Payment scam-where do we stand

[Harry H]

Had a chap do some minor repairs for us. He sends an invoice then a couple of days later asks us via email to pay his PayPal account instead as he's having trouble with his bank. Seemed odd but it's not a huge amount so thought we'd help him out and did as he'd asked.

Week later he's chasing us for the money claiming his email account had been hacked and we still owe him. We've got on to PayPal but no surprise there's not a lot of response.

Where do we stand.

[interstellar]

Did you pay him as friends and family on PayPal or did you pay an invoice to a company?

[Harry H]

Invoice to a company

[Pixelpeep 135]

There is an expectation that the company you are dealing with has adequate security in place and you've acted in good faith based on commination's you have received from the organisation.

a 'hack' is entirely their issue - as long as you've made reasonable checks (email address is correct and not just the 'reply' field etc)

I'd be more reporting them to the ICO for a data breach and asking them how they intend to put it right.

[interstellar]

Harry H said:

Invoice to a company

you are covered then as long as it wasn't friends and family. Its his issue with paypal, I would tell him you have paid it and he needs to take it up with pay pal.

Could he be trying it on?

[Pixelpeep 135]

interstellar said:

Harry H said:

Invoice to a company

you are covered then as long as it wasn't friends and family. Its his issue with paypal, I would tell him you have paid it and he needs to take it up with pay pal.

Could he be trying it on?

It's not paypals issue.


they didn't do anything wrong.

[Canon_Fodder]

OP this is a commercial case but may be informative...


https://www.pbctoday.co.uk/news/construction-techn...

[Harry H]

Canon_Fodder said:

OP this is a commercial case but may be informative...


https://www.pbctoday.co.uk/news/construction-techn...

Had a read of that and appears contradictory to Pixels response.

The email to pay via PayPal was sent from his account and turns out the PayPal email address looks like an employee of his.

Looks like he's been ripped off by one of his employees, he may know exactly what's happened but would seem it's easier to chase us.

[Canon_Fodder]

Harry H said:

The email to pay via PayPal was sent from his account and turns out the PayPal email address looks like an employee of his.

Email addresses are not always what they appear to be - various aspects of them can be spoofed or altered to mislead.

The advice in this situation is always to confirm these changes verbally - ring the person in others words.

If you had paid via your bank account they (your bank) would have covered it, but Paypal may not be bound by the same codes of practice.

[zedx19]

The simple thing here is to open a dispute via Paypal, as the OP has said he didn't send via family and friends. Paypal will investigate and I'd imagine the OP will get a refund. OP then pays the chap and tells him to sort his email security out!

[Canon_Fodder]

Harry H said:

We've got on to PayPal but no surprise there's not a lot of response.
.

OP could you clarify this please - what exactly have you done with Paypal? Have you opened an 'unauthorised payment' dispute?

[p4cks]

Have you spoken to Paypal on the phone? They've been very, very good on the two occasions I had to speak to them

[Harry H]

We'll have another crack at PayPal and will report back.

It may be a while though as I'm jumping on a plane tomorrow for some Easter sun

[Canon_Fodder]

That's the spirit

[Countdown]

Canon_Fodder said:

OP this is a commercial case but may be informative...


https://www.pbctoday.co.uk/news/construction-techn...

That's what we were informed when we got stung for £6.5k.

Now if we're asked to change supplier details we always ring them up to confirm verbally.

[skeeterm5]

Looking at the news you may have ample time while at the airport to give PayPal a call 😊

[Terminator X]

Pixelpeep 135 said:

There is an expectation that the company you are dealing with has adequate security in place and you've acted in good faith based on commination's you have received from the organisation.

a 'hack' is entirely their issue - as long as you've made reasonable checks (email address is correct and not just the 'reply' field etc)

I'd be more reporting them to the ICO for a data breach and asking them how they intend to put it right.

Is it that clear cut? The OP didn't pay to the original requested route, they altered it when hacked email account asked. Obligation on OP to check alternative payment first eg by calling the person expecting the payment?

My invoices for example are always the same account and have been for 10 years or so. If a client of mine paid someone else due to a hacked account I would be up in arms about it too.

TX.

[qwerty360]

Pixelpeep 135 said:

There is an expectation that the company you are dealing with has adequate security in place and you've acted in good faith based on commination's you have received from the organisation.

a 'hack' is entirely their issue - as long as you've made reasonable checks (email address is correct and not just the 'reply' field etc)

I'd be more reporting them to the ICO for a data breach and asking them how they intend to put it right.

Email is difficult to secure. It is comparable to a postcard (The 'from' address is specified by the sender; You can put anything in (afaik it doesn't even need to be a valid email address format...) If anything it is significantly LESS secure than a postcard given it is much harder to copy a postcard and the laws on interfering with physical mail are much much stricter than electronic communication While you can add encryption and authentication, but both of these are done after the fact (and generally aren't used because it is deemed too difficult.)

An invoice should state on it who you pay; Changing this should be difficult (sensible companies now include instructions on the invoice that it shouldn't be changed by email for example...)

I am fairly sure that you are the one who has been defrauded, so it is your responsibility to go to police + contact paypal regarding fraud and your loss not the company/individual you were paying.

Edited by qwerty360 on Thursday 14th April 19:15

Edited by qwerty360 on Thursday 14th April 19:15

[SmoothCriminal]

I can't work out why people don't pick up the phone and check.

You see them in the paper all the time with the sad faces because they've sent their house deposit to someone in Nigeria because an email said so and then they blame the bank or want compo.

Any money I send unless previously confirmed gets a phone call to check

[Electro1980]

Canon_Fodder said:

OP this is a commercial case but may be informative...


https://www.pbctoday.co.uk/news/construction-techn...

That is not the same as
a) that is B2B, which has different expectations for due diligence.
b) that talks about spoofed emails, not hacked.