< back

Are you a victim of CEO fraud? Here's an immediate action plan to recover funds wired to Hong Kong or Mainland China

10 May 2017

Many victims of CEO fraud (also known as business email compromise) are companies involved in cross-border businesses that routinely make international money transfers.

The Federal Bureau of Investigation (FBI) reports that:

  • most of the victims are based in the US, but companies from over 100 other countries have been defrauded;
  • although fraudulent transfers have been sent to over 79 different countries, most of the money is sent to banks in Mainland China and Hong Kong; and
  • the first 24 hours after the fraudulent transfer are critical.

From January 2015 to June 2016, the FBI reported a 1,300 percent increase in exposed dollar losses (which refers to actual and attempted loss) due to CEO fraud at approximately USD 3.1 billion. The extent of this problem could be much higher as many of these crimes may go unreported due to embarrassment or despair at the seeming lack of practical solutions.

The following action plans outline steps to freeze accounts and recover funds.

What is CEO fraud?

CEO fraud is a sophisticated phishing scam targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments. The scam is carried out by compromising legitimate business e-mail accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds.

The most common version of the scam involves criminals impersonating a person of authority within a company, such as its CEO, using a spoofed or hacked email account and demanding that an urgent transfer of money be made overseas.  Spoofing is using an email address that is very similar to the legitimate email address of the CEO.  Hacking here means that your IT systems have been compromised and the emails are being sent from the legitimate address of the CEO.

Often the criminals have been monitoring the company to make the scam appear authentic by mining social media to know the right names, the usual procedures and the business practices of the victim. For example, an email from a fraudulent CEO to the accounts department may read something like this: “Joe, I need you to make an urgent payment to XYZ Co. You know that this is our key client. If this deal falls through, there is no chance you will get the promotion we’ve been talking about!”

There has been a rise in the number and sophistication of these cases, and it seems as if the criminals have decided that there is a smaller chance of being pursued by lawyers and law enforcement if they increase the number of attacks for smaller amounts. In addition, it appears that the criminals are well-versed with the international transfer processes of the banks. For instance, if there are good linkages between particular banks, it may take 24 hours for a transfer of USD 99,999 to go from the U.S. to HK through the international settlement system, while a transfer from HK to the PRC may be virtually instant and take just a few hours for a team of 20 people to collect all of the money as cash from various ATMs in the PRC.

Immediate action plan

The key is to act quickly to stop the payment(s) while it is being transferred between banks.  Since international transfers can take some time, it is also important to freeze the known destination accounts of the criminals. Upon detecting a fraudulent payment, take the following basic steps immediately:

  • contact your local bank to try to stop the payment before it enters the international financial system;
  • ask your local bank to contact the corresponding international bank where the fraudulent transfer was sent;
  • contact your local law enforcement authorities to report the crime;
  • contact the law enforcement authorities in the corresponding country where the fraudulent transfer was sent;
  • when dealing with a country in a different time zone with a foreign language and legal system, contact professionals who are on the ground to help manage the process and ensure that the matter gets proper attention.

If it emerges the fraudsters have wired funds to Hong Kong or Mainland China, here are some specific steps to take in those places.

Hong Kong action plan

Step 1: Contact Hong Kong police

The first and key step is to report the matter to Hong Kong police immediately. If, among other things, they consider there is sufficient evidence that the funds are the proceeds of a crime, the authorities will issue a 'letter of no consent' (or 'non-dealing' notice) to the recipient Hong Kong bank. This, in practice has the same effect as, but is not, a 'freezing order'. The letter of no consent/non-dealing notice is temporary and can be lifted at any time without notice. 

Often it is easier to obtain prompt police assistance if the matter is reported in person. To report the matter to the Hong Kong police by email or online, use the following links:

Reporting by mail/fax are also options, but most people now use email or file a report online. If a report is made online or via email, a follow-up telephone call is encouraged and (if possible) an in-person visit to the relevant Hong Kong police station to ensure that the matter is receiving sufficient attention, bearing in mind that Hong Kong police have many sorts of these inquiries. The phone number for the relevant department of Hong Kong police is +852.3661.1602. To speed things along, and ensure that the correct police station is engaged, we may be instructed to make reports in person to Hong Kong police on behalf of overseas clients.

Step 2: Hong Kong court proceedings

File an application with the Hong Kong courts for a regular civil freezing order (also known as a ‘Mareva Injunction’).

The freezing application needs to be directed at some identified defendant (in this case, the account holder) and may be made without notice to/in the absence of the defendant.  A writ with a general outline of claims will need to be issued for service on the defendant if a freezing order is made. A formal statement of claim only needs to be prepared if the proceedings are contested. Ordinarily they are not.

Usually an application is made at the same time as the freezing order for disclosure against the Hong Kong bank concerned about the account holder(s)/misappropriated funds. This may assist in tracing funds and identifying the wrongdoers. After obtaining judgment, ‘garnishee proceedings’ will be issued for an order that funds in the defendant’s account be paid to you. 

Mainland China action plan

Step 1: Contact authorities and appropriate parties

Contact the local receiving bank and Mainland Chinese police to try to get the funds frozen 'informally'. The transferor bank may be able to assist with contacting the relevant persons at the local receiving bank.  

Report the matter to your local police authorities as well as Interpol. If funds have been routed through other jurisdictions, make a report to police there as well.  Mainland Chinese police usually require a formal request from Interpol/relevant foreign police authorities before taking any action or formally freezing funds that have been transferred from overseas to Mainland China.

Some countries post police liaison officers to embassies/consulates abroad, including in Mainland China. If there is a police liaison officer from your native country based in Mainland China, ensure that person has all of the relevant information and is provided with the contact details of all relevant persons and authorities involved.      

Seek assistance from local lawyers in the relevant city (or nearest large city if in a remote part of Mainland China) to help navigate the process.  We have a deep network of reputable firms we work with in Mainland China and can help source/instruct.  Remember to liaise with local bank officials and police authorities as well as to ensure that the matter gets proper attention.

Step 2: Recovery of funds

Commencing action in Mainland Chinese courts to freeze the bank accounts is not a realistic option.  Where claims are founded on fraud, Mainland Chinese courts will ordinarily decline jurisdiction on the basis that such claims should be dealt with by way of criminal proceedings. Even if the courts were to accept the case, it would usually take too long to freeze the funds.  All of the evidence would need to be translated into Chinese, notarized, legalized and couriered to Mainland China.  This can take weeks.

In Mainland China, the police only have the right to freeze bank accounts and cannot transfer the frozen funds. Once the funds have been frozen, the usual/main option for their recovery will be to seek judicial assistance at the state level via the relevant authority in your home country (such as the Ministry of Justice or equivalent) for the recovery of the misappropriated funds.  Many countries have signed bilateral judicial assistance treaties with China. 

For more information   

For more detailed information, please contact Darren FitzGerald or Peter McCullough of FitzGerald Lawyers.

This alert is for information only and is not legal advice.