I am a subcontractor and my email was hacked. I had been emailing a client inquiring about payment status and my email was highjacked and the scammer sent ACH instructions to go to their account. We do not accept ACH. I can prove ACH wiring bank account is not our account, I can prove my email was hacked and I can prove no monies were deposited into our account. I have filed a lien and our customer is saying they paid and we need to take the loss. I say we gave a service we have not been paid for. I'm not responsible for managing emails sent to them nor their accounting system for not having a multifactor authentication process for taking ACH instructions over email and I have very high IT security in place. Who is liable for the loss?