July 31, 2019

Hacked Emails and Fraudulent Accounts – A Modern Tale

The increased digitalisation of commercial transactions has encouraged criminals to find new ways to defraud their victims, and in some cases, created new issues for the Courts to untangle. In K v A [2019] EWHC 1118, a commodities case on appeal from a GAFTA arbitration award, various issues arising from hacked emails and the payment of over USD 1 million into a fraudulent account, were examined by the Court.

Background

In this case, A agreed to sell to K a cargo of Romanian sunflower meal under a contract dated 16 September 2015 drawn up by Vicorus SA ("Vicorus") acting as intermediary broker.

On 2 November 2015, once the cargo was loaded, A emailed Vicorus an invoice seeking payment of US$1,167,900 into its Citibank NA, New York branch, account. Whilst Vicorus's email account purported to show that this email was forwarded to K that same day, K denied having received it. Instead, K received an email which appeared to come from Vicorus, attaching a separate invoice directing payment to a different account at the London branch of Citibank NA. It emerged later that this was an account in the name of Ecobank.

It was common ground that the parties' communications had been intercepted by an unknown third party, and that each party received fraudulent correspondence purporting to be from one of the other parties.

Unwittingly relying on the fraudulent emails, K remitted US$1,167,900 to the fraudulent account held by Ecobank.

The parties suspected fraud by 23 November 2015, and on 24 November 2015, K requested that the money be recalled from Ecobank. Ecobank approved the request on 24 November 2015, however, due to foreign exchange rate fluctuations, only US$1,006,253.07 was repaid, leaving a shortfall of US$161,646.93, which formed the basis of A's claim under GAFTA arbitration proceedings.

GAFTA Board of Appeal Award

The GAFTA Board of Appeal ("the Board") found that K was required to pay the balance of the price due to A.

The Board took as a starting point the incorporation of clause 18 of GAFTA Form 119 into the contract, which stated:

"A notice to the Brokers or Agent shall be deemed a notice under this contract."

Therefore, by sending the invoice to Vicorus, A fulfilled its obligation under the contract to give good notice, regardless of whether this information found its way to K or not. Consequently, it was K, the buyer, who bore the risk of receipt.

On receipt of the invoice(s) from A, K's obligation was to transfer the funds "into the account nominated by [A]", which K failed to do. The Board, therefore, found that:

"Sellers were entitled to receive 100% of the invoice amount as per Contract and, in the Board's opinion, it was not sufficient that Buyers had demonstrated that 100% of the invoice amount had been paid...".

Accordingly, K was liable for the balance due to A. Furthermore, the Board awarded interest not only on the disputed sum, but also on the full purchase price of the goods.  

The Appeal

K challenged the award on several grounds under sections 68 and 69 of the Arbitration Act 1996.

First, K argued that the Board had made an error of law (s.69 challenge) in holding that K's obligation was to ensure payment into A's bank account. Its obligation was only to pay the sums to the correct bank, the bank being the seller's agent for the receipt of payment, and this was fulfilled when K paid the funds into A's bank, regardless of the incorrect account details.

Secondly, K made a section 68 challenge, claiming serious irregularity, based on the Board's focus on clause 18 of GAFTA 119, which neither party had relied on in their submissions, leaving K unable to deal with the point.

K also argued that the Board failed to deal with several of their arguments, and that it had overstepped its jurisdiction in awarding interest for the full sum. Both of these arguments were dismissed by Mr Justice Popplewell on the basis that the Board stated that it had taken all points raised into consideration, and because the award of interest was so disproportionately small (USD 5,500) that it was of no practical effect.

Mr Justice Popplewell rejected K's first challenge, stating that payment to the bank was not all that was required as it was "commercially impossible" to transfer funds for the benefit of a particular person without identifying the destination account. To find in favour of K would lead to a "commercially absurd result."

However, it was in relation to K's section 68 challenge, regarding the Board's consideration of clause 18 of GAFTA 119, that the Appeal was successful, noting that:

"For s. 68 purposes, it is not necessary for K to show that the result would necessarily or even probably have been different if it had had the opportunity to address its arguments on the point to the Board; it is enough if the Board might well have reached a different view."

Therefore, the Court ordered that the case be remitted back to the GAFTA Board of Appeal.

Comment

Although K was successful in its section 68 challenge, it may turn out to be a pyrrhic victory as the ultimate verdict may still require K to pay the outstanding sums, albeit with the benefit of full legal argument on all issues. Indeed, this was partly acknowledged by Mr Justice Popplewell, when he noted that K had met the test for a successful s.68 challenge but that, for this purpose, there was no need to show that the result would necessarily, or even probably, have been different.  

To come to the conclusion that parties could rely on third party fraud to avoid paying would bring a large degree of uncertainty to the world of trading, particularly with the large increase of cyber fraud in recent years.

Although this case took place in a trading context, the judgment is highly relevant for any party making a payment, whether in a private or commercial setting. A party should ensure, before making a payment, that they are acting on authentic instructions. A widespread practice consists in calling the party who has given the instructions to obtain verbal confirmation of the account details prior to transferring the funds. For now, this is probably the safest option, and provides an additional layer of security, rather than simply relying on written correspondence, such as emails, which can be intercepted and amended relatively easily by fraudsters.