OVERVIEW OF ASSETS TRACKING IN ONLINE SCAM

With the advancement of technology and the widespread use of the internet in all walks of life, there is an unfortunate increase of risk and exposure to online scams. Online scams are activities where computers or network equipment are used as mediums to commit crimes, usually involving the deprivation of both cash and digital assets. These may take the forms of phishing, fake online shopping, investment scams, advance fee fraud, and love scams.

As of June 2024, the total losses from online scams crimes reached over RM2.6 billion in less than three years from 2022. In the span of six months this year, these losses reached over RM5.8 million. As many as 266,230 cases of online scams involving mule accounts were reported by victims from year 2020 until June of 2024.^[1]

Modern criminals increasingly exploit citizens’ low levels of financial and IT literacy while many financial scams, committed well before the internet era, continue to thrive despite ongoing awareness and education campaigns. These scams have been digitalized, modernized, and upgraded to keep pace with advancements in technology. The digital age has fostered a rise in online scams, which have become more sophisticated and creative, leveraging advanced technologies to deceive and defraud individuals and organizations.^[2]

Online scams also pose significant risks to financial service providers (FSPs) that manage and process funds for their clients. These providers can range from merchant acquirers, payment system operators, banks, and investment firms, among others. As custodians of substantial financial assets, FSPs are prime targets for sophisticated fraud schemes. To combat these threats, asset tracking is a critical component in the battle against online scams and this article provides an overview of asset tracking methodologies for both cash and digital assets, offering insights into the techniques used to identify, trace, and recover losses.

A. Tracking Cash Assets

The first step in tracking cash assets is to determine who owns or has beneficial interest in the bank account where cash reserves are kept and involved. This involves several key action including:-

• Analysing transaction records: This can be done by carefully reviewing the bank statements and transaction records to trace the flow of funds. From the reviews, patterns or anomalies can be detected and which could indicate fraudulent activities involving the bank
• Utilising KYC (Know Your Customer) Data: By leveraging on information gathered during the KYC process, such as identification documents and personal details of account This data can provide crucial insights into the legitimacy of transactions and account ownership.
• Filing Disclosures: If necessary, submit formal requests for information to financial institutions to disclose the identities of account holders and any associated parties. This step is often critical in uncovering the true beneficiaries behind complex financial arrangements. Section 134 of the Financial Services Act 2013 permits Financial Institutions to disclose any document or information relating to the affairs or account of its customer to persons as specified in Schedule 11 of the Among others, permitted disclosures are allowed for the following purpose to the following persons:-

“Schedule 11
[Section 134]

PERMITTED DISCLOSURES

Secondly, in cases of financial scams which may involve insiders who facilitate or directly engage in fraudulent activities, the following strategies may be considered to determine any insider involvement:-

• Internal Audits: Companies can conduct thorough audits of internal processes and employee activities to identify and spot irregularities or breaches in organisational protocols that could indicate insider
• Interviewing Employees: Interview members to gather insights and identify any suspicious behaviours from employees. Employees may have observed unusual activities or have knowledge about the involvement of other members, thus it is important to gauge and have open discussions with
• Cross-referencing Data: Compare internal records with external transactions records to identify any discrepancies or unauthorized

Another significant threat to cash asset security is the use of mule accounts by scammers. Money mules are intermediaries used by criminal organizations to conduct transactions with contraband financial assets. They facilitate the transfer of funds between accounts or even national borders. Illegally attained money or other assets is “laundered” after its source has been obfuscated and it then appears as cleanly acquired. The ultimate goal of laundering is the gradual introduction of the newly clean money into the normal financial flows that constitute a legal business.^[3]

Similar to real asset tracking, defending against mule accounts involves vigilant monitoring of account activities which includes keeping a close watch on accounts that exhibit high-risk behaviours, such as frequent large deposits and withdrawals. Enhanced monitoring can help early detection of suspicious activity. Additionally, early reporting to the appropriate law enforcements or financial institutions to investigate and dismantle the network of mule account by sharing account activity and information.

