1. Introduction

Phishing is a form of cyberattack in which an attacker impersonates a trusted person, company, bank, or institution to deceive someone into disclosing confidential information, transferring money, clicking a malicious link, or downloading harmful software.

Phishing liability involving employees concerns the legal responsibility that may arise when an employee receives, responds to, facilitates, or participates in a phishing attack affecting an employer, customer, business partner, or other third party.

Phishing incidents can result in stolen passwords, unauthorised financial transfers, exposure of personal information, ransomware infections, and disruption of business operations. The resulting liability may involve employees, employers, financial institutions, service providers, or external attackers.

An employee's involvement does not automatically make the employee legally liable. The outcome depends on the employee's conduct, the applicable legal duties, the degree of negligence or intent, the employer's security controls, and the connection between the conduct and the resulting loss.

For example, an employee who unknowingly clicks a sophisticated phishing link may have acted negligently, or may simply have been deceived despite reasonable precautions. By contrast, an employee who knowingly provides company credentials to a criminal in exchange for money may face substantially different civil, disciplinary, or criminal consequences.

2. Meaning and scope of phishing liability

Phishing liability refers to potential legal responsibility arising from a phishing incident, including responsibility for the resulting financial loss, data breach, regulatory violation, or security failure.

Common forms of phishing include:

Email phishing: Fraudulent emails impersonate trusted organisations or colleagues.

Spear phishing: Messages are tailored to a particular employee, executive, or department.

Business email compromise (BEC): Criminals impersonate executives, suppliers, or business partners to induce fraudulent payments or changes to bank details.

Credential phishing: Fake login pages collect usernames, passwords, or authentication codes.

Smishing: Fraudulent text messages encourage employees to disclose information or access malicious websites.

Malicious attachment attacks: Attachments install malware or provide unauthorised access to business systems.

Liability may arise where an employee violates security procedures, discloses confidential information, makes an unauthorised payment, deliberately assists an attacker, or fails to follow an applicable legal or contractual duty.

However, a phishing incident alone does not establish negligence, misconduct, or criminal intent.

3. Legal framework governing employee phishing liability

A. Employee responsibility

An employee may face disciplinary, civil, or criminal consequences where evidence establishes that the employee knowingly participated in fraud, deliberately disclosed confidential credentials, bypassed mandatory security safeguards, or caused loss through conduct that breaches an applicable duty.

A distinction must be made between:

An employee who is deceived despite reasonable precautions.

An employee who negligently disregards clear security instructions.

An employee who knowingly assists an attacker.

An employee whose account is compromised without their knowledge or consent.

These situations do not carry the same legal consequences. Negligence does not automatically amount to a criminal offence, and an employer must not assume that the employee caused the incident merely because the attack used the employee's account.

B. Employer responsibility

An employer may face liability if it fails to take reasonable steps to protect confidential information, provide appropriate security controls, train employees, or respond adequately to known cyber risks.

Relevant issues include whether the organisation had multi-factor authentication, payment verification procedures, email filtering, access controls, incident-reporting procedures, and appropriate monitoring.

An employer's responsibility is not necessarily eliminated because an employee clicked a phishing link. Equally, the occurrence of an attack does not by itself establish that the employer was negligent.

C. Indian statutory provisions

The Information Technology Act, 2000, may be relevant depending on the facts.

Section 43: Addresses specified unauthorised acts involving computer systems and networks and may provide for compensation.

Section 66: Applies to specified acts under Section 43 when committed dishonestly or fraudulently.

Section 66C: Addresses fraudulent or dishonest use of another person's electronic signature, password, or other unique identification feature.

Section 66D: Addresses cheating by personation using a computer resource or communication device.

Section 72: Addresses breach of confidentiality and privacy in the circumstances covered by that provision.

Section 72A: Addresses disclosure of personal information in breach of a lawful contract, with the statutory elements required by that section.

Depending on the incident, other provisions concerning cheating, breach of trust, data protection, contractual duties, or employment discipline may also be relevant. These provisions should not be applied automatically to an employee who has merely fallen victim to a phishing message.

4. Important case laws on phishing liability involving employees

The following cases examine phishing-related payment fraud, cybersecurity duties, employee information security, and the legal responsibility of people and organisations involved in cyber incidents. Some are directly concerned with phishing or business email compromise; others provide relevant principles by analogy.

Case 1: Poona Auto Ancillaries Pvt. Ltd. v. Punjab National Bank

Forum: Banking Ombudsman-related adjudication by the Maharashtra Information Technology Secretary, 2013.

Facts: A business suffered a substantial financial loss after a phishing-related fraud involving its bank account. Fraudulent transfers were made after the account holder responded to a phishing email.

