{"id":23372,"date":"2026-10-18T13:58:51","date_gmt":"2026-10-18T17:58:51","guid":{"rendered":"https:\/\/www.virtulexavocats.com\/?p=23372"},"modified":"2026-10-18T13:59:29","modified_gmt":"2026-10-18T17:59:29","slug":"ceo-fraud-international-wire-transfer-bank-liability-desjardins-quebec","status":"publish","type":"post","link":"https:\/\/www.virtulexavocats.com\/en\/ceo-fraud-international-wire-transfer-bank-liability-desjardins-quebec\/","title":{"rendered":"CEO Fraud: Desjardins and Its Business Client Split a $1.4 Million Loss"},"content":{"rendered":"

An email from the “CEO,” a confidential takeover bid, a fake Deloitte lawyer and five wire transfers to Hong Kong and China in seven days. The Quebec Superior Court finds that Desjardins breached its duty of prudence by asking the wrong questions, but that the defrauded business must bear three quarters of its own loss. A detailed ruling on what can be expected of a bank, and of its client, when facing CEO fraud.<\/em><\/p>\n

On the morning of Monday, June 8, 2020, the accounting manager of a Quebec trucking company, a client of a Desjardins credit union (caisse<\/em>) in Drummondville, receives an email from her company’s president. He has chosen her, he writes, to help him close a confidential takeover bid. She is to follow the instructions of a lawyer from the Deloitte firm and tell no one about the deal. Over the following days, she makes five international wire transfers totalling US$1,750,000, roughly CA$2.38 million. The president never wrote that email. The lawyer does not exist.<\/p>\n

Six years later, in Groupe TYT inc. c. Caisse Desjardins de Drummondville<\/em> (2026 QCCS 1707), Justice David E. Roberge of the Quebec Superior Court (District of Drummond) answers the question that keeps many business owners up at night: when an employee is tricked and the money leaves the country, does the bank have to pay? His answer, delivered on May 11, 2026: yes, but only in part.<\/p>\n

The facts: one week, five transfers<\/h2>\n

Groupe TYT inc. (TYT) is a trucking company with about 225 employees and a Desjardins client since around 2010. It uses Desjardins’ online banking platform, Acc\u00e8sD. Before the fraud, it had never done business outside Canada and the United States, and its wire transfers usually ranged from $10,000 to $20,000, occasionally reaching $100,000.<\/p>\n

In early 2020, the company’s director of finance goes on maternity leave. The accounting manager takes over several of her duties. On Acc\u00e8sD, she can, alone, create new suppliers and send international wires of up to $500,000 per day. No one else needs to approve them.<\/p>\n

Posing as TYT’s president, the fraudsters get her to make five transfers on June 8, 9, 10, 11 and 15, 2020, of roughly US$330,000 to US$357,000 each, to three companies in Hong Kong and China. Desjardins’ automated detection system (called Firco) flags every one of them. On June 9, an analyst from Desjardins’ fraud prevention department calls the accounting manager to verify the first two. Following the fraudsters’ instructions, she answers that the payments are for a new supplier, that more will follow and that the goods have been received, which is false. The funds are released. The June 10 and 11 transfers are released without further review because they go to the same beneficiary. On June 15, a second, very brief call precedes the release of the last transfer.<\/p>\n

The fraud comes to light on June 16, when the account falls into overdraft. The funds from the last two transfers (US$686,916) are recovered. Those from the first three, already withdrawn from the foreign accounts, are lost: US$1,063,044, or CA$1,426,652.62. TYT sues the caisse<\/em> and the F\u00e9d\u00e9ration des caisses Desjardins du Qu\u00e9bec for more than $1.5 million.<\/p>\n

What is “CEO fraud”?<\/h2>\n

A fraudster impersonates a senior executive, often through an email that appears to come from that person’s real address, and persuades an employee to make an urgent, confidential payment. The scheme relies on social engineering: flattery, urgency, imposed secrecy, and a fake lawyer to reassure the victim.<\/p>\n

