A Philippine legal article

I. Introduction

A recurring commercial fraud in the Philippines is the “impostor account” or “business email compromise” scenario: a business intends to pay a real supplier, contractor, landlord, or service provider, but the funds are instead sent to a fraudulent bank or e-wallet account controlled by an impostor. The deception may happen through hacked email, fake invoices, spoofed messages, forged collection notices, altered bank details, fake officers, cloned domains, or social engineering directed at accounting staff.

The immediate business question is simple: Who bears the loss?

The legal answer is not simple at all. Under Philippine law, liability may fall on one or several parties, depending on the facts:

the paying business that sent the money,
the fraudster,
the real supplier or intended creditor,
the bank or financial institution that processed the transfer,
the electronic money issuer or payment service provider,
the employee who approved or released the payment,
the corporate officer who failed to maintain controls,
or even a third-party intermediary whose systems were compromised.

The result turns on obligations law, payment law, negligence, fraud, contracts, banking regulation, evidence, cybersecurity compliance, and the allocation of risk under commercial practice.

This article explains the Philippine legal framework comprehensively.

II. The Basic Legal Problem: Was the Debt Actually Paid?

The first and most important issue is this:

If a business intended to pay its real creditor, but the money was sent to a fraudulent impostor account, has the obligation been extinguished?

In many cases, the answer is no.

Under basic Philippine civil law on obligations and payment, payment must be made to the proper person to extinguish the obligation. As a rule, payment should be made to:

the creditor,
the creditor’s successor-in-interest,
or a person authorized to receive payment.

If the debtor pays the wrong person, the debt is generally not discharged, unless the law recognizes a specific basis to treat the payment as effective against the true creditor.

That means a business may suffer a double loss:

It loses the money sent to the impostor, and
It may still owe the original creditor.

This is the harsh starting point.

III. Why “We Already Paid” Is Often Not a Legal Defense

In impostor-account disputes, the paying business often argues:

“We sent the money in good faith.”
“The email looked legitimate.”
“The invoice came from the usual contact.”
“Our employee was tricked.”
“The supplier’s email may have been hacked.”
“The bank transfer was completed, so payment was made.”

These facts may help in later arguments on fault allocation, but they do not automatically extinguish the debt if the money never reached the true creditor or an authorized recipient.

From the standpoint of Philippine obligations law, a debt is generally not extinguished by payment to a stranger.

The real fight therefore becomes:

whether the impostor was somehow authorized or appeared authorized,
whether the true creditor’s own negligence caused the deception,
whether the creditor is estopped from denying the payment,
whether the bank or payment platform was negligent,
whether there was a breach of contract or statutory duty by any party,
and whether the payer can recover the funds from someone else even if the original debt remains.

IV. The Core Civil Law Rule on Payment to the Wrong Person

The Philippine Civil Code requires that payment be made to the proper party. In principle, payment to a person who is not the creditor and is not authorized to receive it is ineffective against the creditor.

A. Payment to an unauthorized person

If the impostor had no authority from the supplier or real payee, then payment to the impostor ordinarily does not discharge the obligation.

B. Exceptions and complications

There are situations where payment to someone other than the creditor may still have legal effect, such as where:

the payment redounded to the benefit of the creditor,
the creditor later ratified the payment,
the recipient had apparent authority caused by the creditor,
the creditor’s conduct created estoppel,
or the funds actually reached the creditor despite the irregularity.

In impostor-account fraud, these exceptions are heavily litigated.

C. Business consequence

A company that pays to a false account usually starts from a weak legal position if it tries to insist that its debt has already been fully settled.

V. The Central Liability Question: Who Was at Fault?

Philippine law does not treat these cases as purely mechanical payment problems. They are also disputes about fraud, negligence, and allocation of commercial risk.

A court or regulator will usually examine:

How the fraud occurred
Who controlled the compromised channel
Who had the last clear chance to prevent the loss
Whether ordinary prudence was exercised
Whether internal controls were followed
Whether any bank or payment provider failed in due diligence
Whether the real supplier’s conduct contributed to the deception
Whether the payment instruction was facially suspicious
Whether any industry or contractual verification procedure was ignored
Whether the transfer can still be traced or frozen

The legal outcome often depends less on abstract doctrine and more on a detailed reconstruction of operational failure.

