Did you know that… an employee who executes a bank transfer following a phishing email may be dismissed and ordered to compensate the employer for the loss?

With order no. 43873 of 13 February 2026, the Italian Supreme Court – Labor Division – held that the dismissal for just cause of an employee working in the accounting department was lawful where she had authorized a bank transfer in favour of third parties on the basis of an email communication that later proved to be fraudulent, also confirming the legitimacy of the employer’s claim for restitution of the amount unduly paid.

In the case at hand, the employee executed a payment in favour of a foreign company following an email apparently sent by the chair of the board of directors. The request subsequently proved to be part of a cyber fraud scheme, as it originated from third parties who had unlawfully used the identity of the company’s chair.

The evidentiary findings showed that the employee had carried out no verification as to the origin of the communication or the consistency of the request with the company’s internal procedures. In particular, the email displayed clear anomalies: the absence of the information necessary to execute an international transfer, the indication of a generic payment reference, and the lack of supporting accounting documentation, all in breach of the operational rules in force within the company.

It also emerged that the employee had been warned, before the final execution of the payment, that the request was not authentic, yet she failed to take steps to block the transaction.

The Court of Appeal found that the conduct amounted to a serious breach of the duties of diligence and fairness, noting that the employee had been permanently assigned to administrative and accounting duties, thus requiring a particularly high level of care in handling payment operations. The second-instance judges further established that there was no company practice capable of justifying the execution of transfers based solely on an email request, in the absence of the checks and authorisations required by internal procedures.

In dismissing the appeal, the Supreme Court held that the merits assessment regarding the existence of just cause was free from defects, observing that the negligence ascertained did not amount to a mere clerical error but revealed a significant disregard for the employer’s interests, such as to undermine the relationship of trust.

The Court of Cassation also upheld the employee’s liability for damages, quantified in the amount of the transfer executed in favour of third parties, noting that such loss was a direct consequence of the employee’s negligent conduct.

In conclusion, the ruling highlights that, in the context of administrative and accounting duties, a high standard of diligence is required: failure to comply with internal procedures and omission to verify evident anomalies may constitute just cause for dismissal and give rise to liability for damages on the part of the employee.

Other related insights: 

• The salary credit fraud. An alert tip for HR managers (Norme & Tributi Plus Lavoro de Il Sole 24 Ore, 19 December 2024 – Vittorio De Luca, Martina De Angeli)