$235,400 Gone — And the Victim Got the Blame. WA Court.

An aisle of a public records room at night, shelves of bound judgments lit red

Estimated Exposure: $235,400 stolen. Only $43,000 recovered. Victim ordered to pay.

What Happened: Mobius Group sent a legitimate invoice to Inoteq — a WA resources company. Hackers intercepted the email chain and sent a near-identical invoice with different bank details. Inoteq paid $235,400 to the wrong account. Standard BEC attack. Happens every day. But heres the precedent: when Mobius sued, the WA District Court found that INOTEQ — the victim who got scammed — was partly liable. The court said they should have verified the payment details. First major Australian court ruling on BEC liability. The business that got defrauded was ordered to pay back the money.

The Message: “I didnt know” is no longer a defence in Western Australia. The courts have ruled. If you dont take reasonable steps to verify and protect, the liability lands on you — even when youre the victim.

Source: [2024] WADC 114, HWL Ebsworth Legal Analysis

What Happened: BEC invoice fraud. $235,400 stolen, only $43K recovered. WA District Court ruled the VICTIM was legally liable.

Explore More Case Studies

A towering wall of identical pigeonhole slots, every one filled, lit red

5 Hours From Disclosure To Mass Exploitation.

Patchstack measured the median time from public disclosure to mass exploitation of a WordPress vulnerability at five hours. 46% have no patch when disclosed.

View Case Study
A filing cabinet with every drawer wrenched open and its contents spilled across the floor

106 GB of Employee Data — Published. Perth Company.

What Happened: DragonForce ransomware hit a WA industrial company. 106+ GB exfiltrated and published.

View Case Study
Financial-services trading desk with regulatory penalty warnings on screen

$2.5 Million Fine for “Inadequate Cybersecurity”

Fiig Securities. ASIC’s first-ever cyber penalty. Four years of ignored vulnerabilities.

View Case Study

Get Certified Before
You're the Next Headline

Every story on this page started the same way — a published vulnerability, a site nobody was watching, and weeks before anyone noticed. The free scan looks at your site from the outside, the same way an automated scanner does. It costs nothing, there is no obligation, and it takes about thirty seconds to start.

Scan My Site — Free