Tracing onto the Second Layer Recipients in Cyber Fraud Cases – What Years of Experience Have Told Us?

Tracing onto the Second Layer Recipients in Cyber Fraud Cases, prepared by Anna Chan and Martin Tse

“Layering” is an inseparable part of money laundering in a typical cyber fraud case. The process involves fraudster transferring the defrauded funds from one bank account to various bank accounts, often belonging to different account holders (or second layer recipients), which could even be in different countries. This is a common technique to “break down” the large defrauded funds so as to avoid alerting the bank when they are ultimately withdrawn. In the case of Hong Kong, the second layer account holders are usually shell companies or PRC residents. More often than not, either that they are knowingly involved in the fraudulent scheme, or that they have lent the accounts to a criminal gang without caring how their accounts are utilized for laundering related activities.

Victims in cyber fraud often find it tricky when they trace the lost sum onto these second layer recipients. Unlike the first layer recipient where the element of fraud is obvious, the second layer recipients may rely on the defence of “bona fide purchaser for value without notice” to suggest that they receive money only pursuant to a legitimate and genuine transaction thus denying any involvement of fraud (the “Bona Fide Defence”) [see Zief Incorporated v Tekchandani Ajai Mohan (t/a D’Ziner Collections (Hong Kong)) & Ors [2021] HKCFI 38, para 3]. These second layer recipients who rely on the Bona Fide Defence are sometimes called the “Equity Darling”. They are “Darling” in the sense that they would be freed from liabilities and could keep the received fund as clean money.

Having dealt extensively with email scams/cyber fraud, we have concluded three aspects which cause particular difficulties when dealing with these second layer recipients:-

  1. The difficulty in identifying/obtaining particulars of the second layer recipients and in obtaining information about the corresponding fund flows (The Discovery Issue);
  2. The difficulty in preserving the defrauded funds received by the second layer recipients in avoidance of further dissipation (The Preservation Issue); and
  3. The difficulty in establishing a case against a second layer recipient who raises a Bona Fide Defence and to hold them liable to pay back the defrauded sum to the victims (The Merits Issue).

We shall discuss each of these three aspects and how they could be tackled in turn.

1. The Discovery Issue

Bank statements are critical to any tracing exercise because victims could only discover where the defrauded sum has been further dissipated and locate the fund by reading the transaction records of the fraudster. Banks however would not disclose victims with bank statements because of confidentiality policy unless the victims can provide a Court order compelling discovery. The Court, however, has to be satisfied that it is relevant and necessary for the requested documents to be disclosed. If the victim is merely asking the first layer recipient to personally compensate the money he wrongfully received, it might not be relevant and necessary to look at his other transactions with third parties. Without seeing the first layer’s account activities, without knowing the identity of the second layer recipients and without the relevant transaction information to prove the fund flow, victims’ tracing exercise onto the second layer recipients might come to an end abruptly.

It is therefore important to correctly structure the claim against the first layer recipient. Usually the problem would be cured if the claim is framed properly as a “proprietary” claim, as opposed to a “personal claim”. In a proprietary claim, the victim asserts proprietary rights in the specific funds defrauded. Since the ownership of such fund, irrespective how many subsequent transfers it has gone through and irrespective of who is currently holding the same, sticks with the victim, the victim has the basis to seek information about such fund. In recent years, it has become increasingly common for practitioners to frame the claim against the first layer recipient (and also the second layer recipients) as one of “proprietary restitutionary claim” which is actually a combination of an unjust enrichment claim with a constructive trust as a remedy [see Zhang Yan v ASA Bullion Ltd [2019] HKCFI 179, para 24]. A proprietary restitutionary claim will in practice be viewed by the Court as a proprietary claim for the purpose of injunction and disclosures.

It turns out that where the claimant’s claim is proprietary in nature, the Court will also readily grant a bankers’ book order which is a kind of discovery order made directly against the bank. By this order, the bank can then be compelled to produce the documents relating to the accounts of the first layer recipient. Through the discovery of the documents provided by the bank, one can then also obtain a “big picture” as to how the funds have been channeled away systematically and swiftly to the second layer recipients.

2. The Preservation Issue

Once the identity the second layer recipients and the corresponding fund flows are known, there is then enough basis to launch legal claims against the second layer recipients.

Likewise, it is necessary to frame the claims against the second layer recipients as proprietary claims such that (1) a proprietary injunction (which points to the specific funds transferred to a second layer recipient), on top of a Mareva injunction (which covers the general assets of a second layer recipient), can be obtained against the second layer recipients; and (2) due to the proprietary nature of the claim, the Court can be asked to grant the necessary orders to assist further tracing of the funds.

