Unknown individuals had hacked in to CMOC’s systems and sent forged payment instructions to CMOC’s bank, resulting in the fraudulent diversion of millions of pounds into bank accounts held by a large number of international and overseas banks, operating across multiple jurisdictions.
CMOC v Persons Unknown [2018] EWHC 2230 (Comm) is a landmark case because it is the first time that the High Court has granted a worldwide freezing injunction against alleged anonymous perpetrators involving cyber fraud in England and Wales. Up until this point, injunctions against ‘persons unknown’ had rarely been granted and even then only for cases like online libel.
According to the Law Gazette’s coverage of the ruling, the High Court’s injunction ultimately required 35 international and overseas banks in at least 19 jurisdictions to freeze the assets of the individuals and the alleged stolen funds, and to reveal the identity of the alleged fraudsters as well as the details of any onward transfers.
At trial the High Court ordered the repayment of the stolen money, awarded damages of around £7m and subsequently enforcement action ensued.
Philip Young, partner at dispute resolution firm Cooke, Young & Keidan (CYK), had advised CMOC on its legal action and told the court that cyber threats were growing in sophistication, with billions of pounds being lost each year.
What corporate victims needed, he said, was a means to fight back. Never before granted in cyber fraud cases like this, the ‘persons unknown’ jurisdiction is a tool that English civil courts have in their toolbox to pursue the alleged perpetrators and, potentially, resolve disputes globally.
Speaking to ESA Risk, Young says that the claimant’s overriding aim was not only the worldwide freezing injunction but the related disclosure orders, which required the banks to say who the purported customers of the accounts were and to hand over documents to show what the account holders had done with the stolen money.
“It is ‘persons unknown’ until you know who they are and then you start naming them and bringing them in as defendants, which is what we did,” he says.
This approach enabled his team to pursue the alleged fraudsters, and, as required, issue domestic orders in the courts of overseas jurisdictions to recover some of the losses.
For reasons of client confidentiality, Young says it is not possible to disclose how much CMOC recovered after the ruling. However, he does disclose that, even after the legal costs were taken into account, CMOC came out with a substantial recovery, with the recovered sums being more than enough to justify the litigation using the ‘persons unknown’ jurisdiction.
Since this landmark ruling, Young notes that the use of ‘persons unknown’ jurisdiction for cyber fraud has been adopted as an approach by the courts in Hong Kong and Malaysia, both of which have seen cases to test the legal waters, relying on the English judgment as precedent.
Lloydette Bai-Marrow, Serious Fraud and Economic Crime Consultant at ESA Risk, believes the ruling may be the start of a trend, which could result in more commercial courts being willing to grant these types of freezing injunctions.
She says that CMOC v Persons Unknown [2018] EWHC 2230 (Comm) is significant because it shows that the courts are starting to wrestle with this issue, adding that the courts recognise that the world is changing, and that the legal landscape needs to be agile enough to respond.
“The way these freezing orders work is that they open a further avenue of recompense for those who have been the victims of fraud,” she says.
However, she doesn’t believe that in the UK the “floodgates” will open. The judiciary, she believes, will still approach worldwide freezing injunctions with a great deal of caution, in part because they are not easy to enforce.
“There are challenges in terms of enforceability and in terms of what seems like the transfer of investigative responsibility over to the banks and other institutions deemed to be responsible for complying with the order,” she explains.
It’s also important to remember that, although a freezing injunction places a responsibility on banks to act and freeze the money, making an application to the courts to apply for one is not a quick process.
Bai-Marrow warns that businesses need to be mindful that there are limitations in the speed it takes to secure one, which can then be enforced or served on parties to enforce. This is especially important to bear in mind because when fraud is involved, targeted businesses need to move quickly to minimise their losses.
Mike Wright, Risk Management and Investigations Consultant at ESA Risk, concurs. He says that when fraudsters move stolen money into overseas bank accounts, it can be channelled into other accounts instantaneously. Chasing the money can be like chasing your tail.
“If fraudsters get a sniff that someone is after a freezing order, they can move the money into three different continents in 15 minutes,” he warns.
Should the alleged fraudsters pour the stolen money in assets, this can be traced more easily, he adds.
“It’s a lot harder and a lot slower to move assets and there is also a trail,” he says. “Even if someone has sold a property or transferred it into their spouse’s name, you can still go after it.”
However, like the worldwide freezing order on bank accounts, the difficulty in freezing assets is that some overseas jurisdictions will have no compulsion to co-operate.
Even before the pandemic struck in early 2020, cyber fraudsters were upping their game, employing ever more ingenious and ruthless measures to defraud businesses.
In recent years, business email compromise schemes (BECs) like the one used in the CMOC v Persons Unknown [2018] EWHC 2230 (Comm) case have increased in prevalence globally, says Bai-Marrow.
