Who is Responsible for Business Email Compromise?

Trying to work out who is responsible for business email compromise is an increasing problem for Australian businesses and their customers.

Who is at fault (also known as being ‘liable’) when a business’s email system is compromised by hackers, bank details manipulated and a customer pays money to the hacker, rather than the business?

This article explains who is responsible for business email compromise and what you can do if you have been the victim of business email compromise.

Author: Farrah Motley, Director of Prosper Law and an online lawyer.

Want to skip ahead?

This article will take you through the legal liability of business email compromise in Australia. You can skip ahead by clicking the links below.

• The Problem of Business Email Compromise
• What is ‘Business Email Compromise’
• The law that is relevant to Business Email Compromise
• Who is legally responsible for a ‘spoofed’ email?
• Who is legally responsible for a hacked email?
• What should you do when you are a victim of Business Email Compromise
• How can you Avoid or Prevent Business Email Compromise

The Problem of Business Email Compromise

Since the start of the global COVID-19 pandemic, the attack, damage and unauthorised access of information and technology systems have significantly increased. Jürgen Stock, the INTERPOL Secretary-General has been quoted as saying:

“Cybercriminals are developing and boosting their attacks at an alarming pace, exploiting the fear and uncertainty caused by the unstable social and economic situation created by COVID-19.”

And it’s not slowing down. In fact, cybercrime is expected to significantly increase in the future.

Ms Abigail Bradshaw, Head of the Australian Cyber Security Centre has said “In 2019-20 financial year there were 4,255 reports of BEC scams reported through the ACSC’s Report Cyber tool, representing losses of over $142 million.”

If you want more information, visit this link for more information on cybercrime in Australia.

Business email compromise is a problem because it usually involves the manipulation of invoices. A cybercriminal pretends to be the trusted supplier and sends a fake invoice to the customer or intercepts a real email, changes the bank details on the invoice, and sends it on to the customer.

Next, the customer pays the money into the hacker’s bank account. Often, by the time either the supplier or the customer realises what has happened, the funds have already been debited from the hacker’s bank account.

In this scenario, both the supplier and the customer lose out. The supplier hasn’t received payment and the customer hasn’t received their goods and/or services.

What is ‘Business Email Compromise’?

Incidents of business email compromise/email account compromise/email compromise fraud are on the rise. Business email compromise is a subset of cybercrime. It is the abuse of trust in a business’ email systems to procure the transfer of data or money, either by social engineering, hacking, or spoofing.

You can find out more about the IT jargon here.

So, who is at fault – or, to put it another way – who bears the loss if a hacker fraudulently intervenes in a legitimate business transaction between two innocent parties and one of those parties suffers a loss?

Publicly available email accounts (usually belonging to employees who have the authority to receive or make payment transfers) are either spoofed or compromised through keyloggers.

A keylogger is a computer program that records every keystroke made by a computer user, especially in order to gain fraudulent access to passwords and other confidential information.

An email account can also be compromised through a phishing attack. A phishing attack is a practice of sending fraudulent communications that appear to come from a reputable source. The hacker uses the guise of trust to do carry out the fraudulent behaviour, resulting in loss to the unwitting victim(s).

Business email compromise is generally also accompanied by a data breach. If it is, your business should also consider whether it is required to notify the Office of the Australian Information Commissioner of the data breach.

Click here to find out more about data breach notifications in Australia.

There are two scenarios when it comes to figuring out who is responsible for invoice manipulation:

1. the business’s emails have been ‘spoofed’
2. the business’s emails have been hacked

You need to work out which one applies before you can determine who is legally responsible.

Next, let’s look at the difference between spoofing and hacking in the context of the law.

Who is legally responsible for a ‘spoofed’ email?

First, let’s recap on spoofing. Spoofing happens when a cyber-criminal pretends to be someone they are not. They do this by overlaying their actual email address with the email address of the person or business they are pretending to be.

For example, their email address might be hacker@123.com, but they have ‘covered’ the email so that when the recipient receives the email, it looks like trusted genuine@business.com. The only way to confirm whether an email has been spoofed or not (before assuming it has actually been sent by the legitimate sender) is to check the source code of the email.

If the business’s email has been spoofed, the business is unlikely to be legally responsible for any loss suffered by the customer who has paid into the wrong account. The customer is still liable to pay the outstanding amounts to the supplier before they can receive the goods and/or services.

Who is legally responsible for a hacked email?

Hacking occurs when a cybercriminal has gained access to a business’s email or IT systems and is impersonating someone at the supplier’s business. The business may be completely unaware that its systems have been compromised. Unlike spoofing, checking the source code of the email will not uncover any indication that you are dealing with a hacker on the other end, because the email will have come from the business.

If a business’s email or IT systems have been hacked, and that has led to an invoice being manipulated, the business may be legally responsible for the loss that the customer has suffered.

Unfortunately (or fortunately [insert ground-breaking legal opportunity here]), there is very little in the way of legal precedent in Australia.

