Cyber fraud and how to combat it

Cases of email and telephone fraud continue to soar globally and Hong Kong is no exception. In the first of a two-part series, Boase Cohen & Collins Associate Arthur Chan and Trainee Vivian Yu examine the options available to someone who falls victim to a scam.

Hong Kong, 27 July 2020: Telephone fraudsters conned more than 500 people in Hong Kong out of HK$185 million in the first five months of this year, according to police figures. There were 532 cases from January to May, compared with 207 over the same period last year, while the total amount stolen more than tripled.

Scammers were successful in persuading victims to transfer money to them through imposter schemes. The elderly continued to be targeted – around half those conned were aged over 60 and each person in this age group lost about HK$380,000 on average.

Scammers are becoming increasingly resourceful and devious, homing in on the older age groups, people who are lonely or vulnerable, or those with little IT knowledge. Typical examples include:

• Cold calling to promote an investment scheme/platform which is, in fact, a bogus operation.
• Spam emails asking the recipient to click on a link for prizes.
• Impersonating someone the victim knows and asking them to transfer money.

Hong Kong’s status as an international financial centre also makes it attractive to money launderers from all over the world. There is free flow of funds in and out of the territory and companies can easily be set up with low yearly registration fees. Fraudsters commonly induce victims to transfer funds to bank accounts opened by shell companies or individuals.

To protect themselves from any potential criminal and civil liability and to hide their true identity, a fraudster will seldom provide their own bank account to their intended targets. Instead, they will prey upon people who are either in urgent need of finance or are attracted by the concept of “easy” money and lure them into opening a shell company or a new bank account directly, through which illicit funds can be transferred.

Often, these people are unwitting accomplices – they might not have knowingly participated in the fraud or money laundering activity, but their actions have enabled it. They might allow the fraudster to take control of their bank accounts through online banking. If these unwitting accomplices are caught, this could result in criminal liability. Therefore, fraudsters have a tendency to look for people who are not permanently resided in Hong Kong to open bank accounts or be directors of shell companies.

Since the identity of a fraudster remains unknown, often the victim can only recover funds from identifiable recipients of the scam funds, i.e. the people who own the bank accounts. However, it is a race against time as the money could be quickly dissipated. Before the victim commences civil proceedings against the recipients to recover the money, they might consider obtaining a Mareva injunction to stop funds being remitted from the recipient’s bank account.

A Mareva injunction – named after a case before the English courts in 1975 – is a court order to keep matters in their original state before a trial, thus preventing an intended defendant from disposing of his or her assets. The application is usually made ex parte, that is, without giving notice to the defendant. While effective, it can be costly, since the plaintiff may have to pay third party costs and could be liable for damages if he or she later fails to prove they were entitled to such an injunction order. Thus, it would be unwise to make such an application if the lost funds are insignificant.

A more cost-effective alternative is to immediately report the incident to the police. Under the “no-consent” regime outlined in s. 25A of the Organised and Serious Crime Ordinance (Cap. 455), the police are allowed to issue a no-consent notice to the bank handling the subject account. This does not freeze the account per se but does dissuade the bank from further dealing with it or run the risk of committing a criminal offence. The police will also investigate matters and attempt to trace where the scam funds have gone to.

If the funds have already been dissipated and the police can identify the receiving bank account – the so-called lower layer of the scam – the victim may seek a Norwich Pharmacal order to obtain details of the account owner. This is a court ruling that orders a third party – in this instance, the recipient of the dissipated funds – to provide the applicant with information or documents relevant to the case. Such an order was first made in 1974 by the UK’s House of Lords in a landmark case, Norwich Pharmacal Co. v Customs and Excise Commissioners.

So, before contemplating any civil action, anyone who suspects they have been defrauded is strongly advised to report the matter to the police. If the scam has occurred online or via email, it is also worth considering engaging an IT consultant for further investigation.

Scammers typically home in on victims who possess only rudimentary IT knowledge.