Sask. crypto fraud victim’s bank recovers $240K, but judge rules he can’t get it back yet

A hacker defrauded a Saskatchewan retiree of money and all of his cryptocurrency. His bank recovered $240,000 of his money, but a Court of King’s Bench judge has ruled he still cannot access it because the case, and who should be held responsible, is still before the courts.

The 66-year-old retiree is from Cabri, Sask., a town near Swift Current, about 275 kilometres southwest of Regina.

He authorized HoneyBadger Enterprises Ltd., an online exchange where people can buy and sell cryptocurrency, to withdraw money from his bank account to purchase some crypto, the court document says.

The man’s email account was later hacked. The hacker then used his access to order HoneyBadger to purchase more cryptocurrency, pulling money from the man’s back account to do so. The hacker then stole that cryptocurrency.

“This is a classic fraud,” said Alfred Lehar, a University of Calgary professor with expertise in financial technology — also called fintech.

“It would be similar if somebody would get access to your online banking information and would instruct your bank to send money abroad — and that money would be gone.”

Cryptocurrency is decentralized, meaning there’s no central bank regulating policy and controlling the money supply. The crypto world is more anonymous, so when fraud occurs, it is difficult to trace where cryptocurrency goes, Lehar said.

“It is more or less gone because, most likely, the person who stole the cryptocurrency sits somewhere else and most likely in a jurisdiction that has very weak law enforcement,” he said. “It’s very hard to ever get these cryptocurrencies back.”

The retiree contacted his bank, Innovation Federal Credit Union, when he learned about the withdrawals, the decision says. The bank then retrieved $240,000 from HoneyBadger’s accounts.

HoneyBadger then successfully applied to the court to have that $240,000 held, pending further decisions about whether the man was entitled to have the money back. HoneyBadger has since received two extensions on that order, most recently by Justice Charlene Richmond last month in Swift Current, Sask.

“A crime has been committed and the perpetrator is unlikely to be found,” wrote Richmond in her decision, dated Sept. 19.

“Although I am sympathetic that [the man] finds himself embroiled in circumstances brought about by an unknown fraudster, I am nonetheless satisfied that HoneyBadger should have the preservation order as requested.”

HoneyBadger believes it is entitled to the money because it was following instructions from its customer’s account. The man disagrees, arguing he should have the money because he never requested, nor received, the cryptocurrency that was bought.

“Unfortunately, the cryptocurrency is unlikely to ever be recovered and ultimately the question of who shall bear the loss from the actions of this theft must be answered,” Richmond wrote.

The preservation order will continue until the matter is brought before the court again, or there is further written agreement between the parties, according to the decision.

The section of legislation Richmond used is relatively new and “designed to be contested,” said Clayton Bangsund, an associate law professor at the University of Saskatchewan. He has found several similar cases in Saskatchewan.

“People don’t want to have their assets frozen pending resolution of the matter. It’s like a prejudgment and shouldn’t be done lightly,” Bangsund said.

Bangsund, who reviewed the decision, said this fraud incident was quite sophisticated. It also resulted in two innocent parties going to court, which might prolong the case.

“It’s going to be really difficult for a court to resolve who’s rightfully entitled to those funds,” Bangsund said.

Lehar — a cryptocurrency enthusiast — suggests people avoid putting large amounts of their savings into cryptocurrency because it’s easy to steal, he said.

He also urged people with cryptocurrency to use two-factor authentication, a cybersecurity measure that protects banking and email accounts, among others, that significantly deters fraudsters, Lehar said.

Daniel Johnson, CEO of Innovation Federal Credit Union, said in an email to CBC News that he couldn’t speak to this particular incident to protect the privacy of its customer, but that the bank works with fraud victims and encourages its members to call the bank if they’re suspicious of a transaction.