Three Neighbours, One E-Transfer, and a Seller Who Never Existed

The situation

Two hundred and ten thousand dollars. That was the number Bram, Joost and Mona had agreed to split three ways to buy a used set of catering and refrigeration equipment they had found listed online, intending to lease it out to a small food business two of them were starting on the side. The listing looked legitimate: photographs of the equipment in what appeared to be a working commercial kitchen, a seller who answered questions promptly and knowledgeably, and a price that was good but not so good it read as a scam.

They had spent weeks discussing the plan before committing any money. Bram had researched roughly what similar equipment cost new, Joost had drawn up a rough schedule of what a lease to the food business could bring in over a few years, and Mona had reviewed both sets of numbers with the same care she brought to any purchase of that size, since a third of the deposit was hers. The math worked, comfortably, and the plan felt less like a risk and more like three careful people putting savings to sensible use.

Bram and Joost were both elementary school teachers who had known each other for years as neighbours in Ajax; Mona, a friend of both, had agreed to put in a third of the money in exchange for a share of the equipment's future lease income. None of the three had bought commercial equipment privately before, and the seller's insistence on an e-transfer rather than any other payment method struck them as inconvenient but not alarming, since e-transfers were how they paid for almost everything else in their lives.

They sent the money in three transfers over two days, each transfer confirmed by their own bank as completed. The seller then stopped responding. The phone number went unanswered, the listing was taken down, and the pickup address the seller had given turned out, when Joost drove past it, to be a vacant unit with no connection to any equipment business.

The three of them went to their bank the same week to ask whether the transfers could be reversed or the receiving account frozen. They were told a fraud claim had been opened, but that recovering e-transferred funds after the fact depended on the receiving bank's own investigation, a process the sending bank could request but not control or accelerate. That answer, more than the loss itself, was what brought Bram, Joost and Mona to our office: they needed to understand what leverage they actually had, and whether there was anything faster or more certain than waiting.

The problem

An e-transfer, once accepted into a recipient's account, is treated by the banking system much like cash that has changed hands. There is no automatic clawback simply because the sender later discovers the transaction was fraudulent. Recovery, where it happens, depends on the receiving bank identifying that the funds are still sitting in the account, freezing what remains, and cooperating with the sending bank's fraud unit, all of which is an internal banking process that account holders themselves have very limited ability to direct or speed up.

That process also runs on the receiving bank's own investigative timeline, which is set by its internal fraud protocols and by any regulatory reporting obligations triggered once a suspected fraudulent account is identified. Neither the sending bank nor Bram, Joost and Mona had any standing to compel a faster answer; the file simply had to move through the queue the receiving institution used for every fraud complaint it received, and that queue was not moving quickly.

Separately from the banking process, there was the question of who could actually be sued. E-transfer fraud of this kind is frequently run through an account opened using a stolen or fabricated identity, which meant the name attached to the receiving account might not correspond to any real, findable person. Pursuing a civil claim against a named defendant only makes sense once there is a real person behind the name, and confirming that took its own set of steps separate from the banking investigation.

The practical result was a file with two clocks running at different speeds: a banking investigation that would eventually determine whether any of the transferred money still existed to be recovered, and a legal question of who, if anyone, could be held civilly responsible for what did not come back through that process. Neither clock could be sped up by demand or urgency alone, and the three clients needed a strategy that made sense while waiting rather than one that assumed a fast resolution.

There was also a question of whether the courts, rather than the banks' own internal process, offered a faster route to a name. Canadian courts recognize what is known as a Norwich order, which compels a third party who is not itself accused of wrongdoing, typically a bank holding a fraudster's account, to disclose identifying information so a wronged party can pursue the right person. That tool exists for exactly this kind of situation, where the only path to a name and an address runs through an institution with no independent reason to hand it over voluntarily. It also carries its own cost and timeline in front of a judge, and applying before the banks' internal fraud process had run its course risked duplicating, rather than accelerating, the disclosure the sending bank's fraud unit was already positioned to obtain.

