In MJ Concepts Kotara Pty Limited v Pandora Jewellery Pty Limited (No 2) [2026] NSWDC 262, the NSW District Court considered who should bear the loss after a payment was diverted to a fraudster.

What happened?

MJ Concepts Kotara Pty Limited (MJC), a Pandora jewellery franchisee operated by the Matthews family, agreed to sell its store assets to Pandora Jewellery Pty Limited for $467,378.

MJC’s director provided MJC’s NAB account details on tax invoices. Before payment was made, a fraudster gained access to the email account of another person working in the family business. At 2.16am, the fraudster sent Pandora a fabricated NAB ‘bank confirmation’ document directing payment to a different account.

Pandora paid the full purchase price into the fraudster's account. Within days, all but $3,162 had been dissipated. MJC discovered the fraud six days later and sought to recover the purchase price as a debt or, alternatively, damages for breach of contract.

The Court entered judgment for MJC for $467,378 plus contractual interest.

Why the fraudulent email did not bind MJC

Pandora argued that MJC had represented that the compromised email account holder had authority to act on its behalf and that Pandora had reasonably relied on that representation.

The Court rejected that argument. MJC had not represented that an unknown fraudster was authorised to act for it. Any representation about the genuine account holder’s authority could not extend to the conduct of a third party who had taken control of the account by unauthorised means. The fraudulent email was therefore a legal nullity.

The Court also found that Pandora’s reliance on the email was not reasonable. The email contained several warning signs that called for an explanation:

• it came from a person who had not previously provided banking instructions;
• it was sent at an unusual hour;
• it contradicted account details supplied only days earlier;
• it did not respond to the most recent relevant email or explain the change; and
• it was accompanied by a supporting document that omitted identifying and licensing information and contained date anomalies.

Despite those warning signs, Pandora did not contact MJC to verify the new account details before or after making payment.

MJC did not fail to mitigate its loss

Pandora also argued that MJC had failed to mitigate its loss by not alerting Pandora sooner that payment had not been received. The Court was not persuaded. Pandora’s emails said only that payment had been ‘processed’ or was ‘in progress’ and did not identify the destination account.

In any event, the Court held that mitigation principles do not apply to a claim in debt, as distinct from a claim for damages. It also reiterated that, where mitigation is relevant, the defendant bears the onus of proving a failure to mitigate and the plaintiff is not required to exercise excessive diligence or achieve perfection in minimising its loss.

MJC’s silence did not create an estoppel

Pandora submitted that MJC was estopped from denying payment because it had not immediately challenged Pandora’s payment confirmation emails. That argument also failed.

The Court considered MJC’s conduct in context. The payment process was international and involved multiple steps. MJC’s failure to appreciate immediately that there was a problem was therefore not unreasonable.

In allocating the loss to Pandora, the Court applied the principle that, where one of two innocent parties must suffer, the loss should fall on the party whose conduct occasioned it.

The outcome may differ on other facts

The decision does not establish that the payer will bear the loss in every business email compromise or invoice diversion fraud. The Court observed that the role and conduct of the party whose email account or systems were compromised may be relevant, depending on matters such as the defences raised, whether that party contributed to the compromise, and the content and circumstances of the fraudulent communications.

Although the Court did not decide those issues, its reasons leave open the possibility of a different outcome in two situations. The first is where the party whose email account or systems were compromised contributed to the compromise (for example, by failing to implement basic email security controls, reusing credentials exposed in a prior breach or ignoring internal warnings about suspicious activity). The second is where the fraudulent communication was more plausible than in this case (for example, if it was sent from the usual contact during business hours, consistent with prior correspondence, and supported by apparently authentic documentation).

Practical steps for businesses

• Lock in payment details at onboarding. Capture and verify counterparty bank details through a controlled process when the relationship is established, and treat any later change as a new verification event rather than a routine administrative update.
• Treat every change to bank account details as high risk. Require independent verification before acting on any request to redirect payment.
• Use a trusted channel. Confirm the change through a previously known telephone number or another independently verified contact method. Do not use contact details contained in the change request.
• Build account details into transaction documents. For one-off transactions, include payment details in the contract where practicable.
• Train staff to identify warning signs. These may include unusual timing or senders, inconsistent dates, missing business identifiers, mismatched signatures and unexplained departures from recent instructions.
• Harden email systems. Enforce multi-factor authentication on all business email accounts, require strong, unique passwords, and monitor for suspicious logins and unauthorised mailbox rules (fraudsters commonly create hidden forwarding or deletion rules to conceal their activity).
• Require additional approval. Significant, unusual or redirected payments should be subject to dual authorisation.
• Confirm payment and receipt promptly. Remittance advice should identify the destination account, and both parties should promptly confirm that the funds have been received.
• Use account-name verification tools where available. Services such as Australia’s Confirmation of Payee service can flag mismatches between the account name and the account details, providing a useful additional check (though not a substitute for independent, out-of-band verification).
• Address payment-fraud risk in the contract. Specify the authorised payment account, require any change to be notified through a nominated channel and confirmed by a nominated person, and consider expressly allocating the risk of fraudulent payment instructions.
• Review cyber and crime insurance cover. Check whether existing policies respond to social engineering fraud, funds transfer fraud and invoice redirection; these exposures are often sub-limited or excluded under standard cyber or crime wordings.
• Maintain an incident response plan – and act within hours, not days, if fraud is suspected. Prospects of recovery fall sharply after the first 24 to 48 hours. Notify the sending and receiving banks immediately, report to ReportCyber and relevant authorities, preserve the original emails (with full headers) and system logs, and engage legal, IT and insurance advisers without delay.

What this means

The decision is a timely reminder that payment processes must be designed for the realities of business email compromise. A familiar email account is no guarantee of a genuine instruction. Where bank account details change, independent verification is not administrative housekeeping – it is the control that stands between the business and both financial loss and continuing contractual liability.

Australia’s Confirmation of Payee service adds a further layer of protection by checking the account name against the BSB and account number entered for the payment. It is a useful safeguard – but it is no substitute for picking up the phone to verify an unexpected change to payment instructions.

This article provides general information only and does not constitute legal advice. The decision considered was made by the NSW District Court and turned on its particular facts. Specific advice should be obtained before acting on any of the matters discussed.