---

Employee fraud is dramatically on the increase – figures from ActionFraud showed that businesses in the UK lost £682m through fraud in 2018-2019, with the largest category being that carried out by employees, at £214m. It is unsurprising that defrauded employers may want to take recovery action when they suffer losses through steps taken by employees. But what if the employee was entirely innocent, and did not benefit from the fraud? That was the case in relation to Patricia Reilly, a credit controller at Peebles Media Group, based in Glasgow (Peebles Media Group Ltd v Reilly [2019] CSOH 89). Her employer brought breach of contract proceedings against her in an attempt to recoup its losses of nearly £110,000, although she had no idea that she was caught up in fraudsters’ devious deeds.

Ms Reilly was the route through which the fraudsters perpetrated what is known as a ‘whaling scam’. In contrast to the better known ‘phishing scam’, when a large number of individuals are targeted in the hope of netting one or more individuals, a ‘whaling scam’ targets one ‘big fish’ in an organisation. In this case, the Managing Director of Peebles Media, Yvonne Bremner.

Ms Bremner was on holiday in Tenerife when Ms Reilly received a series of emails, purporting to be from Ms Bremner, instructing her to make various payments out of Peebles’ bank account. Ms Reilly complied with what she believed to be genuine instructions, but found herself sacked, and then facing a claim in the Outer House of the Court of Session in Scotland, alleging breach of the implied obligation of reasonable skill and care.

In a judgment handed down in November 2019, Lord Summers entirely agreed that employees have an implied obligation to exercise reasonable skill and care in the performance of their duties, as borne out by Lister v Romford Ice and Cold Storage Co Ltd [1957] AC 555 and Janata Bank v Ahmad [1981] IRLR 457. He observed that “employers seldom sue their employees for damages”, a point considered further below, and remarked that there are hardly any reported cases addressing the issue. He then went on to consider the facts.

Having received the first chain of emails from the fraudster, Ms Reilly went to some lengths to assist the sender, whom she (wrongly) believed to be Ms Bremner. She could see that the payee details set out by the fraudster were inaccurate, so checked Companies House records to obtain the correct information, and ended up passing the details on to her line manager, who actually made the first payment. Lord Summers concluded that Ms Reilly could not be said to have breached the implied obligation when she passed the details to her superior, or in not realising that something was amiss, given that her line manager did not realise either.

Considerable time was spent at trial analysing the emails themselves, with Peebles arguing that Ms Reilly should have realised that they were not genuine. Lord Summers did not accept that.

Moving on to the next transfer, he observed that the fraudsters had undoubtedly been buoyed by their initial success, and the following Monday sent a further purported instruction from Ms Bremner. With assistance again from her line manager who, by then, was also on holiday and therefore not in the office, Ms Reilly attempted to make the payment, using the line manager’s credentials on the online banking system. Although a number of fraud warnings popped up as she processed the payment online, she ignored them, as she had seen her line manager do when making the first payment the previous week. Further emails, and requested transfers, were made the following day; by that point, there was insufficient money in Peebles’ current account, so Ms Reilly transferred money into it from another account to facilitate the outgoing payments.

Lord Summers found that Ms Reilly’s only breach was in relation to that inter-account transfer, on the basis that she had not been asked by the purported fraudster to do so, and did not have previous authority to make such transfers. Furthermore, she should have sought approval for the transfer, but did not. However, he also concluded that Peebles’ losses did not ensue as a natural consequence of that breach, applying Hadley v Baxendale (1854) 9 Ex 341. The losses were, he said “exceptional and unnatural because [Ms Reilly] was ignorant of the fraud being perpetrated on her and on [Peebles]”.

On any view, this is an unusual case, not least because the employer chose to bring proceedings against the innocent employee. Lord Summers observed that there was considerable animosity between Ms Bremner and Ms Reilly, and that the loss had been a heavy blow to Ms Bremner. That perhaps explains why the draconian decision was taken to issue proceedings. In the event, Peebles did not recover all of the money paid away (some was recovered through the bank), and Ms Reilly lost her job, and had to go through the stress and ignominy of the court proceedings. As Lord Summers concluded, the fraudster was the real culprit, and it was a tragic case. It had been argued that there was contributory negligence on the part of Peebles; maybe if Ms Reilly had been trained to spot fraudulent emails, and/or if there had been tighter procedures in place, the issue could have been avoided. Fraud may be difficult to avoid or prevent, but proper training and procedures provide a good start in doing so.

---

Harriet Fear Davies' main areas of specialism are Commercial, Energy and Employment Law. Harriet was described in Chambers UK as being “exceptionally bright” and is repeatedly praised for her attention to detail.

Find out more about Devereux's Employment expertise here

---

Back to blog