This article is the second installment in our two-part series. Read Part One here.
When a business email compromise scam succeeds, the scramble to recall the funds is usually only the first fight.
We recently highlighted the unfortunate facts involved when a South Carolina beach town The immediate loss is bad enough, but the harder question that follows, and the one still playing out publicly between that town and its contractor, is who legally bears the loss. Should the town pay because it should have known better? Should the contractor eat the loss because it should have ensured (and insured) its payment process?
Those questions do not have single answers. It depends first on the jurisdictions involved. As a North Carolina and South Carolina law firm, we assume for the purposes of this article that the sending entity is in one of those states. It also depends on the payment authorization process, the bank’s security procedures, the contract terms between the parties, the available insurance, and which side was realistically in the best position to catch the fraud before it worked.
How Courts Tend to Approach the Loss
Many of these cases involve a difficult fact pattern: an employee who was fully authorized to send the money did send it, but only because a fraudster tricked that employee into doing so. Courts have long applied a general principle in disputes like this, one that predates business email compromise entirely: when a fraud harms two parties who are otherwise equally innocent, the loss tends to fall on whichever party’s own carelessness gave the fraudster the opening to succeed.
Increasingly, courts also look at which party was realistically in the better position to prevent the fraud in the first place. An organization that skipped basic verification steps or cybersecurity training can end up bearing more of the loss than a counterparty that did not, even if neither party intended for anything to go wrong. For most businesses, it is common policy or procedure to verify payment instructions prior to making payments. Courts may consider whether such policies and procedures were in place and followed in determining whether a party was in the best position to avoid the fraud.
The Bank’s Role, and Its Limits
For most commercial wire transfers, a body of commercial law generally known as Article 4A of the Uniform Commercial Code (typically called the UCC) sets the starting framework. It addresses how a payment order gets authorized, what security procedures a bank and its customer have agreed to, and who bears responsibility when something goes wrong between them.
A central question is often whether the payment order was actually authorized, and whether the bank accepted it under a security procedure that was commercially reasonable given the circumstances. Not knowing is itself a problem. North Carolina recently made that lesson especially concrete. For payment orders governed by Article 4A, a familiar-looking email address, IP address, or phone number is not, standing alone, a statutory “security procedure.” South Carolina’s Article 4A points in the same practical direction because enforceability can turn on an agreed, commercially reasonable security procedure, and the statute makes clear that a signature comparison alone is not enough. These are compelling reasons why a callback policy or other specialized verification should be built into the process rather than improvised during the process.
This framework does not automatically help the organization that got tricked. Because an authorized employee actually initiated the transfer, even though based on a fraudulent instruction, recovering from the sending bank is often harder than it would be in the case of a truly unauthorized transfer.
Potential claims against a bank can include failing to follow an agreed security procedure, failing to act after receiving notice of the fraud, using a security procedure that was not commercially reasonable, ordinary negligence, or mishandling a recall request once one was made. That said, this same body of law can limit or even replace some of those common law claims, depending on the jurisdiction and the specific theory being pursued, so this is very much a fact specific and law specific inquiry. A recent Fourth Circuit Article 4A decision is a useful caution against expecting bank to pay for every mistake: In a fraudulent ACH redirection case, the court held that the beneficiary bank was not liable for a name-number mismatch without actual knowledge, which means businesses should not assume the receiving bank will be responsible for catching every mismatch after the money leaves.
When the Dispute Is Between Customer and Vendor
If the fraud involved a vendor or another counterparty rather than a bank, the resulting dispute often looks less like a fraud case and more like a contract case. The parties may disagree about whether payment was actually made under their agreement, and the answer can turn on the specific language the contract uses, such as whether it requires the customer to remit payment or requires the vendor to receive it. That is why the contract language matters: North Carolina and South Carolina Article 4A both address when a funds transfer pays and discharges an underlying obligation, but they also leave room for the originator and beneficiary to vary their rights by agreement.
Prior dealings between the parties, whatever verification steps the contract requires for a change in payment instructions, and general negligence principles all tend to matter. So does a question that is not always comfortable to ask: whose email system, or which employee, was actually compromised in the first place. That answer can shape the entire negotiation that follows.
Recovery Paths Beyond the Bank
Several avenues for recovery exist outside of the banking relationship itself, and it is worth understanding all of them rather than assuming only one applies.
- If the account that received the funds can be identified, civil litigation may allow an organization to pursue emergency relief such as a temporary restraining order, an asset freeze, an injunction, or prejudgment attachment, along with civil claims like fraud, conversion, unjust enrichment, or a claim for money had and received.
- Insurance can also respond, though which policy applies is rarely obvious in advance. Potential sources include cyber liability insurance, commercial crime coverage, funds transfer fraud coverage, computer fraud coverage, and social engineering fraud endorsements that some insurers offer as an add on. Whether any of these actually pay out often depends on specific policy wording, whether the transfer is considered to have been authorized, whether required callback or verification procedures were actually followed, and whether an exclusion applies.
- Where a vendor or business partner contributed to the loss, contractual indemnity, a breach of contract claim, or a negligence claim may allow some allocation of the loss between the parties, often turning on which side had the realistic ability to prevent the fraudulent instruction from being accepted in the first place.
- Criminal restitution is also possible if the perpetrators or the money mules who moved the funds are eventually identified and prosecuted, though this path is typically slower and far less predictable than a bank freeze, a civil claim, or an insurance payout. North Carolina and South Carolina both have computer-crime and identity-theft statutes that can fit a payment-redirection scheme involving compromised credentials, spoofed instructions, or fraudulent access to financial resources, even though the federal wire-fraud investigation is often the most visible part of the response.
Building Stronger Contracts and Controls
Because recovery after the fact is uncertain at best, the more reliable protection is prevention built into your everyday payment process.
- Require independent verification of any new or changed wire instructions using a phone number your organization already has on file (or other independent communication means), never a number (or method) supplied in the email requesting the change.
- For higher-risk payments, build in dual approval, a clear separation of duties, documented callback verification, and an escalation step for anything urgent or unusual.
- Contracts can reinforce these habits directly. Consider requiring written procedures for any change in payment instructions, previously verified contact points for confirming such changes, a clear allocation of risk if either party’s communications are compromised, and language confirming that payment is not considered effective unless it reaches a previously verified account.
- Ongoing employee training, multifactor authentication, monitoring for lookalike domains, and careful vendor onboarding all reduce the odds that an attack like this succeeds in the first place.
Liability in these cases is truly fact-specific, and no organization, on either side of a payment relationship, can eliminate the risk entirely. But understanding how loss allocation actually works, and putting stronger verification habits and contract language in place before a loss occurs, puts our clients in a far better position than sorting all of this out after the money is already gone.
If you would like help reviewing your payment verification procedures, your vendor contracts, or your insurance coverage, our team will be glad to talk through what would work best for your organization.
