{"id":1132,"date":"2018-09-04T20:38:04","date_gmt":"2018-09-04T20:38:04","guid":{"rendered":"https:\/\/www.bfvlaw.com\/who-pays-when-a-bec-scam-hits\/"},"modified":"2022-08-03T18:28:50","modified_gmt":"2022-08-03T18:28:50","slug":"who-pays-when-a-bec-scam-hits","status":"publish","type":"post","link":"https:\/\/www.bfvlaw.com\/who-pays-when-a-bec-scam-hits\/","title":{"rendered":"Who Pays When a BEC Scam Hits?"},"content":{"rendered":"

Your business contracts to sell custom manufactured equipment. The equipment is ready, and you email the Buyer to confirm, request wire transfer of payment, and arrange for pick-up. Buyer confirms receipt of your email and that it will send payment and a truck to pick up the equipment. The Buyer\u2019s carrier shows up to take possession of the equipment, but the money never hit your account. The Buyer insists it wired the money three days ago. Someone, somewhere fell for a Business Email Compromise (BEC) Scam<\/a>. The money is gone.<\/p>\n

Who bears the loss?\u00a0 Do you, the manufacturer, have to release the equipment without having received the funds?\u00a0 Does the Buyer have to pay a second time?\u00a0 Does a vendor to the Buyer or Manufacturer bear some responsibility in letting the scammer inside the system? Georgia\u2019s Courts have yet to squarely address these issues, but other jurisdictions have set forth a potentially relevant framework for analyzing liability in analogous cases. The answer likely depends on who\u2019s system was compromised and what safeguards were in place to prevent BEC scams.<\/p>\n

In March of 2018, the U.S. District Court for the Western District of North Carolina allowed claims to proceed for negligence and invasion of privacy against an employer who failed to safeguard its employees\u2019 information against a phishing scam. The events giving rise to the claims in Curry v. Schletter<\/em> are shockingly simple. A human resources employee of Schletter, Inc. received an email purporting to be from the company\u2019s CEO requesting current employees\u2019 W-2 forms. The human resources employee did not recognize that this was a phishing scam and provided the personally identifiable information (PII) of its employees to a cyber criminal.<\/p>\n

The court was particularly unforgiving of this employee\u2019s mistake because Schletter, Inc. had been warned of this exact scam and yet failed to prepare its employees. The FBI, IRS, and a cybersecurity journalist had all provided warnings to the general business community. In light of the widespread warnings, the court found that the company had failed to adequately train its employees on what the court considered \u201cbasic\u201d cybersecurity protocols, including:<\/p>\n