Push payment fraud and freezing injunctions

13th May 2019

Walker Morris’ Banking & Finance Litigation specialists highlight the latest case concerning an injunction to freeze bank accounts used to deposit the proceeds of push payment fraud. The case will be of interest to lenders and their customers, who are increasingly at risk of this type of fraud.

What is push payment fraud?

Payments are described as ‘push payments’ when the payer obtains the payee’s account details and instructs their bank or other payment service provider to send (or push) money to it. A push payment fraud will therefore involve the fraudster somehow persuading the customer/victim to organise a transfer from its account to the fraudster’s account. Examples could include:

• a fraudster who poses as a solicitor and asks the customer to transfer deposit monies for a property transaction
• a fraudster who poses as a builder to receive a large cash transfer
• a fraudster who impersonates a customer’s friend in order to persuade them to transfer a sum of money.

The hacking of e-mail or other accounts, and the proliferation of personal data available via social media and even the dark web, enable fraudsters to impersonate and deceive customers in increasingly varied and sophisticated ways.

What is a freezing order?

A freezing order is an injunction which restrains a defendant or potential defendant from disposing of or dissipating assets. A freezing order is typically obtained by a claimant or potential claimant who wishes to ensure that a potential defendant’s assets remain available pending the enforcement of a court judgment. Various different types of assets can be frozen, including bank accounts, shares, investments, land, property and so on.

Freezing orders, by their very nature, have a severe restrictive impact and so there are strict requirements as to when a court will issue one.  To obtain a freezing order:

1. the applicant must have a substantive cause of action against the respondent (the potential defendant)
2. the applicant must have a good arguable case
3. there must be a real risk of dissipation of assets
4. it must be just and convenient to grant the freezing order, bearing in mind the conduct of the applicant (‘clean hands’); the rights of (and any impact upon) any third parties who may be affected by the freezer; and whether such an order would cause legitimate and disproportionate hardship for the respondent.

What happened in World Proteins Kft v Persons Unknown?

In this recent case [1], the claimant company received two legitimate invoices and several legitimate emails relating to outstanding payments from its longstanding supplier.  An unknown individual then hacked the email account of the supplier and sent several fake emails purporting to be from the supplier.  The fake e-mails (which included a previous chain of emails relating to invoicing, thereby giving the impression of authenticity), claimed that the supplier had a new bank account with Barclays and requested payment of two outstanding payments, of €1.5 million and €500,000 respectively, to be paid to that account.

When the company realised that it had actually fallen victim to a push payment fraud, it was able to recall the transfer for the €1.5 million but not the €500,000. The company therefore issued an urgent claim for the €500,000 and applied for a freezing injunction in respect of the fraudster’s bank accounts.

As with many of these cases, the situation was complicated by the fact that the identity of the fraudster was unknown.

What did the court decide?

However, taking a pragmatic approach, and following the 2017 case of CMOC v Persons Unknown [2], the court granted a freezing injunction.  It was clear that the company had proven the elements required for the freezing injunction (there was an obvious fraud, meaning there was a clear substantive cause of action; there was a good and arguable case against the person unknown; and there was an obvious and real risk of the dissipation of the money).  In addition, whilst the name of the fraudster was initially unknown, the person was clearly identifiable as the beneficiary of the bank account.  Any potential issues in terms of identifying the fraudster further down the line (for example to notify them of the injunction and its penal notice [3]) would apply equally on any kind of injunction, so there was no reason not to extend the accepted rules for injunctions generally to ‘freezers’.  Furthermore, the granting of injunctive relief against ‘persons unknown’ makes particular sense in the context of push payment fraud, where the fraudsters involved are inevitably unknown – at least at the outset – because of their activity as hackers.

Following the granting of the injunction, the Barclays account was frozen. At that point it still contained €350,000, with the remaining amount having been transferred to overseas accounts.  The disclosure of bank records also led to the identification of the fraudster and the discovery of his UK address.  That enabled the named fraudster to be added as a known defendant to the substantive claim.

WM Comment and practical advice

In most fraud litigation cases, particularly fraud by unknown persons, the object is primarily to notify banks of the freezing injunction so that they can freeze any relevant accounts, and then to obtain vital information which might assist in positively identifying the potential defendant(s) and in tracing and ultimately recovering funds – even internationally. The World Proteins and earlier CMOC cases will be welcome to lenders and private claimants alike as they demonstrate the courts’ understanding of push payment fraud and their ability to offer a remedy for victims even in spite of the anonymity (initially, at least) of the fraudsters and the seemingly voluntary nature of the payment.

So, where a lender, customer or other person finds themselves to be a victim fraud, what should they do?

Our recent briefing provides an update on the measures currently being taken by firms and regulators within the financial services industry to combat push payment fraud generally.  There are, however, some specific practical steps that victims can take:

• As well as following any internal incident management regime, victims of fraud should immediately notify the police. They may be able to recover any stolen monies and potentially take criminal action against the fraudsters.
• It may also be necessary or appropriate to notify any insurer, any other interested parties (such as a lender’s customer) and any industry representative body.
• In addition, victims should seek immediate specialist legal advice. Walker Morris’ Banking & Finance Litigation team has significant expertise in fraud claims and would, in many cases, be able to urgently initiate a freezing injunction to try to preserve any stolen monies in the fraudsters’ bank account(s). It may also be possible to obtain an order from the court requiring disclosure of assets to be provided by the suspected fraudsters. If the whereabouts of monies is unknown, Walker Morris has extensive experience in tracing and recovery, both within the UK and internationally.
• There are also a number of civil remedies that victims may be able to pursue. Depending on the type and circumstances of the fraud, there may be breach of contract; negligence, breach of trust; unjust enrichment and/or tracing claims which could mitigate any losses and potentially help to recover lost funds. It may, in some cases, also be possible to obtain compensation or contributions from other involved parties (such as IT security consultants or the like).

If you would like any further advice or assistance on push payment fraud, or indeed fraud generally, please do not hesitate to contact Louise Power, Rachel Elgar or any member of Walker Morris’ Banking & Finance Litigation Team.

_______________________

[1] [2019] 4 WLUK 35
[2] [2017] EWHC 3599 (Comm)
[3] for further information, see our practical guide to worldwide freezing injunctions