Invoice Scams

30 March 2025 in Fraud and Internet Scams | 5 min read | skip to FAQs

This article outlines the importance of incorporating contractual clauses to protect your business from invoice scams. The recent case of Mobius vs Inoteq is considered and effective steps that businesses can take to protect against internet invoice scams are discussed.

Background

The rapid growth of technology has directly affected the increase of fraudulent invoice scams, especially within business operations. Although legislation criminalises these activities, the continual advancement of scams has made it increasingly more difficult to detect and penalise. This results in many victims with no avenues to recover losses or seeking other remedial options.

The reliance on the internet and email for communication and payments transactions  between businesses, especially with digital banking systems, presents a risk of fraud and scam transactions and invoices.

The significance of Mobius v Inoteq

The legal case of Mobius Group PTY LTD v Inoteq PTY LTD (2024) WADC 114 is rather alarming for  businesses. It highlights the need for vigilance and extreme caution when paying an invoice, particularly where bank details are different to any earlier invoice.

In 2024, the District Court of Western Australia created a precedent by ordering a defendant (Inotec) to pay a large sum of money to the plaintiff (Mobius) after Inotec had paid a fraudulent invoice. The perpetrator of the fraud had hacked Mobius’s email system and fraudulently amended the bank details on the invoice that Inotec received.

This case was heard in Western Australia, however, the outcome is relevant to businesses in New South Wales. The case included some unique features, as discussed below. Nevertheless it provides a pertinent lesson on how businesses can avoid electronic invoice scams.

Summary of Mobius v Inoteq

Inotec was engaged on the Rio Tinto managed aquifer reinjection scheme project. In January of 2022, Inotec engaged Mobius, entering into a contract where Mobius was to perform electrical work for Inoteq.

1. In April of 2022, Mobius sent Inoteq an invoice (number 1105) for $200,687.59 due on 26 April 2022.  A further invoice (number 1107) was sent shortly after for $32,712.70 due on 4 May 2022.
2. On 28 April 2022 the payment of Invoice 1105 was outstanding. Mobius sent a reminder email to Inoteq who confirmed that Inoteq had received the invoice and would pay the following day.
3. On 28 April 2022 a fraudster hacked into Mobius’s email account and sent an email to Inoteq changing the details of its bank account in the Invoices 1105 and 1107. The fraudster sent the email containing the “new bank details,” and attached new fraudulent invoices.
4. Inoteq made telephone enquiries of Mobius regarding the altered bank details but did not conclude such enquiries.
5. On 29 April 2022 Inoteq paid the two invoices into the bank account that was nominated by the fraudster. This was later discovered by Mobius, who contacted the police and the bank.
6. Mobius recovered $43,541.13; but were unable to recover the remaining $191,859.16.
7. The trial commenced on 9 September 2024 and concluded on 11 September 2024.

Some of the Issues Considered by the Judge

Is the defendant (Inoteq) able to rely on an indemnity clause in an invoice scam?

1. Inoteq raised the indemnity clause, in accordance with clause 10.1 of the engagement contract.
2. Mobius raised that the indemnity clause does not cover fraudulent acts, and that the interpretation should be narrow.
3. The judge found that the security of Mobius’s email is not relevant and not a matter related to the performance of the contract. Therefore the events that led to Inoteq’s loss were not due to Mobius, rather to the fraudsters.

Did the Plaintiff (Mobius) owe a duty of care?

1. Inoteq argued that the plaintiff, Mobius, had a duty of care to take reasonable steps to avoid economic harm to the defendant. They alleged that Mobius had failed to put in place security arrangements and access controls to prevent unauthorised access or hacking to their email system and fraudulent emails being sent.
2. The Judge found that duty of care does not apply to this case. The Judge also noted that Inoteq’s act of asking for telephone confirmation and requesting proof of account change demonstrates their mindset and that they understood the dangers of paying into a new account. The Judge concluded that the onus was therefore on Inoteq to conduct further checks and confirm that the new account details were not fraudulent.

The Judicial Conclusions

The judge concluded that:

1. Inoteq did not undertake sufficient due diligence to protect themselves against the fraud. The telephone call made by Inoteq demonstrated clear suspicion and further adequate enquires should have been made.
2. Factually, the emails did not come from Mobius, thus Mobius cannot be held liable.
3. Willful blindness by Inoteq, the defendant cannot interfere with the realities of current commercial relationships.
4. The Court ordered Inoteq to pay $191,859.16 plus 6% interest per annum to Mobius.

Key Takeaways 

BSM Sydney lawyers advise incorporating a clause in any contract stipulating that payments will only be made to account details provided within the contract. This clause should ensure that any changes to bank details by the head contractor can only be made under strict, predefined conditions to mitigate the risk of similar fraudulent activities. This case also emphasises the need for extreme caution when making any payments of any invoices particularly where bank details have been amended.

How can BSM Sydney Lawyers assist you?

Brander Smith McKnight’s expert lawyers have decades of experience in business and contract law. Our fraud legal team are experienced in invoice scams and remain up to date with current case law. Our lawyers are therefore able to provide businesses expert advice contractual advice on how to protect the business from invoice scams. BSM Sydney lawyers offer a free 20 minute consultation to discuss any of your business needs, including the protection from electronic invoice scams.

FAQs

BSM Lawyer Sydney has offices conveniently located in Sydney CBD, Sutherland, Parramatta, Shellharbour and Wollongong.