Here, every doubt the accounting manager raised was answered. When she worried that her boss’s email had been hacked, she was told the takeover procedure was strict and only the lawyer could speak with her by phone. When she raised concerns about cash flow, she was sent a fake notice of an incoming wire of US$1,468,785. As she put it at trial: “Everything looked so real.”<\/p>\n

Banks have known about this scheme for years. Desjardins even had an internal toolkit, CyberEco, containing a sample email almost identical to the one the accounting manager received.<\/p>\n

The principle: the bank stays out of your business\u2026 unless something smells like fraud<\/h2>\n

The relationship between a bank and its client is first and foremost contractual. Under Quebec civil law, the bank owes what is called an “obligation of means”: it does not guarantee that no fraud will ever occur, but it must act with the prudence and diligence of a competent financial institution in the same circumstances.<\/p>\n

Normally, a bank has no duty to monitor your accounts: this is the principle of non-interference. But that principle gives way when there are serious signs of irregularity (unusual transactions, out-of-the-ordinary amounts, destinations inconsistent with the client’s profile). The bank must then verify and dispel the doubt, with heightened vigilance for international wires.<\/p>\n

Here, no one disputed that Desjardins’ suspicion had been aroused: amounts of about US$350,000, never seen in this account, sent to Asia, where TYT had never done business, with an automatic alert on each transfer. The real question was whether the checks it carried out were reasonable.<\/p>\n

Desjardins’ fault: asking the wrong questions<\/h2>\n

The heart of the ruling is the June 9 call. Preferring the accounting manager’s precise and consistent account over the analyst’s vaguer recollection, the court finds that the analyst did not explain what CEO fraud is, did not ask who had ordered the transfers and did not ask whom the accounting manager had spoken with by phone. She assumed the instructions came from the supplier and steered the whole conversation toward a different scenario, supplier fraud. According to the court, simple steps would have been enough to cover the CEO-fraud scenario: one targeted question would have revealed that the orders came from the “president” by email and that a “lawyer” was involved, two classic red flags.<\/p>\n

The court identifies two further failings. First, it was “reckless” to release the June 10 and 11 transfers based solely on the beneficiary’s identity, when irregular transfers of more than US$300,000 were piling up day after day. Second, Desjardins failed to show that the analyst, who had no prior training or experience in fraud, had been trained on CEO fraud before June 2020. The three analysts serving the entire network had no procedure or checklist to guide their calls. Without holding that the lack of a written procedure was a fault in itself, the judge concludes that Desjardins could not do without both training and procedure.<\/p>\n

Other complaints by TYT were rejected. Desjardins did not have to reach an executive rather than the employee TYT itself had authorized on Acc\u00e8sD: that would turn verification into investigation, and the evidence showed the executives could not be reached that day anyway. Nor did it have to impose dual authorization by default on Acc\u00e8sD: the option existed, and it was up to the client to activate it. Finally, once the fraud was discovered, Desjardins acted diligently: recall requests were sent to the foreign banks within hours, but the money from the first three transfers had already left the foreign accounts.<\/p>\n

The company’s share: false statements and no internal controls<\/h2>\n

The court refuses to blame the accounting manager for being deceived: her doubts were skilfully dispelled by professional fraudsters, and no one had ever made her aware of this type of scheme. Nor was the lack of structured training on CEO fraud a fault for a company of this size in 2020.<\/p>\n

Two criticisms, however, hold up. First, the accounting manager gave the analyst false information (new supplier, goods received) precisely to prevent the bank from blocking the transfers. She was not an accomplice, but Desjardins was entitled to expect answers consistent with the facts she knew. Second, TYT allowed a single person to create three new suppliers and transfer more than $2 million in one week, with no dual authorization, no alerts and no oversight. The irony: the company required two signatures on its cheques but had never activated that same option, available on Acc\u00e8sD, for its international wires.<\/p>\n

