Voluntary disclosures and the ePayments Code

In the November 2024 edition of the Banking & Finance Law Bulletin, I examined the proposed anti-scam legislation, noting that it did not contemplate any changes to the approach to liability (such as an automatic reimbursement scheme).  That article included passing reference to an AFCA determination[1]  (the Determination) which, by its construction of the ePayments Code, has the potential to have an even greater impact on the allocation of liability for scam transactions.

That determination purported to buttress its construction of the Code by reference to established legal principles concerning “voluntary” conduct.  As discussed below, the legal analysis undertaken was incomplete and the conclusions reached reliant on reasoning expressly rejected by the High Court.

It is accepted that AFCA is by its Rules required have regard to, but is not bound to, follow legal principles.[2]  It is, however, generally undesirable for determinations to incorrectly suggest consistency with legal principle, particularly in circumstances where the legal conclusions reached are contrary to High Court authority.

The Determination

The Determination concerned clause 12 of the Code, which provides that “[a] user must not…voluntarily disclose one or more passcodes to anyone, including a family member or friend”.

The provision is critical to the allocation of liability for loss arising from an unauthorised transaction.  Where an unauthorised transaction is made using a passcode, but it cannot be shown a user has voluntarily disclosed the passcode, clause 11.7(a) of the Code limits a facility holder’s liability for the unauthorised transaction to $150.

In the scenario the subject of the Determination, clause 12 was engaged because one-time passcodes were provided to a scammer in the mistaken belief that they were an employee of the bank, in circumstances where the scammer had deceived the customer into believing that the customer’s funds were in imminent danger.  These circumstances feature commonly in scam transactions.

Approach to construction of clause 12

It is well accepted that the incorporation by reference of industry codes into banks’ contracts with their customers render those provisions enforceable as contracts.[3] It follows that it is appropriate to adopt a contextual approach to ascertaining the meaning of the word “voluntary” when used in the Code.[4]

As observed by Gordon J in Thorne v Kennedy[5] “[t]he word ‘voluntary’ and its cognates are protean expressions which “take their colour from the particular context and purpose in which they are used”.[6]

The Determination referred to a number of authorities that considered the concept of “voluntariness” in a number of different contexts.

AFCA found that the disclosure was not “voluntary” for the purposes of clause the ePayments Code where:

• the environment created by the scammer that gave rise to a state of mind where the complainant thought he was dealing with the bank, and
• the belief that without acting immediately as directed by the scammer, he would lose his funds.[7]

It was found that by reason of these circumstances, the complainant’s “…will was so overborne by the conduct of the scammer and the situation he created that the complainant did not voluntarily disclose the passcodes.”[8]

The meaning of “voluntary”

In reaching the above conclusions, AFCA was required to ascertain the meaning of the word “voluntary” for the purposes of clause 12 of the Code.

AFCA concluded that:

Taking into account the case law, the panel is of the view the term “voluntarily”, as it used in the Code, encompasses situations where a person has disclosed a passcode through the exercise of free choice, and where that person’s will has not been overborne by pressure, duress, inducement or other factors.

This formulation closely follows the test for “basal voluntariness” articulated by Dixon J in McDermott v R[9] as restated in R v Lee[10] as follows:

…a statement may not be admitted in evidence unless it is shown to have been voluntarily made in the sense that it has been made in the exercise of free choice and not because the will of the accused has been overborne or his statement made as the result of duress, intimidation, persistent importunity or sustained or undue insistence or pressure, and…such a statement is not voluntary if it is preceded by an inducement, such as a threat or promise, held out by a person in authority, unless the inducement is shown to have been removed. (my underlining)

The above tests were more recently examined by the High Court in Tofilau v The Queen.[11] It is unfortunate that Tofilau was not considered by AFCA (or, if it was, not addressed in the Determination) because:

1. it considered a factual matrix that, conceptually, closely resembles the scam considered by the Determination; and
2. the plurality in Tofilau considered, and rejected, the proposition that underpinned AFCA’s reasoning in the Determination, namely that a deception was, without more, a sufficient basis upon which to render an act “involuntary”.

Voluntariness and Tofilau

Tofilau dealt with the Canadian technique of obtaining a confession by an elaborate deception whereby typically:

1. A suspect is drawn into a “criminal gang” by undercover officers posing as criminals. The “gang’s” activities (in which the suspect participates) escalate over time;
2. The suspect is told the former police investigation has been reactivated and new evidence has been uncovered; and
3. The suspect is told that their past crime will bring “heat” on the gang, but the gang can make the matter go away, if the suspect confesses.

The very obvious similarities between the above factual matrix and the scam considered in the Determination are that both involved scenarios that were completely fabricated, meaning that the pressure brought to bear on the “volunteer” came about wholly by deception.

