Fraudsters Posing as Art Dealer Got Gallery to Pay Millions

Hackers posing as a veteran London art dealer tricked a Dutch museum buying a John Constable painting into paying 2.4 million pounds ($3.1 million) into a fraudulent bank account.

Scamming their way into the middle of months of negotiating emails between Simon C. Dickinson Ltd. and Rijksmuseum Twenthe, the imposters persuaded the museum to transfer the funds to a Hong Kong account. The Enschede, Netherlands-based museum suffered a setback in its lawsuit Thursday, when a judge ruled against its claim for damages.

During correspondence between the real dealers and the museum, cybercriminals gained access to one of the party’s systems, monitored the negotiations and at a suitable point sent a number of spoof emails appearing to originate from Dickinson.

The art dealer’s negotiators were looped in to some of the emails between the museum and the hackers but they said and did nothing to correct the impression that the emails came from Dickinson, the museum’s lawyer Gideon Shirazi told a London High Court.

“Silence would give rise to an implied representation,” he said. “By saying nothing, they said everything.”

Constable was a 19th century English landscape artist, most famous for his paintings of Dedham Vale on the border between Essex and Sussex counties. The museum’s director became interested in buying one of his works while at the European Fine Art Fair in the Netherlands in March 2018.

The museum should have taken the basic step of independently confirming that the bank details received in an email were genuine, Dickinson’s lawyer Bobby Friedman told the court. The art dealer didn’t know a fraud was being perpetrated and would have been horrified if it had realized this, he said.

“Instead of accepting the reality of the situation, the museum has reacted by pursuing a series of hopeless claims against SCD, in the hope of pinning the blame for the museum’s mistake on SCD,” he said in written submissions.

Judge Mark Pelling dismissed the museum’s application to include eight claims, including that the dealer owed it a duty of care to maintain reasonable email cybersecurity, but said if it considers an alternative way to claim for damages, it can serve another application to amend the claims against Dickinson.

Rijksmuseum Twenthe didn’t respond to a request for comment. Dickinson declined to comment.

The museum is currently holding the painting and won’t return it, despite Dickinson having not been paid, Friedman told the court. It’s preventing the dealer from selling the piece elsewhere and paying the undisclosed owner, he said.

It is still unknown who was behind the hack and whether the fraudsters infiltrated the museum or the dealer’s email accounts. Both sides claim it was the other who got hacked.