Crypto fraud victim loses $240,000 claim after enabling scammers

Someone purporting to represent the “cybersecurity division” of the FBI then contacted Bue, offering to recover all his lost funds for an $80,000 fee payable in cryptocurrency. In April 2023, Bue contacted HoneyBadger, a cryptocurrency broker, to facilitate the purchase. He did not disclose his fraud history to the broker. 

Bue granted the third party posing as the FBI remote access to his computer and provided the password to his email account, the same account he used to transact with HoneyBadger. One of the two email accounts he gave HoneyBadger for know-your-client verification had been created by the fraudsters themselves and given to him. He also directed all purchased Bitcoin into a cryptocurrency wallet the fraudsters controlled. 

Over several weeks, six Bitcoin transactions were executed through HoneyBadger. Bue later disputed four of those transactions worth $240,000 in total, and his credit union reversed the corresponding debits that HoneyBadger had made under a Pre-Authorised Debit agreement. HoneyBadger sued to recover the funds. 

The lower court found both parties partially liable. It attributed the full $40,000 from the transactions Bue admitted authorising to HoneyBadger, then split the remaining $200,000 equally between the parties, concluding that HoneyBadger had failed to issue a verification password under the PAD agreement, which it said could have stopped the fraud. The result was $140,000 awarded to HoneyBadger and $100,000 to Bue. 

The Court of Appeal rejected both of those conclusions. On the PAD agreement, Justice Caldwell found the lower court had misread the relevant clause. The requirement for a “password or security code or other signature equivalent” was an obligation on Bue to generate his own authorisation, not an obligation on HoneyBadger to issue one. The court further found that even under the opposite reading, issuing such a code would not have prevented the fraud, given that Bue had already given the third party unrestricted access to his computer and email accounts for the purpose of the Bitcoin transactions.