Fake payment instruction: Trades (electrical, plumbing, joinery, painting), Germany
A trade business sent interim and final invoices as PDFs by email; on the final invoice for 15'000 euros, unknown persons changed the account details, and the customer paid third parties.
- Incident · date unknown · Schleswig-Holstein, Germany
- Evidence: confirmed by an authority
- Fake payment instruction
As of
What happened
On 18.12.2024, the OLG Schleswig ruled (12 U 9/24) that the customer does not have to pay again: she is entitled to damages under Art. 82 GDPR because the business had sent the invoice without end-to-end encryption. The business is thus left without its payment for the work.
- Affected
- Company (anonymous)
- Loss
- EUR 15'000 (payment for the work lost)
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- true
- Bankruptcy
- no
- Entry point
- Final invoice as a PDF by email, manipulated in transit
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
CEO fraud, diverted payment, fake invoice
Mostly add-on 5 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
According to this judgment, anyone who sends invoices with bank details by email can be liable for manipulations; encrypted sending or portals reduce the risk.
Sources
- Unternehmer bleibt auf Schaden sitzen (OLG Schleswig, Urteil vom 18.12.2024 – 12 U 9/24) (opens in a new window) beck-aktuell · 2025-02-07
«Gerade bei sensiblen oder persönlichen Inhalten komme nur eine Ende-zu-Ende-Verschlüsselung in Betracht»