VI. The Usual Parties Potentially Liable

A. The paying business

The payer is often the first party to absorb the loss because it physically released the funds.

The payer may be found negligent for:

failing to verify changed bank details,
relying solely on email without callback verification,
ignoring discrepancies in account names,
approving urgent or irregular payment instructions,
violating internal approval policies,
bypassing dual authorization,
failing to authenticate vendor communication,
or transferring funds to an account not matching the registered supplier details.

If negligence is serious, the payer may remain liable to the real creditor and have limited recourse except to chase the fraudster or negligent intermediaries.

B. The fraudster

The fraudster is principally liable civilly and criminally. The problem is not legal theory but practical recovery. Fraudsters often disappear, use mules, cash out quickly, or operate through layered accounts.

C. The real supplier or intended payee

The supplier may share liability if the fraud arose from its own poor security, misleading communications, compromised email system, unauthorized staff conduct, or negligent handling of payment instructions.

D. The bank

A bank may be exposed if it acted negligently in account opening, suspicious transaction handling, anti-fraud controls, freeze response, name-check handling, or transaction monitoring.

E. The e-wallet provider, EMI, or payment platform

Where funds were sent through an e-money or digital payment channel, the provider may face similar issues regarding know-your-customer compliance, suspicious account activity, account opening standards, fraud response, and consumer or merchant protection duties.

F. Employees and officers

The company’s own employees may incur labor, administrative, or even civil liability internally, depending on negligence, collusion, or policy violations.

VII. The Real Creditor’s Position: Can It Still Demand Payment?

Usually, yes.

If the creditor never received the funds and never authorized the impostor account, the creditor may still demand payment of the original obligation.

This shocks many businesses, but the legal reasoning is straightforward:

the obligation was owed to the real creditor,
the money was sent elsewhere,
therefore the debt remains unpaid unless a valid defense exists.

Important caveat

The creditor’s right to demand payment may still be reduced, defeated, or complicated if the creditor itself caused or materially contributed to the fraud, such as by:

allowing a compromised employee mailbox to be used for payment instructions,
sending contradictory or careless account-change notices,
failing to warn counterparties of known compromise,
negligently supervising staff who issued fake directives,
or holding out the fraudster as an authorized collector.

That is not because the wrong payment suddenly became valid, but because the creditor may be barred by estoppel, liable in damages, or considered contributorily negligent under the facts.

VIII. Apparent Authority, Estoppel, and Fraudulent Collection Instructions

One of the most disputed areas in these cases is whether the impostor appeared to have authority because of the creditor’s own conduct.

A. Apparent authority

If a business is led to believe, through the acts or omissions of the true creditor, that a particular person or channel was authorized to receive payment instructions, the creditor may be bound by that appearance of authority.

In the impostor-account setting, this could be argued where:

fake account instructions came from a genuine compromised company email,
the supplier had an established pattern of changing collection accounts informally,
the creditor allowed unauthorized agents to negotiate and collect,
the payer had long relied on the same representative who was never formally disowned,
or the creditor’s internal laxity made the deception appear official.

B. Estoppel

A creditor may be estopped from denying the authority of the person who received payment if the creditor’s own conduct misled the debtor into making the payment.

However, estoppel is not lightly presumed. The payer must prove that reliance was reasonable and was induced by the creditor’s behavior, not merely by the payer’s own carelessness.

C. Practical limit

If the paying business ignored obvious warning signs, apparent authority and estoppel become much weaker.

IX. Business Email Compromise and Cyber-Fraud Context

Many impostor account cases are no longer simple fake invoice cases. They involve cyber-enabled deception, including:

hacked or spoofed company domains,
manipulated vendor master data,
fraudulent account-change requests,
malware intercepting invoices,
compromised finance mailboxes,
cloned payment approval chains,
fake executive instructions,
deepened impersonation through messaging apps.

In Philippine law, this means the dispute may involve not just the Civil Code but also:

cybercrime-related criminal exposure,
data and information security obligations,
regulatory expectations on financial institutions,
and evidentiary issues concerning electronic documents and electronic messages.

The civil liability question remains central, but the factual analysis becomes more technical.

X. Liability of the Paying Business Under Negligence Principles

Even where the business acted honestly, it may still be legally negligent.

A. Standard of care

Businesses are expected to exercise the diligence of a prudent enterprise, especially when handling significant payments.

