8 ms·

I'm surprised I'm the first person to point this out, but you have not lost any money, your client has. You sent the goods to the client, and they have yet to

by CPLX 8y ago

I'm surprised I'm the first person to point this out, but you have not lost any money, your client has. You sent the goods to the client, and they have yet to remit the payment to you. So they still owe you the money and you should insist they pay it. Granted, they're not going to like that, but the reality is they sent payment due to you to some other person. That's something they did not something you did. They may be in a position to take steps to recover the payment they sent to someone else, given the banks involved and so on, and they should try to do it. But that's not something you're really in a position to be involved in, you didn't have anything to do with it and aren't a party to the fraudulent transaction. In the meantime they should return the goods or send you the payment they owe.

benmowa 8y ago
this is an issue in real estate transactions as well, where a client or law firm executed fraudulent wire instructions received via spoofed email. see last paragraph: https://themortgagereports.com/39665/cash-to-close-what-is-it-how-to-pay-it-and-how-to-avoid-fraud https://themortgagereports.com/39665/cash-to-close-what-is-i...
Alex3917 8y ago
> my client received an email from "abicde@mydomain.com" stating that there is a change in invoice and revised invoice is again sent which had bank account details of a UK bank account. Emails sent from your domain usually constitute valid contracts. If you're letting other people send emails from your domain because you don't have SPF configured then there's a good chance a court would either rule that you've allowed them to enter into a legally binding contract on your behalf, or else that you were negligent and owe the $10,000 back in damages. That's why you need to take away the email addresses of people who no longer work for your company, so that they can't enter into contracts on your behalf. That said no one should ever wire money based on anything they receive via email. So if the sender email had SPF but the recipient just didn't see it flagged because it was in SOFTFAIL mode or whatever, then it's probably the client's fault at that point.
- Klathmon 8y ago
  I'm not a lawyer, but is that really true? I could see the instance of an ex-employee that still can login can enter into contracts on your company's behalf, but a hacker doing so gets the same protections (for lack of a better word)? That seems very wrong to me. I'm sure it makes things harder to determine the actual issue, but I just don't believe that a judge would look at this and conclude that fraud is ok as long as it comes from your email address... (ignoring issues like gross negligence where a company is doing significantly less to secure their systems than should be expected)
- CPLX 8y ago
  That’s highly doubtful. I think it would maybe be arguable if someone actually hacked the OP’s account and the emails really did come from their outbox, but spoofed email is a different thing entirely. It seems more equivalent as a legal precedent to someone sending a forged letter from a nonexistent employee on similar looking letterhead. Or maybe someone showing up at the door and collecting payment wearing a stolen or counterfeit uniform. If you think of it in legal terms, in a lawsuit say, the client would have to acknowledge the existence of a contract and an obligation to pay the supplier, and then somehow make an argument that a spoofed email from a third party that the supplier had no awareness of, that never entered the posession or control of the supplier at all, somehow invalidates that contract, or proves that the client has satisfied their obligation. That’s quite a stretch. Arguing negligence on the part of the supplier still wouldn’t do anything to satisfy the payment obligation, at best it would seem to be a counter-claim, saying they they suffered a loss because of the suppliers negligence, but then that’s a separate tort and the burden of proof would be on them.
  - Alex3917 8y ago
    > It seems more equivalent as a legal precedent to someone sending a forged letter from a nonexistent employee on similar looking letterhead. Well that's the question I guess, if you don't have SPF enabled is it like what you said, or is it more like allowing random people to come into your office at night and send out whatever they want on your actual company letterhead? I don't know if there is legal precedent there or what a judge would rule, but it doesn't strike me as being completely obvious that this is a simple cut-and-dried case where the client still owes the full amount of the original payment.
cybrjoe 8y ago
If this single transaction is key to the survival of his business this may be one of few, if not the only client they have. In that case it may make longer term sense to "negotiate" a settlement. That could either be a payment plan or percentage of the 10k obligation.
Latteland 8y ago
I strongly disagree with you. The person who sent that money will want to get their money back and you are in the middle. At the very least I would want to stop doing business with someone who communicates bank information in such a careless manner. It's possible these are such tiny companies that they do things like that. In any case, I'd blame the other person whom I thought I was sending money to.

