An email scam cautionary tale
By Nancy Rubin, K.C. and Levi Parsche
What happens if a person accidentally makes payment to a hacker, instead of to the person they actually owe money? Should they have to pay again? In the recent decision, Jane Group Limited v. Heritage Gas Limited, 2022 NSSM 36, a small claims court adjudicator said yes.
EFT Payment Scam
In the case, two companies had agreed to split the costs to repair a sidewalk after a natural gas line was installed. Shortly after the repairs were completed, Jane Group emailed Heritage Gas seeking payment of its share. Heritage Gas responded, requesting an invoice for the repairs, and indicated it could pay by electronic funds transfer (“EFT”) or via cheque. So far, so good.
Then, Heritage Gas received what it assumed was a response from Jane Group, providing banking information and instructions to send payment via EFT. Unfortunately, this email was actually from an online hacker who had intercepted previous communications. The hacker, representing themselves as the Jane Group president, provided information for a fraudulent bank account, and asked for the money to be deposited that same day.
Heritage Gas emailed Jane Group again indicating it needed an invoice before it could make a payment. In response, (and from a different email address) Jane Group provided an invoice, which indicated payment should be made by cheque to a mailing address.
Unfortunately, upon receipt of the invoice, Heritage Gas followed the earlier EFT instructions that had been sent, depositing the payment into the fraudulent bank account provided by the hacker.
Decision
Having not received payment, Jane Group sued for recovery from Heritage Gas. Counsel for Jane Group argued that there were several “red flags” in the email from the hacker (spacing and typographical errors) which should have triggered a follow-up by Heritage Gas, not to mention the discrepancy in the direction to pay via EFT or cheque.
On the other hand, counsel for Heritage Gas argued that the loss of money was due to Jane Group’s “carelessness” and lack of cybersecurity.
In the end, Adjudicator Darling found that both parties were innocent victims of the hacker and ruled that as neither party had exhibited blameworthy conduct, the case must be decided in favour of the Claimant, Jane Group.
Key Takeaway
As we move towards an increasingly digital world, this case serves as a reminder to keep an eye out for fraudulent activity. Take extra steps to make sure your electronic funds transfers are secure. Watch out for email red flags (typos, suspicious links, misspellings, a sense of urgency) and confirm payment details via an additional method – otherwise you might end up on the hook and have to pay twice!
This update is intended for general information only. If you have questions about the above, please contact the authors.
Click here to subscribe to Stewart McKelvey Thought Leadership.
Archive
Neil Jacobs, QC, Joe Thorne and Meaghan McCaw The Newfoundland and Labrador Court of Appeal recently confirmed that accounting/auditing firms may take on several mandates in respect of companies that may or do become insolvent in Wabush Hotel Limited…
Read MoreJoe Thorne and Brandon Gillespie An independent medical examination (“IME”) is a useful tool for insurers. An IME is an objective assessment of the claimant’s condition for the purpose of evaluating coverage and compensation. Where a…
Read MoreOn June 2, 2017 the Supreme Court of Canada released its decision in Saadati v. Moorhead, 2017 SCC 28, clarifying the evidence needed to establish mental injury. Neither expert evidence nor a diagnosed psychiatric illness…
Read MoreMark Tector and Annie Gray This morning, May 30, 2017, Ontario Premier Kathleen Wynne announced her government’s intention to introduce sweeping legislative reform of labour and employment laws. If passed, the proposed Fair Workplaces, Better Jobs Act, 2017 would…
Read MoreCanada’s Anti-Spam Law (“CASL”) is a federal law in force since July 1, 2014, aimed at eliminating unsolicited and malicious electronic communications and requires organizations to comply with specific consent, disclosure and unsubscribe requirements when…
Read MoreJennifer Taylor Introduction Kirby Elson had been fishing in Newfoundland and Labrador for about 50 years when the policy on Preserving the Independence of the Inshore Fleet in Canada’s Atlantic Fisheries (“PIIFCAF”) was introduced in…
Read MoreRick Dunlop, David Randell, Christine Pound, Sadira Jan and Kevin Landry The federal government’s introduction of the Cannabis Act, the first step in the legalization of marijuana (or cannabis), has understandably triggered a wide range of reactions in the Canadian business…
Read MoreMark Tector and Annie Gray On April 26, 2017, the Government of Nova Scotia announced that amendments to the Occupational Health and Safety Act, which were passed in May of 2016, will officially come into force as of June…
Read MoreOn May 2, 2017, the Nova Scotia Court of Appeal issued a significant decision in Tibbetts v. Murphy, 2017 NSCA 35, on the proper interpretation of s. 113A of the Insurance Act. Specifically the issue was whether…
Read MoreJoe Thorne and Amanda Whitehead A fundamental principle of our legal system is that all parties to a dispute should be given the opportunity to be heard. However, the law recognizes that some circumstances warrant speedy judicial…
Read More