Desjardins partially liable in “CEO fraud” case

In June 2020, a trucking company fell victim to a sophisticated phishing scheme known as "CEO fraud." In a recent ruling, the Superior Court of Québec found the financial institution "partially" liable for the losses incurred by the company.

TYT Group, a freight transport company based in Drummondville, employs approximately 225 people. It holds several accounts with the Caisse Desjardins de Drummondville. Both this local branch and the Fédération des caisses Desjardins du Québec were named as defendants in a lawsuit filed by the trucking company, which sought over $1.5 million in damages. As the court’s decision makes no mention of insurance, it can only be assumed that the company was not covered for this type of cybersecurity-related incident.

The company’s chequing account, which has been open since 2011, is linked to the online platform AccèsD. At the time of the five fraudulent transfers in June 2020, the account was also connected to a line of credit. During the height of the COVID-19 pandemic, as economic activity slowed, the company faced liquidity issues. In April 2020, TYT Group secured a $1.5 million loan from the federal government.

By pretending to be TYT president Patrick Turcotte, the fraudsters induced chief accountant Line Blais to carry out the transfers. A fake intermediary, claiming to be a lawyer working for Deloitte—who identified himself as “Didier Ferguson”—also spoke with Blais, who was instructed to maintain confidentiality. The pretext for the transfers was a confidential public takeover bid that supposedly required funds to be wired to Asia.

The accountant eventually provided the fraudsters with financial details, including bank balances and the daily limit authorized for international electronic fund transfers. Armed with this information, the fraudsters gave Blais the necessary instructions to execute the transfers, which took place between June 8 and June 15, 2020. The five transfers totaled US$1.75 million—approximately C$2.36 million.

On June 9, an analyst from Desjardins’ security and fraud prevention department contacted the accountant regarding the first two transfers. Based on the responses provided by the TYT accountant, the funds—which had been placed on hold—were released. The third and fourth transfers were not flagged for follow-up by the financial institution, as they involved the same beneficiary: a company called Quintian Bozai Trading Co.

On June 15, the fifth and final transfer was sent to China. Because this involved a new beneficiary, another Desjardins analyst assessed its legitimacy; however, the transfer was processed nonetheless. The fraud was discovered on June 16, 2020.

Dissatisfied with the responses from Desjardins, TYT Group sought the intervention of the law firm Dentons. The last two wire transfers were recovered, but the funds from the first three were lost irretrievably. The transport company’s loss amounted to US$1,063,044—approximately 1.43 million Canadian dollars.

A lengthy trial

During the trial, which spanned about ten days of hearings in Drummondville in November and December 2025, the parties presented testimony from several experts regarding security measures for electronic transactions, including the internal controls in place on both sides. The complexity of the dispute made it difficult to resolve, which explains the length of the decision handed down on May 11, 2026, by Judge David Roberge—a document spanning 68 pages and 438 paragraphs.

Desjardins alleged that the accountant had lied by making false or inaccurate statements concerning the disputed transfers, arguing that the victim should therefore not be compensated due to this reprehensible conduct. The court rejected this defense.

According to Judge Roberge, the accountant—who was targeted by the scam—had been “manipulated by fraudsters and did not profit from her misconduct.” While Blais’s statements were one element of the analysis, they were not sufficient to preclude a comprehensive review of the conduct of all parties involved, including Desjardins.

TYT Group alleged that Desjardins acted wrongfully in the course of its verification process for international electronic transfers. In its defense, Desjardins maintained that the information provided by the company gave no indication of potential fraud.

The court concluded that Desjardins bears liability toward TYT Group, specifically in light of the initial intervention by Sindy Madore on June 9, 2020.

The alert

At the time of the events, Blais had been serving as chief accountant since February 2020, having stepped into the role following a colleague’s departure on maternity leave. On June 8, 2020, she received an email—purportedly from the company president—instructing her to follow the directives of a "Mr. Ferguson"; the fraudster emphasized that the transaction was both a high priority and strictly confidential. The first two wire transfers were intercepted by the "Firco" system, which Desjardins had implemented in 2018.

The algorithm is designed to detect irregular banking transactions; when an alert is triggered, it prompts human intervention at Desjardins, followed by an analytical review process where appropriate. The fraud scenarios the system is designed to flag include, primarily, "fake vendor" schemes, "fake president" (CEO fraud) schemes, and instances of internal fraud by an employee.

