Business Email Compromise Fraud: Should the Paty Best Positioned to Avoid the Fraud Bear the Loss?
Business email compromise (“BEC”) occurs when a payee’s business email account is compromised or impersonated. The threat actor, posing as the payee or its representative (e.g., the head of the accounting department), sends alternate wire or ACH instructions, causing the payor to direct an otherwise planned payment to an account unassociated with the intended payee. By the time the intended payee inquires about its nonreceipt of funds, the threat actor has already redirected funds from the recipient account, leaving the payor “out” the payment but the intended payee without compensation. Although there is a relative dearth of case law addressing which party should bear the loss under this fact pattern, two divergent approaches have emerged. The Imposter Rule The first approach, adopted by most of the courts that have examined this issue, is to apply the “Imposter Rule” from Article 3 of the Uniform Commercial Code (“UCC”). 1 Although Article 3 addresses third-party fraud in...