I was trawling through some Disputes Tribunal cases and found this one from last September which I found quite interesting, especially as I was self employed doing freelance work and invoicing clients. This sort of thing hadn't ever crossed my mind.

The Applicants were awarded $5,300.00, which they paid as a deposit for painting services from the Respondent (Painter). The Applicants paid the deposit after receiving an invoice that they believed was from the Painter, but it was a "Man In The Middle" scam invoice. The deposit was paid into the bank account of the scammer.

Full decision - https://www.disputestribunal.govt.nz/assets/Documents/Decisions/LK-NI-v-JK-Ltd-2024-NZDT-636-5-September-2024.pdf

This is my summary of the case.

The Applicant asked Painter for a quote for painting services. Painter attended site and issued a quote for $10,600.

At this point scammers intercepted emails to the Painter. Scammers replied to follow-up emails from Applicant and subsequently scammers issued an invoice to the Applicant for a 50% deposit which the Applicant paid. It wasn’t until the Applicant chased up a receipt for the payment, that the Painter advised them that he’s had no correspondence with them after issuing the quote. This is when both parties realised that the Painters’ email was hacked and emails were being intercepted by scammers.

Applicant took Painter to the Disputes Tribunal. The Tribunal determined that the Applicants are entitled to make a claim under the Consumer Guarantees Act 1993, as there is a guarantee that a service will be carried out with reasonable care and skill.  

The follow-up emails that were sent and the attached invoice did appear, from the evidence, to be genuine. As this was a of business email compromise (BEC) issue, the email received by the Applicants was from the Painters' email address and the invoice was like the invoices sent by the Painter (which the Painter did confirm). There did not appear to be any issues that could have caused the Applicants to think that the correspondence and the invoice had not come from the Painter.

The Tribunal found that the Painter did not provide services with reasonable skill and care by not having appropriate cybersecurity measures in place. It determined that in BEC cases, the default liability generally rests with the business, as it is best placed to ensure that cybersecurity measures are in place to protect their IT systems. In this case, the Painter did not have adequate cybersecurity protections in place even though they had an IT firm managing their IT systems.

Judgement in favour of the Applicants and Painter required to pay them $5,300.