By James McGachie

THE recent news that Nominet – the official registry for all .uk names – has suspended nearly 29,000 .uk domain names in the past year signals that UK businesses require to be more alert than ever when contracting and corresponding with third parties online, particularly in terms of making online payments.

While this figure represents only 0.22 per cent of the more than 13 million .uk domains registered, such suspensions generally follow notifications from police or other law enforcement agencies that criminality is involved. The threat from cyber-crime to Scottish businesses therefore remains significant.

In many instances, such domains are used in “phishing” frauds – where fraudulent emails are issued systematically, in many cases purporting to be from online retailer or service provider indicating that account details require to be validated; or in some instances that a refund is due. HMRC recently reported that in the past year it has received more than 620,000 reports from taxpayers offered a tax rebate by phone, text or email by fraudsters in exchange for providing personal information, including their bank details, address, date of birth and mother’s maiden name: valuable information for cyber criminals and profitable should even a small percentage of recipients fail to spot the fraud.

By contrast, a “whaling” uses what might be described as a “harpoon” and targets specific persons or businesses. Often, the fraudster will seek to correspond from a .uk domain name that is substantially similar to a legitimate domain and will present as the legitimate business supplier, requesting that a payment be redirected to a new bank account.

Such frauds came into sharp focus in a recent Court of Session action concerning a credit controller subjected to such a “whaling” fraud in 2015. Unaware of the fraud being perpetrated, the controller proceeded to make payments of £193,250 to the fraudster. While in the region of £85,000 was recovered, her employer raised civil proceedings for recovery of the remaining £107,984 from the controller.

The employer argued that liability arose due to the controller acting in breach of her contractual obligation to exercise reasonable skill and care. It claimed the emails received were “obviously fraudulent” and argued that in ignoring online banking warnings she further breached her implied obligation to exercise reasonable skill and care.

While holding that the decision to transfer company funds without any authority was in breach of contract, Lord Summers did not consider that the loss that ensued was the natural consequence of the breach, finding that it was “exceptional and unnatural” because the controller was unaware of the fraud being perpetrated. Accordingly, the action was dismissed.

From a practical perspective the case highlights the need for employers to ensure staff – particularly those in cash or credit control handling functions – are fully trained and aware of the tell-tale signs of both phishing and whaling scams. Such training may take the form of practical testing through running “spot checks” through deploying “test” phishing and whaling messages to establish if the training has been successful.

The judgement clearly runs on the facts, with an underlying emphasis placed on the controller’s relatively junior role and the attack occurring in 2015, when “whaling” frauds were relatively new. Should such an incident occur today and against a more senior and fully trained employee then the outcome could be different.

James McGachie is Legal Director, DLA Piper Scotland