B. Tracking Digital Assets

Another asset gaining popularity is cryptocurrency and other digital assets. While these assets offer convenience and innovation, they also present unique challenges due to their decentralized and pseudonymous nature. Additionally, as unregulated digital records are not issued or backed by banks or public institutions, there is no governing body to license or ensure the adequacy of their risk management, employee expertise, or customer interactions. This lack of regulation necessitates more creative methods of asset tracking, combining traditional investigative techniques with modern technology to combat online scams effectively.^[4]

An effective method to trace digital assets is by employing a blockchain analysis provider who specialises in tracking cryptocurrency transactions. These experts use sophisticated tools to trace the movement of funds across blockchain networks, identifying wallet addresses associated with illicit activities or utilising IP addresses linked to any cryptocurrency transaction to trace geographical location of possible scammers.

Companies or their service providers can also leverage in Open-Source Intelligence by analysing and investigating possible scammers’ social media or online forums. It is astonishing what can be found through Open-source Intelligence where numerous records, including criminal and civil court records, residential and telephone directories, and other similar files, are accessible on the public internet.^[5]

Challenges in pursuing claims of lost digital assets in the civil courts in Malaysia.

(i) Admissibility of evidence

 In pursuing a claim to recover lost assets in court proceedings, one of the main challenges in civil court is the admissibility of digital evidence, which can include but not limited to transaction reports (e.g. bank statements or cryptocurrency transfer records) and blockchain record or public digital ledger. In Malaysia, digital evidence is admissible as both documentary and primary evidence and is governed under sections 90A, 90B, and 90C of the Evidence Act 1950 (“EA”). The issues of authenticity and reliability are important for digital evidence as it is very fragile and could easily be altered.^[6]

On the issue of authentication of digital evidence, section 90A (2) of the EA requires the production of certificate from the person responsible for the computer’s operation. Without this certificate, the digital evidence tendered in court will render the evidence inadmissible due to lack of authenticity.^[7] However, the certificate is not necessary if the person responsible for the computer’s operation is present during the hearing of the case and able to testify whether the digital document was produced in the course of its ordinary use.^[8] Nevertheless, in some situations where the digital evidences were unchallenged, the requirement of a certificate may be dispensed with.^[9]

 

(ii) Can an injunction order be obtained against the unknown perpetrators?

Perpetrators of online scams frequently stay anonymous and are rarely apprehended or prosecuted as the victims usually will be left unsure on what remedies or recourse they have against the unknown perpetrators. However, this changed with the High Court’s decision in Zschimmer & Schwarz GmbH & Co KG Chemische Fabriken v. Persons Unknown & Anor where in the cyber fraud claim, the High Court allowed the application for proprietary injunction and mareva injunction against the “Persons Unknown”.^[10]

The High Court noted the similar practices in the English case law which had allowed for similar injunctive orders against ‘Persons Unknown’^[11] and there was nothing in the Rules of

Court 2012 (“ROC”) that would prevent the writ of summons and applications from being filed against Persons Unknown. In fact, Order 89 of the ROC for summary proceedings for possession of land allowed for a defendant referenced to ‘Persons Unknown’. In addition, the court could grant parallel reliefs of a proprietary injunction and a Mareva freezing injunction.^[12] The Zschimmer & Schwarz (supra) case was referred to by the General Division of the Singaporean High Court in the case of CLM v. CLN and others when granting interim orders against the ‘Persons Unknown’ (the first defendants) and it was held that the stolen cryptocurrencies ought to be classified as property capable of giving rise to proprietary rights, which could be protected via a proprietary injunction.^[13] The position taken by the Court in recognising that digital assets as a property reinforces the idea that digital assets should be afforded protection possibly making way for further interpretation of the law to allow claims for lost digital assets in Malaysia.

