We are living through — or perhaps suffering through — the golden age of fraud. One burden of daily life in the digital age is the constant need to identify and avoid scams: vishing calls, phishing emails, malicious links in legitimate-looking messages, investment scams on social media, AI-generated deepfakes and more.
Modern payment rails are designed to move money quickly and frequently with as little friction as possible. While these systems have increased economic productivity and convenience, threat actors also exploit them to move money from a victim’s bank account into an account they control and beyond the victim’s reach.
Because threat actors are typically anonymous and do not wait around to be sued, Canadian courts are increasingly asked to allocate liability between innocent parties: the victim and their financial institution, investment dealer or cryptocurrency exchange. We have written about key fraud loss allocation decisions from the British Columbia Court of Appeal, the United Kingdom Supreme Court and lower courts across Canada, as well as the investigation, tracing and recovery of fraud proceeds.
The latest and most comprehensive consideration of this issue is Honeybadger Enterprises Ltd. v. Bue, 2026 SKCA 40. The decision is an important development in Canadian fraud law and provides much-needed clarity on the common law principles governing the allocation of liability among innocent parties after a fraud loss.
Key takeaways for fraud loss allocation
- Innocent parties are not created or treated equally. Where one party’s conduct involves affirmative acts or omissions that unwittingly facilitate the fraud — for example, granting computer access to the threat actor, staying silent about red flags or directing payment to unknown third-party accounts — that party will bear the loss.
- The decision in Alfagomma Inc. v. HSBC Bank Canada, 2022 QCCS 3655 imposed on financial institutions a duty to “exercise a certain degree of care to protect their clients from fraud, especially in the face of suspicious activity” (para. 85). That decision is confined to cases under the Civil Code of Québec. It does not apply in Saskatchewan and, by extension, should not apply in other common law provinces.
- A financial institution or similarly situated party does not owe a duty to police transactions facilitated by their accountholder or customer.
- Where parties allocate liability for payment instructions by contract, the agreement will be enforced under ordinary contract law principles, including a proper consideration of the factual matrix that existed when the parties entered into it.
Background to the Honeybadger fraud dispute
Honeybadger Enterprises Ltd. operates an over-the-counter cryptocurrency business and processes client purchases through pre-authorized debit (PAD) agreements. These agreements allow Honeybadger to withdraw funds directly from a customer’s bank account after receiving payment instructions.
One of Honeybadger’s clients, Mr. Bue, entered into a PAD agreement that authorized Honeybadger to draw funds from his account on his instructions and deposit cryptocurrency into his digital wallet.
A threat actor impersonating an FBI agent socially engineered Mr. Bue. The threat actor led him to believe he had been recruited to help dismantle an illegal operation and needed to deposit Bitcoin into a digital wallet as part of that operation. The threat actor provided the wallet address.
In connection with the social engineering scam, Mr. Bue provided remote access to his computer to the threat actor. Thereafter, Mr. Bue did not realize that the threat actor gained access to, and had control of, his email account.
Mr. Bue provided legitimate instructions to Honeybadger by email to purchase $40,000 of Bitcoin, to be deposited to the wallet address provided by the threat actor. Honeybadger processed those payments pursuant to the PAD agreement and deposited the cryptocurrency into the wallet identified by Mr. Bue, as instructed.
Unbeknownst to Honeybadger and Mr. Bue, the threat actor then sent additional emails to Honeybadger from Mr. Bue’s account providing instructions to purchase $200,000 of Bitcoin. Honeybadger processed those payments pursuant to the PAD agreement and deposited the cryptocurrency into the same digital wallet.
Mr. Bue later discovered the fraud, including the payment instructions provided by the threat actor from his email address. Mr. Bue then asked his credit union to cancel the payments totalling $240,000, which it did. Honeybadger sued Mr. Bue for the amount of the Bitcoin deposited to the wallet.
The lower court’s decision
The lower court held that both parties should bear liability: Mr. Bue for carelessly allowing the threat actor to access his computer and email systems, and Honeybadger for failing to perform what the lower court characterized as a payment verification covenant in the PAD agreement. As a result, Mr. Bue was liable for the $40,000 in payments he initiated, while he and Honeybadger shared liability equally for the $200,000 in payments initiated by the threat actor. Our summary of the lower court’s decision is available here.
The Saskatchewan Court of Appeal’s decision
The Court of Appeal held that the lower court erred in two ways: it failed to apply the correct common law principles for allocating liability among “innocent” parties and made a palpable error in interpreting the PAD agreement.
The allocation of liability as between innocent parties depends on their respective involvement in causing the loss. There are two complementary, but distinct, loss allocation rules engaged by the facts of the case:
- If the fraud victim is not negligent, careless or otherwise at fault, and another innocent party’s careless conduct made the loss possible, the careless party will bear the loss (Marvco Colour Research Ltd. v. Harris, 1982 CanLII 63). In other words, as articulated in Bank of Montreal v. Asia Pacific International Inc., 2018 ONSC 4215, “justice requires that the party who was in a position to prevent the loss should bear it.”
- However, if the fraud victim’s conduct goes beyond basic carelessness and includes affirmative acts or omissions that unwittingly facilitate the fraud, the victim will bear the entire loss even if their financial institution or another innocent counterparty later fails to detect the fraud (Isaacs v. Royal Bank of Canada, 2011 ONCA 88).
The lower court found that Mr. Bue’s active, but uninformed participation was “at the heart of this fraud,” including his failure to mention his dealings with the “FBI” to Honeybadger, which would have brought the fraud to an immediate end. Rather than apply the rule from Isaacs, the lower court erred by applying the principle from Alfagomma, which requires banks to “exercise a certain degree of care to protect their clients from fraud, especially in the face of suspicious activity.” The Court of Appeal observed that this principle is grounded in a general civil law duty of care under the Civil Code of Québec, which Alfagomma characterized as “out of step with authorities elsewhere in the country” (para. 67) — that is, with the common law of negligence in Canada.
Applying Isaacs, the Court of Appeal held that Honeybadger owed no duty to Mr. Bue to warn, inquire, prevent the loss or otherwise intervene, and bore no liability for the fraud loss.
The Court of Appeal then considered whether the contractual terms between the parties — in this case, the PAD agreement — altered the common law allocation of liability. It found that the PAD agreement appeared to be a standard-form agreement from Mr. Bue’s credit union, not Honeybadger, addressing the credit union’s obligations and liabilities and those of third-party payees such as Honeybadger. The lower court therefore palpably misunderstood the agreement’s commercial purpose. Interpreting the agreement in light of the proper factual matrix, the Court of Appeal held that Honeybadger had not agreed to payment verification obligations that altered the common law allocation of liability.
Get advice on fraud loss allocation and payment disputes
If your organization is responding to a fraud loss, payment dispute or unauthorized cryptocurrency transaction, BLG can help assess contractual obligations, potential liability and recovery options. Contact the author or a member of BLG’s disputes team to discuss how this decision may affect your organization.
By Borden Ladner Gervais LLP “BLG” >>
“As Canada’s law firm, BLG provides high-value advice and advocacy to address our clients’ business challenges and problems. We go beyond legal to anticipate, consult and advise in a rapidly changing digital world.
We have extensive experience acting in specialized and complex deals and disputes. Vigilant, curious and collaborative, we harness technology and innovation to offer our clients exceptional service and value.
With 800+ lawyers across Canada, we serve clients throughout North America, Europe, and Asia. Offering expertise in intellectual property, disputes and corporate transactional matters, our connectivity gives our clients the next-level service required to achieve success in complex and international matters.”
Please visit the firm link to site