Court File and Parties

COURT FILE NO.: CV-23-00696470-0000 DATE: 20230515 SUPERIOR COURT OF JUSTICE - ONTARIO

RE: LIGHTSPEED COMMERCE INC. and LIGHTSPEED PAYMENTS USA INC. AND: NURZAN NAJEEBDEEN, SPICE NADU INC., ECO CARE MAINTENANCE INC. and J. DOE CARDHOLDERS

BEFORE: Justice A.P. Ramsay

COUNSEL: Philip Holdsworth, for the Plaintiffs

HEARD: April 20, 2023

Endorsement

A. Overview

[1] The plaintiffs claim the defendants have exploited and taken advantage of loopholes in its payment platform. The underlying action relates to two fraudulent sales schemes, namely a credit card and refund scheme, alleged to have been perpetrated by the defendants on the plaintiffs in 2022. The scheme involved a series of chargebacks on fraudulently processed credit cards and unauthorized transfers, or refunds to cardholders whose identities are still unknown. The plaintiffs claim there were two separate frauds, the first being the sales fraud, which occurred between September and November 2022, amounting to approximately $293,802.20 of the damages claimed, and the refund fraud, occurring between December 2 and 6, 2022, amounting to $6,501,376.79.

B. Nature of the Motion

[2] The plaintiffs bring an ex parte motion, on an urgent basis, for a Mareva injunction against the defendants, Nurzan Najeebdeen (“Mr. Najeebdeen”), Spice Nadu Inc. (“Spice Nadu”), and Eco Care Maintenance Inc. (“Eco Care”). They further seek a Norwich order, directing third party financial institutions to disclose information about the J. Doe Cardholders, and to return funds intercepted by the third parties. I granted the motion, with reasons to follow.

C. Background

[3] Lightspeed Payments USA Inc. is a subsidiary of Lightspeed Commerce Inc. (collectively “Lightspeed”). Lightspeed is a digital commerce payment processing company offering software services for retail merchants, and payment processing products. Lightspeed’s payment processing products are integrated with Lightspeed’s other software services and provided through a commercial partnership with other third-party payment processing companies including Stripe Payment Canada Inc. (“Stripe"). Stripe enables access to the Automated Clearance Settlement System (ACSS) operated by Payment Canada to clear payments through the banking system in Canada.

[4] In early 2022, Mr. Najeebdeen signed on to access Lightspeed’s payment services under the company name of Eco Care and processed small consistent payments for several months under that account. Between August 26, 2022, and September 13, 2022, 22 sales transactions totaling $205,372.65 were processed on the Eco Care account with an indication that the card was not present. These transactions were then subject to charge backs; that is to say, the cardholders disputed the sale transactions. Lightspeed submits that this transaction is known in the payments risk industry as a “bust-out” sales scheme. Cardholders have disputed 22 of the 26 “card not present transactions” totaling $182,957.01. On the evidence, the ACSS chargeback process triggers an automatic recovery of the funds through Lightspeed’s payments product, out of the merchant (defendants) connected bank account. The Eco Care bank account was emptied of the funds received before the chargebacks were triggered, causing Lightspeed to fund the chargebacks to the cardholder’s accounts at their respective issuing financial institutions, in an amount totaling $167,241.69. Lightspeed has attempted to verify the authenticity of the transactions, but the evidence indicates the transactions were not validated. Lightspeed closed the account down.

[5] On September 26, 2022, Mr. Najeebdeen opened a second account under the name of the corporate defendant, Spice Nadu, as the merchant contracting party. Lightspeed was not immediately aware that Mr. Najeebdeen was the same individual behind this company, and it therefore initially processed a number of transactions. In November 2022, a similar situation arose whereby a large number of transactions were processed with an indication that the card was not present. Between November 26 and November 30, Spice Nadu attempted to process 43 transactions where the card was not present. On November 30, 2022, Lightspeed contacted Mr. Najeebdeen and sought information to substantiate and explain the transactions. Lightspeed requested and received some documents from Mr. Najeebdeen which it determined were fraudulent. Lightspeed terminated the Spice Nadu account. Lightspeed argues that the same situation unfolded with Spice Nadu wherein transactions that were processed began receiving chargebacks.

[6] In addition, as of December 2, 2022, Spice Nadu’s account was still able to process refunds credited to a card for which there was no corresponding debit entry in Lightspeed’s system, which Lightspeed refers to as “unreferenced refunds”. The evidence suggests that this was a vulnerability not identified at the time. Mr. Najeebdeen processed 131 unreferenced refunds through Spice Nadu’s account in a four-day period totaling $6,501,376.79. The funds were drawn automatically from Lightspeed’s accounting system. Lightspeed has identified the financial institutions to which the transfers were made and the respective accounts. Stripe was able to intercept and reverse $2,842,688.43 through the ACSS before the funds settled into the J. Doe Cardholders’ account. The evidence before me indicates that $3,658,688.36 has settled through the ACSS into the financial institutions’ internal accounts.