Decision and principle: The reported adjudication awarded compensation against the bank after identifying shortcomings in the bank's safeguards, while also considering the account holder's conduct.

Relevance to employee phishing liability: This matter illustrates that responsibility for phishing losses may be shared or allocated according to the conduct of the parties and the effectiveness of their security procedures. An employee's response to a fraudulent message should not automatically absolve the organisation or financial institution of responsibility for its own failures.

Legal significance: The case is useful as an Indian cyber-fraud example, but it was an administrative adjudication rather than a Supreme Court judgment establishing a universal rule for employee liability. The allocation of responsibility depends on the particular facts and applicable legal framework.

Case 2: ICICI Bank Ltd. v. Uma Shankar Sivasubramanian

Forum: Madras High Court proceedings arising from a phishing-related banking dispute.

Legal issue: Whether a bank could be held responsible for transactions allegedly made possible by the customer's disclosure of confidential information in a phishing incident.

Principle: The dispute involved competing arguments concerning customer negligence, the bank's responsibility, and the application of the Information Technology Act to the fraudulent transactions.

Relevance to employee phishing liability: In a workplace incident, a similar analysis may be required to determine whether the employee's conduct, the employer's security procedures, or another party's failures contributed to the loss.

Legal significance: The case demonstrates the importance of examining the actual conduct and applicable statutory provisions rather than assuming that every phishing incident creates automatic liability for the party whose credentials were compromised.

Note: The case should be cited with its precise procedural history and final disposition verified before relying on it in formal legal submissions.

Case 3: Ernst & Haas Management Co., Inc. v. Hiscox, Inc. (2022)

Court: United States Court of Appeals for the Ninth Circuit.

Legal issue: Whether a company's financial loss caused by fraudulent email instructions directing an employee to transfer money could fall within commercial crime insurance coverage.

Facts: An accounts-payable employee received emails impersonating a company superior and transferred money to a fraudulent recipient. The company sought coverage under its commercial crime insurance policy.

Decision: The Ninth Circuit held that the loss could fall within the policy's computer-fraud and funds-transfer-fraud provisions and remanded the matter for further proceedings.

Relevance to employee phishing liability: The employee initiated the transfers, but the fraudulent instructions were central to the loss. The case illustrates why the employee's involvement in a transaction does not automatically settle the question of who bears the financial loss.

Legal significance: Organisations should examine payment-verification controls, internal authorisation procedures, and insurance wording. This judgment concerned insurance coverage, not a finding that the employee was personally liable.

Case 4: Shapiro v. Wells Fargo Bank, N.A. (2019)

Court: United States Court of Appeals for the Eleventh Circuit.

Legal issue: Whether a bank could be held responsible for processing a wire transfer initiated after a targeted phishing scam.

Facts: A law firm fell victim to a targeted email scam and initiated a wire transfer of approximately $504,611.13 in connection with a business transaction. It subsequently challenged the bank's handling of the transfer.

Decision: The Eleventh Circuit affirmed summary judgment for the bank.

Relevance to employee phishing liability: Employees who handle payments must be careful when receiving changed payment instructions or requests involving urgent transfers. Nevertheless, liability depends on the relevant duties, the transaction's circumstances, and the evidence.

Legal significance: The case cautions against assuming that a bank is automatically liable whenever an employee initiates a transfer because of a fraudulent email. It also illustrates why companies need independent verification procedures for high-value payments.

Case 5: Sackin v. TransPerfect Global, Inc. (2017)

Court: United States District Court for the Southern District of New York.

Legal issue: Whether a company could face negligence liability for allegedly failing to take reasonable measures to protect sensitive employee information from phishing-related disclosure.

Facts: The plaintiffs alleged that an employee responded to a phishing email and disclosed sensitive personal information. They argued that the employer had failed to implement adequate cybersecurity safeguards, including appropriate training and protective measures.

Decision: The court concluded that the allegations were sufficient at the pleading stage to support a negligence claim.

Relevance to employee phishing liability: An employee's response to a phishing email does not necessarily eliminate the employer's potential responsibility for protecting information entrusted to it.

Legal significance: The case illustrates that courts may examine the employer's security practices, awareness of foreseeable threats, and obligations to protect employee information. A decision allowing a claim to proceed is not the same as a final finding of liability.

Case 6: Clemens v. ExecuPharm, Inc. (2022)

Court: United States Court of Appeals for the Third Circuit.

Legal issue: Whether an employee could establish the required injury for a lawsuit following a cybersecurity incident involving stolen personal information.

Facts: A hacking group accessed ExecuPharm's servers through a phishing-related attack and stole sensitive information concerning current and former employees, including financial and identifying information.

Decision: The Third Circuit held that the plaintiff had adequately alleged an injury sufficiently imminent to establish standing and remanded the case for further proceedings.

