81–88 of 88 posts
Earlier quoted context omitted.
> The scammer has already accessed your account because you fell for a phishing scam > It's not your fault that they paid the wrong person. How is this not the OP's fault? It's absolutely their fault - the fault that lead to their email being compromised
You don’t know t was the OP’s email that was compromised. It could have been the clients or something else entirely.
My two cent: any business should have ALSO a phone number, perhaps not immediately reachable, but still a phone number. Perhaps also a fax number, old but still useful in emergency.
If I can't reach flesh on a phone during business hours, I do my business with somebody else. No exceptions. A friend was trusting money and login details to a site with no mailing address or phone number and I pointed this out. He was suddenly aghast, another who did the same shrugged, I shuddered. Some people insist on learning the hard way.
Earlier quoted context omitted.
> Emails sent from your domain usually constitute valid contracts Gonna need a source on that one, chief.
> Gonna need a source on that one, chief. The example I always use is when a college coach tells an athlete they've been accepted to a college before the admissions committee formerly approves them, and they actually get rejected. This happens dozens of times per year, and the reason you never see any lawsuits about it is that the colleges just let them in to avoid the bad publicity.
Email domain spoofing is super easy.
Earlier quoted context omitted.
> If the athlete turned up waving a _spoofed_ email and they let them in then that would be a more appropriate example. Fair, I was just making the point about the validity of email agreements in general. But let's say Harvard let others send email that appeared to come from their domain (by not having SPF enabled) and some kid withdrew all their other college applications because one of their friends was playing a p…
I think you’re greatly mistaken in your assumptions. Harvard would suffer much greater damage to their reputation if they honored a fake acceptance email. To my knowledge, no university has ever honored a fake (physical) acceptance letter either, and those have existed (as pranks or otherwise) for a while. It’s highly unlikely that such a case would even get to trial without being dismissed. For example, see this Quo…
A couple of humble suggestions: 1. Get/Hire someone to do a proper analysis of the "breach". This may require your client's cooperation. 2. Regardless of whose fault that was, try to improve the process to protect yourself and your clients in the future (e.g. email signing, confirmation via a different channel, different way of collecting payments etc.)