As said, it is common nowadays to frame the claim against the second layer recipients as proprietary restitutionary claim. Such a claim has the following benefits:-

  1. A proprietary restitutionary claim would still be viewed by the Court as proprietary in nature and therefore the claimant would also be able to preserve the fruits of judgment by way of a proprietary injunction (on top of a Mareva injunction). A second layer recipient might seek to discharge both the proprietary and the Mareva injunctions against it. In cases where the second layer recipient can demonstrate that there is no real risk of it dissipating the assets, the Court might discharge the Mareva injunction (as “real risk of dissipation” is one of the elements required). The existence of proprietary injunction could offer some protection to the victim in such circumstance because unlike Mareva injunction, “real risk of dissipation” is not an element required in proprietary injunction. [see Tokic DOO v Hongkong Shui Fat Trading Ltd & Ors [2022] HKCFI 217]
  2. A proprietary restitutionary claim would also open the way for further tracing exercise, pursuant to which bankers’ book orders can be obtained against the bank accounts of the second layer recipients. If it is subsequently discovered that the funds have been transferred onwards, legal actions can then be launched against third layer recipients in a similar fashion to maximize the chance of recovery.
  3. Due to the proprietary nature of a proprietary restitutionary claim, the victim would also have the option of seeking a declaration from the Court to assert his proprietary rights in the specific funds defrauded. In doing so, the claimant may then have priority over other victims (if any) competing for the limited funds available.
  4. In a proprietary restitutionary claim, as unjust enrichment being the primary cause of action is still a personal claim, the claimant may choose to waive the proprietary remedy and just obtain a monetary judgment where a second layer recipient is in default of defending the case. The procedures for both obtaining and executing a monetary judgment is simpler and faster. On the other hand, if the claim is a pure constructive trust claim (with no unjust enrichment claim), the primary remedy would be proprietary in nature, and the mechanism for executing the judgement is much more complicated since it involves an account of trust assets first; and
  5. Unlike a pure constructive trust claim, a proprietary restitutionary claim relies on an unjust enrichment claim as its primary cause of action. Therefore, even if the Court may not accept that a constructive trust arises in such circumstances (eg. Zief Incorporated, paras 43-52), the claimant can still have a complete cause of action as long as there is “receipt” of funds (which can be easily proved by the banking documents) and the claimant can point to one of the usual “unjust” factors.
3. The Merits Issue

Where a second layer recipient raises the Bona Fide Defence in a cyber fraud case, this would often be taken by the Court with a grain a salt. Still, there were cases where a defendant has successfully raised such a defence.

It may be thought that if a second layer recipient receives funds from a third party (i.e. not the contractual counterparty of the alleged transaction), this would deprive him of a Bona Fide Defence at all. However, this is not the case because third party payment is not something prohibited by the law in the first place. Similarly, the law does not impose a general duty on the recipient of funds to make enquiry about the provenance of the funds unless the recipient is under a statutory duty to do.

On the other hand, it has recently been suggested that the risk of money laundering and cyber fraud arising from payment out of a totally unknown bank account is conspicuous and one cannot simply ignore such a risk (Luk Mei Suet Michelle v Afsafari Services Co Ltd & Ors [2022] HKDC 191, para 91). Therefore, this would suggest that a second layer recipient cannot be acting bona fide where he is deliberately ignorant in suspicious circumstances.

Other than challenging the bona fides of the second layer recipient, recent cases successfully defeating a Bona Fide Defence mostly involve challenging the existence of the alleged transaction. Sometimes, the claimant may even go further to challenge the second layer recipient having a real legitimate business at all. However, these are serious allegations which involve a careful analysis of the evidence.

Where the transaction alleged by the second layer recipient involves an underground banking transaction, the consensus is that the illegality of such transaction would prevent the second layer recipient from raising the Bona Fide Defence at all, since in law he cannot be regarded as having provided consideration. It is notable that in Hong Kong, there is no capital or remittance control and thus the use of underground remittance dealers is not illegal within the jurisdiction per se. The breach of remittance control is therefore concerning illegality under foreign law only. The victim would have to file foreign law expert evidence to assist the Hong Kong Court in establishing illegality.


Claiming against the second layer recipients is not an easy task. It is therefore advisable that the victims seek instant assistance from experienced litigators to handle the civil claim. On the Discovery Issue and the Preservation Issue, quick action is the key. On the Merits Issue, the defendant’s case has to be studied carefully to decide the right strategy, with an eye to be kept on the latest legal developments. However, experience has told us that, where all the things are done correctly, there is still a high chance to recover a large part of the defrauded funds.



Limitation of Action



Limitation of Action