Business email compromise fraud: the legal response

What is BEC fraud, and how does it work in practice?

You received an email from the “CEO” asking you to transfer NIS 200,000 to a new supplier by the end of the day. He is abroad and not available by phone. The urgency pushes you, and you transfer the money. Two days later you discover that the email was forged.

This is BEC fraud: Business Email Compromise. It does not start with a break-in to your network, but with social engineering: someone imitates a trusted email address (sometimes differing by one letter), builds credibility, and exploits pressure and urgency. The money goes out, often to accounts abroad, and then it is hard to trace.

Three common BEC scenarios: Spoofing a manager’s address: an email to the accounts department in the CEO’s name asks for an urgent payment. Posing as a supplier: an email from what looks like an existing supplier, with “updated” bank account details. Compromise of a real account: the fraudsters break into an active email account of a business partner and send from it. The last is the most dangerous, because everything is real except the payment instruction.

Is a business liable when its employee transferred money because of a fake email?

An employer that did not train its employees, did not put verification procedures in place, and did not prohibit large transfers without double approval may face a claim of contributory fault if it sues the bank or another party, and then the compensation awarded to it will be reduced according to its share of responsibility for the damage (section 68 of the Torts Ordinance). Toward third parties, an employer is liable for an act that its employee did in the course of their work (section 13 of the Ordinance).

On the other hand, an employee who acted in good faith, did not exceed their authority, and had no information that would have raised a reasonable suspicion is unlikely to be considered negligent: negligence is assessed by what a reasonable and prudent person would have done in the same circumstances (section 35 of the Torts Ordinance). Your insurance company may cover the loss (see below), subject to the terms of the policy; some policies make cover conditional on having verification procedures.

How do you spot an attempted payment fraud before the money goes out?

The signs that require you to stop and check:

Artificial urgency: “It has to be today”, “Don’t talk to anyone else”, “This is confidential”. This is an immediate red flag. An almost identical email address: ceo@company-il.com instead of ceo@company.co.il. Look at the domain, not only the name. A request to change account details: a supplier asking to change its bank account should be verified by phone, at a number you have from another source, not from its email. Spelling mistakes or untypical wording: a manager who usually writes in a certain style suddenly writes differently.

The golden rule: every payment instruction above an amount you set in advance (for example NIS 10,000) requires voice verification: a phone call to the number you know, not a call to a number that appeared in the message.

What to do when you discover you have been caught: the critical 24 hours

Step 1, the bank, now: call the bank immediately and ask it to stop the transfer. If it is still in the interbank clearing process, it can sometimes be stopped. The faster you respond, the better the chance. Give the full transfer details.

Step 2, immediate documentation: keep all the emails; do not delete anything. Take screenshots. Record who did what and when. This will form the basis of the claim and the timeline for the insurance company and the police.

Step 3, report to the police: file a complaint with the cyber unit. An investigation takes time, but the report itself is important for proving a future claim, and sometimes cooperation between law enforcement bodies abroad and in Israel leads to tracing the thieves.

Step 4, a lawyer: if a significant amount is involved, early legal advice will let you consider a civil claim, an application to the court for interim relief (stopping funds from going out), and checking insurance cover.

How to protect the business: procedures that prevent BEC

Three procedures that reduce the risk dramatically (on safe payment procedures in more detail: Preventing payment fraud: legal duties):

Double verification for payments: every payment above an amount you set requires phone approval from a manager other than the one who made the request. This is basic, needs no budget, and makes this type of fraud much harder.

Setting up SPF/DKIM/DMARC on your domain: these are email authentication protocols that prevent outsiders from sending emails in your domain’s name. Your IT manager can set them up. This will not prevent impersonation from an external account, but it will prevent your domain from being used for an attack.

Employee training: once a year, explain to the team what BEC is. Show real examples. Define the procedure for when someone becomes suspicious. An employee who knows the fraud will stop before making the transfer.

Cyber insurance: what does it cover, and what not?

Many cyber insurance policies include cover for BEC fraud, but you need to read the small print. What most policies cover: direct financial loss from electronic fraud, investigation costs, the costs of notifying customers (if there was also a data breach), and the costs of restoring systems.

What is usually not covered: a loss from fraud caused by the business’s gross negligence (for example, a transfer without any verification), and losses caused after the insurance company gave notice that there is no cover. Cover terms vary greatly between policies: you must read them and get advice before an incident, not after it.

Can you get the money back?

Sometimes, yes, provided you respond fast. Money still in interbank clearing can be stopped. For money that has reached a bank account in Israel, you can apply to the court for a stay order. Money that has gone abroad is harder to recover, but not impossible, through international cooperation.

In addition, you can bring a civil claim against the bank if it acted negligently (sections 35 and 36 of the Torts Ordinance [New Version]), for example if it approved an unusual transfer without proper checks. It is advisable to consult a lawyer before giving up.