Deception alone is insufficient to establish involuntariness

The plurality in Tofilau surveyed a number of authorities relied on by the appellants as standing for the proposition “that the ‘conduct of a person who has been deceived is in an important sense not voluntary: the behaviour is, to the extent it is governed by the deception, not under the control or the choice of the actor’”. Their Honours found[12] that “[t]hat reasoning is unsound in relation to the ‘basal involuntariness’ doctrine” and that[13] “It may be accepted that if the accused’s will has been overborne in the sense in which that word is used in the Australian authorities, any resulting confession is involuntary. It does not follow that an accused’s will is overborne merely by reason of misrepresentations.”

Their Honours concluded[14] that:

“While it is possible to conclude that there has been basal involuntariness in circumstances which include the fact that the accused has been deceived, the mere fact of deception is insufficient in itself to justify a conclusion of basal involuntariness.”

The disclosure of the passcodes considered by the Determination was brought about entirely by deception.  It is contrary to the High Court’s findings in Tofilau, and otherwise doctrinally unsound, to proceed on the basis that deception alone can give rise to an overbearing of the will of a person so as to render an act involuntary.

Inducement

The status of inducement as a matter capable of rendering the disclosure of a passcode involuntary was also undermined by the High Court in Tofilau.

The law of evidence provides that for an inducement to vitiate a voluntary confession, it must be made by a “person in authority”.  The person in authority must be a person exercising the coercive power of the state.

The majority in Tofilau rejected attempts by the lawyers for the accused to extend the concept of a person authority to individuals who (because they were posing as gangsters) the accused did not believe were organs of the state.

Such an extension was observed not to be a “minor modification” to the requirement, but rather went “very close to abandoning any ‘person in authority’ requirement” and “annihilating the distinction between inducements offered by persons in authority as traditionally understood and inducements offered by anyone at all.”[15]

The High Court’s analysis in Tofilau confirms, therefore, that the suggestion that an inducement offered by a fraudster is capable of overbearing the will of a person such that the disclosure of a passcode is not “voluntary” represents a significant departure from settled legal principles.

Basal involuntariness

The plurality in Tofilau carefully analysed Dixon J’s formulation (closely followed by AFCA in the Determination) of basal involuntariness.  Their Honours observed that Dixon J “drew a distinction between confessions made in the exercise of free choice and those made by persons whose will was overborne” and that “[t]he examples he gave of an overbearing of the will – ‘duress, intimidation, persistent importunity, or sustained or undue insistence or pressure’ – are instructive, for they are restricted.”[16]

As to duress, their Honours observed that when McDermott was decided, the concept of duress was limited to the use or threat of violence or imprisonment, and (importantly) did not include economic duress.  As to the other examples referred to, their Honours found that “[e]ven though these examples selected by Dixon J are not exhaustive, his use of them points to a relatively narrow ambit for ‘basal involuntariness’”.[17]

Overbearing of the will

AFCA’s conclusion that a disclosure which occurs where there has been an overbearing of the disclosing party’s will is undoubtedly correct, and consistent with authority.  As outlined above, however, that will not follow from a deception alone, nor (in a scam scenario) an inducement.

A difficulty also arises with respect to the second of the circumstances (duress) referred to in AFCA’s formulation of involuntariness.  The rejection of duress as giving rise to an overbearing of the will was made clear by McHugh JA in Crescendo Management Pty Ltd v Westpac Banking Corp,[18] in which his Honour rejected “the overbearing of the will theory of duress”, on the basis that “[a] person who is the subject of duress usually knows only too well what he is doing. But he chooses to submit to the demand or pressure rather than take an alternative course of action.”[19]

How is it established that a person’s will is overborne?

In Thorne[20] it was observed by the majority that “[t]he question whether a person’s act is “free” requires consideration of the extent to which the person was constrained in assessing alternatives and deciding between them”.

Later in the Court’s reasons, Gordon J undertook a more detailed survey of the relevant authorities and the manner in which a court approaches the task of ascertaining (in the context of the doctrine of undue influence) whether the will of a party is not independent and voluntary because it is overborne. As her Honour emphasised, the focus of the enquiry is a person’s “capacity to exercise independent judgment”.[21] Some relationship, or circumstances surrounding the transaction, must be shown to have impaired the autonomy of the weaker party to a serious and exceptional degree. The assessment of a set of circumstances is fact-specific.[22]

In Thorne, the circumstances bearing upon the appellant’s capacity to make a free choice (including lack of financial equality and reliance on the other party) were all real, not imagined.

Conclusion

While the approach taken in the Determination has been subsequently applied in at least one other case,[23] the AFCA Rules do not compel decision makers to follow the approach taken in it to the construction of the Code.[24] It would be desirable for AFCA’s subsequent consideration of the meaning of “voluntary” for the purposes of the Code to squarely address the analysis in Tofilau and its application to the voluntary disclosure of passcodes where that disclosure has been procured wholly by deception.