Contractor’s Email Was Compromised And I Followed Scam Payment Instructions

Location: Maryland, USA. I’m in uncertain territory here and would really appreciate your perspective(s):

I recently hired a contractor to do some work on my house, and nearly all of our communications have been over email (their official business email to my Gmail). The quote, the contract, then the guidance on how to pay the first installment ($10k) were all sent in the same email thread.

They came out to start the job, then told me they hadn’t received the first installment yet. I let them know that I already paid it per their instructions in our email correspondence.

It turns out that their business email had been compromised. I was getting payment instructions from their exact email address in the very same thread as the quote and contract. But they had no record of those messages on their end, and the hacker was seemingly intercepting any messages about the payment from me to them.

I immediately contacted my bank to report the scam and initiate a recall. By this point, unfortunately, several days had passed and the money could not be retrieved. The bank concluded no fraud on the basis that I sent the money. I filed with the FBI’s IC3, CFBP, the police, and my state’s consumer protection bureau. I reopened the fraud investigation with my bank. Nothing has come of any of this.

The way I see it, the contractor and I are both victims here. Yes - I should not have blindly followed the payment instructions, but since it was coming from the same email address and thread, I thought nothing of it. I didn’t realize scams could be this sophisticate, and I have learned an important lesson here.

However - it was their business email that was compromised. Their security was lax and this put their customers at risk.

The contractor finished the work and received the second and third payments from me. They are now requesting I send them the initial payment, saying that the “invoice is still outstanding”.

I do not believe I am on the hook for this, considering that it was their email that was compromised. Shouldn’t a business have insurance for these types of situations?

Please weigh in here: am I being unreasonable? How do you see this playing out?

TLDR: Contractor’s business email was compromised, and I received scam payment instructions in the same thread as the quote and contact. Money could not be recalled. What now?