Chapter 33: The Transparent Partner — Impersonating an Employee or Business Owner to Suppliers

In the modern business world, trust is the most important currency. It is the oil in the gears of both international and local commerce. When we send a purchase order to a supplier we have been working with for a long time, or when we receive an invoice from a regular service provider, we do not stop every single time to verify the sender's identity. We rely on the familiar email address, the writing style, and our shared history. Yet right here, within the comfort zone of "business as usual," one of the most sophisticated and destructive threats of the digital age lurks: BEC (Business Email Compromise) fraud, which focuses on impersonation within the supply chain.

This is not just another virus that locks the computer and demands a ransom in Bitcoin. It is an art of social engineering, combining precise intelligence gathering, the patience of a predator, and virtuosic forgery skills. In this chapter, we will analyze the mechanism by which scammers infiltrate the most sensitive relationships of a business, understand the complex legal implications of "who is to blame when money disappears along the way," and outline the lines of defense that every business owner and financial manager must know.

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustrative purposes only.

The Silent Storm at "Techno-Logistics"

Amir was proud of the company he built. "Techno-Logistics" was stable and provided complex electronic components to manufacturing plants in Israel, relying on a tight network of suppliers in Taiwan and Germany. The beating heart of the relationship with suppliers was Dana, the procurement manager, who had worked with "Hans," the sales manager of their main German supplier, for years.

It all started on a routine Tuesday in October. Dana received an email from Hans. "Dear Dana," it read in his usual polite English, "We are undergoing an annual audit process and have changed our bank account details for receiving payments in foreign currency for efficiency purposes. Attached is the invoice for the last shipment (number 8892-G) with the new bank details in Frankfurt. Please confirm receipt."

Dana did not suspect a thing. The email address appeared identical to Hans'. The German company's logo appeared at the top of the invoice, and the details of the shipment—the quantity of components, the unit price, and the delivery date—were incredibly accurate. She forwarded the approval for payment to Amir, who signed it digitally, and the money—120,000 euros—was sent to the new account.

Ten days passed. The phone in Amir's office rang. It was Hans from Germany. "Amir, my friend, what is going on with the payment for shipment 8892? We are already a week past the due date, and my system is blocking new shipments."

"What do you mean?" Amir asked with a feeling of distress. "We paid you ten days ago. Dana received an email from you with the new bank details in Frankfurt."

Silence fell on the other end of the line. "Amir," Hans said in a low voice, "I never sent such an email. And we haven't changed our bank account in the last decade. Our bank is actually in Munich, not Frankfurt."

At that moment, the ground under Amir's feet shook. He realized they had fallen victim to a scam. The attack had started months earlier. Hackers had broken into the email account and waited. They quietly read every piece of correspondence, learned the speaking style, knew the names of the operators, and followed the delivery schedule. They waited for the moment when an invoice large enough to justify the "score" would be issued, and small enough not to raise unusual questions in the compliance department of Bank Leumi.

In such situations, seeking legal advice is done with a sense of urgency. It is possible to examine bank liability and the legal possibilities for recovering the funds, but it is important to understand that the legal and banking reality is complex and requires an in-depth analysis of the circumstances.

Anatomy of a Fraud: How They Break Into Relationships

To understand the legal side, we must first understand the mechanics of the scam. Unlike purely technological breaches, this involves the use of an existing business identity to carry out seemingly authorized actions. The attacker does not steal money directly from the account by hacking a password, but rather convinces the account holder to send the money of their own free will to the wrong address.

There are three main methods by which such impersonation is carried out against suppliers:

1. Full Account Takeover

The attacker gains full access to an employee's email at the company or the supplier, usually through phishing. From that moment on, they monitor the activity and set up automatic forwarding rules so that every relevant email is forwarded to an external inbox under their control. When they send the fake payment request, it may be sent from the real server, which creates a completely reliable presentation for the receiving party.

2. Look-alike Domains

The attacker registers a domain that is almost identical to the original domain, changing one character or one letter. The human eye, especially under work pressure, tends not to notice the slight change. They create a user profile with the name and picture of the familiar contact person and start a conversation.

3. The Human "Man-in-the-Middle"

The scammer manages to slip into the email chain and sends emails to both sides while impersonating the other. They manage the dialogue between them as a "filter," intercepting invoices, changing the bank details, and sending them to the paying customer.

The Legal Arena: Who Bears Responsibility When the Money Disappears?

When such an event occurs, a legal analysis is required to decide between two seemingly innocent parties: the supplier who did not receive their money, and the customer who paid the full amount—but to the wrong party.

