Bol.com fell victim to whaling and must pay after all

If you make a payment based on a (hacked) email to a fake account number, you are in principle not released from liability: you must still pay your actual creditor. You are only released if you believed in good faith and had reasonable grounds to believe that you were paying correctly. Therefore, always verify any notification regarding changed bank details via an independent channel — such as calling back yourself.

Online retailer bol.com was defrauded of over 750,000 euros: supplier Brabantia's email system was hacked, after which bol.com paid an incorrect account number based on a fake email. Nevertheless, the court ruled that bol.com must still pay its supplier because it should have been more critical (ECLI:NL:RBMNE:2021:1528).

What is whaling?

In late 2019, bol.com received an email from the address of a Brabantia employee stating that payments should henceforth be made to a different account number. An employee changed the number; the email turned out to be fraudulent. This is a textbook example of whaling: a scammer impersonates someone from another company to gain trust and get money transferred. It is not always clear who is held responsible for the damage.

When is an incorrect payment actually liberating?

The payer has a debt to bring: he must ensure that the payment reaches the creditor. If it ends up elsewhere, this is in principle at his own expense, and the creditor may demand payment again. There is one exception: if the payer, acting in good faith and on reasonable grounds, believed he was paying the correct creditor.

The Court of Appeal in Den Bosch previously confirmed this (ECLI:NL:GHSHE:2018:4531): in that case, a fraudster had “fished” invoices out of a post office box, forged them, and sent them in the original envelope. The debtors did not know the real account number and had reasonable grounds to believe that they were paying properly — they were discharged from liability.

Why bol.com was not liberated

The email to bol.com was full of grammatical errors (“Voortaan moten all incoming betalen have been overgemaakt naar onze filiaalrekening in Spanje”). Nevertheless, the employee had no doubts, because the email came from a known Brabantia address and the formatting looked genuine. The judge found that bol.com should have been more vigilant: the email was visibly manipulated and the grammatical errors should have been noticeable. Bol.com should have at least verified, for example by calling Brabantia themselves. Therefore, there were no reasonable grounds to assume that payment was made correctly.

Bol.com attempted to argue that Brabantia had acted unlawfully by allowing itself to be hacked, but the judge dismissed that (late-raised) appeal. An appeal to a higher court is not ruled out.

Frequently Asked Questions

Do I have to pay again after a whaling fraud?

In principle, yes: due to your obligation to bring, a payment to a false account number is at your own expense. You are only released from liability in good faith and with reasonable grounds to pay the correct party.

How do I prevent damage from a fake payment instruction?

Verify every change to bank details via an independent channel, for example by calling back a known number yourself. Pay attention to language errors and discrepancies in the email.

Is the hacked supplier liable?

Not without further ado. In this case, the reliance on unlawful conduct by the supplier was unsuccessful. Whether the situation might be different depends on the circumstances and the security measures.

Prevent or dispute payment fraud

The legal experts at MKB Juristen advise you on payment fraud, your obligations, and your position in the event of a dispute. View our expertise in contract law or schedule an intake interview .