Currently, there is a matter before the Victorian Supreme Court involving Mills Oakley Lawyers. This incident allegedly involved a hacker pretending to be Mills Oakley’s client, Mr Chua, requesting the transfer of settlement funds to an overseas bank account. Mills Oakley transferred the sum (to the tune of nearly $1 million) to the hacker’s account.

Also, State and Territory legislatures have somewhat codified (I say “somewhat” because the various legislation does go to pains to state that it is not intended to codify) the law of negligence in their respective Civil Liability (and equivalent) Acts.

Taking Queensland as an example, the Civil Liability Act 2003 (Qld) states that (in summary):

you need to establish that the other party (in this context, the business) failed to take precautions against a risk that was foreseeable, not insignificant, and, in the circumstances, a reasonable person would have taken precautions against;

that last point (refer to bold text) requires that the “reasonable person” would have taken into account the probability and likely seriousness of the loss or damage, the burden of taking precautions and the social utility of the thing that gave rise to the risk of loss or damage;

in deciding whether a breach caused the particular loss or damage, it needs to be established that the breach was a necessary precondition of the loss or damage and that it’s appropriate for the scope of liability of the person in breach to extend to the loss or damage;

if the case is exceptional (which, given the dearth of legal precedent, one may argue is the case), whether or not and why the party in breach should be held liable; and

always, the onus of proof rests with the plaintiff (in this context, the customer) to establish on the balance of probabilities (i.e. more likely than not) the facts giving rise to the cause of action.

“In a dark place we find ourselves, and a little more knowledge lights our way” Quote: Yoda

If we apply the law of negligence to business email compromise, a business owes its customers and suppliers (and others who could foreseeably suffer a loss) a duty of care and must take reasonable steps to avoid business email compromise hacking scams.

For a business to do this, it must ensure that it is aware of the risks that may come from cybercriminal activity and business email compromise. In the face of the increasing sophistication of cyber-attacks and cybercriminal activity, businesses cannot afford to become complacent.

It is important for businesses to put procedures and systems in place to ensure the business is less likely to be a victim of cybercrime and business email compromise.

If a business fails to do this, it may breach its duty of care owed in negligence to its clients and suppliers and a court may find that the business is liable for the damage caused by cybercriminal behaviour due to the negligence in failing to safeguard the business from the cybercriminal activity.

What Should you do if you are a Victim of Business Email Compromise?

If you or your business have been the victim of a business email compromise scam, you should:

1. (either yourself or through a third party, such as CIA Solutions) conduct a forensic examination of email headers and log files required to prove the email fraud
2. negotiate with the likely source of the scam, which is usually a solicitor, a real estate agent, a conveyance, or some other business that has requested payment into their business bank account
3. failing negotiation, commence proceedings against the likely source of the business email compromise scam (this will enable you to utilise the court’s discovery processes and compel the other party to disclose documents and other records)
4. engage a well-known forensic IT expert to give an expert opinion on the business email compromise scam, such as Schatz Forensic Digital Evidence Experts.

How Can You Avoid or Prevent Business Email Compromise?

You can reduce the risk of business email compromise by ensuring you have robust security and IT systems in place. However, this sometimes isn’t enough to prevent stealthy and expert hackers from gaining access to your business’ emails.

In that case, you should seriously consider investing in cyber insurance. Although the insurance premiums for cyber insurance can be costly, it is often worth every penny. This is because not only can the insurance make you whole, but you can pass the benefit onto your customer who may also have fallen victim, thereby ensuring that you’re keeping your customer happy and preventing some negative reviews of your business.

If your business is still compromised, it’s possible that the cybersecurity system you have installed at your workplace has failed or the cyber security expert you have engaged to monitor your systems and alert you of an issue has failed to do their job.

My client telephoned the bank, and advised that the account the money was paid into was suspected of being fraudulent.

The bank advised my client to wait until the funds had cleared (up to three business days) and confirm that the merchant business had not received the funds. If they hadn’t, my client was advised to call the bank again.

On the face of the documents, it appeared that the business’s email system had been compromised. However, to be able to prove this, my client would need to hire a forensic IT expert to examine both my client’s systems (and email), as well as the business’s.

Additionally or alternatively, my client could pursue the bank for alleged negligent advice in telling my client to wait a further period of time before the bank made an attempt to recover the funds. My client opted to pursue the bank initially and we submitted a formal (and successful) complaint to the Australian Financial Complaints Authority on my client’s behalf.

How can Prosper Law help?

Prosper Law is Australia’s online law firm. We provide legal advice to businesses and individuals across Australia. Our areas of legal practice include contracts, eCommerce, publishing, legal counsel and employment law.

If you need to talk to an online lawyer, get in touch today.

Contact the team at Prosper Law today to discuss how we can provide you with online legal advice for a fixed fee or at affordable hourly rates.

Enjoyed this article? Check out What to do when you get a bad online review?

Farrah Motley | Director

PROSPER LAW – Australia’s Online Law Firm

M: 1300 003 077

E: farrah@prosperlaw.com.au

W: www.prosperlaw.com.au

A: Suite No. 99, Level 18, 324 Queen Street, Brisbane, Queensland Australia 4000