Afridi & Angell recently acted successfully for a client in proceedings arising from a banking fraud, resulting in a significant and relatively rare decision of the Dubai Court of Cassation requiring the bank to compensate the customer for the loss suffered. The decision is particularly significant at a time when banking fraud is becoming increasingly prevalent and sophisticated. The judgment confirms that a bank cannot avoid responsibility simply because the underlying fraud was committed by third parties; the bank’s own conduct must be assessed by reference to the professional duty of care it owes to its customers, including its response once it is notified that a customer’s account has been compromised.
The fraud
Our client’s bank accounts were compromised after fraudsters, impersonating law enforcement officials, coerced him into disclosing his banking credentials. Using those credentials, the fraudsters gained control of the accounts through an ATM. They subsequently registered the accounts for online banking and, within a matter of hours, transferred substantial sums of money through three separate bank accounts without our client’s knowledge or authorisation.
The client promptly notified the bank when he discovered what had happened. His case was that, despite being placed on notice of the fraud, the bank failed to respond with the urgency required to contain its consequences, trace the transferred funds and take effective steps to recover them before they became irretrievable.
The claim asserted
Proceedings were commenced on the basis that the bank had failed to discharge its professional and legal obligations. The central issue was not whether the bank had perpetrated the fraud, which was plainly committed by third parties, but whether the bank had independently complied with the duties arising from its relationship with the customer. The bank argued that no fault was attributable to it because the fraudulent acts had been committed by third parties and not by the bank or any of its employees. Our case was that this did not answer the separate question of whether the bank had discharged its own duty of care.
The courts’ approach
The Court of First Instance rejected the claim, essentially on the basis that the fraud had been committed by third parties and not by the bank or its employees.
The Court of Appeal took a different approach. It considered whether the bank had independently discharged its professional duty of care, including:
➢ Whether the Bank maintained sufficient security measures and fraud detection mechanisms to reasonably protect customers against fraud of this nature;
➢ whether the transactions were sufficiently unusual, having regard to the customer’s established banking history and transaction patterns, to have warranted intervention or further inquiry from the Bank before the transactions were approved; and
➢ whether the bank responded adequately and promptly once it was notified that the account had been compromised and fraudulent transactions had occurred.
Evidence arising from Sanadak’s investigation and later disclosed in these proceedings revealed a number of deficiencies in the Bank’s response, most notably, delays, and in respect of certain transactions, complete omissions, in initiating fund recall efforts after it had been alerted to the fraudulent activity.
The Court of Appeal found the bank in breach of its duty of care and ordered it to compensate the client.
The Court of Cassation upheld that judgment.
Why the decision matters
The significance of the judgment lies in the distinction between the fraudster’s responsibility and the bank’s own responsibility towards customers.
The fact that a third party perpetrated the underlying fraud does not, in itself, discharge the bank from the professional obligations arising from its relationship with its customer. The bank’s responsibility must also be assessed by reference to its own conduct, including what it did – or failed to do – once it became aware of the fraud.
The decision is particularly notable because cases in which a bank is required to compensate a customer for losses resulting from a third-party fraud are relatively uncommon. It therefore provides an important judicial affirmation that a bank is not merely a passive intermediary once its customer’s funds have been fraudulently misappropriated.
Once placed on notice, banks may be required to act promptly, diligently and effectively to mitigate the loss, including by investigating the circumstances, tracing the transferred funds and taking meaningful steps to seek their recovery before the damage becomes irreversible.
A missed opportunity?
None of the courts however considered the relevance of the UAE Central Bank’s Consumer Protection Regulations (Regulations) in cases involving fraud against customers. The Regulations require financial institutions to promptly compensate consumers who fall victim to fraud, save where the consumer is proven to have been grossly negligent or to have engaged in fraudulent conduct in connection with the incident. The Regulations reverse the burden of proof by requiring banks to prove that the customer was grossly negligent in order to avoid liability, as opposed to the customer having to prove negligence on the part of the bank, as would be the case in the ordinary course.
This appears to be a missed opportunity to clarify the interaction between the general principles of civil liability and the specific regulatory protections afforded to consumers, and to establish a principled framework capable of guiding financial institutions, consumers, and lower courts in future cases involving banking fraud.
Practical implications
The central message of the judgment is clear: the question is not only who committed the fraud, but also whether the bank discharged its own duty of care when it had the opportunity to prevent the fraud or mitigate the consequences.
The judgment has significance for both banks and customers.
For banks, it highlights the importance of effective systems for identifying unusual or suspicious transactions, appropriate escalation procedures, and a prompt and documented response once suspected fraud is reported.
For customers, it reinforces the importance of immediate notification to the bank when fraud is discovered, and of preserving a clear record of the notification and the bank’s subsequent response.
For customers who have been affected by banking fraud, the decision highlights the importance of promptly assessing not only the conduct of the fraudsters, but also the bank’s response and the steps taken to mitigate the resulting loss. It likewise demonstrates the importance of acting swiftly through the bank’s internal complaints processes and the avenues of recourse available under the UAE’s banking regulatory framework, including Sanadak and, where necessary, the courts. Our Dispute Resolution team regularly advises and acts in such matters. ■