Executive Summary: Key Legal and Evidentiary Issues

• Bank’s contractual and mandataire obligations toward its client in the context of unauthorized electronic funds transfers and banking security.
• Causation and burden of proof regarding whether the hacking originated from the client’s systems or the bank’s systems.
• Weight and sufficiency of uncontradicted expert evidence showing the client’s computer and mobile devices were not the source of the security breach.
• Assessment of whether unusual and non-habitual transactions should have triggered enhanced verification and diligence obligations by the bank.
• Limits of the client’s proof of consequential damages beyond the amount of the unauthorized transfers.
• Determination of the appropriate monetary remedy, including principal, interest, additional indemnity and costs, once fault is established.

Facts of the case

Réfrigération Belisle inc. maintained a business bank account with the Banque Royale du Canada (Royal Bank of Canada). In February 2022, a series of electronic funds transfers were executed from Réfrigération Belisle’s account to third parties. These transfers were not in line with the company’s ordinary banking practices and were not authorized by the company. On 24 February 2022, transfers in the amounts of 4,990 dollars to Nandy Cherubin and 5,000 dollars to Akinnola were initiated, followed on 25 February 2022 by a transfer of 4,995 dollars to Amenan Ehoussou. None of these transactions corresponded to the company’s usual pattern of account activity, which did not typically involve such outgoing transfers to these payees. As soon as the unauthorized activity was detected, the company’s representative, Mr. Alain Belisle, went to the bank on 25 February 2022 to seek an explanation. He returned the following day, still without receiving a clear answer as to how the debits had occurred or why they had been allowed to go through. Despite this prompt reaction, it was only in March 2025 that the bank provided a substantive response, asserting that the security breach originated from the company’s own computer system rather than from the bank’s systems or processes. Faced with this assertion, Réfrigération Belisle commissioned an independent analysis of its equipment. The company retained an expert, Mr. Paul Leclaire, to examine both the office computer and Mr. Belisle’s mobile phone. The expert’s report concluded that the systems of Réfrigération Belisle were free from any attack or compromise that could have generated the unauthorized transfers. This expert evidence was produced in court and, significantly, it was never effectively contradicted by the bank. On the transactional side, the amount of 4,990 dollars destined for Nandy Cherubin was never finally debited from the account or was reimbursed by the bank. The practical loss at issue therefore related to the remaining transfers, namely 5,000 dollars sent to Akinnola and 4,995 dollars sent to Amenan Ehoussou, for a total of 9,995 dollars in unauthorized debits. Réfrigération Belisle also claimed an additional 2,500 dollars as damages, seeking to recover not only the principal sums transferred but also consequential harm allegedly suffered as a result of the incident.

Legal framework and issues

The case was heard by the Cour du Québec, Civil Chamber, Small Claims Division, sitting in Saint-Jean-sur-Richelieu. The claim was framed as a contractual liability action under article 1458 of the Civil Code of Québec, which imposes on every person the duty to honour contractual undertakings and to repair the material, moral or bodily prejudice caused to the co-contracting party in the event of a failure to perform. Within this contractual matrix, the court examined the well-established duties of banks toward their clients in relation to electronic fund transfers, referencing prior appellate and trial level jurisprudence. The Court of Appeal’s decision in Djamad v. Banque Royale du Canada and the judgment of Judge Marengo in Chocron v. Banque Royale du Canada were used to describe the scope of a bank’s obligations. In those authorities, a bank is characterized as having obligations akin to those of a mandataire toward its clients, with a duty of prudence and diligence in the execution of payment instructions. The bank must verify the authenticity of the client, ensure that the transfer order contains no anomalies, and show heightened vigilance where operations are unusual or potentially fraudulent. Particularly in the environment of automated electronic payments, where physical signatures and documents may be absent, the bank’s verification of identity and legitimacy of the transaction becomes critical. The jurisprudence also emphasizes that when account operations are visibly abnormal, or when transactions appear illicit or fraudulent, the financial institution’s suspicion should be activated. In such circumstances it must investigate and clarify what is suspect; failure to do so can amount to a breach of its duty of diligence. Against this legal backdrop, the trial court identified the central legal and evidentiary questions: whether the bank had committed a fault by allowing the disputed transfers to go through without adequate verification and whether Réfrigération Belisle had satisfied its burden of proof, under articles 2803 and 2804 C.c.Q., to establish that the unauthorized transfers and resulting loss were attributable to that fault.

