$6.2m term deposit scam claim against a bank: plead the missing safeguards before discovery

In Solomon v Bendigo & Adelaide Bank Limited [2026] NSWSC 1301, the Supreme Court of New South Wales (Parker J, Equity Division, Commercial List) dealt with a customer's application for discovery (court-ordered disclosure of documents) in her claim against her bank over $6.2 million lost in a fake term deposit scam. The result was that the judge refused two disputed categories of internal bank documents in their current form, told the bank to reconsider its denials, and held that the customer must first amend her pleading to say what the bank, as an institution, should have done. The important point is that a negligence claim against a bank must identify specific, forward-looking safeguards. A list of questions that, in hindsight, might have exposed one particular scam is not enough. All paragraph references below are to the judgment.

Why it matters: This is an interlocutory ruling (a decision made along the way, before trial) about pleadings and discovery. The Court made no finding that the bank was negligent or liable, and the customer's allegations have not been tested. What the case does show is how a court expects a bank-scam claim to be framed before the bank has to open its internal files ([79]–[80]).

At a glance

• Court and level: Supreme Court of New South Wales, Equity Division, Commercial List (first instance)
• Area of law: Civil procedure (discovery and pleadings); negligence and contract claims against a bank
• Decision type: Interlocutory ruling on a notice of motion for discovery
• Outcome: Disputed Categories 1 and 1A not permitted in their present form; the bank to reconsider its pleaded denials; the customer to file a further amended pleading; interrogatories ordered; the discovery motion stood over ([64], [80], [82]–[86])
• Standard applied: Whether the documents sought are relevant to the issues as pleaded, and whether the categories are clear enough to comply with ([47], [50]–[58])
• Costs: Not dealt with in the judgment

🧩 Facts and Issues

Background

The plaintiff, a customer of Bendigo & Adelaide Bank ("the Bank"), sues for compensation for the loss of $6.2 million in an investment scam ([1]). She is 97, and her son managed her dealings with the Bank as her authorised signatory ([2]).

The following facts are as alleged and untested ([3]). In early 2024, while researching rates for a maturing term deposit, her son was emailed by scammers posing as a large international bank, using an entire fake banking website ([4]–[7]). They offered a six-month term deposit at 6 per cent, payable into an account at another bank, apparently opened by the scammers in the names of the son and his mother ([7], [10]). On 16 April 2024 the son attended a branch and a teller processed the $6.2 million transfer, allegedly checking only the account name, BSB and number ([11]–[13]). The scam was discovered on 30 April; only about $500 was recovered ([14]).

In March 2024 the Bank had published a warning, "Term Deposit Scams on the Rise", describing this type of scam ([15]–[16]).

How the case got here

The plaintiff sued in October 2025, claiming the money in debt, or alternatively damages for breach of contract or negligence ([17]). Her discovery motion was filed in April 2026; after the judge raised pleading problems, both sides amended, and this judgment deals with three disputed categories ([18]–[19]). Orders were settled after a hearing on 21 October ([84]–[85]).

What each side argued

• The plaintiff's central allegation is that the Bank was negligent in processing the transfer without taking further precautions, such as asking more questions, verifying the recipient account and warning about scams, which she says would have uncovered the scam ([20]–[21], [27]).
• The case is pleaded as institutional negligence: a failure by the Bank to devise and implement proper procedures, not a personal failure by the teller ([28]).
• The Bank argued the categories were too broad and imprecise, and that its internal views on what precautions to adopt were irrelevant because breach of duty is judged objectively ([32], [45], [50], [56]).
• The plaintiff answered that broad requests were unavoidable, and that internal procedures showed what precautions were feasible and at what cost ([33], [46]).

The issues

• Should the Bank have to produce board, fraud-team and other documents about term deposit scams (Category 3)?
• Should it have to produce its internal procedures for questioning, verification and warnings (Category 1), and documents about whether those procedures were adequate (Category 1A)?
• Was the claim pleaded clearly enough for those categories to be settled?

⚖️ Applicable Law – Legislation, Rules and Principles

• Discovery is limited to documents relevant to the pleaded issues, in categories clear enough to comply with ([31], [43], [50]).
• Breach of duty is judged objectively; a defendant's own opinions are generally irrelevant ([45]–[46]).
• The "Shirt calculus" weighs the likelihood and seriousness of harm against the burden of precautions ([43]).
• A plaintiff must specify what the defendant should have done ([65]–[66]).
• Breach is assessed looking forward, not with hindsight, including for economic loss ([69]–[72]).

📌 Authorities Relied On

• Wyong Shire Council v Shirt: how breach is assessed ([43]).
• Dovuro Pty Limited v Wilkins: breach is judged objectively (relied on by the Bank) ([45]).
• State of NSW v T2 [2025] NSWCA 165: internal procedures may be relevant (relied on by the plaintiff) ([46]).
• Pyrenees Shire Council v Day and Metropolitan Gas Co v Melbourne Corporation: the plaintiff must say "affirmatively what should have been done"; hindsight is not the test ([66], [69]).
• Vairy v Wyong Shire Council, Romeo, Dederer and Adeels Palace: breach is judged prospectively ([70]–[72]).
• State of New South Wales v Briggs: a diffuse risk calls for a procedure applied across the board ([73]).

