Initial response to business email compromise, and the allocation of loss

1. Initial response where an unauthorized payment is suspected

Contacting the bank

Where a payment is suspected of being unauthorized, contact the remitting bank as soon as possible and check what stage the payment has reached and whether it can be stopped or recalled. Contacting the bank does not mean that the payment can be stopped. The outcome varies considerably according to the stage the payment has reached, the response of any intermediary bank and of the receiving bank, and whether the funds have already been withdrawn.

A point that calls for care here is that a recall of a remittance is a procedure based on the remittance contract and on banking practice. It is not a statutory mechanism under which a refund follows as a matter of course once fraud is reported. Requesting a recall, the request being accepted, and a refund actually being made are three different things. In some cases the consent of the recipient is required.

Verifying the instruction through a separate channel

Where a message asking for the payment details to be changed is received, it needs to be verified through a channel other than the suspect email. The basic point is to use contact details that were already known to you, rather than a telephone number given in the email. Where the payment has already been made, checking the facts with the genuine counterparty through the channel used previously is the starting point for everything that follows.

Preserving evidence

Emails suspected of being fraudulent, the instruction to change the account, internal approval records, records of the payment, and correspondence with the bank should be preserved with the original data and the time information intact. Not all of this is subject to a statutory retention requirement, but where responsibility or the allocation of loss is later disputed, which communication was made, when, and through which channel can be decisive. For emails, it is preferable to preserve the originals including the header information, rather than forwarded copies.

Containing the compromise and preventing further payments

Where your own or the counterparty's email account may have been compromised, the intrusion that is under way needs to be stopped alongside the preservation of evidence. Changing credentials, terminating unauthorized sessions, checking whether any unrecognized forwarding settings or inbox rules have been created, and enabling multi-factor authentication are steps to be taken together with your IT staff or your IT provider.

At the same time, check whether other payment instructions have come through the same channel and whether other counterparties have received similar messages. Payments based on suspect instructions are put on hold. Where the extent of the compromise is unclear, decide how far other scheduled payments need to be checked and consider the response together with the effect on payment deadlines. Contacting the bank and preserving records do not, on their own, bring an ongoing compromise to an end.

Where personal data is involved

Where the incident also involves the leakage of, or another incident affecting, personal data — for example where the compromised account contained personal data — whether a report is required and whether the individuals concerned must be notified need to be considered separately from each other.

A report is required not only where an incident of a type specified by legislation has occurred, but also where there is a likelihood of such an incident. It is not the case that the question can be left until leakage has been confirmed. Nor, on the other hand, does a payment fraud automatically give rise to a reporting obligation: it is necessary to check whether the situation falls within the specified categories. The body to which the report is made may be the competent minister to whom the relevant powers have been delegated.

Where the incident may have involved acts carried out for an improper purpose, personal information that has already been acquired, or that is to be acquired, and that is intended to be handled as personal data is also taken into account in considering whether a report is required.

Where a report is required, check the deadlines for the preliminary report and for the final report separately. Notification to the individuals concerned also has to be given without delay according to the circumstances, so it is not possible to wait in every case until the full picture is known. Responding to intrusions from outside is covered on our cybersecurity page.

2. When the genuine counterparty demands payment again

Treating the applicable law separately for each issue

In this situation, different laws may apply to the question whether the original payment obligation has been discharged and to the question whether damages can be claimed from those involved. A governing law clause in the contract of sale does not necessarily extend to the relationship with the bank or to a claim in tort against a third party. Where a foreign law applies, its content needs to be checked separately. In an international sale of goods, the application of the United Nations Convention on Contracts for the International Sale of Goods (CISG) may also be in issue even where Japanese law has been chosen. What follows assumes that the Japanese Civil Code and related legislation apply to each issue.

Payment by transfer into an account

Under the Civil Code, performance by way of a transfer into the obligee's deposit or savings account takes effect when the obligee acquires the right to demand repayment of the amount transferred from the financial institution holding the account. Performance is not completed simply because the payment instruction has been issued or because the funds have left your own account.