[7] The financial institutions have notified the plaintiffs that they were able to intercept and hold certain funds from settling into the J. Doe Cardholders accounts, but they require a court order to identify and return the funds.

D. Analysis

[8] Pursuant to s. 101 of the Courts of Justice Act, R.S.O. 1990, c. C.43, the court has discretion to grant an interlocutory injunction where it appears just or convenient to do so, and the court may include such terms as are considered just. In this case, there is strong evidence before the court of fraud by the defendants, perpetuated by Mr. Najeebdeen via the two corporate vehicles, Spice Nadu and Eco Care. In 2092280 Ontario Inc. v. Voralto Group Inc., 2018 ONSC 2305, at para. 28, the Divisional Court commented that “(t)he Mareva injunction is an important tool for Plaintiffs to try and recover their losses due to fraud or theft.”

[9] The plaintiffs must establish: (a) a strong prima facie case; (b) that they would suffer irreparable harm if the injunction were not granted; and (c) that the balance of convenience favours granting the injunction: Chitel v. Rothbart (1982), 39 O.R. (2d) 513 (C.A.); Petro-Diamond Inc. v. Verdeo Inc., 2014 ONSC 2917, 13 C.B.R. (6th) 211, at para. 25. In Chitel, the Ontario Court of Appeal articulated several guidelines which a plaintiff should adhere to in the evidence to be presented to the court as follows:

a) the plaintiff must make full and frank disclosure of all matters which are material for the judge to know;

b) the plaintiff must provide particulars of the claim against the defendant, stating the grounds of the claim and fairly stating the points made against the defendant;

c) the plaintiff should give some grounds for believing that the defendant has assets in the jurisdiction;

d) the plaintiff should give grounds for believing that there is a risk of the assets being removed before the judgment or award is satisfied; and

e) the plaintiff must give an undertaking as to damages.

[10] On the evidence, the plaintiffs have a strong prima facie case on the merits. There is a pattern of conduct exhibited by Mr. Najeebdeen involving putting through sales transactions which were logged as “card not present” transactions. These transactions allowed credit card holders to challenge the transactions, funds to be returned to the cardholder, and for the defendants to remove the funds from the defendants’ bank accounts. Mr. Najeebdeen used Spice Nadu’s account to process $6.5 million in refunds without there being any corresponding sales transaction.

[11] A review of the materials indicates a link between the defendants and the fraudulent transactions. Lightspeed has identified two of the defendants’ bank accounts into which funds said to be part of the sales fraud were deposited and has identified unauthorized transfers of funds to credit card accounts, owned or controlled by, or suspected to be owned and controlled by the defendants. With the help of Stripe Payments, some of those funds were intercepted and reversed. There is a significant amount of funds that are in limbo, with some settling on the J. Doe Cardholders credit card. While Lightspeed suspects those accounts are also owned and controlled by the defendants, the identity of the cardholders is really still unknown.

[12] In the statement of claim, the plaintiffs allege fraud, knowing receipt, conversion, and unjust enrichment as against the defendants and the J. Doe Cardholders. The plaintiffs have identified assets of the defendant in addition to information made available due to the business relationship.

[13] The jurisprudence establishes that irreparable harm is harm which either cannot be quantified in monetary terms, or which cannot be cured, usually because one party cannot collect damages from the other: RJR-MacDonald Inc. v. Canada (Attorney General), [1994] 1 SCR 311, at p. 341; Christian-Philip v. Rajalingam, 2020 ONSC 1925, at paras. 33-34.

[14] In Sibley & Associates LP v. Ross, 2011 ONSC 2951, 106 O.R. (3d) 494, at para. 63, Strathy J. (as he then was) found that “the risk of removal or dissipation of assets can be established by inference, as opposed to direct evidence, and that inference can arise from the circumstances of the fraud, itself.” On the evidence, I am satisfied that absent the assistance of a Mareva injunction against the defendants, it is not clear that the plaintiffs will be able to collect an eventual judgment. As noted by Strathy J., in Sibley, at para. 62:

[…] On the other hand, there may be circumstances of a particular fraud that give rise to a reasonable inference that the perpetrator will attempt to perfect the deception by making it impossible for the plaintiff to trace or recover the embezzled property. To this extent, it seems to be that cases of fraud may merit the special treatment they have received in the case law

