Rijksmuseum Twenthe v. Simon C Dickinson Ltd.
In the High Court of Justice, Business and Property Courts of England and Wales, Commercial Court (QBD)
Case CL-2019-000002
Before Judge Pelling
Decided on January 30, 2020

Relevancy of the Case: Application for amending claims in a case involving fraudulent transfer of funds due to spoofed emails

Relevant Facts of the Case

• The claimant is a publically-funded art museum in the Netherlands. The defendant is a dealer in fine arts in London.
• An unidentified painting owner appointed the defendant as an agent for selling the painting. Through email, the claimant agreed to buy the painting from the defendant.
• The claimant alleges that fraudsters hacked into the defendant’s email account and sent spoof emails to the claimant.
• In one such email, the claimant received the instructions to transfer money to a Hong Kong-based account. Before they realised the fraud, the fraudsters transferred the money from the beneficiary account.
• The claimant seeks a declaration that they fulfilled their part in the contract. Hence, they have the legal ownership over the painting. The defendant denies that the claimant paid any money and demanded the return of the painting.
• To their original claim, the claimant added damages based on implied representation, ratification, estoppel, and the defendant’s breach of duty of care.

Prominent Arguments by the Counsels

• The claimant’s counsel argued that if the spoof emails were not the defendant’s representation, the defendant was in breach of duty as it failed to inform the claimant that they were not genuine emails. Further, he argued that the defendants authorised and ratified spoof emails, thus giving rise to an estoppel by representation.
• The defendant’s counsel opposed the application to amend the claims. He states that the new claims do not pass the test of realistic arguability. He added that the fraudsters copied the spoof emails to the defendant’s employee and did not ask them to do anything specific.

Opinion of the Bench

• The fact that the fraudsters copied the spoof emails to the defendant’s employee is irrelevant to deciding whether the pleaded case was arguable.
• The claimant’s assertion that the defendant authorised the sending of emails is inconsistent with their submission that the emails are spoofs.
• No authority is presented to support the existence of a duty of care. The claimant did not plead that the defendant assumed responsibility for the claimant. They also did not show that the defendant knew the claimant would rely on spoof emails without verifying first.

Final Decision

• The bench refused the permission to amend the original claims.

Anjali Agrawal, an undergraduate student at the NALSAR University of Law, prepared this case summary during her internship with The Cyber Blog India in May/June 2022.