CURRENT MONTH (May 2025)
Risk Allocation in Fraudulent Funds Transfers to Cybercriminals: Make the Call
By Alan S. Wernick, Esq., Wernick & Associates, LTD.
Who is at risk of loss when a payor and a payee are victims of a cybercriminal’s scam and monies are sent (e.g., via a wire transfer) by the payee to the cybercriminal? With the acceleration in the number of cyberattacks and malware injections, this is a question that an increasing number of businesses must grapple with. The answer depends on the applicable law, which may shift the risk of loss, and the facts, which may be quite nuanced.
In a recent decision in Thomas v. Corbyn Restaurant Development Corp., the Court of Appeal of California, Fourth Appellate District, Division One (No. D083655, 2025 Cal. App. LEXIS 332 (Cal. Ct. App. May 27, 2025)), was presented with “an issue of first impression in California: Which party bears the risk of loss when an imposter causes one party to a settlement to wire settlement proceeds to the imposter instead of the other settling party?” The Court ultimately affirmed the trial court’s judgment against the defendants and defendants’ defense counsel (the payor) who acted on a cybercriminal’s “spoofed” emails and phone call which purported to be from plaintiff’s counsel, and fraudulently instructed them to wire transfer a $475,000 settlement to the cybercriminal’s bank account. After the parties discovered the fraud, the defendants refused to pay the plaintiff, and the plaintiff applied ex parte to enforce the settlement agreement.
The Court’s analysis focused on the Uniform Commercial Code Section 3-404(d)’s “imposter rule.” That rule provides that a “if a person paying the instrument or taking it for value or for collection fails to exercise ordinary care in paying or taking the instrument and that failure substantially contributes to loss resulting from payment of the instrument, the person bearing the loss may recover from the person failing to exercise ordinary care to the extent the failure to exercise ordinary care contributed to the loss.”
The Court cited several federal cases that have considered the issue confronting it in this case of first impression and found those cases had uniformly shifted the risk of loss caused by an imposter’s fraud to the party in the best position to prevent the fraud. And the Court found that the trial court’s allocation of the risk of loss was supported by substantial evidence detailed by the trial court.
The bottom line is that before you send that wire transfer (or send money by other means, or act based on an “urgent” request), verify with a trusted individual at the recipient’s business using a trusted (verified) method (or methods) of contact that any changes whatsoever in the payee’s banking or wire transfer information are valid and/or that the “urgent” request to act is valid and duly authorized. It is better to make the call to a known person at a known number and verify, than to not make that call and have the funds diverted to someone other than the intended recipient.
For more information, please see Business Law Today’s forthcoming full-length article on this topic.
© 2025 Alan S. Wernick.
