Invoice Fraud
Many web pages of international banks will define for you what invoice fraud is. For example Barclays’ bank web site states:
What is invoice fraud?
Invoice fraud involves a fraudster notifying your company that supplier payment details have changed and providing alternative details in order to defraud you. The fraudster could be claiming to be from your company’s genuine supplier, or even be posing as a member of your own firm. Funds are often quickly transferred so recovering money from fraudulent accounts can be extremely difficult.
How does invoice fraud happen?
Invoice fraudsters are often aware of the relationships between companies and their suppliers, and will know the details of when regular payments are due. The fraud may only be discovered when the legitimate supplier follows up on non-payments.
Fraudulent letters and emails sent to companies are often well-written, meaning the fraud is difficult to spot without strong operating processes and controls in place. Email addresses are also easy to spoof, or in the case of malware-infected PCs, criminals can access genuine email addresses.
The process of changing the bank details of someone you are paying should always be treated with extreme caution.
Examples of three cases our trading clients have been involved in over the last few months:
During 2020 some of our clients from the agri-commerce business have been direct or collateral victims of this type of fraud. Three trading companies have been affected, all of them with a very large volume of business.
In the first case, the client had bought a shipment of grain on FOB basis in the Black sea. The parties agreed to wash out the contract and as a result our client, the Buyers, sent an invoice to the Sellers for payment for about EUR 250,000.00. Unfortunately, the Sellers did not receive the correct invoice. Instead they received another invoice which, on its face, appeared to look like the Buyers’ actual invoice but was payable in a German bank. It also contained a beneficiary that did not match the Buyers’ name.
The Buyers claimed payment to the Sellers and the latter argued that the matter was being investigated before the criminal Courts of his country. As a result, our firm commenced GAFTA London arbitration for the Buyers, and the Sellers shortly after made a fresh payment to the Buyers to settle the case.
In the second case, our client sold a cargo of fertilizers and sent his invoice to the overseas Buyers for payment. However, the Buyers did not receive the Sellers’ invoice but another one issued by fraudsters. It is to be noted that the fraudster’s invoice was sent in an email written in English, whereas all the prior correspondence between Sellers and Buyers always took place in Spanish. The matter is being dealt with in commercial terms as the parties have a very solid commercial relationship of trading going back many years.
The most recent and significant case just happened earlier this week. It concerned a sales contract for feeding stuff sold on CIF terms with destination in a Middle East country. Sellers sent payment instructions to the Buyers, but the Buyers did not receive them. Instead, the Buyers received a well forged cover letter with different payment instructions. It contained the Sellers’ signatures and stamps, claiming payment of the goods’ price for more than five million Euros into a Spanish bank account. The beneficiary of the bank account was a confusing mixture of the Sellers’ name and a third party name. The Buyers made payment on the 23 September 2020 in accordance to the instructions contained in the forged document. As the Sellers did not receive payment, on the 28 September 2020, the Sellers contacted the Buyers to learn that the latter had made payment five days ago. The Buyers realized that payment had been made to fraudsters. It is noteworthy that someone from the fraudsters had the effrontery to call the Buyers’ office requesting a copy of the Buyers’ Director’s passport, which was then provided. The Buyers had not realized that the beneficiary name did not tally the Sellers correct name and sent the funds to a very large Spanish bank. Within 30 minutes from the client’s call to our firm, with the assistance of two top clients of our agri desk, we managed to contact two executives from the Spanish bank that received the funds. The client was asked to go to the police. Thankfully, the bank account of the fraudsters was blocked in less than two hours, and the matter is having a happy ending.
However, what happens when a Buyer pays for a sales invoice to fraudsters? Which party shall bear the consequences?
The numbers are very frightening. In the UK alone in the year 2018 more than 100 million Euros were lost as a result of this type of fraud.
A solution under the sales contract is to include a clause making sure it is clear that the burden of proof rest on the party that has to make the payment to put protocols and measures in place to ensure that no invoice fraud takes place.