What we did

1. Documented the full transaction trail immediately, gathering the e-transfer confirmations, the original listing screenshots before they could disappear further, and all messages exchanged with the seller, because a fraud investigation moves faster and further when the paper trail is assembled before memories and records fade, and because a listing taken offline cannot be recovered later if nobody preserved it first.
2. Confirmed with Joost's own on-site visit that the pickup address was genuine before treating the file as a total loss, ruling out the possibility of an ordinary miscommunication or a seller who had simply gone quiet for a legitimate reason, so that the fraud report to the bank could be made on a clear and accurate factual basis rather than a guess.
3. Formalized the fraud report with the sending bank in writing, rather than relying on the verbal report already made at the branch, laying out the transfer dates, amounts and the full chain of messages with the seller in a single document. A written, dated report is what actually triggers a bank's internal fraud escalation protocols in a traceable way, and it created a record that would matter if the bank's timeline or handling of the file were ever questioned.
4. Requested confirmation of the receiving bank's investigation status at regular intervals rather than waiting passively for an update to arrive, understanding that we had no way to compel speed from an institution we had no direct relationship with. A documented pattern of follow-up, each request logged with a date and a response, kept the file from being deprioritized in an overloaded fraud queue and built a record of diligence that supported our clients throughout.
5. Pursued identification of the account holder through the banking fraud process, working with what limited information the sending bank's fraud unit was able to share once its own internal escalation allowed disclosure, rather than immediately applying to the court for a Norwich order compelling that disclosure, since the banks' own process was already moving and a parallel court application would have added cost without clearly speeding the answer. The goal throughout was determining whether a real, locatable individual sat behind the receiving account.
6. Prepared a civil claim in parallel rather than waiting on the bank process to finish entirely, drafting the statement of claim and assembling the supporting evidence so that, once an identifiable defendant emerged or any recovered funds were confirmed, the claim could be filed immediately rather than losing further weeks to drafting after the fact, at a point when speed could matter to what remained collectible.
7. Negotiated directly with the receiving bank once a partial recovery was confirmed, working through precisely what portion of the original 210,000 dollars remained traceable and unspent in the account at the point it was frozen, since only funds still physically present in the account, rather than the full amount originally sent, could realistically be returned through the banks' reconciliation process, and confirming that figure took its own back-and-forth.
8. Advised the three clients on realistic expectations at each stage of a process none of them had been through before, being direct that institutional fraud investigations are slow by nature and that full recovery, once funds have already been moved out of a fraud account, becomes progressively less likely the longer that account remains active and unfrozen, so hope for a full recovery did not delay them from planning around a partial one.

The outcome

The receiving bank's investigation, which took the better part of a year to conclude, confirmed that a portion of the funds, just under half of the original 210,000 dollars, remained in the account at the point it was frozen and had not yet been withdrawn or transferred onward by whoever controlled it. That portion was returned to Bram, Joost and Mona through the banks' own reconciliation process rather than through a court order, since the funds were still identifiably theirs sitting in a frozen account.

The remainder was gone. Whoever had opened the account had withdrawn or moved the balance of the money before the freeze took effect, and the identity attached to the account, once the banking fraud unit was able to share limited details, did not lead to a real, locatable person our clients could sue with any prospect of collecting. The account had been opened using identification that did not match any traceable individual once the bank's own internal checks were run, which is common in this kind of scheme and is precisely what made pursuing a civil claim against a named defendant impractical. Pursuing a claim against a name that could not be connected to an actual defendant would have added cost without a realistic path to further recovery, and we advised against it, however unsatisfying that answer was for three people who had done nothing wrong beyond trusting a convincing listing.

Bram, Joost and Mona ended the file with just under half of what they had lost recovered, a result they described as better than they had feared but well short of whole. The remainder they treated as a hard, shared lesson about the limits of e-transfer as a payment method for a purchase of that size, and about how little control even a diligent buyer has once the money has left the account, regardless of how quickly a fraud report is filed afterward.

What you can learn from this