Email Consultation
Fictional scene
← Back to InsightsTaiwan Criminal Litigation ColumnsLegal Information

Hacked Forex Account, Broker Overseas, Home in Taipei: Who Answers Under Taiwan Law

6 min read

Fictional scene

Who pays when someone else's login empties a forex account that a Taipei resident holds with a broker in another country? Rarely the intruder. Repayment, if it comes, comes from the broker or from the company hosting the server that ran the trading software, and Taiwan law reaches them through the account terms first. The intruder is a matter for a criminal complaint, which runs on a short clock.

The broker and the server host: what the account terms decide

With a foreign broker or hosting company, two questions follow, and they are separate.

Which law applies? For contract claims, Article 20 of the Act Governing the Choice of Law in Civil Matters Involving Foreign Elements follows the law the parties chose. A US broker's terms that pick New York law, for example, would be the starting point even before a Taiwan court. Without a choice, the court looks for the law most closely connected to the contract, presumed to be the law of the domicile, at the time of the act, of the party whose performance characterizes the deal. Tort claims default to the law of the place of the tort under Article 25, unless another law is more closely connected.

Which court? Article 2(3) of the Code of Civil Procedure sends suits against a foreign legal person to the court where it keeps its principal office or place of business in Taiwan. Article 15 lets tort suits be brought where the act occurred. A forum clause in the terms will be read alongside both. Suing at home is the other path; a foreign judgment can then be enforced against assets in Taiwan only after a Taiwan court grants an enforcement judgment, which requires that no Article 402 ground, including lack of reciprocity, applies (Compulsory Enforcement Act, Article 4-1).

Taiwan's licensing rule sits in the background

Taiwan residence brings a licensing question with it. Article 3 of the Futures Trading Act counts leveraged margin contracts, where one side pays a fraction of the price and the difference is settled later, as futures trading. In a May 28, 2020 press release, the Financial Supervisory Commission said forex margin trading is futures trading under the Act and should go through licensed domestic firms.

A foreign futures commission merchant needs Taiwan recognition and a license (Article 56), and a forex margin dealer needs a leverage-dealer license (Article 80); operating without one is a crime on the firm's side under Article 112(5). The customer has a rule too. Article 105 says no one may place futures trades through an unlicensed person, and Article 119(1)(1) attaches an administrative fine of NT$120,000 to NT$2.4 million. The Act does not single out accounts opened abroad before a move, so an account opened in the United States is judged on its own facts: what is traded, and through whom.

After a hack, the licensing gap also shuts doors. The Commission's September 8, 2023 press release states that trades through unlicensed offshore securities platforms are outside the Securities Investor and Futures Trader Protection Act and the Financial Consumer Protection Act. The mediation and ombudsman routes described in our column on Taiwan brokerage disputes assume a licensed Taiwan firm.

The intruder: a criminal complaint on a six-month clock

What if the attacker is abroad? Article 4 of the Criminal Code treats an offense as committed in Taiwan when either the act or the result occurs there. Picture a broker whose servers sit in the United States and a password lifted from a laptop in Taipei (an invented example). The server is abroad; the laptop is in Taiwan. Which of those facts fixes the place of the act or the result is decided case by case. Whatever the licensing position, the person whose account was emptied keeps the right to complain as a crime victim (Code of Criminal Procedure, Article 232).

Logging in without authorization with another person's account name and password, or breaking a protection measure to enter their computer, is an offense under Article 358: up to three years' imprisonment or detention, or a fine of up to NT$300,000, or both. Obtaining, deleting or altering someone's electronic records without cause and causing damage falls under Article 359, with up to five years' imprisonment or detention, or a fine of up to NT$600,000, or both. Interference by computer program is Article 360.

All three are complaint-only offenses. Article 363 says so, and that means no prosecution without a victim's complaint. Article 237 of the Code of Criminal Procedure gives six months from the moment the victim learns who the offender is. Not from the day the balance hit zero.

Money moved out to an account the attacker controls changes the picture. Article 339-3 punishes obtaining another person's property, with intent to gain unlawfully, by feeding false data or improper commands into a computer to create records of property rights, with up to seven years' imprisonment, an optional fine of up to NT$700,000, and attempts included. It is not on the Article 363 list, so the six-month limit does not apply.

Complaints may be made in writing or orally to a prosecutor or a judicial police officer (Code of Criminal Procedure, Article 242). How settlement and withdrawal interact with the six-month window is covered in our column on settling and withdrawing complaints in injury cases; the same rules apply to complaint-only offenses.

Civil liability runs alongside. Where Taiwan law governs the tort under Article 25, Civil Code Article 184 makes anyone who intentionally or negligently and unlawfully injures another's rights liable for damages. A lawsuit, though, needs a defendant with a name.

A Taiwan lawyer can draft the criminal complaint and organize the evidence, read the broker's and host's terms for choice-of-law and forum clauses, assess whether to claim in Taiwan or abroad, and review whether the trading itself raises a Futures Trading Act issue. Consultations with an English-speaking lawyer in Taipei are available through Hovering International Law Firm at wei@hoveringlaw.com.tw; see also our criminal matters page. Taipei office: 7F-2, No. 35, Sec. 1, Chengde Rd., Datong Dist., Taipei City 103 (臺北市大同區承德路一段35號7樓之2).

The login records, the attacker's messages and the broker's replies are what fix the date the offender became known. In a complaint-only case, that date controls the deadline.

Sources

Checked October 26, 2026.

Frequently Asked Questions

I still don't know who hacked me. Has Taiwan's six-month complaint deadline started?
Probably not for the complaint-only offenses. Article 237 of the Code of Criminal Procedure runs six months from the time the person entitled to complain learns who the offender is, and that rule covers unauthorized access and record tampering under Articles 358 to 360 of the Criminal Code. A missing legal name alone does not decide it: if you can already identify the person, the clock may be running. Computer fraud under Article 339-3 is not complaint-only and has no such period.
My broker's terms pick New York law and New York courts. Can I still sue in Taiwan?
The clause will be argued, but it is not the only rule in play. Article 20 of the choice-of-law act starts from the law the parties chose. On the forum, Article 2(3) of the Code of Civil Procedure looks to a foreign company's principal office or place of business in Taiwan, and Article 15 allows tort suits where the act occurred. A New York judgment would need a Taiwan enforcement judgment, granted only if no Article 402 ground applies, before it could be enforced against assets in Taiwan.
Can I sue the hacker in a Taiwan civil court?
Where Taiwan law governs the tort under Article 25 of the choice-of-law act, Civil Code Article 184 makes anyone who intentionally or negligently and unlawfully injures another's rights liable for damages. A civil suit still needs an identified defendant, so the claim usually waits until the intruder has a name.

This article provides general information and is not legal advice on any individual matter.

Related reading