That provision cannot, however, be applied as it stands where funds have been sent to a fraudulent account. The account is not the obligee's account, so the situation is not the one the provision contemplates.

The appearance of authority to receive payment

What arises instead is the Civil Code provision on performance rendered to a person who has the appearance of being the person entitled to receive it. Under that provision, performance rendered to a person other than the person entitled to receive it who, in light of common sense in transactions, has the appearance of being so entitled is effective only where the person rendering performance acted in good faith and without negligence.

Whether that provision can be relied on calls for careful consideration. The situation here is one in which funds were sent to an account that had been changed by an impersonator, so three points are checked separately.

First, whether the person who gave the instruction to change the account had authority to give it. Second, to whom the payment is to be characterized as performance, and whether that person, in light of common sense in transactions, had the appearance of being entitled to receive it. Third, what the party making the payment knew and what checks it carried out — in other words, whether it acted in good faith and without negligence.

Even if the counterparty's genuine email account was used, that alone does not establish that a valid instruction to change the account was given. Nor is it enough to say that you were unaware of the fraud: what checks were carried out when the change of account was notified, what procedure the contract laid down, and what the internal approval process was are all assessed.

The payment terms in the contract

Also to be checked are the place and method of payment under the contract, the procedure for changing the account, and whether the instruction to change it was genuine. Where the contract lays down a procedure for changing the account and that procedure was followed, the assessment may differ from a case where the payment was made in the absence of any such provision. That said, following the contractual procedure does not by itself establish that the debt has been discharged. The question of interpreting the contract and the question of authority to receive payment are considered separately.

Where the counterparty has received a benefit

Under the Civil Code, apart from the case described above, performance rendered to a person other than the person entitled to receive it is effective only to the extent that the obligee has been enriched by it. Where there are circumstances indicating that the genuine counterparty received some benefit, that point also falls to be considered. It does not follow, however, that the amount sent to the fraudulent account amounts to a benefit to the counterparty.

Keeping the two questions apart

Whether the obligation to pay the genuine counterparty remains, and whether damages can be claimed from that counterparty, are decided separately. An argument that "the counterparty was also at fault, so we do not have to pay" does not succeed in that form. Discharge of the debt, liability in damages, and set-off each have to be considered on their own terms.

3. Liability and the allocation of loss between those involved

Liability for non-performance

Under the Civil Code, where an obligor fails to perform in accordance with the purport of the obligation, or where performance is impossible, the obligee may claim damages for the loss caused by that failure, unless the failure is due to grounds not attributable to the obligor in light of the contract or other source of the obligation and common sense in transactions.

The fact that a BEC loss has occurred cannot, taken on its own, be treated as a breach of contract by the counterparty. What obligations the counterparty owed, and whether it can be said to have breached them, have to be identified specifically.

Where an email account was compromised

Even where it is established that the counterparty's email account was compromised by a third party, that does not in itself establish the counterparty's liability in damages. What security obligations the counterparty owed, whether the compromise was foreseeable and could have been prevented, whether it gave a warning or notice after it became aware of the compromise, and whether there is a causal link between those matters and the payment all fall to be considered.

Liability in tort

Under the Civil Code, a person who intentionally or negligently infringes the rights or legally protected interests of another is liable for the loss caused. Liability does not follow merely from the fact that a loss occurred or that a particular person was involved; the requirements have to be considered for each person against whom a claim is contemplated.

Contributory negligence

Japanese law contains provisions under which the fault of the injured party is taken into account. For non-performance of an obligation, the Civil Code provides that the court takes this into account in determining liability and the amount of damages; for tort, it provides that the court may take it into account in determining the amount of damages. The two provisions operate differently and cannot be treated as the same.

Nor does it follow that, where the checks carried out when the account was changed were inadequate, the whole of the loss must be borne by the party that made the payment. The counterparty's own security arrangements, the sophistication of the fraud, and practice in the industry are also taken into account.