(iii) Enforceability

In furtherance to the Injunctions order granted against the “Persons Unknown” in the case of Zschimmer & Schwarz (supra), the High Court further granted a self-identification order against the “Persons Unknown” as the 1^st defendant, requiring the “Persons Unknown” to provide identification and address for service.^[14] The self-identification advertisement in Malaysia could be effective to alert the Persons Unknown to reveal themselves if it appeared that the plaintiff’s monies remained within Malaysian bank accounts and Malaysian jurisdiction.^[15] Where assets are located in different jurisdictions, international cooperation and legal agreements such as Reciprocal Enforcement of Judgments Act 1958 (“REJA”) play a critical role in the enforceability of such court orders.

Conclusion

The admissibility of digital evidence in Court is a critical aspect of attempting and pursuing claims to recover lost assets, either real or digital assets. With the continuous advancement of technology, it is paramount that digital evidence that is relevant, authentic, and complies with the provision of the EA ought to be admissible. It is likewise crucial for any digital evidence that is relevant and authentic that will lend assistance in claims to recover digital assets be properly kept. With the expansion of technology, especially with and within cryptocurrency, we can leverage blockchain technology and assistance from forensic analysis to provide robust proof of asset transfers to the Court. As digital transactions become more prevalent in the current financial landscape, the ability to effectively present digital evidence in court will inevitably to play a vital role in asset recovery.

If you have any questions or queries, please contact our Associate, Ms. Maryam Amilah Zaini (maryam@nzchambers.com) or Associate Ms. Aireen Natasha Ab Wahab (aireen@nzchambers.com).

Authors:

1. Mayram Amilah
2. Aireen Natasha

References:

[1] Jabatan Perdana Menteri (Undang-Undang dan Reformasi Institusi); Astro Awani (Niaga Awani, 12 July 2024) https://www.astroawani.com/videos/bisnes-x7sinh/niaga-awani-data-statistik-jumlah-penipuan-dalam-talian- melonjak-x920588.

[2] Bele, J. L. (2020). FINANCIAL SCAMS, FRAUDS, AND THREATS IN THE DIGITAL AGE. Modern Approaches
to Knowledge Management Development: Collective Monograph, 39–50.

[3] Ibid.

[4] Ibid.

[5] Appel, E. J. (2014). Cybervetting: Internet Searches for Vetting, Investigations, and Open-Source Intelligence. In CRC Press, Inc. eBooks. https://dl.acm.org/citation.cfm?id=2765721

[6] Lim Peng Hock & Anor v. Chuah Peng San (Peguambela & Peguamcara, Pemilik tunggal yang beramal sebagai Tetuan Chuah, Halim & Co) & Anor [2021] MLJU 192.

[7] Bank Bumiputra Malaysia Berhad v. Emas Bestari Sdn Bhd & Anor [2014] 1 CLJ 316.

[8] Gnasegaran a/l Pararajasingam v. Public Prosecutor [1997] 3 MLJ 1.

[9] Standard Chartered v. Mukah Singh [1996] 3 MLJ 240; Am Finance Berhad v. Ultimate Eight Sdn Bhd & Ors
[2014] 3 CLJ 695.

[10] [2021] 7 MLJ 178.

[11] CMOC Sales & Marketing Limited v. Persons Unknown and 30 others [2018] EWHC 2230 (Comm); Cameron Liverpool Victoria Insurance Co Ltd [2019] 3 All ER 1, SC

[12] Zschimmer & Schwarz GmbH & Co KG Chemische Fabriken v. Persons Unknown & Anor [2021] 7 MLJ 178.

[13] [2022] 5 SLR 273.

[14] Zschimmer & Schwarz GmbH & Co KG Chemische Fabriken v. Persons Unknown & Anor (No 2) [2021] 3 CLJ 587.

[15] Zschimmer & Schwarz GmbH & Co KG Chemische Fabriken v. Persons Unknown & Anor (No 2) [2021] 3 CLJ 587.