What counts as reasonable care depends on:

amount involved,
prior payment practice,
nature of the business,
known fraud risks,
internal controls,
urgency and irregularity of request,
vendor onboarding rules,
and account verification procedures.

B. Common payer failures

A business is more exposed when it:

accepted changed bank details by email only,
failed to confirm through an independent channel,
did not verify the account name against the supplier name,
ignored mismatched account ownership,
rushed payment because of “urgent” instructions,
allowed a single employee to create and approve the vendor record,
failed to segregate duties,
did not maintain maker-checker approval,
or failed to freeze the transaction immediately after discovery.

C. Effect of negligence

Negligence can mean:

the debt to the supplier remains payable,
the business cannot shift the full loss to the supplier,
the business may have a weaker claim against the bank,
and internal management may face shareholder or governance concerns.

XI. Liability of the Supplier or Intended Creditor

The supplier is not always innocent in the legal sense, even if it did not receive the money.

The supplier may bear some or all of the loss if the fraud was caused or enabled by its conduct.

A. Compromised email or systems

If the supplier’s own email or invoicing system was hacked and used to send fraudulent account details, the payer may argue that the supplier failed to maintain reasonable information security.

B. Failure to secure payment channels

A supplier that regularly transmits account changes through unsecured means, without verification rules, may be found to have created unreasonable risk.

C. Negligent employee management

If a rogue or careless employee sent false payment instructions from the supplier’s systems, the supplier may be liable under agency, labor, supervision, or corporate responsibility principles.

D. Failure to warn counterparties

If the supplier knew of attempted compromise or prior account-manipulation incidents but failed to alert customers, that omission may be highly damaging.

E. Effect on the original debt

Even if the debt was technically unpaid, the supplier’s negligence may give the payer a counterclaim, set-off argument, or damages claim that changes the practical result.

XII. Bank Liability in the Philippines

Banks occupy a special legal position in Philippine law. They are generally expected to observe a high degree of diligence in dealing with accounts and funds because banking is affected with public interest.

That principle does not mean banks are automatic insurers against fraud. But it does mean they may face liability where their own failures contributed to the loss.

A. Account opening and KYC failures

A bank may be scrutinized if the fraudulent recipient account should not have been opened in the first place because of defective know-your-customer procedures, fake identity documents, mule-account indicators, or suspicious account profiling.

B. Unusual transaction activity

If a newly opened account suddenly received large commercial payments inconsistent with its profile and quickly dispersed the funds, the bank’s monitoring and suspicious-activity handling may be questioned.

C. Failure to act promptly on fraud reports

Once notified, the receiving or remitting bank may be examined for how quickly it responded to freeze, hold, report, or investigate the transaction.

D. Name mismatch issues

A recurring issue is whether the bank should have flagged a mismatch between the account name of the intended supplier and the actual beneficiary account.

This depends heavily on the payment rail, operational rules, system design, and applicable regulations. In some systems, account number controls; in others, name matching is stronger or increasingly expected. Liability is therefore very fact-specific.

E. Confidentiality versus fraud response

Banks must balance deposit confidentiality and customer rights with legal duties regarding fraud reporting, suspicious transactions, anti-money laundering obligations, and lawful disclosure.

F. The practical barrier

Even if bank negligence exists, the payer must still prove:

breach of duty,
causation,
actual loss,
and why the bank, rather than the payer’s own negligence, should bear the loss.

XIII. Anti-Money Laundering and Fraud Tracing Implications

Fraudulent impostor accounts often involve rapid movement of funds through mule accounts, layered transfers, cash withdrawals, crypto off-ramps, or e-wallet exits.

In the Philippines, anti-money laundering controls become relevant because fraud proceeds may qualify as unlawful proceeds connected with predicate offenses depending on the facts and criminal framing.

Practical relevance

These issues matter for:

attempted freeze or hold actions,
coordination with banks,
tracing beneficiaries,
filing suspicious transaction reports,
preserving evidence,
and building civil or criminal recovery actions.

A business victim should act immediately because delay may allow complete dissipation of the funds.

XIV. E-Wallets, Digital Payment Platforms, and Fintech Liability

If payment was sent to a fraudulent e-wallet or other digital account, the legal analysis is similar but adapted to the digital ecosystem.