For instance:
Payment shall be 100% net cash free of any commissions and or deductions into the bank account designated by the Sellers. Buyers shall ensure that funds reach the Sellers’ bank account timely and correctly and that Buyers have a security and checking procedure in place ensuring that no invoice fraud may take place.
What happens in the absence of such a clause?
One could run the argument that it is for the party that has suffered the breach of his communications to bear the consequences. In other instances, if the fraud was not well made and the documents contained a different beneficiary name or the language being used in the exchange of communications was not the usual one, this could bring liability to the party that made the wrong payment.
2019 GAFTA case K vs. A
We all know that England is the king jurisdiction to deal with commodity dispute resolution.
Last year a Gafta arbitration reached the High Court in London for a case where a fraud invoice had taken place.
The facts of the case were as follows:
By a written contract confirmation dated 16 September 2015 drawn up by Vicorus SA (“Vicorus”) as intermediary broker, and signed on behalf of the parties, A agreed to sell and K agreed to buy 5,000 metric tonnes, 2% more or less at sellers’ discretion, of Romanian sunflower meal in bulk for US$229 per m.t. FOB stowed/trimmed 1 safe berth, 1 safe port Galati, Romania, for shipment in the second half of October 2015. The payment provision (with correction of an obvious typographical error) was as follows:
“100% Net cash within 2 banking days to Sellers’ bank upon presentation of scan/fax copies of the following original documents to [Buyers]. Commercial Invoice …” The contract also incorporated the terms of GAFTA Form 119 which provided by Clause 18: “Notices. All notices required to be served on the parties pursuant to this contract shall be communicated rapidly in legible form…A notice to the Brokers or Agent shall be deemed a notice under this contract.”
On 2 November 2015, A loaded the goods on the vessel MV Sea Commander, which was common ground constituted good delivery. At 13:44 on 2 November 2015, (all times are CST unless otherwise stated) A sent an email with an attached invoice. The invoice, dated 30 October 2015, was for US$1,167,900, the correct contract price, and sought payment to Citibank NA, New York branch, account number 36323207 with a SWIFT number and a reference ending 3886. I shall refer to this as “the correct A account”. Vicorus’ email account purported to show that the email was forwarded by Vicorus to K at 15:05 with the attached invoice. However K denied receiving that email. K received an email which appeared to come from Vicorus at 15:50 which contained an attachment directing payment to a different account at the London branch of Citibank NA.
It was common ground that the invoices received by K providing for payment into the London account were fraudulent. At the hearing before the GAFTA First Tier Tribunal and the Board of Appeal, there were rival allegations as to where the fraudulent email manipulation had taken place, whether at any or all of the offices or servers of A, K, and/or Vicorus. Submissions were made on the basis of rival allegations as to who was at fault for the manipulation and who bore vicarious liability. In the Award, the Board of Appeal concluded that on the evidence adduced it was impossible to determine where or how the fraudulent manipulation had taken place, and it decided the appeal on that basis.
On 5 November 2015 K instructed its bank, Rietumu Bank, Riga, to make payment of the full price to A. The instruction was for a SWIFT payment via Deutsche Bank Trust Company America’s New York account, through Citibank NA New York as an intermediary, in favour of the fraudulent account at the London branch of Citibank NA. On the same day, and in response to a request for an update as to payment from A, K confirmed by email that the payment had been made.
A requested a SWIFT confirmation of the payment for the purposes of tracking the funds, and at 20:16 on 5 November 2015, K sent a copy of the SWIFT payment confirmation to A which identified the destination account as the fraudulent account in London. A however received a SWIFT confirmation purporting to be sent at 20:28 on 5 November from K confirming that the amount had been remitted for credit to the correct A account. Although not expressly stated in the Award, the implication from other findings is that this had been manipulated by the fraudster.
On 6 November 2015, A sent K a message that no funds had been received and sought payment. A asked K to confirm that the reference number had been added, and requested if it had not that K do so immediately. There are two further emails which purport to be from K to A. One asked A to confirm that the reference number which needed to be added was the sheikmancons one. The Award’s findings accept that this was received by A. The second attached a further SWIFT confirmation showing payment to the fraudulent account at Citibank NA London Branch. There is no finding that this was received in this form by A.
