Supreme Court clarifies risk of loss due to fraudulent EFTs

La version française de cette communication est publiée ici.

The SCC released a short decision on December 10 confirming unanimously that it is the bank’s customer who bears the risk of loss of an amount that the bank transferred by electronic payment order from the customer’s account to a third party as a result of a phishing scam¹. The decision adopts the reasoning of the Québec Court of Appeal and specifies that it would not have been different if the customer’s account had been in positive balance. In this case, the customer’s account was in a debit position.

The decision

Sollio Groupe Coopératif, formerly known as La Coop Fédérée, (La Co-op) was a client of the National Bank of Canada (Bank). La Co-op was the victim of a “phishing” scam, fraudulently inducing it to instruct the Bank to execute payment to a fraudster. Having carried out the instructions, the Bank debited almost US$5 million dollars from the line of credit of La Co-op. The funds were transferred to the credit of the fraudster’s account at a bank in China, and never recovered. La Co-op claimed the loss under two insurance policies. Liberty International Underwriters (Liberty) paid up to its limit of CA$1 million, but Co-Operators General Insurance Company (Cooperators) denied coverage, invoking several reasons. Among these reasons, they argued that the Bank should suffer the loss under the Bills of Exchange Act. This raised the question as to whether a credit transfer initiated electronically (an electronic funds transfer or EFT) is a bill of exchange or a cheque.

The Court of Appeal considered at length the differences between a cheque and an EFT and concluded that EFTs are not bills of exchange, confirming the prevailing opinion of legal scholars in Quebec. Rather, EFTs are properly characterized as mandates (analogous to contracts of agency) that are not governed by any particular statutory regime, but are subject to the practices of the banking industry and the particular contractual terms between the bank and its customer. In this case, the agreement between the Bank and La Co-op provided that the customer assumed the risk of any liability resulting from electronic banking instructions it gives to the Bank. It is noteworthy that the behaviour of the Bank in relation to the loss was not at issue. The parties did not dispute at trial who was responsible for allowing the fraud to occur.

Cooperators also argued that the funds did not belong to La Co-op, but to the Bank, and therefore the Bank should have assumed the risk of loss. The Court of Appeal held that ownership of the amount loaned by the Bank to La Co-op passed to La Co-op at the time the amount was debited from its line of credit, along with the risk of loss of the property, by the application of article 2327 of the Civil Code of Quebec. As a result, La Co-op bears the risk of loss. The Court of Appeal stated at paragraph 110 of its reasons that the customer bears the risk of loss if the account is in a debit position, but that if the account were in a credit position then the bank would bear the risk of loss.

The two-paragraph decision of the Supreme Court of Canada dismissed the appeal essentially for the reasons of the Court of Appeal of Québec, but stated, without giving reasons, that the customer bears the risk of loss whether or not their account is in a credit or debit position. The reasons for adopting the same result whether or not the customer’s account is in a credit or debit position may need future elaboration, but the outcome is clear.

Conclusion

The result of this civil law case is consistent with long-standing principles in the common law. Both civil law and common law systems have long characterized bank deposits as money lent by the customer to the bank creating a debt owed by the bank to the customer, the amount of which is reduced with each authorized withdrawal. See the long-standing authority of Foley v. Hill, [1848] 2 HLC 28; 9 ER 1002 (HL) which has been followed in Québec since at least Corporation Agencies Ltd. v. Home Bank of Canada, [1925] S.C.R. 706, confirmed by [1927] A.C. 318 (P.C.). Credit transfers were distinguished from cheques in the common law by Tenax Steamship Co Ltd v Reinante Transoceanica Navigacion SA, [1973] 1 WLR 386 (QBD). Allocating to the customer the risk of loss caused by a third party’s fraud on that customer, rather than to the bank, promotes the tightening of security procedures on the customer’s side.

In the final analysis, this decision has the benefit of simplicity and provides clarification for all parties engaged in electronic funds transfers. The Supreme Court decision is thus a welcome clarification of the law which also highlights the need for extra vigilance at a time when business is increasingly conducted remotely.

_________________________

¹ Co-Operators General Insurance Company v. Sollio Groupe Coopératif, 2020 SCC 41, confirming 2019 QCCA 1678.