by CPLX 8y ago

benmowa 8y ago

this is an issue in real estate transactions as well, where a client or law firm executed fraudulent wire instructions received via spoofed email. see last paragraph: https://themortgagereports.com/39665/cash-to-close-what-is-it-how-to-pay-it-and-how-to-avoid-fraud https://themortgagereports.com/39665/cash-to-close-what-is-i...

Alex3917 8y ago

> my client received an email from "abicde@mydomain.com" stating that there is a change in invoice and revised invoice is again sent which had bank account details of a UK bank account. Emails sent from your domain usually constitute valid contracts. If you're letting other people send emails from your domain because you don't have SPF configured then there's a good chance a court would either rule that you've allowed them to enter into a legally binding contract on your behalf, or else that you were negligent and owe the $10,000 back in damages. That's why you need to take away the email addresses of people who no longer work for your company, so that they can't enter into contracts on your behalf. That said no one should ever wire money based on anything they receive via email. So if the sender email had SPF but the recipient just didn't see it flagged because it was in SOFTFAIL mode or whatever, then it's probably the client's fault at that point.

Klathmon 8y ago
I'm not a lawyer, but is that really true? I could see the instance of an ex-employee that still can login can enter into contracts on your company's behalf, but a hacker doing so gets the same protections (for lack of a better word)? That seems very wrong to me. I'm sure it makes things harder to determine the actual issue, but I just don't believe that a judge would look at this and conclude that fraud is ok as long as it comes from your email address... (ignoring issues like gross negligence where a company is doing significantly less to secure their systems than should be expected)
CPLX 8y ago
That’s highly doubtful. I think it would maybe be arguable if someone actually hacked the OP’s account and the emails really did come from their outbox, but spoofed email is a different thing entirely. It seems more equivalent as a legal precedent to someone sending a forged letter from a nonexistent employee on similar looking letterhead. Or maybe someone showing up at the door and collecting payment wearing a stolen or counterfeit uniform. If you think of it in legal terms, in a lawsuit say, the client would have to acknowledge the existence of a contract and an obligation to pay the supplier, and then somehow make an argument that a spoofed email from a third party that the supplier had no awareness of, that never entered the posession or control of the supplier at all, somehow invalidates that contract, or proves that the client has satisfied their obligation. That’s quite a stretch. Arguing negligence on the part of the supplier still wouldn’t do anything to satisfy the payment obligation, at best it would seem to be a counter-claim, saying they they suffered a loss because of the suppliers negligence, but then that’s a separate tort and the burden of proof would be on them.
- Alex3917 8y ago
  > It seems more equivalent as a legal precedent to someone sending a forged letter from a nonexistent employee on similar looking letterhead. Well that's the question I guess, if you don't have SPF enabled is it like what you said, or is it more like allowing random people to come into your office at night and send out whatever they want on your actual company letterhead? I don't know if there is legal precedent there or what a judge would rule, but it doesn't strike me as being completely obvious that this is a simple cut-and-dried case where the client still owes the full amount of the original payment.

cybrjoe 8y ago

If this single transaction is key to the survival of his business this may be one of few, if not the only client they have. In that case it may make longer term sense to "negotiate" a settlement. That could either be a payment plan or percentage of the 10k obligation.

Latteland 8y ago

I strongly disagree with you. The person who sent that money will want to get their money back and you are in the middle. At the very least I would want to stop doing business with someone who communicates bank information in such a careless manner. It's possible these are such tiny companies that they do things like that. In any case, I'd blame the other person whom I thought I was sending money to.