Executive Summary: Key Legal and Evidentiary Issues

• Sophisticated business email compromise redirected a $221,422.38 payment intended for a long-time supplier into a fraudulent bank account controlled by the defendants.

• Evidence from bank records and corporate filings linked the defendants directly to the Ottawa Scotiabank account that received the funds, supporting an inference they were the fraudsters or intended beneficiaries.

• Substituted service by email, authorized under a prior Norwich order, was accepted as effective notice, enabling the plaintiff to proceed to default judgment.

• The court found no legitimate basis for the defendants to receive funds owed to the supplier and treated the misdirection as clear cyber-fraud warranting restitution and additional damages.

• Punitive damages were awarded to denounce highly reprehensible cyber-fraud and deter similar conduct, relying on prior Ontario decisions addressing fraudulently obtained funds.

• Full indemnity costs were granted in light of the fraud, the defendants’ failure to respond, and the plaintiff’s need to pursue court orders to identify and recover the misappropriated money.

  ---

Background and commercial relationship

Air Liquide Canada Inc. is a Montreal-based corporation supplying and delivering industrial, medical and specialty gases. It owed $221,422.38 to H. Blanchette Ltée, a steel structure and metal work company located in Trois-Rivières, for work previously performed. The relationship between Air Liquide and Blanchette was characterized as a long-standing commercial supplier relationship, in which Air Liquide would typically satisfy its indebtedness by paying Blanchette directly.

The fraudulent email scheme and diversion of funds

In March 2025, Air Liquide received an email that appeared to come from Blanchette. The email advised that Blanchette wished all future payments to be made by electronic transfer instead of by cheque and that its banking arrangements had changed, directing Air Liquide to wire funds to a Bank of Nova Scotia branch in Ottawa. The court described the fraud as “reasonably sophisticated,” noting that the fraudster had to know that funds were due and owing and was able to insert themselves into the existing email chain between Air Liquide and Blanchette. Air Liquide attempted to verify the banking change by contacting Blanchette’s general manager through the email address listed on Blanchette’s website. However, the fraudster intercepted that communication as well and responded in a way that persuaded Air Liquide the new banking information was legitimate. Relying on these representations, Air Liquide wired the $221,422.38 it owed to Blanchette to the Ottawa Scotiabank account specified in the fraudulent correspondence. It later emerged that this account was not owned by Blanchette at all, but was owned or controlled by the defendants, 1001020467 Ontario Corp. and its sole director, Messina Steyn Nkosi. The court held that the defendants had no right to those funds and that it was reasonable to assume they were behind the fraud or, at minimum, its intended beneficiaries.

Discovery of the fraud and freezing of the account

Fortunately, Air Liquide’s bank flagged the transfer as potentially suspicious. On further inquiry with Blanchette, Air Liquide learned that Blanchette had not received the funds and that its email system had been hacked. Although the Bank of Nova Scotia could not return the funds without a court order, it appears to have frozen the Ottawa account, preventing the misappropriated funds from being dissipated. At that point, Air Liquide faced exposure to Blanchette for the unpaid account, and its business relationship with a long-time supplier had been disrupted.

Norwich order and identification of the account holders

To investigate and preserve its recovery rights, Air Liquide sought and obtained a Norwich-type order in January 2026. That order compelled the Bank of Nova Scotia to disclose the identity of the account holder and any other account to which the funds had been transferred. It also authorized substituted service of any subsequent proceedings on the unknown (“John Doe”) account holders by using the email addresses on file with the bank. In response, the bank advised that the funds remained in the Ottawa account and had not been disbursed, and it identified the owners and operators of the account as the defendants named in this action. Armed with this information, Air Liquide commenced the present proceeding in the Ontario Superior Court of Justice.

Linking the defendants to the fraudulent account

The evidence before the court showed that the corporate defendant, 1001020467 Ontario Corp., had been incorporated on September 27, 2024. The individual defendant, Mr. Nkosi, was the corporation’s sole director, and his address for service on the corporate records matched the corporation’s registered office. Bank records demonstrated that Mr. Nkosi opened the Scotiabank account in person and provided his email address as his contact information. The court found that service by email to the address on file with the bank, as authorized under the earlier order, would have come to the defendants’ attention. Since they did not file a defence or communicate with Air Liquide, the court permitted Air Liquide to proceed by way of default judgment. On the pleadings and affidavit evidence, the court concluded there was no legitimate reason why funds owed to Blanchette would be payable to the defendants, and that the fraudulent Blanchette emails pointed to the account holder as either the fraudster or the intended beneficiary of the scheme.

Compensatory and general damages

Having accepted Air Liquide’s evidence, the court ordered restitution of the full $221,422.38 that had been misdirected into the defendants’ account. In addition, the court awarded general damages of $5,000. The judge noted that Air Liquide had been unable to pay Blanchette the funds owed, leading Blanchette to commence its own action in Quebec. The interference with a long-term supplier relationship, coupled with the time and trouble caused to Air Liquide by the fraud and ensuing litigation, justified modest general damages on top of simple repayment of the diverted money.

Punitive damages to denounce cyber-fraud

Air Liquide also sought punitive damages. The judge referred to a recent decision in a very similar cyber-fraud context, Mississippi Mills (Town of) v. 16442676 Canada Inc., and to the analysis adopted in The Bank of Nova Scotia v. Rosario Rosado on punitive awards in fraud cases. The court reiterated that merely ordering the return of fraudulently obtained funds may be inadequate in cases of online fraud, especially where the conduct constitutes “highly reprehensible misconduct that departs to a marked degree from ordinary standards of decent behaviour.” In this case, the deliberate hacking and manipulation of email communications, the targeting of an existing commercial obligation, and the effort to pass off the defendants’ account as Blanchette’s justified a strong denunciatory response. To express society’s condemnation of such cyber-fraud and to deter others from similar schemes, the court awarded punitive damages of $100,000 against the defendants.

Costs on a full indemnity basis and overall outcome

Given the fraudulent nature of the conduct, the defendants’ complete failure to engage with the proceedings, and the necessity for Air Liquide to obtain investigative and procedural relief (including the Norwich order) in order to identify the perpetrators and preserve the funds, the court also granted full indemnity costs. After reviewing the plaintiff’s costs outline, the judge awarded $12,815.33 as full indemnity costs. In the result, the court granted default judgment in favour of Air Liquide Canada Inc. as the successful party, for the return of the $221,422.38 in misdirected funds, $5,000 in general damages, $100,000 in punitive damages, and $12,815.33 in full indemnity costs, for a total monetary award of $339,237.71.