Potential issues include:

onboarding diligence,
identity verification,
limits and velocity controls,
device and account anomaly detection,
response to fraud reports,
transaction reversibility,
records preservation,
coordination with law enforcement,
and compliance with central bank regulations governing electronic money and digital finance.

Digital providers are not necessarily liable simply because their platform was used. Liability still depends on negligence, contract, regulatory breach, and causation.

XV. Internal Corporate Liability: Employees, Officers, and Governance

An impostor payment incident can become an internal corporate law problem, not just an external fraud problem.

A. Employee liability

An employee who negligently approved a payment may face:

disciplinary action,
administrative sanctions,
possible civil accountability to the employer in extreme cases,
and criminal exposure if there was collusion or gross bad faith.

Ordinary employee negligence, however, does not always mean automatic reimbursement to the employer. Labor law considerations remain important.

B. Officer liability

Finance heads, treasurers, controllers, and approving officers may face issues if they:

ignored controls,
failed to implement basic anti-fraud procedures,
overrode verification systems,
or permitted concentrated approval powers.

C. Board and management oversight

A major fraud loss may expose weaknesses in risk management, compliance, internal audit, and vendor payment governance. This becomes significant especially in larger corporations, regulated entities, and public-interest businesses.

XVI. Contract Clauses That Change the Outcome

The legal result may be heavily influenced by the underlying contract between payer and supplier.

Important clauses include:

designated payment account provisions,
exclusive notice procedures for account changes,
no-reliance clauses,
email instruction disclaimer clauses,
cybersecurity allocation clauses,
fraud notification obligations,
indemnity clauses,
verification protocols,
and dispute-resolution clauses.

A. Exclusive designated account

If the contract states that payments are valid only when made to a specific named account, a payer who remits elsewhere is usually in a much weaker position.

B. Change-of-account procedure

If the contract requires written notice signed by named officers and confirmed by a callback, noncompliance may clearly shift risk to the party who ignored the process.

C. Supplier security obligations

A contract may require the supplier to maintain secure communications and notify customers immediately of any compromise. Breach can support damages or risk shifting.

D. No oral or email modification

Such clauses can matter greatly if the fake change instruction came through informal channels.

XVII. Electronic Evidence in Philippine Litigation

These cases rise or fall on electronic evidence.

Key evidence often includes:

emails and headers,
domain registration records,
logs of account changes,
screenshots of invoices,
approval trails,
bank transfer confirmations,
call logs,
messaging app communications,
device records,
access logs,
incident reports,
forensic findings,
and vendor master-data histories.

A. Authenticity matters

A party must not merely present screenshots and claim fraud. It must establish authenticity, source, and integrity.

B. Chain of events matters more than labels

Whether someone calls it “hacking,” “spoofing,” or “phishing” matters less than proving exactly how the false payment instruction came to be trusted and executed.

XVIII. Criminal Exposure Alongside Civil Liability

Sending payment to a fraudulent impostor account can trigger both civil and criminal proceedings.

Potential criminal dimensions may include:

estafa or related fraud theories,
cyber-enabled fraud,
use of falsified documents,
identity-related offenses,
money-laundering-related consequences for proceeds handling,
and liability of accomplices, mules, or colluding insiders.

Important distinction

Criminal prosecution of the fraudster does not automatically resolve the civil allocation of loss among the business, supplier, bank, and payment providers.

A business may still need separate civil action, contractual action, or defensive litigation over the original unpaid obligation.

XIX. Can the Paying Business Recover From the Fraudster?

Legally, yes. Practically, it is often difficult.

The business may sue to recover based on:

fraud,
unjust enrichment,
quasi-delict,
restitution,
or criminal restitution-related remedies.

But real obstacles include:

fake identities,
mule accounts,
rapid withdrawals,
layered transfers,
offshore movement,
nominee account holders,
and lack of assets.

Recovery is easiest when the fraud is discovered quickly and the funds can be frozen before dissipation.

XX. Can the Paying Business Recover From the Bank?

Possibly, but not automatically.

To recover from a bank, the business typically must prove more than the bare fact that the bank processed a transfer to a fraudulent account. It must show some combination of:

breach of contractual duty,
breach of the extraordinary diligence expected of banks,
negligent onboarding,
negligent monitoring,
negligent handling of clear red flags,
failure to respond after prompt notice,
or other actionable omissions.

