Banks and businesses warned to be on alert to invoice hijacking

Civil fraud and asset recovery expert Alan Sheeley of Pinsent Masons, the law firm behind Out-Law.com, was commenting on a recent case in which an individual was defrauded of £103,670 by persons unknown, who had hacked his email account and intercepted a genuine invoice raised by the individual's builder.

Nicholas Ho was ultimately successful in his application for a 'Norwich Pharmacal' disclosure order against Lloyds Bank, with whom the fraudsters held their account, as well as a declaration that the monies he had transferred to that account had been received and were being held by the owner of that account on trust for him. However, in order to do so, he had to convince the court that it was "strongly arguable" that a fraud had been committed and it was in the public interest for Lloyds to provide the information necessary for the owners of the bank account to be identified, Sheeley said.

Invoice hijacking cases of this nature were becoming a "real issue", and "individuals and corporates really need to think before they press the send button in respect of funds", Sheeley said.

"The simplest thing to do whenever a large sum needs to be transferred is to send a small sum first - £25 for example - and then on receipt of that sum make a bigger payment," he said. "This should be standard practice. It is far too easy to make payments now, and people just need to apply common sense."

"The Payment Systems Regulator is currently looking at how best to protect victims of fraud. However, no matter what system is adopted, if a party tells its bank to make a payment then the bank will make that payment. Banks are under an obligation to make payments – it is what banks do. If banks do not make the payments then they will be in breach of their client contract. People need to think and protect themselves," he said.

A Norwich Pharmacal order is a special type of disclosure order which can be obtained from a court in very limited circumstances. It allows a victim of wrongdoing to obtain evidence and information from an innocent third party that has become mixed up in that wrongdoing, such as a bank or accountant. It can often be used without informing the person that has committed the wrong.

The High Court, in the recent case, was willing to grant the order sought by Ho on the evidence provided, according to a summary of the judgment published on Lawtel. The information as to the identify of the fraudster could not be obtained from any other source, so the bank was obliged to provide the necessary information given the public interest argument and the likelihood that the fraud had in fact been carried out.

"This is an example of the court being persuaded, based upon strong evidence of a fraud taking place and it being in the public interest to do so, to order trusteeship of the monies to the claimant," said civil fraud and asset recovery expert Jennifer Craven of Pinsent Masons.

"Given the increase in these types of fraud, it is likely that banks will see more and more of these types of orders coming their way. This raises important questions for banks as to how, in the current environment where fraud is on the increase, they handle claims for trusteeship, weighed against their duties to their own customers and bank account holders," she said.

Alan Sheeley said that it was vital for victims to act quickly after becoming aware that a fraud had taken place.

"Once a payment is made it is of vital importance that the victim acts quickly and engages civil fraud solicitors to seek orders such as the Norwich Pharmacal relief," he said. "Time is of the essence if the victim wants to maximise the chances of recovering the payment or understanding who, ultimately, is behind the fraud."