The initial conversation between Sindy Madore and Line Blais was not recorded, and their accounts of the exchange differ on key points. The accountant testified that Madore identified herself as working for Desjardins’ security department and asked whether the first transfer was related to goods received from a new vendor.

Seeking to avoid disrupting the transaction—and following the instructions of the fraudster posing as the president and "Mr. Ferguson"—the accountant confirmed that it was, and claimed to have had verbal communications with the vendor. Blais testified that there was no mention at the time of the possibility of a “CEO fraud” (or “fake president” fraud) and that Madore did not raise the subject.

The court notes that, based on the transaction history of the TYT Group account, there were, in fact, indicators that the transfers made on June 8 and 9 deviated from the company’s usual profile.

On the evening of June 9, the accountant asked the sender of the email for reassurance. The sender reiterated the importance of following the instructions provided by “Mr. Ferguson” (supposedly a lawyer) and mentioned that an external financing agreement had been signed, which would offset the international transfers. He added that only the lawyer was authorized to discuss the matter with her verbally.

Two further transfers were made on June 10 and 11. Once again, while flagged by the Firco system, they were authorized by Desjardins, given that previous checks had already been conducted regarding the same parties to the transactions. On June 15, “Mr. Ferguson” sent the accountant what appeared to be confirmation of an international transfer in transit. A fifth payment took place that same day.

Following the discovery of the fraud on June 16, 2020, the parties requested the intervention of cybercrime investigators from the Sûreté du Québec. The investigation failed to identify the perpetrators. The case was closed.

Apportionment of liability

Judge Roberge noted that “CEO fraud” has been well known to financial institutions since at least 2015. The case primarily requires determining whether Desjardins carried out reasonable verifications regarding the disputed electronic transfers, in order to detect and prevent the risk of "CEO fraud."

The AccèsD platform offers the option to require a dual signature for electronic verifications, based on a chosen monetary threshold. The agreement associated with the TYT Group account does not include this provision. Cybersecurity awareness activities are conducted occasionally, as the company was the target of a cyberattack in 2018. For its part, Desjardins maintains two separate teams to process and analyze transactions that pose a risk of fraud. The "CyberEco" toolkit specifically addresses "CEO fraud" and its characteristics.

The court notes that, in the context of a claim for damages, its role is limited to assessing whether the conduct of the parties aligns with the standard of reasonable behavior. It is well-established that a financial institution’s duty of care and diligence is heightened in the context of an electronic fund transfer.

The case law cited by the parties includes two instances involving "CEO fraud": Alfagomma v. HSBC Bank, decided in April 2022, and Concessions Caravane 1986 v. Toronto Dominion Bank, from May 2020. However, the court observed that in both of these precedents, it was not required to analyze the substance of the verifications performed by the bank, as no steps had been taken to validate the legitimacy of the transactions—unlike in the present case.

Prudent and diligent conduct

The court analyzed the conduct of the parties and concluded that “Desjardins did not act with reasonable prudence and diligence regarding the electronic transfers in dispute.” The five disputed transfers were intercepted by Desjardins’ automated Firco system. The financial institution was “on alert” and was required to verify the legitimacy of the transfers. “The question is whether the measures taken were reasonable.”

According to the court, the interaction between Madore and Blais on June 9, 2020, is central to this dispute. The judge determines that Madore failed “to provide sufficient explanations regarding the characteristics of the ‘CEO fraud’ [‘president fraud’] and to ask specific questions” of the accountant. Consequently, the possibility of a “CEO fraud” scenario was ruled out. There is no recording of the June 9 discussion, and the accounts provided by the two individuals involved contradict each other on certain points.

The accountant’s version of events, as presented at trial, is consistent with the statement she gave to the police shortly after the loss occurred, as well as with her testimony during the pre-trial examination. As for the Desjardins analyst, her recollection of the conversation is less clear—which is to be expected, given that she handles many such interactions daily as part of her job.

The evidence shows that the discussion between the two women quickly shifted toward security concerns regarding transactions linked to a supplier. While Madore has participated in hundreds of similar interactions, this was a unique experience for Blais, and her memory of it was almost certainly solidified following the discovery of the fraud. The analyst merely asked the accountant whether she had “spoken to anyone” and inferred—indirectly—that she meant a supplier.