The bank's position

Whether a bank can be held liable is considered by reference to the applicable law, the terms governing the remittance, the content of the instruction, the circumstances the bank could have been aware of at the time, and which specific obligation is said to have been breached. It cannot be asserted that banks owe a general duty to detect or prevent fraud. The roles of the remitting bank, any intermediary bank, and the receiving bank also differ. Where a foreign bank is involved, that fact alone does not determine that the law of that country applies: for contractual matters the applicable law is established by reference to any choice of law and related rules, and for tort by reference to the rules on the law applicable to torts.

Where the contract allocates the loss

Master trading agreements increasingly include provisions on the procedure for changing account details and on what is to happen if loss is caused by impersonation. Where such a clause exists, its scope and validity are assessed under the governing law. It does not follow that a clause is valid simply because it is in the contract, or that a party that breached a security-related clause bears the whole of the loss.

4. Recovery of the funds and provisional measures

The Act on Payment of Damage Recovery Benefits

The Act on Payment of Damage Recovery Benefits from Funds in Deposit Accounts Used for Crime provides for the payment of damage recovery benefits and related matters where deposit or savings accounts at financial institutions in Japan have been used for crimes. That mechanism is understood to apply to accounts in Japan and not to apply as it stands where funds have been remitted overseas. Where an account in Japan was used as the account to which the funds were transferred in the course of the crime, or was used to move funds out of such an account, the flow of funds and the use made of the account are checked in order to consider whether it falls within the accounts covered by the legislation.

Because the mechanism draws on the funds remaining in the account concerned, the full amount of the loss is not necessarily paid out. If it is used, the period for applying for payment needs to be checked from the public notices issued by the Deposit Insurance Corporation of Japan and elsewhere, and an application made within that period.

Claims against the recipient

Where the return of funds sent as a result of fraud is sought, the legal basis of the claim has to be identified. Where Japanese law applies, the claim may be framed as one for the return of unjust enrichment or as one for damages in tort. The fact that a person is the account holder does not, however, establish that the person was enriched or is obliged to return the whole amount. What needs to be examined differs from case to case — for example where the account holder had lent the account to a third party. In assessing whether there was a benefit, it is necessary to look not only at whether cash was received but also at who acquired the deposit claim as a result of the transfer.

Whether a provisional remedy is available

To obtain a provisional attachment of a monetary claim in Japan — a court procedure by which assets are frozen before judgment so that later enforcement remains possible — the Japanese court's jurisdiction must be established, and a prima facie showing must be made of the right to be preserved and of the necessity for preservation. A provisional attachment is not available merely because you have been defrauded: it is necessary to show against whom the claim lies, what the claim is, and why it needs to be preserved.

Where the person against whom the claim lies or the property concerned cannot be identified, it is difficult to formulate an application straight away. That an account number is known, that there is a basis for a claim against the holder of that account, and that property capable of being attached can be identified are three separate matters.

Security may be required in support of the application. Bearing in mind that a demand or notice to the other side may lead to the funds being moved, we consider the order in which contact and any application are made, and the cost of security and of any local procedure.

For accounts in Japan, the procedure under the legislation described above and a provisional attachment or similar step may affect each other, so the stage each has reached is checked in deciding the order in which to proceed.

Accounts outside Japan

Whether an account outside Japan can be frozen, made subject to a provisional remedy, or recovered depends on the law and procedure of the countries concerned. An application in Japan, or a request from a Japanese lawyer, does not bind a foreign bank. Whether steps can be taken locally, and whether they are proportionate in cost and time, are assessed case by case. Reporting to the police or other authorities in the country or region to which the funds were sent, and any filings required locally, are also checked alongside contacting the bank.

5. Insurance and criminal proceedings, and how they relate to the civil side

Notifying the insurer

Under the Insurance Act, where a policyholder or insured under a non-life insurance contract becomes aware that loss has been caused by an insured event, it must give notice to that effect to the insurer without delay. That provision imposes a notification obligation; it is not itself the basis of cover. At the same time, a delay in giving notice does not automatically mean that the whole claim is refused. For any policy that may be relevant to cover, we recommend notifying the incident first and examining the scope of cover in parallel. There is no need to hold off on notification until the policy wording has been examined. This does not, however, mean that a notification obligation under the Insurance Act arises in every BEC case.

