Bank not liable for forged mails.

A decision of the Federal Supreme Court (ruling 4A_9/2020 of 9 July 2020) shows the limits of the bank’s liability and at the same time indicates which circumstances would have justified liability.

Fraudsters hacked the e-mail account of a Turkish national and sent a total of 8 fictitious payment orders to the bank over a period of just over a month. In this way, they quickly made off with several hundred thousand francs. The Federal Supreme Court ruled that the client had to bear this loss himself. It argued that the client had previously expressly authorized the bank to accept instructions, in particular by e-mail, and to execute them immediately without prior written confirmation. The client had also done this himself several times before the email account was hacked. The bank did not have to systematically assume that emails could be forged. The fraudulent emails were very similar in language to the originals, and the amount of the transactions did not make it necessary to ask for further information, given the client’s assets. Finally, the money had been transferred to known banks in Great Britain and not to exotic destinations where the bank should have been suspicious. For these reasons, the bank could not be accused of serious fault and the passing on of the loss to the customer provided for in the general terms and conditions was permissible.

Assessment:

In this case, the victim was a very wealthy person who regularly placed large payment orders by e-mail. The payments triggered by the fraudsters therefore did not have to come to the attention of the bank. Moreover, by instructing the bank to execute orders by e-mail immediately, the victim had deprived himself of the argument that the bank had to ask for confirmation of the order before executing it. In addition, the fraudsters were very clever: By gaining control of the victim’s email account, they were able to read the messages exchanged between the victim and the bank and therefore imitate the style maintained by the victim.

The verdict seems correct – it is a reminder of the dangers that arise from e-mail correspondences.