Follow us on Google News
An Australian court has ordered Inoteq to pay ₹1.27 crore after hackers diverted payments using a supplier’s compromised email.
How Did the Invoice Fraud Occur?
Inoteq Pty Ltd had engaged electrical contractor Mobius Group to carry out work on a Rio Tinto project. In March and April 2022, Mobius issued invoices totalling approximately ₹1.56 crore for the work. When Inoteq prepared to settle the invoices, hackers gained access to Mobius’s email system and sent messages containing altered bank account details.
The first fraudulent email appeared to originate from a Mobius director and instructed Inoteq to update its payment records. An Inoteq employee attempted to verify the change by telephone, but a poor connection prevented confirmation. The company subsequently requested proof through email, unaware that the hacker could respond using the compromised account. Inoteq transferred the money to the fraudulent account.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
How Was the Fraud Discovered?
The deception came to light approximately a week and a half later when Mobius contacted Inoteq about its unpaid invoices. Both companies realised that the payments had been redirected, and police were informed. By then, some of the stolen funds had been transferred overseas. Authorities recovered approximately ₹28.82 lakh, leaving ₹1.27 crore outstanding.
A cybersecurity expert told the court that the attacker had accessed the email account of a Mobius director, making the fraudulent messages difficult to identify through their sender address alone. The expert maintained that telephone verification was necessary before accepting changes to bank account details.
Why Did the Court Hold Inoteq Responsible?
Mobius initiated legal proceedings against Inoteq to recover the outstanding payment. Inoteq argued that it should not bear responsibility, relying on an indemnity clause in its contract. It also alleged that Mobius had failed to exercise adequate care in protecting its email accounts.
However, District Court of Western Australia Judge Gary Massey rejected both arguments. The judge acknowledged that Inoteq had taken a reasonable initial step by calling Mobius. Nevertheless, because the call failed to confirm the banking change, another verification attempt should have been made.
The court found that relying on the subsequent email response was insufficient and ordered Inoteq to pay approximately ₹1.27 crore, together with annual interest of six per cent.
What Does the Ruling Mean for Businesses?
The dispute highlights the financial consequences of accepting revised payment instructions without independent confirmation. Australian Competition and Consumer Commission figures cited in the case showed that false billing scam reports increased from 13,120 in 2020 to 39,587 in 2023.
Lawyer Andrew Bower described the ruling as the first reported decision, to his knowledge, involving fraudulent banking instructions sent exclusively through a compromised legitimate email address. The judgment places particular emphasis on verifying payment changes, even when instructions appear to originate from an established supplier.