Whether and to what extent a loss is covered depends on what the particular policy covers, the exclusions, the limits, and the notification and other conditions. The understanding that "we have cyber insurance, so a payment loss is covered" is not accurate. How losses from unauthorized access, payments made deliberately by the insured, and claims received from third parties are each treated has to be checked against the policy wording.

Under the Insurance Act, where insurance proceeds are paid, the claims held by the insured in respect of the loss caused by the insured event pass to the insurer to the extent provided by that Act. Where the proceeds fall short of the amount of loss to be indemnified under the policy, the extent of that transfer is determined taking the shortfall into account, and the insured is entitled to be satisfied in priority to the insurer in respect of the claims remaining with it. Policies covering loss arising from a company's business activities may, however, contain special terms that differ from this. The extent of subrogation, the claims relating to the uninsured portion, and the priority and allocation of recoveries are checked against both the applicable law and the policy wording. A settlement with, or a release of claims against, another party affects the position with the insurer, so the points to be coordinated in advance need to be identified.

In addition to notifying the incident, the procedure and the deadlines for making the claim itself are managed separately.

The relationship with criminal proceedings

A report of a crime to the police and a formal complaint are different procedures: a formal complaint is a statement of the facts of an offense accompanied by a request that the offender be punished. Making a complaint does not mean that the offender will be caught or that the loss will be recovered.

The progress of criminal proceedings and the management of civil claims and limitation periods also have to be considered separately. Filing a report or making a complaint does not in itself stop the limitation period for a civil claim from running.

6. Replying to the renewed demand, negotiations, and what we check at the outset

Before replying

Before replying to the renewed demand, the contract, the message changing the account details, the records of the payment, and the sequence of checks carried out on each side are compared in chronological order. There is no need, however, to wait until all the necessary documents are to hand before contacting the bank or dealing with deadlines. Those steps proceed in parallel.

Drafting a provisional reply

In a provisional reply, we separate the facts that have been confirmed from the matters still being checked, and consider wording that does not inadvertently settle whether the debt exists or how responsibility is to be apportioned. The Civil Code provides that a limitation period is renewed where the right is acknowledged. Whether the content of a reply amounts to such an acknowledgment depends on the particular facts, so it is not appropriate to write on the assumption that adding the words "all rights reserved" will necessarily avoid that consequence.

Asserting set-off

Under Japanese law, a set-off is effected by a declaration to the other party, and that declaration may not be made subject to a condition or a time limit. Asserting a claim for damages does not in itself extinguish the obligation to pay the price. We consider how to frame the argument after checking the requirements for set-off, the cases in which it is prohibited, and how it differs from a settlement by agreement.

Resolution by agreement

Where an additional payment or a sharing of the loss is to be agreed, we make clear what is being settled, which claims are reserved, what happens to claims against third parties, and what needs to be coordinated with the insurer. An agreement between two parties cannot determine the liabilities or rights of those who are not party to it, such as a bank or an insurer.

Setting the approach

In setting the approach, we consider the prospects and the costs separately for defending the renewed demand, for negotiating the allocation of loss with those involved, and for recovering the funds. Even where recovery of the funds is difficult, there is still value in considering the response to the renewed demand and the allocation of loss. At the same time, we do not suggest that instructing a lawyer will necessarily improve the prospects of recovery. We set out the prospects frankly and then discuss the approach with you.

7. Arrangements to prevent recurrence

Providing for changes of account details in the contract

Where the allocation of responsibility after a loss is disputed, the procedure that was supposed to be followed for changing account details is part of the material on which the assessment is made. Providing in a master trading agreement or a memorandum that changes to payment details are to be made by a specified written form, that any notice of change is to be verified against registered contact details, and that the method of verification is fixed in advance can help to prevent losses and makes the position easier to sort out if something does go wrong.