The exclusion clause does not save the bank<\/h2>\n

Desjardins also relied on its Acc\u00e8sD agreement, under which it cannot be held liable for fraudulent acts committed against the business. The court accepts that the clause had been brought to TYT’s attention but refuses to enforce it. A clause that would release the bank from its essential obligation of prudence and diligence cannot be set up against the client, particularly in a contract of adhesion, meaning a contract whose terms are imposed by one party without real negotiation (arts. 1437 and 1474 of the Civil Code of Qu\u00e9bec<\/em>). The other part of the agreement, however, which required the client to maintain its own internal anti-fraud controls, does weigh in the apportionment of liability.<\/p>\n

The split: 25% for Desjardins, 75% for the business<\/h2>\n

When several faults cause the same injury, liability is shared according to the seriousness of each (art. 1478 C.C.Q.). In the two Quebec precedents most often cited on CEO fraud, including Alfagomma Inc. c. HSBC Bank Canada<\/em> (2022 QCCS 3655), the bank bore 50% of the loss, but it had made no verification at all. Here, Desjardins did step in, albeit poorly, and was partly misled. The judge concludes that its share must be below 50% and finds that TYT’s combined faults are more serious.<\/p>\n

The result: out of a loss of $1,427,027.62 (the three unrecovered transfers plus $75 in bank fees for each of the five transfers), the F\u00e9d\u00e9ration des caisses Desjardins is ordered to pay 25%, or $356,756.90, with interest and the additional indemnity from the formal demand of June 30, 2020. Only the F\u00e9d\u00e9ration, which is responsible for fraud prevention across the network, is held liable; the action against the local caisse<\/em> is dismissed. TYT’s legal costs are limited to 25%.<\/p>\n

Why this case stands out<\/h2>\n

The two most-cited Quebec precedents on CEO fraud involved banks that had asked no questions at all. Here, the court examines in detail the quality<\/em> of a verification. The message is clear: a verification call is not a formality. To rule out CEO fraud, the institution must explain the scheme to the person on the line and ask precise questions about where the instructions came from. A call aimed at the wrong scenario does not protect it.<\/p>\n

The ruling also contains a paradox worth pondering. The bank that verifies poorly is assigned a smaller share of liability (25%) than the one that does not verify at all (50% in the precedents). The judge’s reasoning is defensible: courts do not want to penalize proactivity, and the analyst was misled by the client itself. But one could argue the opposite: a superficial check gives the business a false sense of security, and an institution that knew the scheme, and had its exact description in its own tools, was better placed than anyone to thwart it.<\/p>\n

Finally, a small business’s security cannot rest on its bank alone. Now that artificial intelligence can clone a voice in minutes, even a confirmation call is vulnerable: dual authorization and segregation of duties matter all the more.<\/p>\n

Key takeaways<\/h2>\n

Turn on dual authorization.<\/strong> If one person can create a supplier and send hundreds of thousands of dollars abroad, your business is exposed, and a court will hold it against you. Check the options your banking platform offers and set thresholds that fit your operations.<\/p>\n

Never lie to your bank’s fraud department.<\/strong> Even if “the president” insists on confidentiality, answer your financial institution’s questions truthfully. In this case, those statements proved costly.<\/p>\n

Confirm any unusual request through another channel.<\/strong> An urgent, confidential transfer to an unusual country, requested by email: meet the person or call them at a number you already know, never the one provided in the message.<\/p>\n

Act within the hour.<\/strong> As soon as you suspect fraud, notify your financial institution and request a recall of the funds. Here, only the most recent transfers could be recovered.<\/p>\n

Don’t take the exclusion clause at face value.<\/strong> A bank cannot use a general clause to escape its essential duty of prudence. If you are the victim of fraud, have your financial institution’s conduct reviewed.<\/p>\n

On the liability of financial institutions toward businesses, see also our column on RBC’s liability for cutting off an entrepreneur’s credit overnight<\/a>.<\/p>\n

Related reading<\/h2>\n