Chapter 74: The Shadow in the Inbox: Invoice Fraud and Business Email Compromise (BEC)

Over the years, while providing professional support to businesses, companies, and organizations, it has become evident that the modern battlefield is not only found within the walls of a courtroom, or even in the cutthroat business competition on the street. It is located inside your inbox. In previous chapters, we addressed scams directed straight at the top—CEO fraud—or the technical alteration of supplier details. This chapter, however, deals with a sophisticated threat that combines a silent technological breach with social engineering: Business Email Compromise (BEC) and fake invoice fraud.

This is a world where the criminal is not merely an impersonator; they become a covert 'tenant' within the organization. They read the correspondence, study the writing style, understand the organizational structure, and wait for the right moment when a significant sum of money is being transferred to divert it onto their own path. In this book, 'Have You Been Scammed?', the goal is to expose this mechanism not only to warn, but to present the legal and practical tools for dealing with the event on the day after.

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

The Calm Before the Storm: An Educational Scenario Regarding 'Solid Foundations' Ltd.

Rina (a pseudonym) was a bookkeeper at a mid-sized contracting company specializing in infrastructure. She was considered a thorough employee who knew all the company's suppliers personally.

One Tuesday, in the early afternoon, Rina received an email that appeared to be from the company's primary supplier. The email was a direct continuation of an existing email thread regarding an active infrastructure project. 'Hi Rina,' the email read, 'Attached is the updated invoice for the latest steel shipment. Please note that due to an internal accounting audit on our end, we have temporarily changed the payee account to our subsidiary's account. An official bank verification document is attached. Thanks, Gilad.'

Rina opened the attachment. The invoice looked perfectly legitimate: the supplier's logo, the correct address, and the precise breakdown of the goods provided. Even the company's internal purchase order number appeared there. She also saw the bank verification—a document that appeared to be an official statement confirming the new account details. The email was sent from an address that appeared completely identical to the one they had used for correspondence over the past several years.

She entered the details into the banking system. A significant sum of money was transferred to the new account. Rina sent a reply email confirming the transfer and received an almost immediate response thanking her for the prompt handling.

Two weeks later, during a routine phone call with the supplier, it turned out that the supplier had not requested to change the account details and had not received the payment. Upon closer inspection of the email sent two weeks prior, a tiny change in the sender's domain name was discovered—a change of a single character that turned the address into an impersonation. The hackers had been 'on the line,' reading the correspondence, and learning exactly when to send the fake invoice.

In a scenario of this type, the money is usually withdrawn minutes after the transfer and passed through a series of shell accounts, making it very difficult to recover immediately without rapid intervention.

The Anatomy of the Breach: How Do They 'Sit' on Business Email?

To understand how such a scam occurs, it is important to realize that cybercriminal organizations operate methodically. BEC fraud is typically divided into four stages:

1. The Infiltration Stage

The attackers choose a target—usually a company that performs high-value bank transfers. The initial infiltration is usually carried out via 'phishing' or by purchasing leaked passwords. Once they have access to an email inbox within the organization (or the supplier's organization), they may remain hidden for the purpose of intelligence gathering.

2. The Monitoring Stage

This is a stage where the attacker may set up 'routing rules' in the compromised inbox. Emails containing specific keywords are automatically forwarded to the attacker, who studies the contracts, schedules, and style of communication between the parties.

3. Creating the 'Doppelgänger' Domain

The attacker creates a domain that looks almost identical to the original. A change of one character or a different suffix may not raise suspicion in an untrained eye or during periods of heavy workload. In some cases, more advanced techniques are used to send an email from the seemingly legitimate address.

4. The Execution

The attacker 'hijacks' the email chain at the exact moment an invoice is expected to be processed. The combination of familiarity with the transaction details and high-quality graphic forgery increases the success rate of the scam.

The Legal Aspect: Exploring Liability Options

When such a case reaches legal review, the question of liability arises between the parties involved: the victimized business, the supplier, the originating bank, and the receiving bank. The legal analysis typically focuses on tort law, contract law, and payment services law.

The Payment Services Law, 2019

This law establishes the allocation of liability between the customer and the payment service provider in the event of an 'unauthorized payment transaction.' In BEC cases, a legal difficulty sometimes arises because it is the customer who performed the actual authorization. Therefore, the examination of the case will focus on whether the authorization was obtained through fraud under circumstances that should have raised suspicion for the payment service provider.

Liability of the Payment Service Provider (The Bank)

In certain cases, it is possible to examine whether the bank breached its duty of care toward the customer. Courts may examine whether there were 'red flags' that the bank should have identified, such as an irregular transfer to a new account or a clear discrepancy. The possibility of imposing liability depends on the specific circumstances and the question of whether there was a concrete suspicion of fraud that could have been prevented.

The Struggle Between the Business and the Supplier

Another complex issue is the question of who bears the responsibility for the breach itself. If the email was compromised on the supplier's side, an argument may arise that they did not take adequate security precautions. Conversely, the supplier might claim negligence by the business for failing to verify the account details. In these cases, courts examine which of the parties was the 'cheapest cost avoider' and may determine a division of liability based on 'contributory negligence.'

Defense and Risk Management Strategies

During the professional years of an attorney working in this field, it has become clear that prevention is the most effective tool. The risk of BEC fraud can be reduced by adopting clear protocols:

Out-of-Band Verification

It is recommended to establish a procedure stating that one should not rely on email as the exclusive source for changing payment details. In any case of a request to change a bank account, an out-of-band verification must be performed by phone with a known contact at the supplier's official phone number.

Multi-Factor Authentication (MFA/2FA)

Enabling multi-factor authentication on all corporate email accounts is a basic and essential step. A business that does not implement these types of safeguards may be considered as having failed to take reasonable precautionary measures.

Employee Training

Periodic training to increase awareness among finance department staff can help identify warning signs, such as subtle domain changes or suspicious phrasing.

Cyber Insurance and Contractual Aspects

One may consider purchasing insurance policies that cover cyber events and social engineering. Additionally, it is recommended to include clauses in supplier contracts that regulate how changes to payment details will be executed.

Summary of Legal Analysis

The law in Israel is undergoing adjustments for the digital age, and the standard of care expected from banks and businesses is rising. While in the past it was difficult to impose liability on financial institutions, today their liability can be examined according to their ability to identify anomalies in payment systems.

The chances of recovering funds or receiving compensation depend on the circumstances of the case, the degree of negligence of the parties, and the speed of response after the discovery of the fraud. Questions such as the source of the breach, the customer identification procedures at the receiving bank, and adherence to basic security protocols are what will tip the scales when a court comes to examine the allocation of liability.

In conclusion, BEC fraud exploits trust and the desire for efficiency in the business world. Sometimes the most correct step is to stop, check, and perform a simple human verification before clicking the transfer button.