Scam victims are bound to be diligent

A victim of a scam cannot use the scam as a defence against a claim to pay debts. This was held by the First Hall of the Civil Court on 12 June 2024 in lawyer Cedric Mifsud on behalf of foreign company Luise Associates Srl vs the ship MY Queen Mavia. The Court was presided over by Judge Miriam Hayman.

In his application, Cedric Mifsud explained that Luise Associates Srl is an Italian company which offers maritime services. In 2017, the Italian company gave agency services to MT Queen Mavia, a pleasure yacht registered in the Marshall Islands. The Company issued five invoices, which in total amount to €41,551.66. These invoices were accepted but never paid. The Company asked the court to order the defendant vessel to pay the claim.

The vessel explained in its statement of defence that the invoices add up to €38,115.06 and this sum was paid according to the instructions given by the company.

The case focused on the fact that the Plaintiff company did not receive payment in its bank account. The Defendant claimed that payment was made. It resulted that the Defendant was subject to an internet scam called phishing. The Defendant argued that it was up to the Plaintiff Company to guarantee that its emails were safe. The Plaintiff argued that the Defendant was negligent when it made payment.

The Court looked up the term “phishing” and according to the Oxford Dictionary it meant “the fraudulent practice of sending emails or other messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit cards number.”

From the evidence produced by the CEO of the Plaintiff Company, the company handled the security of its internet systems and IT infrastructure. From 2016 the Plaintiff Company used a Google Cloud platform to avoid these phishing attacks. From 2017 it gave warnings against phishing in its emails, since it was common in the yachting industry. The warning was a precaution and not because there was an attack nor was it hacked. Google had a two layered verification system and therefore, one of the best security systems. The Plaintiff Company presented copies of the emails the captain of the vessel with the bank details he had used to transfer the funds.

Another witness of the Plaintiff Company explained that with the invoices there were the bank details where the payment had to be affected. The company had sent several reminders for the Defendant to pay the invoices. Then he received a proof of payment from the captain that the payment was affected. This was sent to the KBC Bank NV, Brussels instead to Deutsche Bank Napoli. Then the captain of the vessel sent the emails it had acted on and it was clear that these emails were not sent by the Plaintiff company. The emails did not contain any invoices but only bank details.

The captain testified that he contacted the agents of the yacht to put their minds at rest that they were to pay. He had recommended that the invoices be paid.He produced emails showing that payment should be made to a different bank account. The Plaintiff Company had threatened to institute legal action if payment was not made. The owner of the yacht authorised payment of €38,115.06. He said that there was no reason to think that the email did not come from the Plaintiff Company. He insisted that he paid in good faith. He knew of the hacking warning in the email he received from the Plaintiff Company.

A witness from the yacht owning company, said he had vetted the invoices. He had discussed these invoices with the captain of the yacht. They received an email from the Plaintiff Company to send the payment to a different bank account from those indicated in the invoices. In January 2018, the yacht was arrested, since the Plaintiff company held that it did not receive the payment.

The Court quoted from Judge Philip Sciberras’s book, ‘L-Alfabett tal-Kodici Civili Vol. P-Q’. Here for a person to be freed from a debt is upon payment and it is up to this person to prove payment to the creditor. Payment must be made to the person who had the right to receive it.

The Defendant Company pleaded it had paid the debt. As such the Defendant had accepted the debt and therefore the debt was uncontested. It claimed that payment was made according to the instructions of the Plaintiff Company. The Court pointed out that the Plaintiff Company did send warnings and therefore, the Defendant was aware of the dangers of Phishing. The Court held that it was up to the debtor to show it was diligent towards the creditor and fulfilled its obligations. In this case, in order to avoid legal action, the Defendant hurried to make payment, and did not assure itself that did not pay to the correct account.

The Court then moved to uphold the Plaintiff Company’s claim and order the Defendant to pay €41,551.66.