The Higher Regional Court (OLG) Karlsruhe has commented on the question of what security measures must be observed when sending emails in business transactions as part of a current ruling. The ruling concerns, in particular, the handling of violations of these security precautions and their impact on monetary claims.
In the present court decision of the Higher Regional Court of Karlsruhe of July 27, 2023, with the file number 19 U 83/22 was ruled on a case where a car buyer unknowingly transferred the purchase amount to a scammer. She held the seller responsible for the error due to alleged breach of IT security obligations and refused to pay the actual invoice.
The most important points in brief
- According to the opinion of the Higher Regional Court, there are no legal requirements for security precautions when sending emails in business dealings to date.
- The Mosbach Regional Court (LG) had previously dismissed the lawsuit, accusing the plaintiff of insufficient security measures in email communication.
- In the opinion of the Higher Regional Court (OLG), the plaintiff was not obligated to use specific encryption methods, such as end-to-end encryption, when sending the invoice email.
The decision of the Higher Regional Court of Karlsruhe
The parties disputed an outstanding purchase price payment of 13,500 Euros for a used car.
The CEO of the selling company sent the buyer the invoice as an attachment in an email. Shortly after receiving the email, the buyer received another email from the seller's email address.
After the buyer mistakenly transferred the purchase price to unauthorized third parties due to the second email sent by hackers, despite obvious discrepancies and indicators of a fake email, the buyer refused further payment to the seller. The email sent by the hackers contained linguistic errors and a different salutation. The seller therefore argued that the buyer had reason to be suspicious and that it would have been reasonable for him to inquire with the seller.
It remained unclear how exactly the hacker attack could have happened.
Against this background, the seller filed a lawsuit for payment of the outstanding purchase price. She claimed that she had fulfilled her contractual obligations and that the defendant was therefore obligated to pay the purchase price. The defendant, on the other hand, argued that she had received a forged invoice and was therefore not obligated to pay the purchase price. She claimed that the plaintiff had violated her IT security obligations, which had caused the incorrect transfer.
Contrary to the previous instance (LG Mosbach), the OLG ruled that the defendant must pay the agreed purchase price to the plaintiff. The claim for payment exists because the payment was made to the wrong account and not to the plaintiff's account. Furthermore, the court determined that the defendant is not entitled to damages because the plaintiff had taken all reasonable security measures, such as regularly (every two to four weeks) changing the mailbox password and maintaining an up-to-date firewall.
At the same time, the appellate court ruled that end-to-end encryption when sending invoices and signing PDF files were not required.
Security measures for sending business emails
The Higher Regional Court states that there are no specific legal requirements regarding which security precautions must be observed when sending emails in business transactions. Nevertheless, with its judgment, it clarifies the necessity of taking appropriate security precautions.
Companies are urged to consider security expectations in business dealings and take reasonable measures to prevent potential damages. Furthermore, it is clarified that violations of these security precautions do not extinguish primary claims, but they can establish claims for damages.
The use of measures such as end-to-end encryption or the encryption of PDF files was not considered mandatory in the relationship between the parties. Furthermore, a possible breach of duty by the plaintiff would be nullified by the fact that the defendant itself had not requested any explicit security measures for email communication.
To securely send emails containing sensitive information in practice, it is recommended to encrypt the email. With encryption, the email remains encrypted throughout the entire transmission path, meaning it is unreadable, and is only decrypted by the recipient, thus making it readable. However, there is no explicit legal obligation to encrypt emails with personal data.
If the recipient wants to be sure that the stated sender of the message is actually the same as the real sender and that the content of the email has not been tampered with „on the way,“ a so-called „digital signature“ helps. It has a similar function to the signature on a paper document and shows your communication partner that the email truly comes from the sender and that the content has not been altered by third parties.
Conclusion
Legally, the defendant lost the lawsuit: The purchase price claim was not extinguished by payment to the wrong account, and the defendant also had no claim for damages against the plaintiff. The deception through the falsified email was to her detriment in this regard. Such deceptions must therefore be recognized and circumvented in a timely manner. Spelling errors in emails, in particular, are often an indication of an IT threat. Therefore, it is particularly important for companies that employees are sufficiently trained to avoid liability cases.
However, the plaintiff could also have done something to avoid the legal dispute and thereby ensure greater data security and customer satisfaction. This is because hacker attacks often not only lead to claims for damages but also to data protection violations, which attract special attention from supervisory authorities. For example, a frequent password change is strongly discouraged as an important measure: Frequent password changes increasingly lead to the selection of easy-to-remember and therefore insecure passwords. Instead, a sufficiently long and secure password should be chosen.
The present judgment brings some clarity to a poorly regulated area and contributes to greater legal certainty in business email communication. Companies should be aware that appropriate security measures are not only legally required but also help to avoid potential financial damage.
„>