$100K fraud claim dismissed by B.C. tribunal due to alleged messenger hack

In this Tuesday, Aug. 11, 2015 file photo, a bank clerk counts Chinese currency notes at a bank outlet in Huaibei in central China's Anhui province. (Chinatopix via AP)

A customer who claimed a B.C. currency exchange had defrauded them of more than $100,000 has had the case dismissed after the company claimed it was hacked.

Jing Wang – who is referred to throughout the B.C. Civil Resolution Tribunal decision on the matter as “Mrs. Wang,” but with the gender-neutral pronoun “they” – alleged that XHD Pacific Forex Service Ltd. had caused them to lose 544,000 Chinese Yuan that they were trying to convert to Canadian dollars.

In response, XHD claimed that Wang was the victim of “a third-party fraudster” who hacked an XHD employee’s WhatsApp account and directed Wang to transfer the funds to the hacker’s account.

Tribunal member Peter Nyhuus issued his decision on the matter Tuesday, calling the incident “sad,” but finding in XHD’s favour and dismissing Wang’s claim.

CRT jurisdiction

Notably, Wang’s decision to pursue the fraud claim through the CRT is unusual, given that the tribunal is intended to provide the public a recourse for resolving small claims and has a maximum award on such files of $5,000.

Nyhuus' decision notes that tribunal members must dismiss cases that the deem to be outside the CRT’s jurisdiction, and speculates about whether he should dismiss this case on such grounds.

“The CRT regularly allows parties to bring small claims disputes worth more than $5,000 if they abandon their claim to any amount above this monetary limit,” the decision reads. “However, I am not aware of a CRT dispute in which a party abandoned 95 per cent of their claim.”

The decision explains that Nyhuus asked the CRT’s case manager to contact Wang and ensure that they understood that abandoning the claim for an amount over $5,000 would also preclude them from pursuing the remaining $95,000 in a different setting.

“The case manager reached Mrs. Wang by phone,” the decision reads. “He informed me that Mrs. Wang confirmed they are abandoning the portion of their claim over $5,000, that they understand they would not be able to claim the remaining amount in any other Canadian court or tribunal, and that they wish to continue with the CRT’s adjudication process.”

With that confirmed, Nyhuus proceeded with his analysis of the case.

The tribunal member denied XHD’s counterclaim alleging that Wang had defamed it, however, because defamation claims are explicitly not within the CRT’s jurisdiction.

What happened

According to the decision, Wang attended XHD’s storefront on Oct. 30, 2023, to inquire about exchange rates on a transfer of $100,000 that they needed for “emergency purposes.”

The decision does not elaborate on what those purposes were, nor does it specify where in B.C. Wang and XHD were operating at the time, but a Better Business Bureau listing for a company by that name indicates it is based in Richmond.

Also, B.C.‘s Registrar of Companies indicates that a company called XHD Pacific Forex Service Ltd. was voluntarily dissolved on Oct. 30, 2024.

While at the XHD storefront, Wang spoke to an employee identified in the decision as “L,” who added Wang as a contact on her personal WhatsApp account.

“Mrs. Wang did not sign a contract with XHD while at the store,” the decision reads. “I infer that this is because they needed to first open a Canadian bank account that could receive a wire transfer from a bank in China.”

XHD provided screenshots of the WhatsApp messages that followed between Wang and L, along with translations from Chinese, the validity of which Wang did not dispute.

During the exchange, Wang said the earliest appointment they could get to open an account was on a Friday, and L responded by suggesting that the transfer should wait until the following week.

However, when Wang messaged again after their appointment on the Friday, asking for the day’s exchange rate, the hacker – who by this point had purportedly taken over L’s account – responded.

“The hacker responded at 6:41 p.m. to say, ‘Cannot transfer today,’” the decision reads. “I pause to note that this was a skilled comment by the hacker as it was entirely consistent with L’s earlier messaging about not being able to transfer on Friday.”

However, the hacker followed up 11 minutes later, quoting an exchange rate and asking how much Wang needed to transfer.

“About 20 minutes later, the hacker provided Mrs. Wang an account number for a bank in China and told them to transfer 544,000 RMB to that account,” the decision reads.

“At 8:27 p.m., Mrs. Wang sent the hacker a picture of a phone showing a warning screen, advising caution about online wire transfer fraudsters. I infer that this is a warning message from Mrs. Wang’s Chinese bank that automatically appears before a customer makes a large transfer. Mrs. Wang asked the hacker why they were receiving this message. The hacker advised Mrs. Wang how they should answer the bank’s questions so that the transfer could proceed.”

A few minutes later, Wang messaged the hacker an image showing that the transaction was successful, according to the decision.

Then, at 9:45 p.m. on the same night, L supposedly realized her WhatsApp account had been compromised and advised Wang to call police about the fraud.

Who is liable for third-party fraud?

“Both parties say that this case is about fraud, although they characterize the fraud differently,” begins Nyhuus' analysis of the facts and applicable law in the case.

“Mrs. Wang implies that XHD colluded with the holder of the Chinese bank account to implement a scam against them. XHD denies this and says that the fraud was committed by the third party hacker. Given that Mrs. Wang has not disputed XHD’s claim about the hacker’s existence, I accept XHD’s account. So, I will not consider Mrs. Wang’s allegation of fraud further.”

Even if XHD was not responsible for the fraud, however, it could still be held liable for Wang’s loss if there was evidence of willful misconduct, dishonesty or negligence on the part of XHD, according to the decision.

The company could also be held responsible if there was evidence that the parties had a contract that allowed Wang to rely on instructions sent by WhatsApp message.

Nyhuus found no evidence of willful misconduct or dishonesty, and concluded that Wang had “taken no steps to prove” XHD was negligent in allowing the hack to occur.

The question of whether the contract allowed Wang to rely on WhatsApp instructions was less clear-cut, according to the tribunal member.

Nyhuus noted that XHD did not suggest it was unusual for L to add Wang as a WhatsApp contact, and found that the company’s agents often negotiated via phone or text.

“Given that XHD’s standard exchange process includes the use of phones to finalize exchange rates, account information, and the wire transfer contract itself, I find that XHD’s standard process leaves it vulnerable to being held liable for an attack by a third party hacker,” the decision reads.

“However, I find that I cannot hold XHD liable in this case. This is because Mrs. Wang did not follow the rest of XHD’s standard process, which did include safeguards against fraud.”

Wang “disregarded XHD’s transfer protocols,” which generally call for the parties to sign a contract before commencing a transfer, according to the decision.

Nyhuus also found Wang failed to “sufficiently question” the hacker presented with information contradicting L’s previous suggestion that the transfer could not happen on a Friday, and failed to take the Chinese bank’s fraud warning as a red flag suggesting further due diligence was necessary.

“In summary, I find Mrs. Wang was negligent in the handling of their own money,” the decision reads. “They were the party dealing with the fraudster and best placed to recognize the signs of fraud. I find Mrs. Wang most enabled the fraudster. So, I dismiss Mrs. Wang’s claim.”

XHD claimed $375 for reimbursement of its translation expenses related to the case, which Nyhuus found was a reasonable request, but one he nevertheless declined to grant.

“Bearing in mind how much Mrs. Wang has already lost while trying to use XHD’s services and that I have found XHD’s process left it vulnerable to this kind of hacking, I decline to add to Mrs. Wang’s losses,” the decision concludes.