{"id":70167,"date":"2020-01-16T08:23:05","date_gmt":"2020-01-16T08:23:05","guid":{"rendered":"https:\/\/www.pbctoday.co.uk\/news\/?p=70167"},"modified":"2020-01-16T08:23:07","modified_gmt":"2020-01-16T08:23:07","slug":"email-hacking-in-construction","status":"publish","type":"post","link":"https:\/\/www.pbctoday.co.uk\/news\/digital-construction-news\/construction-technology-news\/email-hacking-in-construction\/70167\/","title":{"rendered":"Email hacking in the construction industry: Who is liable?"},"content":{"rendered":"

Michael Gerard of construction and engineering law firm Michael Gerard Solicitors<\/a> looks at the legalities and liabilities around the issue of email fraud<\/h2>\n

Technology may have revolutionised many areas of the construction industry<\/a> but is has also created a whole new set of problems around cybercrime such as email fraud. Construction companies are particularly vulnerable to scams such as phishing due to the number and value of invoices involved in paying for subcontractors and labour, as well as materials and equipment.<\/p>\n

This issue has come up for several clients and areas around culpability and liability can be confusing. Companies owed money were once protected by the cheque rule, which offered protection to the payee in that once a cheque was issued to the payee, it became a separate contract between the customer and the supplier to the contract that was previously entered into for the supply of the goods and\/or services.<\/p>\n

Except in very limited circumstances, such as counterfeit or stolen cheques, there is no defence to stopping a cheque. Once the cheque has been signed and handed over then a legally binding contract has been entered into and the customer has to honour the debt. Hence when a cheque was returned unpaid, the supplier could elect to bring a claim either under the supply contract or the separate contract entered into when the cheque was issued to the supplier \u2013 this is referred to as the \u201ccheque rule\u201d.<\/p>\n

Although the cheque rule still applies, payment by cheque is fast disappearing, replaced by electronic funds transfers (EFTs). However, despite the clear advantages of EFTs, this new technology also brings in new challenges, not least email hacking.<\/p>\n

Unfortunately, fraudsters hacking into email accounts is now not so uncommon \u2013 and it\u2019s on the rise. This has serious implications for companies that have lax internal procedures and poor IT security in place.<\/p>\n

Hacked email: A case study<\/h3>\n

So, what are the victim\u2019s legal rights when an email is hacked, resulting in fraud? This grey area can be illustrated by a recent matter I was involved with concerning a main contractor who had engaged a specialist contractor on a construction project. The project was to run for several months and the specialist contractor\u2019s input was required for much of the duration. This meant that the specialist contractor was entitled to regular valuations and payments with the majority of communications, document exchanges and financial transactions carried out electronically.<\/p>\n

Unbeknown to both parties, the specialist contractor\u2019s email account had been hacked and software installed that was capable of reading all incoming and outgoing emails, flagging up certain words to the hackers like \u2018bank\u2019, \u2018payment\u2019, \u2018monies\u2019 and \u2018invoice\u2019.<\/p>\n

By coincidence, partway through the contract the specialist contractor informed the main contractor that it was intending to change its bank, which acted like a red rag to a bull to the hackers. Having intercepted a valuation, the hackers subsequently advised the main contractor\u2019s accounts department that a new bank account had been set up with all future payments to be paid into the new account. The main contractor\u2019s accounts department duly complied, having previously received internal authorisation of the amount to be paid by the contracts department, which was tens of thousands of pounds. The scam was not discovered until the specialist contractor started to chase payment, by which time the fraudster\u2019s account had been cleared of funds, bar \u00a34.00.<\/p>\n

In such circumstances, who is culpable for the loss? From the main contractor\u2019s perspective, it had complied with a request to make payment to a specific bank account, the request of which had been forwarded via an email that looked as if it had come from the specialist contractor\u2019s own email account \u2013 it had even correctly addressed the accountant by his Christian name in the email. From the specialist contractor\u2019s perspective, it had carried out the works but had not received payment.<\/p>\n

Reasons for liability<\/h3>\n

Harsh as it may sound, and despite the fact that it was the specialist contractor\u2019s email account that had been hacked, the main contractor did not have grounds or a valid defence for not making payment for the following reasons:<\/p>\n