When the Bank Stays Silent: High Court Finds CIMB Liable for Failure to Intervene in Fraud

In a landmark decision that redefines the responsibilities of financial institutions toward vulnerable customers, the High Court has ruled that a bank cannot remain a passive observer when faced with clear evidence of fraudulent activity. The case, Estate of Ng Choon Luk @ Ng Choon Lak (deceased) v. CIMB Bank Berhad , underscores the critical "Quincecare duty" and the necessity for banks to act when suspicious transactions deviate from a long-term customer's profile.

The 14-Day Fraud Marathon

The deceased, an 85-year-old "Preferred Customer" with a 30-year relationship with the bank, became the target of a sophisticated scam. Between June 24 and July 7, 2022, his account saw a radical departure from its history of cheque and utility payments. For 14 consecutive days, scammers withdrew approximately RM40,000 daily—the absolute maximum permitted—via ATM and MEPS transfers, siphoning off RM529,774.79.

The plaintiff, representing the deceased’s estate, argued that the bank failed in its duty to protect the customer. The defense rested on the argument that the deceased had voluntarily disclosed his PIN and allowed access to his card, thereby breaking the chain of causation and absolving the bank of liability.

A Duty to Act: The Legal Tug-of-War

The legal debate centered on the application of the Quincecare duty—the principle that a bank must refrain from executing orders if it has reasonable grounds to believe a transaction is an attempt at misappropriation. While the bank cited the UK Supreme Court’s Philipp v. Barclays case to argue that they were simply following instructions, the Court found this inapplicable.

"In this court's judgment, Philipp is distinguishable on its facts... Here, the deceased did not instruct CIMB to make payments. Rather, the scammers obtained the deceased's debit card and PIN and used them directly," noted Noradura Hamzah JC.

Furthermore, the bank’s own officer admitted during cross-examination that their systems were capable of flagging such anomalies, yet no SMS, phone call, or account freeze was initiated during the two-week fraud window.

Why the Silence Proved Costly

The Court rejected the notion that the deceased’s initial gullibility completely neutralized the bank's responsibility. While the deceased was found to be partially at fault for surrendering his credentials, the Court emphasized that the bank’s failure to act was an independent, compounding factor.

> "The defendant cannot escape liability by arguing that it did not know of the fraud. The Defendant had systems capable of detecting the unusual pattern. The defendant had contractual powers to intervene." — Noradura Hamzah JC

The Court’s Verdict: Shared Responsibility

Applying Section 12(1) of the Civil Law Act 1956, the Court apportioned liability at 40% to the deceased and 60% to the bank.

The Judge concluded: "While the deceased's voluntary disclosure of his PIN and card was serious, the Defendant as a sophisticated financial institution with fraud detection systems and contractual powers to intervene bears the greater responsibility for failing to protect a vulnerable elderly customer over a 14-day period."

The Court awarded the plaintiff RM317,864.87, plus interest, dismissing the claim for general damages.

Implications for the Banking Sector

This ruling serves as a stern reminder that internal "fraud detection systems" are not merely for show—they carry with them a legal expectation of action. For the public, it reinforces the necessity of account security; for banks, it signals that "following the customer's mandate" is no longer a blanket defense when institutional neglect permits a systematic emptying of an account.

Key Observations

• On the Bank’s Capability: "The defendant had the means to detect, the authority to intervene and the opportunity to prevent further losses after the pattern became apparent. It did nothing."
• On Vulnerable Customers: "An 85-year-old customer suddenly engaging in maximum daily withdrawals for 14 consecutive days is precisely the kind of pattern that should have raised concerns."
• On the Role of Banks: "The defendant cannot rely on the general rule [of following mandates] while ignoring the exception that the very same authority establishes."