A then sent a further message chasing payment and asking K to check with their bank, identifying that payment should have been made to Citibank NA New York Branch for account 36323207, i.e. to the correct A account. On 9 November at 09:24, A again chased K for payment. On 10 November 2015, A continued to chase K for payment and relayed a recent advice from Citibank NA in New York that the funds were not visible and had not been received on their side.
On 13 November 2015, K emailed A asking for confirmation that funds had been credited to A’s account. K advised that its bank had been told by Citibank NA New York branch that the latter had had payment confirmed by the London branch on 10 November 2015. It also recorded that Citibank NA London branch had sent a message through the banking chain requesting confirmation from the buyers’ side that all due diligence had been performed on the payment “as last payment for same beneficiary has been recalled because fraudulent.” That may explain the fact that the funds were not removed from the fraudulent account in London.
The payment of US$1,167,900 was converted by Citibank into £ sterling before being credited to the fraudulent account (in the name of Ecobank) in the amount of £768,372.45. The reasons for the conversion are not the subject of any findings, but it may simply have been the result of that being a £ sterling denominated account in London.
By 23 November 2015, the parties suspected fraud. Funds remained in the Ecobank account in London. On that date A emailed K stating that there were two errors with the payment, one being that it was not credited to the correct account and the other being that it was converted from US dollars into £ sterling. The message recorded the advice of Citibank that in order to remedy the position it was necessary for Citibank to repay the funds and receive a second payment that was correctly designated. The email suggested that the intermediary bank, Deutsche Bank, should recall the funds from Ecobank and then remit them to the correct beneficiary account in A’s name, namely account 36323207 at the New York branch. K reverted attaching the (fraudulent) invoice it had received and stated it did not see any of the account details which A had now quoted. K asked for confirmation that the new account details were the correct ones. This is consistent with this being the first time K had seen the correct destination account details.
On 24 November 2015, Ecobank approved the debit from their account of £674,831.46. This was less than the sum credited of £768,372. Citibank explained the difference on the basis of fluctuations in foreign exchange rates. The £674,831.46 was transferred to A’s correct account on 18 December 2015. Conversion at the prevailing exchange rate made this equivalent to $1,006,253.07, leaving a shortfall from the contractual price of US$161,646.93, which was the sum claimed by A in the arbitration commenced on 12 January 2016.
Gafta First Tier:
The GAFTA First Tier Tribunal made an award on 7 July 2017. It appears from passages in the Board of Appeal Award that the First Tier Tribunal approached the issue on the basis that the loss should be borne by the party whose email account was hacked.
Gafta Board of Appeal:
On Appeal, the Board’s reasoning involved the following steps: (1) Although it appeared to be common ground that a fraud had occurred and that an email account was likely to have been manipulated, the Board considered that it could not make any finding on the evidence before it as to how the fraud occurred. What the parties and Vicorus variously alleged must have happened had to be treated as supposition. The Board therefore declined to make any finding on when or how the fraud occurred but proceeded on the basis that it had to identify the allocation of liability based on risk (Award paragraph 9.9). (2) The claim was for payment of the balance of the price, not a claim for damages (Award paragraph 9.19). (3) The emails and invoices sent by A to Vicorus contained the correct bank details for payment into A’s nominated bank account. By reason of clause 18 of GAFTA 119, the emails and attachments sent by A to Vicorus constituted good notice under the contract because Vicorus were acting in their capacity as Broker (Award paragraph 9.28). (4) Accordingly under the contract it was K which bore the risk of receipt of the incorrect bank details which was what caused payment to be made into the incorrect account. K’s duty was to transfer the price “into the account nominated by [A]”, which K had failed to do. “Accordingly, WE FIND THAT Sellers did send a correct invoice under the Contract to Buyers via Brokers (or direct) and further that Buyers were in breach of contract by their failure to pay Sellers the correct value of the goods into the correct bank account nominated by Sellers”. (Award paragraph 9.29). (5) “Sellers had satisfied their obligations to Buyers under the Contract by delivering goods and were entitled to payment as per their invoice sent to Vicorus. It was therefore up to Buyers to fulfil their obligations. THE BOARD FINDS THAT Sellers were entitled to receive 100% of the invoice amount as per Contract and, in the Board’s opinion, it was not sufficient that Buyers had demonstrated that 100% of the invoice amount had been paid; Buyers’ obligation was to ensure that 100% of the amount in cash equivalent was received by Sellers in the nominated bank account………..Accordingly, the difference between the amount paid to Sellers by recovery of the amount from Sellers’ bank and the amount invoiced for the goods (whether a cost of foreign exchange or not) is recoverable by Sellers as this was a consequence of payment by Buyers into the incorrect account.” In relation to interest the tribunal not only awarded interest on the disputed sum of US$161,616.93 but also on the full purchase price of US$1,167,900 for the period between 6 November 2015 when it was due and 18 December 2015 when £674,831.46 or its dollar equivalent was received into the correct A account.