Relevance to employee phishing liability: This case demonstrates that phishing incidents can create legal consequences extending beyond the person who clicked a link. Employees whose information is compromised may have claims against an employer depending on the circumstances and governing law.

Legal significance: The judgment concerned standing to sue, not a final determination that the employer was negligent or that a particular employee was liable.

Case 7: Ramirez v. The Paradies Shops, LLC (2023)

Court: United States Court of Appeals for the Eleventh Circuit.

Legal issue: Whether employees affected by a ransomware-related data breach could pursue a negligence claim against their employer.

Facts: Cybercriminals obtained sensitive personal information belonging to current and former employees during a ransomware attack. The plaintiff alleged that the employer had not taken adequate steps to protect the information.

Decision: The Eleventh Circuit reversed the dismissal of the negligence claim and remanded it for further proceedings, while affirming dismissal of the implied-contract claim.

Relevance to employee phishing liability: The case highlights the employer's potential duty to protect employee information. Where phishing is the entry point for a larger attack, the adequacy of organisational security measures may be relevant to liability.

Legal significance: The decision did not establish that every data breach constitutes negligence. It addressed whether the particular allegations were sufficient for the negligence claim to proceed.

Case 8: United States v. Iwuanyanwu (2023)

Court: United States Court of Appeals for the First Circuit.

Legal issue: Criminal responsibility for participation in a business email compromise scheme.

Facts: The defendant participated in a business email compromise operation involving spoofed or compromised email accounts and fraudulent payment instructions intended to induce targeted businesses to transfer funds to accounts controlled by the perpetrators.

Decision: The First Circuit affirmed the challenged sentencing enhancements.

Relevance to employee phishing liability: This case illustrates the distinction between an employee who is deceived by a fraudulent message and a person who knowingly participates in a scheme using fraudulent email instructions.

An employee who deliberately helps redirect company funds, supplies credentials to criminals with fraudulent intent, or participates in a coordinated payment-diversion scheme may face criminal liability if the relevant statutory elements are established.

Legal significance: Criminal responsibility depends on evidence of the defendant's conduct and the required mental state. Merely receiving or mistakenly acting on a phishing email is not equivalent to knowingly participating in a fraud scheme.

5. Factors determining employee liability

The following factors are particularly important when evaluating a workplace phishing incident.

6. Preventive obligations of employers

Employers can reduce legal and financial risks by establishing a comprehensive phishing-prevention programme.

Employee training

Conduct regular phishing-awareness training, explain how to identify suspicious messages, and provide a simple process for reporting them. Training should focus on prevention rather than automatically blaming employees after an incident.

Strong authentication

Implement multi-factor authentication, secure password practices, least-privilege access, and appropriate controls for sensitive systems.

Payment verification

Require independent verification of bank-detail changes, unusual payment instructions, and high-value transfers, especially those requested by email.

Incident response

Maintain a documented reporting process, preserve relevant logs, disable compromised credentials promptly, and contact the bank or appropriate authorities quickly when funds or sensitive information are affected.

7. Employee disciplinary action and legal safeguards

An employer may investigate a phishing incident and take proportionate disciplinary action where evidence establishes a breach of a valid workplace rule or other applicable duty.

However, the investigation should distinguish between deliberate wrongdoing, careless conduct, and an employee being deceived despite reasonable precautions.

A fair investigation should generally:

Establish how the phishing message reached the employee.

Determine what the employee actually did and whether the relevant security rule was communicated.

Examine whether the organisation's technical and procedural safeguards were adequate.

Assess whether the employee's conduct caused or materially contributed to the loss.

Give the employee an appropriate opportunity to explain the circumstances.

Apply any required contractual, statutory, or disciplinary procedures.

An employer should not automatically deduct the entire loss from an employee's salary or dismiss the employee merely because the employee clicked a link. Any recovery of losses or disciplinary action must comply with applicable law and the employee's contractual and statutory protections.

8. Conclusion

Phishing liability involving employees requires a careful distinction between being a victim of cybercrime, negligently breaching a workplace duty, and deliberately participating in fraud.

The cases discussed above demonstrate several important principles: fraudulent email instructions can generate complex payment and insurance disputes; employers may face negligence claims when employee information is inadequately protected; and deliberate participation in a business email compromise scheme can attract criminal consequences.

At the same time, a company cannot assume that every phishing loss is automatically the employee's responsibility. The employee's intent, the employer's security controls, the relevant contractual or statutory duties, and the evidence connecting the conduct to the loss must all be examined.

The central principle is that phishing liability must be determined from the actual conduct of each party, the applicable legal duties, and the evidence—not merely from the fact that an employee interacted with a fraudulent message.