Victims of online fraud are often left without any practical remedies as, by design, the fraud will be carried out in such a way as to make it extremely difficult to uncover the fraudsters' identities and to trace any stolen monies.

A recent decision of the English Commercial Court does, however, show that practical solutions can be found. The decision appears to be the first time in which an English court has granted a worldwide freezing order against 'unknown persons' to assist the victim of a sophisticated online fraud trace stolen monies across the globe and identify the fraudsters.

What happened?

CMOC Sales & Marketing Ltd (CMOC) was the victim of a sophisticated hacking into one of its directors' email accounts. The hackers sent requests to CMOC's bank, purportedly from the director, directing it to make multiple payments, totalling more than US$8 million, to accounts in some 50 banks in 19 different countries.

To recover the stolen money, CMOC sued the hackers and others involved in the fraud as 'unknown persons'.

CMOC also joined a number of the banks into which the stolen monies had been transferred to the proceedings so it could obtain information and disclosure orders against them. Although the identity of the fraudsters and those who received the funds was unknown, CMOC was able to show the Court how the fraud actually took place.

In a landmark decision handed down in 2017 but only made public recently, the English Commercial Court granted a worldwide freezing order over the assets of the unknown persons and information and disclosure orders against the banks.

The two orders worked in parallel. Once the Court granted the worldwide freezing order, CMOC could require the banks to freeze the relevant accounts to prevent further transmission of the monies. The information and disclosure orders then required the banks to disclose certain information as to the identity of the account holders to CMOC. Armed with this information, CMOC was able to carry out further investigations and to name certain individuals as defendants in the proceedings once satisfied as to their role in the fraud.

Did the orders help to identify fraudsters?

The orders helped CMOC to identify 31 individuals who were involved in the fraud. CMOC was then able to get various court orders against them requiring them to pay back the monies stolen or received by them (in or around US$1 million) in addition to damages for the loss suffered. In making its case to get these orders, CMOC provided the Court with a detailed flowchart outlining the flow of the stolen money between bank accounts, and demonstrating how some of the fraudsters were identified.

The orders should also assist CMOC to identify the remaining 'unknown persons', allowing it to continue to trace and retrieve the balance of the stolen monies.

Why is this case significant?

This appears to be the first time a worldwide freezing order has been granted by an English court against 'unknown persons'. It is a recognition by the English courts of the need for practical legal remedies for the victims of online fraud. In international fraud litigation, freezing orders are often a stepping stone for victims to get other relief and to recover stolen monies.

Interestingly, due to the large amount of background evidence used to secure the orders, and the fact that the banks were located all across the world, service of the evidence and orders on the banks was effected by granting them access to a data room containing all the necessary information. Innovative means of service like this can make it easier for victims of online fraud to enforce, and banks to comply with, these types of orders.

The case shows that practical remedies can be fashioned to assist victims of online fraud. Although not binding on the Irish courts, the decision may prove to have a significant impact on online fraud litigation in Ireland and abroad.

This article contains a general summary of developments and is not a complete or definitive statement of the law. Specific legal advice should be obtained where appropriate.