Evidence and absence of policy clauses at issue

In this dispute, there was no detailed discussion of specific written banking policy terms or standard-form clauses governing online access, user credentials or client verification, nor did the judgment focus on particular contractual stipulations limiting the bank’s liability. Instead, the analysis turned largely on the general contractual obligations of the bank under the Civil Code, as interpreted through the cited case law. The plaintiff’s evidence was centred on factual and expert proof. The company showed that the transactions in question were not authorized, that they were inconsistent with the historical pattern of account activity, and that, upon discovering the transfers, its representative took prompt steps to alert the bank. To rebut the bank’s assertion that the breach arose from the company’s own systems, Réfrigération Belisle relied on the expert report by Mr. Leclaire, which concluded that neither the desktop computer nor the mobile phone contained traces of an intrusion capable of generating the unauthorized transfers. This report was placed before the court and remained unchallenged; the bank did not file a competing expert report nor any technical analysis to demonstrate that the client’s environment had in fact been compromised. By contrast, the bank’s evidentiary response was thin. It did not furnish a detailed incident report, technical breakdown or documentary explanation of the events surrounding the transfers. Instead, its position rested on general assertions and hypotheses that the hacking must have arisen from the client’s computer system and on the contention that it had acted at all times with prudence and diligence. The court stressed that although the bank did not bear the initial burden of proof, once the plaintiff had produced uncontroverted expert evidence supporting its version of events, it was incumbent on the bank to present persuasive counter-evidence if it wished to displace that proof. In the absence of such evidence, the plaintiff’s version remained predominant on a balance of probabilities.

Court’s analysis of fault and liability

In assessing liability, the court referred back to the principles set out in Djamad and Chocron, namely that banks have an obligation of means and must exercise the level of skill, prudence and diligence reasonably expected of a qualified financial institution. This includes adherence to their own internal standards and procedures, as well as an enhanced vigilance when confronted with irregular or suspicious operations. The court found that the transfers in question were both unauthorized and atypical for the plaintiff’s account. Given that these operations were out of character and involved beneficiaries with no established relationship to the company, they should have triggered additional verification measures on the bank’s part. The judgment underscores that in a system of electronic payments, where automation and the lack of physical documentation can obscure the true origin of instructions, the bank’s duty to verify the identity of the person initiating the transfer and the legitimacy of the transaction acquires particular importance. According to the court, the bank failed to demonstrate that it had taken all necessary steps to ensure that the orders to transfer funds to Akinnola and to Amenan Ehoussou were authentic and valid. The court accepted as proven that the bank authorized these transfers without adequate verification, thereby breaching its contractual obligations toward the client. It concluded that Réfrigération Belisle had met its burden of proof and that the bank had committed a fault in allowing the unauthorized transactions to proceed without implementing the level of scrutiny demanded by its duty of prudence and diligence.

Damages and outcome

Having established fault and causation, the court turned to the quantification of damages. Réfrigération Belisle originally claimed 12,495 dollars: an amount corresponding to the three transfers, less the sum relating to the transaction that had been reversed or reimbursed, plus a further 2,500 dollars in damages. The court first noted that the transfer of 4,990 dollars destined for Nandy Cherubin had not ultimately resulted in a net loss for the plaintiff, either because it was never debited or because the amount had been reimbursed by the bank. The actual unauthorized loss therefore consisted of the two other transfers: 5,000 dollars to Akinnola and 4,995 dollars to Amenan Ehoussou, for a total of 9,995 dollars. As for the additional 2,500 dollars in damages, the court observed that the plaintiff had been previously advised during the hearing that this head of damage was not supported by adequate documentary proof. In the absence of evidence capable of justifying an award of this additional sum, the court declined to grant it. Ultimately, the judge partially upheld the plaintiff’s claim and ordered the Banque Royale du Canada to pay Réfrigération Belisle inc. the sum of 9,995.00 dollars, representing the two unauthorized transfers, together with interest and the additional indemnity provided for in article 1619 C.c.Q. from 5 June 2024. The judgment also awarded judicial costs against the bank, but without specifying the exact monetary amount of those costs, which are to be determined according to the usual procedural rules. In outcome, Réfrigération Belisle inc. is the successful party, obtaining a principal monetary award of 9,995.00 dollars plus interest, the statutory additional indemnity, and costs, although the precise quantum of the latter cannot be determined from the judgment alone.