Banks will usually defend by arguing:

they followed the payment instruction exactly as given,
the payer authorized the transfer,
account-number-based systems are standard,
there was no obvious irregularity requiring refusal,
the fraud was caused by the payer’s or supplier’s own compromised communications,
and the funds had already been withdrawn before any hold request could lawfully or practically take effect.

XXI. Can the Paying Business Refuse to Pay the Supplier Again?

Sometimes businesses assume the supplier must absorb the loss because the payment was intended for the supplier. That is not the default rule.

The payer can refuse a second payment only if it has a legally sustainable defense, such as:

the supplier actually authorized the account,
the supplier’s conduct created apparent authority,
the supplier is estopped,
the supplier materially breached contractual payment-security obligations,
the supplier’s negligence caused the fraud,
or the funds somehow redounded to the supplier’s benefit.

Without such a defense, the payer may still owe the supplier.

XXII. Contributory Negligence and Shared Loss

Not every case has one guilty civil party and one innocent civil party. Often both the payer and supplier were careless in different ways.

Examples:

the supplier’s email was compromised,
but the payer also failed to verify changed bank details;
the bank opened a suspicious mule account,
but the payer ignored an obvious account-name mismatch;
the supplier used insecure communications,
but the payer bypassed its own callback policy.

In such cases, a court may effectively allocate loss through findings on causation, damages, counterclaims, or comparative fault reasoning, depending on how the causes of action are framed.

The practical result may be:

the payer remains liable for the invoice,
but recovers partial damages from the supplier or bank;
or the supplier’s claim is reduced because its own negligence materially caused the loss;
or the bank bears part of the loss for independent negligence.

These are highly fact-dependent outcomes.

XXIII. The Role of Unjust Enrichment

Unjust enrichment may support recovery against a person or entity that wrongfully retains the benefit of the misdirected payment.

This theory is most direct against:

the impostor,
mule account holders,
persons who received onward transfers without valid basis,
or intermediaries who cannot legally justify retaining funds.

It is usually less useful against the real supplier, because the supplier typically did not receive the money. Against the supplier, the real arguments are more likely to involve negligence, estoppel, contract breach, or agency.

XXIV. Practical Scenarios and Likely Legal Treatment

Scenario 1: Fake email changes supplier bank account details; payer transfers funds without callback verification

The payer is in a difficult position. The original debt may remain unpaid. The payer may try to shift loss to the supplier if the email compromise was clearly on the supplier’s side, but failure to independently verify changed account details is a major weakness.

Scenario 2: Fake instruction comes from a genuine compromised supplier email account with full transaction context

The payer has a stronger argument that the supplier’s security failure materially caused the fraud. Still, the payer must show that reliance was reasonable and that its own controls were not deficient.

Scenario 3: Account name clearly does not match supplier name, but payment proceeds anyway

This significantly weakens the payer and may create questions for the bank depending on the payment system and visible data.

Scenario 4: Longstanding supplier representative informally collects through varying accounts, and the company tolerated it for years

This strengthens an apparent authority or estoppel argument against the supplier.

Scenario 5: Receiving bank opened a mule account with obviously defective identification and allowed rapid cash-out

The bank may face serious scrutiny for negligence and compliance failures.

Scenario 6: Payment sent to fraudulent e-wallet account and immediately dispersed

Urgency becomes critical. The business must act fast with reports, preservation requests, and law enforcement coordination. Recovery becomes much harder after dispersion.

Scenario 7: An internal employee colluded with the impostor

The company may still owe the supplier if the supplier was unpaid, but the company will likely pursue the employee, the impostor, and any negligent financial intermediary.

XXV. Immediate Legal and Operational Steps After Discovery

The first hours matter enormously.

A Philippine business that discovers an impostor-account payment problem should typically do the following immediately:

1. Notify the remitting bank or payment provider

Request urgent trace, recall, hold, or freeze steps within lawful bounds.

2. Notify the receiving institution

As quickly as possible through available channels.

3. Notify the real supplier

To preserve facts, avoid further fraud, and address the unpaid obligation.

4. Preserve all electronic evidence

Do not alter inboxes, logs, or devices prematurely.

5. Conduct internal incident review

Identify how the payment was approved, who changed bank details, and whether there are other compromised transactions.

6. Consider police and cybercrime reporting

Particularly where criminal fraud is evident.

7. Consider legal demand and recovery actions

Against the identified account holder, intermediaries, or responsible parties.