🧠 Analysis

Issue

Whether the disputed discovery categories should be ordered, and whether the pleading identified the Bank's alleged failures clearly enough for discovery to be framed around them.

Rule

Discovery follows the issues on the pleadings. In an institutional negligence claim, those issues include what procedures the institution should have adopted, judged prospectively and objectively under the Shirt calculus ([43], [65]–[72]).

Application

Institutional knowledge, not every employee's inbox

On Category 3, the judge said the relevant knowledge is the Bank's institutional knowledge: information that was, or reasonably could have been, available to the decision makers responsible for the internal procedures. Information casually acquired by an employee would not usually qualify ([35]). Only information available by the date of the transfer was relevant, so the request to 30 June 2024 went too far, though later documents recording earlier information could still be sought ([36]).

The Bank's blanket denial was the real problem

The judge also found that the Bank was in a real sense responsible for the breadth of the request, because it denied outright that it knew of term deposit scams ([37]). The judge did not understand how that denial could "seriously" be maintained, given that the Bank's own March 2024 warning reflected that knowledge ([38]). The Bank was directed to review its position and reconsider its response, which would narrow the real dispute ([39]). Counsel for the Bank also accepted that it could hardly deny a general awareness that customers were at risk from scammers, so its denial of the pleaded "Risk of Harm" will also need amending ([82]–[83]).

Internal procedures can be relevant, but opinions about them usually are not

The judge accepted that the Bank's internal procedures, and its deliberations about them, are capable of being relevant to the feasibility and cost of precautions, so Categories 1 and 1A could not be rejected on relevance alone ([47]). Documents about the "adequacy" of procedures, however, would mostly contain opinions, which are not themselves relevant ([48]).

Hindsight questions cannot be matched to pre-existing guidelines

The deeper problem was the wording. The pleaded precautions were questions, checks and warnings tailored to the specific branch interaction on the day ([55]). No guideline written before then would have been that specific, so deciding whether a guideline required a question "of [its] type" would be a matter of interpretation and an unreasonable burden ([58]). The verification steps were obscure ([59]), and adding guidelines that merely "recommended" or "suggested" a step created further uncertainty. A discretionary step would not necessarily have avoided the loss ([62]–[63]). The judge refused Categories 1 and 1A in their present form ([64]).

The pleading did not say what the Bank should have done

The judge then identified a more fundamental flaw. A plaintiff must say what should have been done, both to test causation and to apply the Shirt calculus ([65]–[68]). The Bank faced a "diffuse" risk: it could not know in advance which customers were being targeted, so the question was what procedure could be applied by every teller to every customer ([73]). The pleading instead worked backwards from what happened, which was "a hindsight analysis" ([74]). Asking whether the customer's representative was "comfortable" with the transfer, for example, was unlikely to change anything when he had been completely taken in ([76]). The plaintiff's case presumably had to be that tellers should not process specified classes of transaction without specified confirmations or checks, but apart from a "question-begging" reference to a "large" transaction, the pleading said nothing about that ([77]–[78]). The pleading therefore failed to say "what should have been done", institutionally, by the Bank ([79]).

Conclusion

Further amendment of the plaintiff's pleading is the first step. Once the precautions are properly identified, new versions of Categories 1 and 1A, including documents recording the decision makers' deliberations, can be formulated ([80]). Any "scam awareness conversation" theory also needs its content pleaded ([81]). None of this decides whether the Bank breached any duty.

🏛️ Outcome, Orders and Costs

• Order 1: the Bank must answer interrogatories (written questions answered on oath), verified by affidavit, by 28 October 2026. They ask whether, as at 16 April 2024 or alternatively 1 May 2024, it had any policy or document about asking customers certain questions or conducting a "scam awareness conversation", and if so, details of each document ([85]–[86]).
• Order 2: the plaintiff must serve a Further Amended Commercial List Statement (her amended statement of claim) by 6 November 2026 ([86]).
• Order 3: the discovery motion was stood over to 12 November 2026 to consider any objections by the Bank to the new pleading and for further directions ([86]).
• The Bank's response is also to be further amended, including on the knowledge issue ([85]).
• Costs were not dealt with in the judgment. The claim itself remains undecided.

🧭 Practical Lessons

• For self-represented litigants: Discovery is tied to what you have pleaded. If your claim does not say clearly what the other side should have done, the court may send you back to fix it before ordering documents ([79]–[80]).
• For practitioners: Plead the specific procedures, classes of transaction and preconditions the bank should have adopted, so that causation and the Shirt calculus can be assessed ([77]–[78]).
• For practitioners: Limit knowledge categories to institutional knowledge held by the relevant decision makers, and to the date of the transaction ([35]–[36]).
• For practitioners: A blanket denial of matters your client has published itself can backfire, by justifying wide discovery and inviting criticism from the court ([37]–[39]).

🧠 Take-Home Lesson

• Plead what the bank should have done as an institution, before the loss, in specific terms.
• Discovery follows the pleading; broad requests built on hindsight will be cut back.
• The Court has not found the bank liable. The case is about framing the claim, not its outcome.

"Hindsight is not a pleading. Say what the bank should have had in place, then ask for its files."

This digest is general information about a published judgment, not legal advice. For advice about your own situation, speak to a lawyer, Legal Aid or a community legal centre.