“The fraudsters will be watching the flow of information between two parties and will then identify potential transactions that could then be used to divert money from the business into their own accounts,” she explains.
“They will then replicate an email that appears to have come directly from the business they intend to defraud or the other parties. As they’ve seen the pattern of information, they’ll know who to say they are to the recipient.”
What Covid-19 has done is create the perfect conditions for fraudsters to prey on vulnerable businesses, whether they are high-profile operations or small enterprises.
Graeme McGowan, Cyber Risk & Security Consultant at ESA Risk, notes that one development that has worked to the fraudster’s advantage is the move to remote working.
“You’ve got people who are in senior positions in banks working at home on the laptop or PC, accessing the corporate system. It’s a recipe for disaster,” he warns. “At the moment, it’s a hacker’s and criminal’s playground with lockdown.”
Taking into consideration the very serious and growing threat that cyber fraud poses businesses of all sizes; the practical considerations involved in applying for a worldwide freezing order; and the difficulty in enforcing it effectively, what is the best course of action for businesses to take?
Arguably, the most effective safeguard against cyber fraud is prevention. BECs and other types of fraud occur because there are vulnerabilities in IT systems and staff may not be sufficiently trained to identify scams. Bai-Marrow says that businesses should adopt a two-part approach.
“Strengthen your cyber defences and ensure you’ve invested in all the relevant online protection tools but also ensure the individuals in the key areas of your business who are most susceptible to being a victim of a scheme like this are effectively trained to recognise the warning signs,” she explains.
“Even with BECs, before they proceed with paying that money out, call the company up and just double check, have a process in place, and review your procedures when it comes to how your business pays out funds.
“For example, if a vendor you are using changes its details, have a process in place that that bank account must be verified. Processes can be tedious and boring but they are absolutely the right thing in order to protect your business. So, for example, if you notify us of a change of bank account, it will take us seven days to change that. In that time, we will verify that bank account with intended recipient through a variety of means to ensure authenticity.”
It’s also about training staff in important, albeit vulnerable, positions, she says. “Don’t just click on an email response and not check who the email is really from. There are things that companies can do to sensitise their staff, especially those in critical roles, to ensure they don’t inadvertently become facilitators of fraud.”
McGowan has written extensively about the growing sophistication in cyber crimes, including providing practical steps on how best to enhance security on business and personal accounts.
He argues that IT system improvement is a priority, not just as a deterrence against hackers but also to minimise the risk that regulators will potentially impose a fine on a business for failing to protect its clients’ confidentiality.
“You need to have a full structured IT assessment done, checking out all of your policies and procedures, including ISO 27001,” he argues.
“If you’ve got everything in place and you’ve got a good training regime in place, accidents will still happen because hackers are clever at what they do. However, if you do get hacked, GDPR comes in and the ISO won’t fine you because you’ve taken the necessary steps.”
With the move to remote working, McGowan also argues that businesses must tighten up their employees’ home security. One option is a firewall, which sits between the router and IT devices. It monitors all incoming and outgoing traffic and prevents any malicious activity.
“A lot of people probably don’t want to do that but they don’t understand that it is a good solution,” he says.
“You need some means of monitoring incoming and outgoing traffic. You need up to date security software to protect you. You need to be working possibly through a VPN [virtual private network] 100% of the time.”
McGowan also warns about the huge increase in the use of ‘deepfakes’, a type of identify fraud that leverages artificial intelligence to create convincing fake images, videos and voice recordings.
Although deepfakes are not a new threat, this type of fraud is becoming increasingly convincing and difficult to identify, he says.
McGowan admits that the chances of a fraudster using a deepfake to impersonate a CEO in a financial institution to extract funds is slim but there has been at least one case involving a less sophisticated approach.
“In October 2019, it was reported that a top executive in a UK-based energy company had been duped into transferring £200,000 to cyber fraudsters,” he says.
“The perpetrators used AI voice technology to mimic the executive’s boss, who was based at the German HQ. The executive was instructed to move the funds immediately to a Hungarian bank account and was told they would be returned later. They never were.”
In most fraud cases, it is rare for businesses to retrieve the stolen money. Often businesses will chalk up the loss and move on, says Bai-Marrow. This is because it’s more damaging to their reputations to come out publicly and declare the financial loss.
Fraudsters know this and may even be encouraged to hack into systems because they are confident they will not be pursued. What’s more, they recognise that speed of response is critical, so preventative steps are undoubtedly the best protection to minimise any financial losses and protect reputations.
One of the services that ESA Risk will be looking to offer clients in the future is a blockchain fraud software solution, says McGowan.
“This allows us to not just identify the chain of what might have happened, it allows us to get inside the details and that would allow us to advise the banks.”