Where such clauses are used, it is necessary to consider which party is to carry out which checks, and how a failure to carry them out is to be treated. Including a provision in the contract does not, however, mean that it takes effect exactly as written. The validity and scope of the clause are assessed under the governing law.

Internal procedures

Putting in place a process under which changes to amounts or payment details are verified by more than one member of staff before a payment is released is an effective way of preventing losses. We also recommend deciding in advance who is to contact the bank, who is to verify matters with the counterparty, and who is to preserve the records if a loss is suspected. In a BEC case, contacting the bank and preventing further losses are important from the point at which a loss is first suspected.

8. How we work on these matters

Where we are instructed, we first organize the facts and the documents in chronological order and assess separately whether the obligation to pay the price remains, whether claims can be brought against those involved, whether the loss may be covered by insurance, and whether the funds can be recovered. We then consider the content and timing of the reply to the genuine counterparty and, where necessary, conduct negotiations.

Where the allocation of loss cannot be agreed, we consider resolution through litigation or another procedure. Where the whereabouts of the funds become known, we also consider whether a provisional remedy is available. Where steps are needed abroad, we work with local lawyers and explain the prospects and the costs before discussing with you whether to proceed.

Our work centers on the initial stages of matters involving disputes and incidents, and we are able to advise at a point where the facts have not yet been established. It is fine to come to us while you are still working out what has happened.

Related pages

International legal services (feature) / Recovering payment and handling quality disputes in international sales of goods / Cybersecurity / Crisis management and incident response / Internal investigations

Key legislation and official sources

English translations of legislation are provided for reference. The Japanese texts are authoritative.

Where it appears	Legislation	Source type
Payment by transfer into an account; the appearance of authority to receive payment; performance to a person not entitled to receive it	Civil Code（民法）	Japanese legislation
Liability for non-performance; liability in tort; contributory negligence	Civil Code（民法）	Japanese legislation
Set-off; renewal of a limitation period by acknowledgment	Civil Code（民法）	Japanese legislation
The law applicable to contractual matters and to torts	Act on General Rules for Application of Laws（法の適用に関する通則法）	Japanese legislation
Reporting incidents involving personal data and notifying the individuals concerned	Act on the Protection of Personal Information（個人情報の保護に関する法律）	Japanese legislation
Notifying the insurer; subrogation to the insured's claims	Insurance Act（保険法）	Japanese legislation
Payment of damage recovery benefits from funds in accounts used for crime	Act on Payment of Damage Recovery Benefits from Funds in Deposit Accounts Used for Crime（犯罪利用預金口座等に係る資金による被害回復分配金の支払等に関する法律）	Japanese legislation
Provisional attachment of assets in Japan	Civil Provisional Remedies Act（民事保全法）	Japanese legislation
Whether the CISG applies to an international sale of goods	United Nations Convention on Contracts for the International Sale of Goods（国際物品売買契約に関する国際連合条約）	Treaty

Legal information reviewed: 2026-09-18

Frequently asked questions

Contact

Making an inquiry

Please tell us the outline of the situation, any notice you have received and its date, and any deadline you are working to.

Contact Form

Related Services

Related Crisis Management Topics

Recovering payment and handling quality disputes in international sales of goods

A legal guide to sales of goods with a business partner abroad, covering the law that applies and whether the CISG applies, examination and notice, requiring performance, avoidance of the contract and damages, and recovery through negotiations, court proceedings or arbitration.

Responding to the misuse of trade secrets by a competitor

A legal guide to situations where trade secrets are suspected of having been taken, covering the preservation of evidence, investigation, and claims for injunctive relief and damages.

International legal services: overview

Sets out what to check when a problem arises in a transaction with a party abroad, and points to individual guides on contracts, regulation and dispute resolution.

International legal services (practice area)

Sets out our work on transactions and contracts with parties abroad, establishing operations overseas, regulatory matters including imports and exports and cross-border data, and international dispute resolution.

This article is provided for general informational purposes only and does not constitute legal advice on any specific matter. Please consult us regarding your specific situation. The content is based on the laws and regulations in effect as of the date of the last update.