1(2)(b), Rules of the High Court (Cap. 4A) (‘RHC’), Zimmer Sweden AB -v- KPN Hong Kong Ltd [2016] 2 HKC 282, [2016] 1 HKLRD 1016 (CA)).
 

However, it should be noted that if the plaintiff does not have to establish fraud in order to seek recovery of fund, then summary judgment is still available provided that the defendant has no defence (see Universal Capital Bank -v- Hongkong Heya Co Ltd [2016] 2 HKLRD 757; Laerdal Medical Ltd -v- Hong Kong Haocheng International Trade Ltd (21/06/2017, HCA2193/2016)).
 

Hence, instead of pleading fraud against the defendant in the Statement of Claim, the plaintiff can sue the defendant on other grounds, such as: (1) unjust enrichment (or money had and received); (2) constructive trust; and (3) knowing receipt and/or dishonest assistance. 
 

In terms of procedural matter, there may be another required process of delivering the litigation documents outside Hong Kong if the fraudster and/or relevant parties including the beneficiary reside(s) outside Hong Kong. In this regard, the plaintiff must apply for leave to issue a concurrent writ and for service out of jurisdiction pursuant to Order 6, rule 7 and Order 11 rule 1 of the Rule of the High Court (Cap.4A). This service-out application must satisfy: (1) there is a good arguable case (2) serious issue to be tried and (3) forum convenience.
 

Remedies
 

Default judgment and garnishee order
 

Once the defendant has failed to file and serve the acknowledgement of service and/or defence within the stipulated deadline under the court procedure, the plaintiff can apply for a default judgment be entered against the defendant. The court has confirmed that where a plaintiff has only obtained a Mareva injunction over the defendant’s assets and would like to apply for a default judgment against the defendant, the court can exercise its inherent jurisdiction to grant default judgment, despite the wordings of O.13, r.6 of the RHC which appears to suggest that the plaintiff needs to abandon its claim for injunctive relief before a default judgment can be entered against the defendant (see Baslokka Invest AS -v- Lambert and Sons Incorporated & Ors [2016] HKCU 1261).
 

After obtaining a default judgment, the plaintiff can apply for a garnishee order under O.49, RHC for recouping the stolen money. 
 

Declaratory relief
 

As regards the relief, aside from claiming for return of the funds, since there may be other competing creditors against the plaintiff, the plaintiff should also seek a declaratory relief from the court to hold that the stolen funds are held on trust for the plaintiff so that to put the funds out of the reach of other creditors of the defendant (see Guaranty Bank and Trust Co -v- Zzzik Inc Ltd, (unreported, HCA 1139/2016, 18 July 2016).
 

The controversial ‘vesting order’
 

In recent years, there has been conflicting authorities regarding the application of vesting order under s.52(1)(e) of the Trustee Ordinance (Cap. 29) (TO) in email fraud case, ordering the bank to return the traceable proceeds of stolen funds to the plaintiff (see 800 Columbia Project Company LLC -v- Chengfang Trade Ltd and others [2020] HKCFI 1293 where Recorder Eugene Fung SC concluded that s.52 of TO is not engaged upon the court making a declaration that the defendant holds money in a bank account on a constructive trust for a plaintiff in the context of email fraud (see para.16) ; Wismettac Asian Foods Inc -v- United Top Properties Ltd and others [2020] HKCFI 1504 where Deputy High Court Judge Paul Lam SC took the view that s.52(1)(e) of the TO is wide enough to cover the vesting by way of operation law in a constructive trust situation. However, the plaintiff has to establish that the current balances are attributable to the plaintiff as the source of money over which it asserts a proprietary claim such that the remaining balance in the defendant’s account is subject to a constructive trust (see para. 43-50).
 

Some legal practitioners prefer applying for a vesting order instead of a garnishee order the reason being that, for the latter option, it is likely that more costs would be incurred and the recovery of the money would be further delayed, though Deputy High Court Judge Paul Lam SC in Chambers has doubted whether more costs would be saved under the vesting order application (see Wismettac Asian Foods, Inc -v- United Top Properties Ltd and Others (10/07/2020, HCA252/2020) [2020] HKCFI 1504, para 58).
 

In Tokić, D.O.O. -v- Hongkong Shui Fat Trading Ltd and Others (04/08/2020, HCA381/2020) [2020] HKCFI 1822, DHCJ Douglas Lam SC examined the scope of TO and held that that ‘vesting order’ could not be applied to the defendant in the email fraud case. The judge referred to the UK Supreme Court case, Williams -v- Central Bank of Nigeria [2014] AC 1189 and considered that the defendants in the email fraud case were no more than recipients of proceeds of fraud and not ‘true’ trustees, constructive or otherwise. The extension of trustees to constructive trustees in s.2 of the TO confines to true constructive trustees or de facto trustees. The use of the phrase ‘or otherwise’ in s. 52(1)(e) in the TO (which mirrors the wording in section 51(1)(v) of the English Trustee Act 1925), despite its wide import, cannot have the effect of expanding the meaning of ‘trustee’ or ‘constructive trustee’ beyond the scope of the TO to include persons other than the true trustees (paras. 14-16 of the case of Tokić, D.O.O.). 
 

Lastly, the judge ordered the defendants to execute documents to instruct the banks to transfer the funds to the plaintiff, failing which the plaintiff can apply for an order under s. 25A, the High Court Ordinance (Cap. 4), where the court can nominate a person to execute the documents to effect the transfer of the funds.
 

From the above cases, it seems that the debate on the vesting order remains unsettled and can involve complicated legal issues. It may be more cost-effective and sensible for the practitioners to proceed with the traditional garnishee proceedings to recoup the funds.
 

Conclusion
 

Upon discovery of the fraud, victims should immediately inform the banks and file a police report. They shall quickly instruct solicitors to apply for injunction orders to prevent dissipation of funds, as well as Norwich Pharmacal order/bankers trust order requiring the bank to disclose the identity of the holder of the bank account and bank records showing the movement of the funds after receipt of the victims’ money. 
 

In some, but not all, cases, and if the victims are fortunate, by the time the relevant bank accounts have been frozen, there would still be some credit balance in those accounts. In most cases, the wrongdoers and/or recipients of fund will not appear in legal proceedings commenced by the victims against them. The victims may consider applying for default judgments against the defendant and then garnishee order against the bank for returning the funds.
 

If the funds have been transferred to other bank accounts, it is likely that the victims will have to apply for an injunction order against other recipients, Norwich Pharmacal order and bankers trust order to reveal the information of the third parties and whereabouts of the funds. It is advisable to seek legal advice as soon as you can. The longer the delay in taking action the greater the likelihood that funds will be transferred to various layers of recipients, rendering the recovery process more difficult and incurring higher costs.
 

 

For further information, please contact:  

 

Edward Liu , Legal Director, Hill Dickinson Hong Kong

edward.liu@hilldickinson.com