[Alex3917]

> It seems more equivalent as a legal precedent to someone sending a forged letter from a nonexistent employee on similar looking letterhead.

Well that's the question I guess, if you don't have SPF enabled is it like what you said, or is it more like allowing random people to come into your office at night and send out whatever they want on your actual company letterhead?

I don't know if there is legal precedent there or what a judge would rule, but it doesn't strike me as being completely obvious that this is a simple cut-and-dried case where the client still owes the full amount of the original payment.

[CPLX]

It’s not like having someone come into your office at night if it’s a spoofed email. It’s just someone figuring out what your letterhead looks like.

Either way though the client owes the original payment. That’s not in dispute. Legal issues don’t work in some holistic “who do you think should have the money” way, there are specific causes of action.

The first thing a court would ask is does the client owe the money, and is the obligation satisfied. The first answer is yes the second one is no, the client never sent the supplier the money. Nobody claims they did. Period.

Then the client would have a cause of action for negligence, due to someone else spoofing their email. Who wins that one? I don’t know but you’d have to look for some precedent and claim that the supplier was actually the proximate cause for some third party defrauding you. Maybe but it’s a pretty tenuous argument and you’d have to demonstrate clear causality.