8. Assess contractual obligations

Determine whether the invoice remains due and whether there are notice or dispute deadlines.

Delay can destroy recovery prospects.

XXVI. Internal Controls That Strongly Affect Liability

In litigation, a business with strong controls looks very different from one with weak controls.

Key controls include:

vendor bank account master-data lock controls,
independent callback verification for account changes,
dual or layered approvals,
segregation of duties,
positive payee verification where available,
domain and email authentication monitoring,
mandatory cooling-off period for changed payment instructions,
whitelisting of approved beneficiary accounts,
fraud awareness training,
escalation of urgent or irregular requests,
periodic supplier account confirmation,
and incident response protocols.

A business that ignored basic controls may struggle to shift the loss elsewhere.

XXVII. Philippine Regulatory and Compliance Context

Even without naming specific recent issuances, the Philippine legal environment generally expects regulated financial actors to maintain systems for:

customer identification,
transaction monitoring,
fraud management,
operational resilience,
information security,
and consumer or client protection.

For businesses outside the financial sector, the same environment still matters because courts will often judge conduct against what prudent commercial practice now requires in a digital fraud setting.

The more foreseeable this fraud type becomes, the higher the expected standard of care.

XXVIII. Supplier-Side Best Practices That Affect Legal Position

A supplier wanting to avoid bearing the loss should maintain and document the following:

one formal payment-instruction channel,
written “no bank account changes by email only” policy,
authenticated account-change protocol,
secure invoicing systems,
incident notification procedure,
vendor-contact verification practices,
staff authority matrix,
and immediate warning notices when compromise is suspected.

These practices do not eliminate fraud, but they greatly improve the supplier’s legal position.

XXIX. Payer-Side Best Practices That Affect Legal Position

A paying business wanting to reduce liability should implement:

strict callback verification using independently sourced contact details,
prohibition on changing beneficiary accounts based only on email,
reconciliation of account name and beneficiary identity,
approval thresholds and dual control,
cyber-fraud training for finance teams,
documented vendor onboarding,
periodic reconfirmation of approved accounts,
rapid fraud escalation process,
and legal review for major payment disputes.

A business that can show disciplined controls is far better positioned to argue that the loss should lie elsewhere.

XXX. What Courts Usually Care About Most

In real litigation, the decisive questions are usually practical, not rhetorical.

Courts tend to focus on:

who was the proper payee,
who actually received the funds,
whether the true creditor authorized the account,
whether reliance on the instruction was reasonable,
whether the payer exercised due care,
whether the supplier’s conduct created the deception,
whether the bank failed in diligence,
whether the fraud could have been prevented by ordinary prudence,
and what evidence proves each step.

The side with the clearest documentary reconstruction often wins.

XXXI. Common Misconceptions

Misconception 1: “A completed bank transfer means the debt is paid.”

Not necessarily. Payment to the wrong person usually does not extinguish the debt.

Misconception 2: “Good faith alone protects the payer.”

Good faith helps, but it does not automatically shift the loss.

Misconception 3: “The supplier always bears the risk if its name was used.”

Not always. The payer may still be negligent.

Misconception 4: “The bank is automatically liable because fraud happened through an account.”

Not automatically. Bank liability depends on breach of duty and causation.

Misconception 5: “Once the money is gone, only criminal law matters.”

Wrong. Civil liability over the unpaid invoice and damages often remains the core issue.

XXXII. Bottom-Line Legal Position in the Philippines

Under Philippine law, a business that sends payment to a fraudulent impostor account generally remains liable to the true creditor unless the payment was made to an authorized recipient, benefited the creditor, or the creditor’s own conduct legally binds it through apparent authority, estoppel, contract, or negligence principles.

That means the paying business often bears the initial loss.

But that is not the end of the analysis. Liability may shift wholly or partly if the facts show that:

the supplier caused or enabled the deception,
the bank or payment provider failed in the high standard of care expected in handling accounts and suspicious activity,
the fraudster or account holder can be traced and sued,
or the parties’ contract allocated the risk differently.

The real legal question is not just “who sent the money,” but:

who had the legal right to receive it,
who made the fraud believable,
who failed to exercise reasonable diligence,
and whose breach most directly caused the loss.

That is the legal heart of business liability for payment sent to a fraudulent impostor account in the Philippines.