The Tribune

• CBH Bahamas blasted for ‘serious error and negligence’

• Failed to detect scam despite incorrect client name, e-mail

• Only became suspicious when account almost exhausted

By NEIL HARTNELL

Tribune Business Editor

nhartnell@tribunemedia.net

A Bahamian financial institution’s “serious error and negligence” resulted in fraudsters plundering more than $2m from one of its client’s accounts, the Supreme Court has revealed.

Justice Ian Winder, in a May 12, 2022, ruling blasted CBH Bahamas for “failing to exercise the requisite due care and skill expected” when it failed to detect signs it was communicating with criminals rather than the Moldovan arts and antiquities dealer who was the account’s ultimate beneficial owner.

After an e-mail used by Andrei Rujnicov’s secretary (now his wife) had been compromised by a so-called “phishing” attack, CBH Bahamas bankers did not realise that both the address and name used by the fraudsters were spelled incorrectly. And they missed these vital clues when corresponding, and even speaking via telephone, to the persons impersonating Mr Rujnicov.

As a result, acting on the fraudsters’ instructions, the bank transferred more than $2m from the art dealer’s account in a series of 12 transactions that took place between October 16, 2014, and December 11 that same year. CBH Bahamas and its staff only became suspicious when they realised the account belonging to Mr Rujnicov and his entity, Zampa Overseas, had been almost totally depleted and the fraudsters were demanding more funds in excess of the remaining balance.

CBH Bahamas, in its defence, sought to blame the loss on the Moldovan arts dealer’s failure to inform it on a timely basis that his assistant’s e-mail may have been compromised. However, Justice Winder said that upon reviewing the evidence and testimony at trial he was “satisfied” the bank “was indeed guilty of serious error”.

“It cannot be seriously disputed that CBH was in breach of its mandate with Zampa,” he wrote. “The sum of $1.62m was paid from the account by CBH, net of refunds, without Zampa’s consent. CBH had paid out almost the entirety of the sums standing to Zampa’s account in ten transactions before realising it had no consent from Zampa to do so.

“In fact, it was only because nearly all of the funds had been depleted, and the fraudster was seeking additional funds in excess of the balance, that CBH appreciated that fraud had been conducted and CBH then sought to attempt to recover the monies paid out. In the course of the fraud, CBH accepted correspondence that was flawed on its face (executed by someone called Andre Ruzhnikov) and sent by the fraudulent e-mail to amend the account mandate.”

CBH Bahamas executives, and their counterparts at the Swiss head office, failed to spot the difference between the name used by the fraudsters - “Andre Ruzhnikov” as opposed to the correct Andrei Rujnicov - as well as the fact that the fake e-mail they were corresponding with had an extra ‘i’ in it as compared to the address used by the art dealer’s secretary.

The largest sum of money obtained by the fraudsters in any one transaction from Mr Rujnicov/Zampa’s account was $290,000, but Justice Winder said the frequency of transfer requests - which rose to three per day at their peak - should also have alerted CBH Bahamas executives that something was amiss.

“Banks are expected to be more than mere automatons,” his judgment read. “The evidence of Zampa’s expert witness emphasises that in providing service to customers, particularly in the digital age, requires banks to rise beyond the strict execution of payment instructions without pause for inquiry.

“The bank must, as a rule, interrogate the instructions given by clients. The rapid succession in which the payment requests came, in some cases two and three times in one day, ought to have created a cause for some concern.” Justice Winder said calling clients back, so as to verify they had actually issued transfer instructions, became mandatory at CBH Bahamas after it fell victim to the deception.

However, he was “persuaded” this had been a feature of the bank’s relationship with the Moldovan art dealer from the outset. “The evidence is clear that CBH committed a serious error,” Justice Winder added. “This is so if only for the simple fact that it paid out in multiple transactions almost the entirety of Zampa’s account without proper authority.

“There were just too many missed opportunities on the part of CBH to intercept and discover the fraud. The spelling of Rujnicov’s name, the additional ‘i’ in the e-mail that was passed off as [his secretary’s], the lack of due diligence and follow-up were all confirmed in the testimony of the compliance expert. These all point to a breach of the account opening agreement (AOA) on the part of CBH.

“In particular, the expert spoke to protocols in general in the offshore banking sector, and that had these general protocols been followed they could have averted the fraud.” The account, which was opened earlier in 2014 in Zampa’s name, stated that Rujnicov had a “power of attorney” as its authorised representative to conduct transactions - a power that could not be transferred or delegated to third parties.

A so-called “reference code” was established between CBH and the arts/antiquities dealer for the purpose of authenticating transactions on Zampa’s account. Two such transactions took place on April 14, 2014, and October 13, 2014, on e-mail instructions from Mr Rujnicov’s then-assistant, Ekaterina Yakushkina. On both occasions the Swiss-based banker who opened Zampa’s account, Leandre Sappino, called to verify the instructions were correct.

However, between October 14-16, 2014, Yakushkina’s e-mail was compromised after she clicked on a “phishing” e-mail. The fraudsters behind it subsequently began corresponding with CBH and Sappino, who on October 17 introduced them to Bahamian bank executives, Ahmad Strachan and Ursula Rolle. The imposters subsequently sent the bank a false “letter of authorisation” on October 28, 2014, giving Yakushkina authority to handle Zampa’s account.

Mr Strachan was said to have even communicated with the fraudsters over the phone, having “absolutely no way of knowing who he was talking to”, and Justice Winder said: “Perhaps the most striking error or omission was the failure of Sappino to detect that he must have been corresponding with an imposter or, at the very least, something was awry.

“On October 17, 2014, he had introduced Yakushkina to Rolle and Strachan, yet on October 20 he received a request from the imposter, posing as Yakushkina, to be introduced to CBH. Sappino’s response was to do nothing and simply re-send the introduction.” Sappino admitted on trial that the two introduction requests within three days of each other “seemed weird”, and Justice Winder said he would have discovered the fraud if he had checked the e-mail address used.

Some $437,500 of the “unauthorised transactions” were recovered, leaving a balance of $1.62m to be reclaimed. However, Justice Winder reduced this award by 20 percent on the basis that CBH Bahamas was not given a timely alert that the e-mail may have been compromised by the “phishing” attack. Still, he placed the majority of the blame on the Bahamian financial institution.