Dubai Court Rules on Liability of Telecom Providers in Cases of Bank Fraud

Introduction

On 12 June 2024, the Dubai Court of Cassation issued a landmark judgment regarding the tortious liability that can arise in cases of bank fraud in relation to third parties, other than the fraudsters or the banks involved. 

The judgment was issued against a major telecommunications company based in the UAE, which had acted as the provider of a sim card, obtained by a network of fraudsters with falsified documents, used in accessing and draining a victim’s local bank account. 

Background

The victim was a Qatari resident, who held a bank account in the UAE. When first opening the account, a UAE phone number was required to be registered with the bank, in order to set up an OTP-based system in approving transactions. For this purpose, the client opted to register the phone number of an acquaintance, not being in possession of a UAE sim card of his own. 

The bank account, which contained significant funds, lay dormant for some time after being opened, until around 2020, when a fraud occurred at the hands of a network of fraudsters, most likely including bank employees. The fraudsters, having noted the inactivity on the account, conspired to use fabricated identity documents to obtain a new sim card from the telecommunications provider, and proceeded to drain the victim’s funds by wrongfully approving transactions using the illegitimate sim card. 

At the first instance, the victim attempted to sue the bank on the basis of their negligence in failing to secure the account and not having the appropriate internal systems in place that would have prevented such a breach. This matter was litigated before the Abu Dhabi Courts over a lengthy period, eventually reaching the Court of Cassation in Abu Dhabi. This court reached a verdict in favour of the bank, not finding it liable under UAE law. 

Due to the legal principle of res judicata, which translated into “a thing adjudged”, meaning that the same matter cannot be reconsidered more than once before a competent court, the victim could not sue the bank again after the issuance of this judgment.  

Having exhausted the option of pursuing the bank in this way, it remained possible for the victim to sue the telecommunications provider directly instead. The action would be based on the breaches of the provider, in failing to conduct the appropriate checks to authenticate the identity documents submitted by the fraudsters when obtaining a new sim card for the registered phone number. 

This action was commenced before the Dubai Courts of First Instance, and represented an uncommon basis for invoking the tort of negligence under UAE law. Such actions in tort usually tend to involve a relationship in which a duty of care is owed by one party to another. In the case of the bank, for example, a duty was owed to the victim as a direct customer, with the bank acting as a custodian for their funds. The challenge with pursuing the provider, in contrast, lay in the fact that the phone number did not belong to the victim in the first place, rather belonging to an acquaintance. It was thus open for the provider to dispute the existence of a duty of care owed to the victim directly, in defending their case, which was the exact line of defence pursued.  

Judgments of the Courts of First Instance and Appeal

At the First Instance and Appeal stages of the litigation, the lower courts dismissed the victim’s claim, applying UAE contract law to the matter. On this basis, reflecting on the lack of a direct contractual relationship between the provider and the victim, the claims were rejected.  

Judgments of the Court of Cassation and Second Court of Appeal

The Court of Cassation, on 13 October 2021 reversed this decision, instead finding that the correct legal basis on which to adjudicate this matter would be the law of tort, rather than the law of contract. Accordingly, the matter was returned to the Court of Appeal to re-adjudicate on this basis.  

The subsequent decision of the Court of Appeal, issued on 8 February 2023 was in favour of the victim, with the judgment reflecting the existence of a duty of care owed in tort by the provider.  

Second Judgment of the Court of Cassation

By a final round of appeal, the telecommunications provider re-applied to the Court of Cassation. This court, by a final and irrevocable judgment handed down on 12 June 2024, rejected the second appeal of the provider, upholding the previous judgments obtained from both the Supreme Court and the Court of Appeal. 

Precedent

The precedent set by this judgment is exceptionally significant, with the court confirming that a duty of care can be owed in tort by such providers not only towards their direct customers, but to third parties affected by instances of their negligence as well. This has the effect of embedding a fundamental principle of tort law into the UAE legal system in the context of bank fraud, which will be vital for victims in the future. 

Conclusion

This was a notably rare case, which sets a vital precedent for victims of banking fraud who have struggled to sue banks successfully. 

By its decision, the Dubai Court of Cassation has clarified that the law of tort may apply to cases of bank fraud by means of a duty of care existing between individuals and third-party providers implicated in negligent actions. This confirms that victims not only have the option of pursuing a claim based in contract law against the banking institutions involved, but may also claim against third party institutions on the basis of the tort of negligence in the alternative.