The High Court judgment, Popplewell Mr. J. held, inter alia, that:
Out of the grounds put under sections 68 and 69 of the 1996 Arbitration Act, it is worth reproducing the following passages of the High Court judgment.
(…) It is true that paragraph 9.31 of the Award talks of the obligation being one to ensure that 100% of the price was received by A into the nominated bank account, which read literally would be overstating the extent of the obligation. The buyer is not the guarantor of the correct processing of the payment between the seller’s bank and its customer. But reading the Award as a whole without an unduly critical attempt to pick holes in it, it is clear that the Board’s reasoning was that the payment obligation was not fulfilled unless transfer instructions were accompanied by the destination account details notified by A, because without such details there could be no question of a transfer which was equivalent to net cash. That conclusion seems to me to be obviously right. The contractual obligation is to make payment to the seller’s bank for the account of the sellers, in the sense that it must be accompanied by the account details which the seller has notified. This is in substance what the Board held.
The cases relied on by Mr Nolan were concerned with the moment at which hire transferred to shipowners’ banks could be said to have been paid to shipowners themselves within the meaning of the hire payment clause in the relevant time charter, a matter of importance because of the withdrawal clause in the charterparty. But in those and other cases where the timing point has arisen, the transfer had been accompanied by the correct account details, and the debate was simply whether the moment of payment is receipt by the bank, a reasonable time thereafter in which to credit the customer’s account, or the moment at which the account is in fact credited. Those cases lend no support to the proposition that payment can be treated as made when accompanied by incorrect destination account details.
Indeed Mr Nolan’s submission that it was the bank alone who needed to have unfettered access to the funds, irrespective of destination account details being correctly given, seemed to me necessarily to lead to the conclusion that if the payer gives account details which are known not to be those of the payee but of a wholly unrelated third party, the payment obligation is fulfilled by transfer for the benefit of that third party merely because the accounts are held at the same bank, which would be a commercially absurd result.
Mr Nolan sought to advance an alternative argument that if that were the true nature of the obligation, it was fulfilled on the facts of this case (independently of the argument relying on the emails of Mr Gey of 9 and 10 November which I address below). However it became apparent that the submission depended upon messages which were not included in the findings of fact made by the Board and were not Aissible before me on a section 69 application. The Board reached the right legal conclusion on the nature of the payment obligation and found on the facts that it was not fulfilled. This argument is therefore not available to A on this application.
Finally, the judge agreed to one of the arguments run by the appellants, K, holding that the latter were entitled to the remission to the Board to reconsider its reliance on clause 18 of GAFTA 199 form with the benefit of submissions from the parties on the point.
Conclusions:
In the era of internet and digitalization, these fraud cases are bound to spring up. Each case is to be tackled and judged by its own facts, but Sellers are warned to ensure they insert provisions in the sales contracts protecting their interest where as a result of a fraud the Buyer makes payment to a fraudster. Buyers in turn must pay careful attention to documentary instructions, put in place very secure communications systems, and set up of protocols for payment to alert them of any detail that may become suspicious in a payment transaction.
Arizon Abogados S.L.P