Spoofed payment instructions: who pays when a wire goes to a fraudster

The email looks exactly like your supplier's. Same name, same signature, a thread you recognize. "Please note our banking details have changed. Kindly use the attached instructions for this month's payment." You wire $180,000. A week later the real supplier calls asking where their money is.

This is business email compromise, and construction is an attractive target: large payments, many parties, constant email, and deadlines that make people move fast. When it happens, the hardest question is who absorbs the loss.

There's no single rule

No statute neatly answers who bears a loss between a payer and a payee when a fraudster redirects a wire. Courts have filled the gap in different ways:

• The party best positioned to prevent it. Many courts borrow the reasoning of the Uniform Commercial Code's "imposter rule" and ask which party could most easily have stopped the fraud with reasonable care. In Arrow Truck Sales v. Top Quality Truck & Equipment (M.D. Fla. 2015), the payer bore the loss because it ignored obvious red flags in the instructions, including a beneficiary that wasn't the company it owed. In other cases the party whose email account was compromised has been held responsible.
• A question for the jury. In Beau Townsend Ford Lincoln v. Don Hinds Ford (6th Cir. 2018), each side had evidence the other was careless, and the appeals court sent the question to trial.
• What the contract says. Some courts have simply enforced the parties' agreement, such as an indemnity clause, without weighing fault.

The practical takeaway: if there's no clause, you may spend months arguing about whose email was hacked and who should have noticed. A clause decides it in advance.

Habits that stop it

• Call back on a known number. Any change to payment instructions gets confirmed by phone, using a number you already had, never one from the email that asked for the change.
• Treat urgency as a warning. "Must go out today" plus new bank details is the classic pattern.
• Two people for new instructions. One person sets up the change, a second approves it after the call-back.
• Send a small test payment to new instructions and confirm receipt by phone before sending the full amount.
• Lock down email. Multi-factor authentication on every account that handles invoices or payments, and alerts for new forwarding rules, which attackers often add.
• Check the beneficiary name. If the account name doesn't match the company you owe, stop.

A clause to add

Add a short payment-instructions clause to your subcontracts, purchase orders and supplier agreements. For example:

Payment instructions may be changed only by a written notice signed by an authorized officer and confirmed by telephone between the parties' designated contacts at numbers listed in this agreement. Neither party may rely on payment instructions received only by email. A party that fails to follow this procedure bears any loss resulting from a payment misdirected because of that failure.

Have your attorney fit it to your contracts, and make sure the people who actually send payments know the procedure exists.

If it happens

Call your bank immediately and ask them to contact the receiving bank to freeze or recall the funds. Hours matter. Report it to the FBI's Internet Crime Complaint Center at ic3.gov, notify your insurer (some policies cover social engineering fraud, many don't), and preserve the emails without forwarding them around.