The legal analysis examines questions of liability and negligence. In contract law and tort law, the concept of the "cheapest cost avoider" is examined. In other words, which of the two parties could have, with reasonable effort and simple preventative actions, prevented the occurrence of the case?

Customer Liability (The Payer)

It is possible to examine whether the customer had a duty to check the details and whether there were "red flags." A sudden change in bank details, especially if the account is located in a different country, may be considered a red flag. If a company makes a transfer without verifying the change via a separate and verified communication channel, its level of negligence may be examined according to the circumstances.

Supplier Liability (The Impersonated)

Conversely, one can examine whether the breach occurred on the supplier's servers and whether their security level was appropriate. If it turns out that the supplier did not take basic precautions that allowed the creation of the misleading presentation, liability may arise on their part.

The Issue of "Apparent Agency"

In some cases, the doctrine of "apparent agency" is examined—did one party create a representation that a certain person is their agent? However, courts tend to be very cautious in applying this doctrine to cybercrimes, as there is usually no real intent on the part of the business owner to authorize the hacker.

Bank Liability

When examining the liability of Bank Hapoalim and other financial institutions, a distinction must be made between the sending bank and the receiving bank. Payment services law regulates some of these aspects, but in wire transfers that the customer approved themselves, the sending bank may argue that it acted according to an explicit order. Liability may arise if it is proven that the bank ignored its professional duties or proper banking procedures in examining the receiving account.

The Triple Dance: The Attacker, the Victim, and the Business Partner

In legal representation in such cases, the challenge is often strategic. Usually, both businesses are interested in continuing the business cooperation between them, and prolonged legal proceedings could cast a shadow on the relationship.

Therefore, in many cases, the legal analysis leads to risk management and loss allocation. An examination of the level of negligence of both parties may lead to solutions of compromise and division of responsibility between them.

The following scenario is an educational example based on common fraud patterns.

In an educational scenario based on similar cases, a company paid a supplier a significant amount to a bank account that belonged to the scammers. After examination, it turned out that although the breach was on the supplier's side, the fake email contained suspicious signs that should have caught the payer's attention. In such cases, as part of risk management, the parties may reach a compromise that balances the responsibility of both factors and allows for the continuation of business activity.

Multi-Layered Defense: Preventing the Next Scam

Over the years of professional work, it appears that the most effective solution combines human procedures together with digital tools.

Out-of-Band Verification

This is a professional iron rule. Never approve a change in payment details based on an email confirmation alone. In any case of a change in bank account details, telephone verification must be performed with a known contact, using verified phone numbers that do not appear in the suspicious email itself.

Technological Protection of Mailboxes

The use of Multi-Factor Authentication (MFA) is an essential step in preventing breaches. It is also recommended to implement advanced security protocols that help mail servers identify fake messages.

Employee Training

Employees in finance and procurement departments should undergo training to identify fraud patterns and develop healthy skepticism. An organizational culture that encourages double-checking and asking questions is a significant defensive tool.

Contractual Arrangements

It is recommended to include clauses in contracts with suppliers that define in advance the authorized communication channels for changing payment details and the division of responsibility in the event of a cyber incident.

Red Flags

• Unusual Urgency: Time pressure applied to prevent in-depth inspection.
• Change in Bank Details: Various excuses such as "audits" or "technical problems" that require a transfer to a new account.
• Slight Change in Email Address: A different suffix or a missing letter in the sender's address.
• Language and Style: A change in the tone of address or unusual grammatical errors.
• Request for Confidentiality: An instruction not to involve other parties in the correspondence.

What to Do Immediately When a Scam Is Discovered?

1. Immediate Stop: An urgent request to the sending bank to recall the transfer.
2. Reporting to the Receiving Bank: An attempt to locate the receiving bank and report the suspected fraud for the purpose of freezing the funds.
3. Police Complaint: Filing a formal complaint with the cyber department to document the incident.
4. Documentation and Preservation of Evidence: Saving all correspondence and associated technical information (Headers).
5. System Check: Performing a comprehensive security check of the company's computers to ensure there is no active access by a hostile party.

A Concluding Legal Aspect

In cases of impersonation against suppliers, the legal analysis often focuses on examining "contractual fault." Courts may expect businesses to demonstrate a level of caution corresponding to known digital risks.

It is important to understand that there are possibilities for recovering funds, and the chances depend on the specific circumstances of each case. If it can be proven that a certain party breached their duty of care, a legal opening may be created for claiming compensation or allocating losses.

In this educational scenario, the result may be complex. After a legal examination of the evidence, it may be proven that the receiving bank ignored alerts, which could lead to a significant compromise settlement. Over the years, the firm has encountered diverse cases that teach us that in the digital world, "trust and verify" is an essential strategy for maintaining business stability.