Australian company ordered to pay $191,859 after hackers used a supplier’s compromised email account to redirect invoice payments to a fake bank account

An Australian company has been ordered to pay a supplier more than $190,000 after hackers changed the bank details on an invoice and redirected the payment. Inoteq Pty Ltd had hired electrical contractor Mobius Group to carry out work on a Rio Tinto project. In 2022, when Inoteq prepared to pay the invoices, it received emails from Mobius’s hacked systems containing new bank account details. The company transferred the money to the new account, not realising that the details had been changed by hackers.Inoteq later argued that it should not be held responsible for the lost money. According to ABC News, the District Court of Western Australia rejected its argument, finding that the company had failed to take enough steps to confirm the new bank details.Hackers sent fake bank details from Mobius’s compromised email systemMobius Group, an electrical contractor, had agreed to carry out work for Inoteq Pty Ltd on a Rio Tinto project. In March and April 2022, Mobius sent Inoteq invoices totalling $235,400. However, on the day Inoteq was preparing to make the payments, a hacker sent emails from Mobius’s compromised systems.The first email appeared to come from Mobius’s director and provided new bank details, asking Inoteq to update its records. The change raised concerns at Inoteq, so a staff member called Mobius to verify the details. However, the poor phone connection prevented them from confirming the change. Inoteq then emailed Mobius asking for proof of the new account details. The hacker replied to that email without either company realising that the response was fraudulent.Supplier discovered the fraud after contacting Inoteq about unpaid invoicesThe fraud was discovered about a week and a half later, when Mobius contacted Inoteq about the unpaid invoices. Police were called after the companies realised what had happened. By that stage, some of the transferred money had been sent overseas. However, $43,541 was recovered. A cybersecurity expert who gave evidence in the case said the scammer had accessed the email account of Mobius’s director. This meant Inoteq could not have identified the messages as fraudulent from the email address alone. The expert said a phone call was needed to verify the changed bank details. Mobius later began legal action to recover the remaining $191,859 from Inoteq.The court ordered Inoteq to pay the remaining $191,859 with interestInoteq argued that it should not be held responsible for the loss. It pointed to an indemnity clause in its contract and claimed that Mobius had failed in its duty of care by not adequately protecting its email accounts. However, Judge Gary Massey rejected both arguments.The judge acknowledged that Inoteq had taken a sensible step by calling Mobius to verify the new bank details. However, the call did not confirm the change because of the poor phone connection. He said Inoteq should have made another call instead of relying on the email response. Since it failed to do so and transferred the money to the fraudulent account, the court ordered Inoteq to pay the outstanding $191,859, along with 6% annual interest.False billing scams a growing concern for Australian businessesThe case has drawn attention because false billing scams are common and the decision may influence similar disputes across Australia. Australian Competition and Consumer Commission data cited in the report recorded 13,120 reports of false billing scams in 2020. That figure rose to 39,587 in 2023. Lawyer Andrew Bower said the case was, to his knowledge, the first reported decision involving fraudulent updated bank details sent solely from a legitimate email address that had been compromised.Disclaimer: This article is based on publicly available information, including the report published by ABC News and details of the court proceedings. The Times of India has not independently verified the claims, financial transactions, or other details mentioned. The information is based on the reported findings and the court's decision in the case.You use AI every day. Now get your AI Quotient. Take the AIQ test.