Important Note: This article is for general information and educational purposes only — not legal advice. It draws on the High Court’s oral judgment delivered on 26 August 2026 as reported by The Edge and Free Malaysia Today.
For illustration only
What the High Court’s ruling means for banks, payment systems, and customers making large online transfers
In 2022, Yatt Fatt Auto Supplies Sdn Bhd made an online transfer of RM1.23 million intended for Perodua Sales Sdn Bhd. However, the money never entered Perodua’s account. Instead, it ended up in an unknown third party’s account, and the company spent the next four years trying to recover it.
The company had used Alliance Bank’s Bizsmart online system, which required both the recipient’s name and the account number. Even though the account number it entered did not match Perodua’s account number, the system processed the payment anyway.
On 26 August 2026, the High Court held that the bank could not rely on automation to escape responsibility. Because the system required two identifiers but did not compare them, the bank had failed to exercise the reasonable care and skill expected of a prudent banker. The court ordered Alliance Bank Malaysia Bhd and its subsidiary, Alliance Islamic Bank Bhd, to pay RM1.163 million, with interest and costs.
The ruling does not say banks must guarantee every transfer. It says something narrower: if a bank designs its payment system to require certain information, that information must be meaningful.
What Went Wrong
Yatt Fatt Auto Supplies has been a subscriber of Alliance Bank’s Bizsmart online banking system since 2017. Sometime in May 2022, the company made three transfer payments intended for Perodua Sales Sdn Bhd:
| Date | Amount |
|---|---|
| 24 May 2022 | RM400,000 |
| 27 May 2022 | RM400,000 |
| 30 May 2022 | RM433,224.53 |
However, on 31 May 2022, Perodua informed Yatt Fatt Auto that it had not received the funds. When the company contacted the bank, it was told that the money had already been transferred to another party. No further details were given at that time.
Consequently, Yatt Fatt Auto’s managing director, Datuk Too Peng Huat, lodged a police report. A year later, it was discovered that the money had been transferred to a Maybank account belonging to Banarsi Das Trade, an entity the company did not know and had never dealt with.
The company filed legal action and Maybank Islamic returned RM69,303.53 of the total sum.
The Bank’s Defence
Alliance Bank and its subsidiary defended the claim on the basis that the transactions had been authorised by Yatt Fatt Auto’s own authorised personnel.
The bank argued that:
- The transfers were made using the company’s valid username and password.
- There was no evidence that the Bizsmart system had been compromised.
- The system had processed the payments according to the information supplied by the customer.
- The bank had taken steps to recover the money once it was informed of the error.
In short, the bank’s position was that it had done what a bank was required to do, and that the loss arose from the customer’s own mistake in keying in the wrong account number.
The Court’s Reasoning
Judicial Commissioner Moh Kok Wai accepted that Yatt Fatt Auto’s mistake had set the events in motion. But he held that the company’s loss could not be attributed to that mistake alone.
The court’s reasoning centred on how the Bizsmart system was designed.
The system required two mandatory pieces of information:
- The beneficiary’s name.
- The beneficiary’s account number.
Yet the evidence showed that the system did not compare the two. It did not check whether the name and the account number pointed to the same recipient. It simply processed the payment according to the information provided.
The judge said this was the central problem.
“A bank which chooses to require particular information as part of its payment architecture must take reasonable care to ensure that the information it requires performs a meaningful function.”
The court further held that automation did not reduce the bank’s duty of care.
“Automation may replace the human hand, but it does not replace the law’s insistence upon reasonable care.”
The Decision
The High Court found that Alliance Bank and its subsidiary had failed to exercise the reasonable care and skill expected of a prudent banker.
In the court’s view, that breach materially contributed to Yatt Fatt Auto’s loss. It was not enough for the bank to point to the customer’s mistake. By requiring two identifiers but failing to compare them, the bank had created a system that ignored the very information it demanded.
The two banks were ordered to pay RM1.163 million — the balance of the lost transfer — together with interest at 5% per annum from the date of judgment until full settlement.
Costs of RM50,000 were also awarded.
Practical Takeaways
For banks and financial institutions
- A payment system that requires two identifiers must use them meaningfully. If a bank asks for both a beneficiary name and an account number, its system should at least flag obvious mismatches before the transfer becomes irrevocable.
- Automation does not lower the standard of care. The duty to act as a prudent banker continues even when the human hand is replaced by technology.
- The bank’s own operational practices matter. Evidence that banks ordinarily stop and clarify inconsistent payment details can weigh heavily in court.
For businesses
- Large online transfers should be checked carefully, especially where the recipient’s name and account number are both required.
- If a payment goes missing, act immediately. Notify the bank, request a freeze or recall, and keep written records.
- A customer’s own error may not absolve the bank if the bank’s system failed to detect a contradiction it was designed to catch.
- Preserve all correspondence, bank confirmations, police reports, and system-generated records. These become evidence if recovery fails and litigation follows.
For lawyers and compliance teams
- The case is a useful authority on the duty of care in digital banking.
- It connects bank negligence with system design, not just individual employee error.
- It shows that courts will examine whether required information in a payment system performs a real function or is merely decorative.
- The decision can be used alongside Chan Yan Li to advise financial institutions on monitoring, verification, and customer communication.
A Closing Thought
Yatt Fatt Auto made a mistake by entering the wrong account number, but the bank had built a system that asked for two details and then ignored one of them. That was the problem the court could not overlook.
The case does not say banks must guarantee every transfer or prevent every fraud. It says that when a bank designs a payment system, the information it requires must be meaningful, and automation does not erase the duty of care.
For businesses, the lesson is to double-check large transfers and act quickly if something goes wrong. For banks, the lesson is equally clear: the system itself can become the strongest evidence, and the duty of care follows every design choice.