Business Email Compromise: Who Bears the Loss When a Vendor Payment Goes to a Fraudster

If your office pays a supplier’s invoice into a “new bank account” sent by a fraudster, the loss usually stays with you. A debt is discharged only by paying the creditor or someone the creditor has authorised, so payment to an impostor does not ordinarily settle what you owe, and you may have to pay the genuine supplier again. The RBI’s customer-protection framework covers unauthorised debits, not a payment your own staff authorised. Call 1930 at once, file an FIR and pursue the receiving accounts, and from now on accept bank-detail changes only after a call-back on a number already on file.

How the fraud happens

Mr. Rao, an accounts officer at a public institution in Pune, owes ₹8 lakh to a regular supplier. An email with the supplier’s logo says: “Due to our annual audit, our bank account has changed.” The payment goes. Ten days later the supplier phones: “Sir, our payment has not come.”

There are two usual routes:

• The supplier’s mailbox was hacked. The email came from the genuine address. Unauthorised access is a civil wrong under IT Act s.43 and an offence under s.66 when done dishonestly or fraudulently.
• A look-alike address was used. For example “supplier.co” instead of “supplier.com”, or “rn” in place of “m”. That is identity theft (s.66C) and cheating by personation using a computer resource (s.66D).

Either way, the fraudster has cheated under BNS s.318. A genuine sender address does not make a genuine instruction.

Who bears the loss

1. Your debt is usually still unpaid. A debt is discharged by paying the creditor or its authorised agent, which the fraudster was not. Unless the supplier’s own conduct misled you, you may have to pay twice.
2. The bank is usually not liable for your authorised transfer. The RBI customer-liability framework (2017 circular, now in RBI’s 2025 Master Directions) covers unauthorised debits. Your staff approved this payment, so it is authorised, though induced by fraud.
3. The new RBI directions coming from 1 January 2027 cover some authorised-but-fraudulent transactions, but compensation is limited to gross losses up to ₹50,000, once in a lifetime. They do not help with business payments of several lakhs made today.
4. Shared fault. If the supplier’s mailbox was breached because of its own weak security, you may have an argument that it should share the loss, depending on your contract.

What to do in the first hours

1. Call 1930 and file on cybercrime.gov.in. Give the beneficiary account, IFSC, UTR number and amount so funds still there can be frozen.
2. Write to your own bank asking it to send a recall request to the beneficiary bank.
3. Register an FIR. Any police station can register it as a zero FIR under BNSS s.173. Attach the fraudulent email with full headers.
4. Preserve the evidence. Do not delete the email. Export full email headers. Copies of electronic records need a certificate under s.63 of the Bharatiya Sakshya Adhiniyam, so keep the original mailbox intact.
5. Consider civil recovery. Sue the account holders once identified; compensation under IT Act s.43 can also be claimed before the Adjudicating Officer (s.46).

The variant: a WhatsApp message from “the head of office”

A section officer gets a WhatsApp from an unknown number carrying the head of office’s photograph: “I am in a meeting. Please buy ten gift cards of ₹10,000 each and send me the codes.” It relies on authority, urgency and the hesitation to call a senior back.

This is not hypothetical. On 3 June 2022, Banaras Hindu University warned faculty and staff that WhatsApp messages from an unknown foreign number, carrying the Vice-Chancellor’s name and photograph, were asking them to buy 15 Amazon gift cards of ₹10,000 each. The university posted a public warning on its official handle telling staff not to entertain such requests.

This is IT Act s.66D and BNS s.319. The practical defence is a standing written instruction: no financial request received only on a messaging app is to be acted upon, and verifying it with the senior officer directly is expected, not disrespectful.

Prevention: the clause and the call-back rule

Add this kind of clause to every vendor contract and purchase order:

“Any change in the Supplier’s bank account details shall be effective only on a written request signed by an authorised signatory of the Supplier on its letterhead, and after the Buyer has confirmed the change by telephone with the Supplier’s contact person on the number recorded in the Buyer’s vendor master. The Buyer shall not be liable for any payment withheld pending such confirmation.”

• Call back on the number already on file, never the number in the new email.
• Senior approval before the first payment to a changed account.
• Train the accounts section and keep records: documented due diligence protects officers under IT Act s.85.

Frequently asked questions

We paid the fraudster in good faith. Do we still owe the supplier?

Ordinarily yes, because payment to someone the creditor never authorised does not discharge the debt. The supplier’s own role in the breach can change this, so check your contract and the facts.

Will the bank refund us under RBI rules?

Usually not. The current framework covers unauthorised debits. A transfer your staff approved is authorised, even if induced by fraud. Report to 1930 quickly to improve the chance of a freeze.

Which sections apply to the fraudster?

IT Act ss.43, 66, 66C and 66D, and BNS ss.318 and 319.

Is a hacked supplier mailbox the supplier’s fault?

Possibly, depending on its security and your contract; it may support loss-sharing.

Quick quiz

For staff who also want a short course on personal online fraud safety, see the Cyber Fraud Safety certificate course (₹299). For accounts and administrative teams: Cyber Crime Law for Offices and Institutions, ₹599. These are certificates of completion, not professional qualifications.

Sources

• Information Technology Act, 2000: ss.43, 46, 66, 66C, 66D, 85
• Bharatiya Nyaya Sanhita, 2023: ss.318, 319
• Bharatiya Nagarik Suraksha Sanhita, 2023: s.173
• Bharatiya Sakshya Adhiniyam, 2023: s.63
• RBI circular on customer liability in unauthorised electronic banking transactions, 6 July 2017, as carried into RBI’s 2025 Master Directions; RBI directions finalised June 2026, applicable from 1 January 2027
• Banaras Hindu University public warning, 3 June 2022, as reported in the press

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.