[15] The risk of asset flight or dissipation can be reasonably inferred from the material facts supporting a strong prima facie case of fraud: Wallace v. Pristine Developments, 2021 ONSC 2794, at para. 29. On the evidence before me, I infer that there is a real risk of dissipation of assets given the lengths Mr. Najeebdeen went to in order to carry out the scheme, including the setting up of a new company when his deceitful activities were discovered. He then took advantage of the loophole with Stripe which was created when Lightspeed attempted to terminate his account. Lightspeed has established, on the evidence, that Mr. Najeebdeen was able to process so called refunds without the requirement of a corresponding purchase transaction on the merchant’s account. Schedule C of the plaintiffs’ factum sets out a log of all the unreferenced refunds.

[16] On the evidence, there is a reasonable inference that Mr. Najeebdeen will attempt to perfect his fraud and deception putting the funds beyond the reach of Lightspeed. As Lightspeed argues, at least $3.66 million of the funds have been dissipated. In the circumstances, there is a significant risk that Lightspeed will suffer irreparable harm.

[17] The balance of convenience favours granting the interim Mareva injunction for the reasons stated above; the plaintiffs may ultimately be deprived of any asset against which to enforce a judgment given the nature of the fraud.

[18] Aside from the factors set out in Chitel, I find that it is just and convenient to grant the Mareva injunction. I am mindful that there is no responding evidence from the defendants. The plaintiffs are obliged to make full and fair disclosure. Counsel for the plaintiffs submit that Mr. Najeebdeen was asked for an explanation but submitted fraudulent documents. The plaintiffs have identified the assets with some precision and have given an undertaking as to damages.

E. Order for a Norwich Order

[19] The plaintiffs submits that a Norwich order is required to identify the funds which escaped the financial institutions which received them, identify the identity of the J. Doe cardholders who received funds, and disclose the status of intercepted funds. Counsel for the plaintiffs submit that it is not known how much of the funds settled into the account of the J. Doe Cardholders or are caught in limbo in the banking system. Counsel submits that the big five banks are involved, and the banks have indicated that a court order is required.

[20] A Norwich order is an equitable remedy of pre-action discovery which requires a third party to a potential action to disclose information that is otherwise confidential. Section 96(1) of the Courts of Justice Act, which provides that the "[c]ourts shall administer concurrently all rules of equity and common law" governs the court’s jurisdiction to make the order sought. The principles are articulated in Norwich Pharmacal Co. v. Comrs. of Customs and Excise, [1973] 2 All E.R. 943 (H.L.).

[21] In determining whether to grant the order sought, the moving party must satisfy the court that the discovery sought is for a legitimate purpose. In GEA Group AG v. Ventra Group Co., 2009 ONCA 619, 96 O.R. (3d) 481, at para. 91, Cronk J.A., speaking for the court explained: “The information sought may be needed to obtain the identity of a wrongdoer (as in Norwich Pharmacal), to evaluate whether a cause of action exists (as in P. v. T.), to plead a known cause of action, to trace assets (as in Bankers Trust and Leahy), or to preserve evidence or property (as in Leahy).” The factors to be considered by the court in determining whether to grant the order sought are set out in GEA Group AG, at paras. 62 and 91 and 1654776 Ontario Limited v. Stewart, 2013 ONCA 184, 114 O.R. (3d) 745, at paras. 47-59, leave to appeal ref’d, [2013] S.C.C.A. No. 225; Isofoton S.A. v. Toronto Dominion Bank (2007), 85 O.R. (3d) 780 (S.C.), at para. 40; and Bluemoon v. Ceridian, 2022 ONSC 301, at paras. 28-31, aff’d 2022 ONCA 868.

[22] Having regard to those factors, I am satisfied that the plaintiffs have provided sufficient evidence to raise a valid claim. The plaintiffs have established a relationship between the financial institutions and the J. Doe Cardholders accounts where funds were transferred. The funds can therefore be traced to the financial institutions identified by the plaintiffs. The plaintiffs have already added the J. Doe Cardholders as party defendants, but their identity is unknown. The information regarding the identity of the cardholders and the status of the funds is confidential, and the financial institutions are the only practicable source of the information. The interests of justice favour the obtaining of the disclosure sought.

[23] In the circumstances, it is appropriate to grant this exceptional remedy on the terms that the order is restricted to the J. Doe credit cards or accounts where funds have been traced, settled, or to disclose the status of the funds in limbo.

F. Conclusion

[24] The order to go is revised and already signed by me.

Justice A.P. Ramsay Date: May 15, 2023