Fake invoices with a false IBAN – what to do if you have fallen for fraudsters?

My law firm is seeing an increasing number of cases in which clients have become victims of bank transfer fraud and have been taken in by forged invoices with manipulated IBANs. In my experience, it is often the case that senders are hacked by poor IT and correctly created invoices are changed and sent directly on the sender’s server. These invoices often contain a note such as “Oh, sorry, take this invoice…” or “this contract”. In contrast to the ruling of the Higher Regional Court of Karlsruhe of 27.07.2023 (Ref. 19 U 83/22), this may lead to liability on the part of the sender.

The judgment of the Karlsruhe Higher Regional Court – an isolated case?

In its judgment of 27.07.2023 (case no. 19 U 83/22), the Higher Regional Court of Karlsruhe ruled that the buyer must pay even if they have transferred money to a forged invoice with a false IBAN. The case concerned the purchase of a used car. The seller had initially sent a correct invoice, but shortly afterwards the buyer received a second email with changed bank details. He transferred money to this account and ended up without a car and money, and the OLG found that the buyer was obliged to check the authenticity of the second e-mail. The purchase price debt was not fulfilled by the transfer to the wrong account.

Is that always the case? Do I have to pay twice?

In my experience, this judgment cannot be generalized. Whether the invoice recipient has to pay again depends very much on the individual case. The decisive factor is how plausible the forged invoice was and whether the recipient could and should have recognized the manipulation. it is true that the payment to the false account does not result in fulfilment of the purchase price debt, as it is a debt to be discharged at the creditor’s domicile. However, there may well be claims against the allegedly hacked sender, depending on how well they have protected their IT systems and whether they are partly to blame for the hack.

Further cases of bank transfer fraud

Unfortunately, bank transfer fraud is a widespread phenomenon. The fraudsters use various scams:

• CEO fraud: Here, the perpetrators pretend to be a high-ranking executive and instruct employees to make urgent bank transfers.
• Fake invoices from suppliers: Hackers penetrate suppliers’ email servers and send fake invoices.
• Romance scam: Scammers use dating platforms to gain the trust of their victims and then ask for money.
• Phishing: Bank customers are lured by e-mail or SMS to fake websites where they are asked to disclose their access data.

What to do if you have fallen for a fake invoice?

Anyone who notices that they have paid a fake invoice should act quickly:

• Inform your bank immediately and try to arrange a return transfer. Unfortunately, according to the SEPA rules, this is often no longer possible if the transfer has already been executed.
• In any case, file a complaint with the police. In combination with an investigation request to the bank, this may lead to the money being seized.
• Document and secure all evidence, especially e-mail correspondence.
• Inform the actual biller and describe the facts of the case.
• Seek legal advice. A lawyer can check whether you have to pay again and whether there are any claims against the sender.

I would be happy to advise you – make an appointment now!

Have you also fallen victim to bank transfer fraud and been taken in by a fake invoice? Don’t know what to do now? I will be happy to advise you on your options and represent your interests vis-à-vis the biller, and you can easily book an initial assessment of your case via my Calendly tool. In a 15-minute phone call, you describe your case to me and I give you an initial legal assessment. You can find the link to this directly here on my website, and for more in-depth advice it is best to make an appointment with my office right away. With Velevo GmbH & Co KG, I also have a strong partner at my side to analyze possible IT weaknesses at your company or your invoicing party and thus strengthen your position – an audit is definitely worthwhile and I can help you with this. Simply contact me at info@itmedialaw.com or via the contact form on my website. Together we will find a solution! I look forward to getting to know you and supporting you in your difficult situation.

Author: Marian Härtel

Marian Härtel ist Rechtsanwalt und Fachanwalt für IT-Recht mit einer über 25-jährigen Erfahrung als Unternehmer und Berater in den Bereichen Games, E-Sport, Blockchain, SaaS und Künstliche Intelligenz. Seine Beratungsschwerpunkte umfassen neben dem IT-Recht insbesondere das Urheberrecht, Medienrecht sowie Wettbewerbsrecht. Er betreut schwerpunktmäßig Start-ups, Agenturen und Influencer, die er in strategischen Fragen, komplexen Vertragsangelegenheiten sowie bei Investitionsprojekten begleitet. Dabei zeichnet sich seine Beratung durch einen interdisziplinären Ansatz aus, der juristische Expertise und langjährige unternehmerische Erfahrung miteinander verbindet. Ziel seiner Tätigkeit ist stets, Mandanten praxisorientierte Lösungen anzubieten und rechtlich fundierte Unterstützung bei der Umsetzung innovativer Geschäftsmodelle zu gewährleisten.