$5-million cyber claim for phishing scam heads to top court

A $5-million coverage dispute with The Co-operators that arose from a phishing attack is headed to the Supreme Court of Canada.

Canada’s top court is booked Dec. 7 to hear arguments in Co-operators General Insurance Company v. Sollio Groupe Coopératif. The claim was based on fraudsters inducing a Quebec agricultural co-operative to make an electronic funds transfer.

It all began in August 2014, when Sollio Groupe Coopératif had a deposit account in U.S. currency with the National Bank of Canada. Sollio Groupe, known in 2014 as La Coop Fédérée, is a Quebec agricultural cooperative.

A phishing attack resulted in an electronic funds transfer of US$4.946 million from Sollio Groupe’s account. In Canadian funds, Sollio Groupe’s total loss was about $6.5 million.

Phishing scams often use social engineering and can look like they come from a company’s bank or another business, the Associated Press reported earlier.

When Sollio Groupe fell victim to the 2014 phishing scheme, it made claims on two insurance policies it had at the time. One was a $1-million fidelity and crime policy written by Liberty International Underwriters. The other was a $100-million policy, written by several insurers, with  Co-operators General writing the first $15-million layer. That policy had a $500,000 retention with no exclusion for computer fraud.

Liberty International paid Sollio Groupe to its policy limit of about Cdn$1 million.

iStock.com/WhataWin

The Co-operators initially denied coverage.  Sollio Groupe took The Co-operators to court and initially won.

One of The Co-operators’ arguments was that the US$4.9-million, which was unwittingly wire-transferred to a fraudster in 2014, did not belong to Sollio Groupe. Instead, The Co-operators argues that the stolen money actually belonged to the National Bank of Canada.

But in Coop fédérée v Compagnie d’assurances générales Co-Operators, released Jan. 9, 2017, by the Superior Court of Quebec Montreal District, Justice Michel Déziel ordered Co-operators General to pay Sollio Groupe (known then as Coop Fédérée) Cdn$5.4 million on its claim.

There were several issues on appeal. The main result of the Quebec Court of Appeal’s ruling, released in 2019, is that The Co-operators still has to pay $5.4 million to Sollio Groupe.

Now The Co-operators is asking the Supreme Court of Canada to set aside the Quebec court ruling and declare that National Bank must return the US$4.9 million from the fraudulent wire transfer to Sollio Groupe’s account.

Complicating matters is that at the time of the 2014 phishing attack, Sollio Groupe’s account with the National Bank of Canada was overdrawn by US$3.39 million. So after the US$4.9 million was electronically transferred, the account was overdrawn by a total of US$8.33 million.

National Bank of Canada argues that if an account is overdrawn, the money is loaned to the customer, and the bank does not assume the customer’s risk of losing that money.

In its original 2017 ruling against The Co-operators, the Quebec Superior Court cited two sections of Quebec’s Civil Code. Section 2314 states: “A simple loan is a contract by which the lender hands over a certain quantity of money or other property that is consumed by use to the borrower, who binds himself to return a like quantity of the same kind and quality to the lender after a certain time.”

Section 2327 of the Civil Code states: “By simple loan, the borrower becomes the owner of the property loaned and he bears the risks of loss of the property from the time it is handed over to him.”

iStock.com/Jagrutiben Patel

As an intervener in The Co-operators’ appeal to the Supreme Court of Canada, the Canadian Bankers Association argues that National Bank of Canada should not have to assume responsibility for Sollio Groupe Coopératif’s loss from the phishing scheme.

“The liability of a bank, if any, must be assessed in light of the contracts between the bank and its customer, the scope of the bank’s undertaking to a customer in performing any given service, and the unique set of facts of each case,” CBA wrote in its factum.

Although CBA is urging the Supreme Court of Canada not to rule in favour of The Co-operators, CBA actually disputes part of the premise of the Quebec Court of Appeal’s 2019 ruling against the insurer.

The Quebec Court of Appeal said that if a customer’s account is in debit, the customer owns the funds and bears the risks of a loss in a situation like the one Sollio Groupe faced in 2014.

But the appeal court also said that if a customer’s account balance is in credit, the bank owns the funds and bears the risks of loss.

CBA disagrees, arguing that when banks process wire transfers based on their customers’ instructions, those banks are never using their own funds, regardless of whether the customer’s account balance is in debit or credit.

Essentially, CBA argues there is a key difference between wire transfers and paper cheques, which are subject to the federal Bills of Exchange Act.

“A bill of exchange is a transferrable instrument addressed by one person to another that promises a fixed sum of payment either immediately or at a future date,” CBA wrote in its factum. “The right to payment is incorporated in the document, which allows the holder to transfer the instrument by simple endorsement. As such, a bill of exchange has inherent property value and it is this valuable piece of paper that is negotiated between different parties.”

But with wire transfer instructions, there is no “underlying” instrument with any value, adds CBA. Instead, the customer instructs the bank to transfer funds to another party.

“When banks carry out their customers’ instructions, they are acting as their customers’ mandatary. They do not become an insurer of the transaction,” wrote CBA.