The Higher Regional Court of Karlsruhe has just assumed this (judgment of July 27, 2023, Az. 19 U 83):
A company bought a used car from another company for 13,500 euros. The invoice was sent by email. Two minutes later, another email arrived with an altered invoice: a different bank account was given. The buyer transferred the purchase price to this account. However, the money did not reach the seller. It turned out that the second email had been sent by unknown "hackers".
Who bears the risk?
In this particular case, the buyer: they have to pay again.
But that is not always the case. For example, in the case decided by the Higher Regional Court of Karlsruhe, the email was a remarkably bad fake: The salutation was no longer correct, the email contained linguistic errors and the invoice was only incompletely forged (the bank details were only forged in the footer, while the correct bank details were still in the header).
Above all, however, the buyer's lawyer apparently made a crucial mistake:
There were clear indications that the falsified e-mail originated from a hacker attack in the seller's sphere. Other customers of the seller had also received correspondingly modified invoices. Nevertheless, the buyer's lawyer apparently conceded that the falsified e-mail did not originate from the seller. The Higher Regional Court in Karlsruhe had to base its decision on this.
It would have been better if the buyer's lawyer had provided evidence that the falsified e-mail originated from the "correct" e-mail account of the seller. Technically, it is possible to easily fake the sender name displayed in an email. However, the part of the email that is not directly visible, known as the "header", contains further information that is difficult to falsify. A specialist can use this information to reliably determine whether the email comes from a specific provider and a specific mailbox and whether the content is authentic or has been tampered with during transmission.
This could presumably have proved that the e-mail was authentic and came from the seller's correct inbox (at least, that's how the case sounds). And then the Higher Regional Court of Karlsruhe would probably have assumed sole or at least shared responsibility on the part of the seller.
Conclusion
When it comes to IT issues, you should choose a lawyer who is familiar with them.
The statements represent initial information that was current for the law applicable in Germany at the time of initial publication. The legal situation may have changed since then. Furthermore, the information provided cannot replace individual advice on a specific matter. Please contact us for this purpose.