Had the analyst’s inquiry been more focused, she would have realized that the accountant had spoken with a lawyer, not a supplier, and that the instructions had arrived via email from the individual posing as Turcotte. Had these irregularities been identified, the fraud would have been uncovered sooner. Given the vague nature of the analyst’s contemporaneous notes and the court’s assessment of the testimony, the court concluded that the accountant’s account was more credible.

A useful toolkit

The CyberEco toolkit contains “an example of an email nearly identical to the one sent to Blais by the person posing as Turcotte.” This information was never shared with the representatives of TYT Group. “The Desjardins analyst was obligated to provide a sufficient explanation regarding the characteristics of a ‘CEO fraud’ and to ask targeted questions—specifically, to clarify who was providing the instructions,” the court noted. The analyst steered her questioning toward a “fake supplier” fraud scenario. This created a narrowing effect that prematurely ruled out the possibility of a “CEO fraud.”

The amounts involved in the international transfers, as well as their destination in Asia, were “truly anomalous” compared to TYT Group’s previous transactions. Desjardins failed to meet its duty of care regarding the first two wire transfers, even though the accountant’s responses led the analyst to conclude that the transactions were legitimate.

The evidence does not establish that a call from the analyst to another executive at the transport company would have uncovered the fraud. The court is of the opinion that it was reckless for Desjardins to release the funds on June 10 and 11, 2020, based on a single criterion—the identity of the beneficiary—without any further analysis, and in a context where irregular international transfers involving the TYT Group account were occurring with increasing frequency.

Regarding the training provided to analysts and the intervention procedures in place at Desjardins in June 2020, the court concludes, in paragraph 210, that the financial institution “failed in its obligation to provide Madore with appropriate training in the detection of banking fraud.” Despite Madore’s lack of practical experience, no procedures had been established regarding the steps analysts should take when attempting to validate the legitimacy of transactions. The court specifies that Desjardins could not neglect both of these aspects without incurring liability in this matter.

However, the court rejects the other arguments put forward by the plaintiff concerning the security of the AccèsD platform and the financial institution’s conduct following the discovery of the fraud.

On June 19, 2020—at a time when TYT Group still held out hope of recovering the second and third transfers—the company asked Desjardins to share the costs of the efforts being undertaken by the law firm Dentons. The financial institution refused on June 23; however, Dentons had already ceased these efforts on June 22, given the amount of time that had elapsed. The court does not view this as a failure by the financial institution to act reasonably and dismissed TYT Group’s claim for Dentons’ legal fees.

The company’s contribution

Desjardins argued that the carrier’s damages were caused solely by its own negligence. Justice Roberge noted that the accountant was not a fraudster, but rather an employee who had been deceived. It is reasonable to believe that a more in-depth discussion, involving a qualified analyst at Desjardins, would have alerted the accountant to the scheme, changing the outcome: the first two transfers would have been blocked, and the subsequent ones would never have taken place.

The court concluded that the accountant did not exhibit culpable credulity or willful blindness; she had, in fact, raised doubts and asked questions, which the fraudsters skillfully sidestepped. Although Desjardins leveled a long list of criticisms against her, the court found that many of these allegations were based on hindsight.

Where the plaintiff’s case falters, however, is in the statements the accountant made to Desjardins’ analysts—statements that did not reflect reality and were, in certain respects, false and misleading. The accountant acknowledges that by making such statements, she intended to avoid having the transfers blocked or suspended by Desjardins. These erroneous statements render TYT liable.

The court is of the opinion that the company acted negligently by failing to implement any segregation of duties involving the accountant. As of June 2020, she held all the authorizations required to execute the five transfers without any form of secondary verification. Her supervisor was not even aware of the nature of the transactions that Blais could carry out via the AccèsD platform.

The court concludes that TYT Group is entitled to 25% of the total quantum—established at $1,427,027.62—which corresponds to the sum of the first three transfers, plus 75% of the bank fees incurred across the five transactions. Justice Roberge notes that this is a discretionary exercise, which entails weighing the gravity of the respective faults and their causal impact.

Given the company’s internal governance shortcomings and the accountant’s misleading statements, the court finds that TYT bears a greater share of responsibility than that resulting from Desjardins’ own failures. The plaintiff is entitled to an amount of $356,756.90.

Interest and the additional indemnity shall be calculated from June 30, 2020, the date the formal notice was served to the defendant. Only the Fédération is ordered to reimburse this amount, as the Caisse Desjardins de Drummondville committed no fault. The court also limits TYT’s recovery of legal and expert costs to 25% of the total incurred.