A client hired our firm to maintain a collection of websites, 12 in total. Our maintenance services include a couple of items particular to security: namely scanning the website for malware and removing malware if found. One of those websites is actually owned by a third party.

The third party reached out and said they found a number of security issues. The majority of issues were with subdomains -- which are different websites and we bill separately for them -- which is to say we were not maintaining these additional websites.

Amongst the issues found that were particular to the website we maintained were an SSL certificate (what allows a site to load https:// "secure" -- though this functionality itself was not broken) that was not installed properly prior to our firm inheriting the site.

Additionally, the site is on a CMS that by default has a URL where you can see limited information about users accounts on the site. We reinstalled the SSL and prevented anyone from being able to visit the URL where user information was available. We also assisted with a number of the subdomains issues.

We did all of this at no additional cost though it is outside the scope of our flat rate monthly maintenance. Additionally, we discounted the client's invoice by about 1/6 (after explaining to the client that we did all the work we are contracted for and more, and after the client refused to pay and threatened to fire us).

We also did a call with the third party and our client to discuss the security issues. We noted the work we did to meet their concerns and provided context for our company. On the phone call the third party said they wanted to host the site themselves, but would continue to work with our client.

Two months later our client decided that they were no longer going to work with us and decided to not to pay the last monthly invoice. We informed the client that we are fine with the separation, offered to complete any pending monthly maintenance work and informed the client that though they was cancelling on the 30th of the month we would not hold them to the contract of needing to provide x days notice, and rather close their contract immediately, but they would still owe their final invoice for the preceding 30 days.

The client refused to pay and threatened to sue for loss of work and damages. We politely informed client when their invoice was due, when it would become past due, when it would reach a point were under the contract penalties could be charged -- noted we would extend this timeframe and had no interest in charging penalties if they would simply close the invoice. All steps resulted in additional threats that we would be hearing from their attorneys.

Please advice if it is worth pursuing the unpaid invoice and any risk of being sued for damages/lost third party client.

  • 1
    Why the close-vote? While the OP might not be a freelancer, the situation is one freelancers can easily find themselves in.
    – morsor
    Dec 11, 2020 at 8:14

3 Answers 3


The moment a client says you will hear from their lawyers, tell them you will wait for their call. Shut up, and don't talk to that client anymore - they are over you.

If it is worth fighting for, get yourself a lawyer. Likely, the first contact will result in payment (not many companies want to be the defendant in a court). If not, the lawyer will guide you forward.

Again, do not mess with a company who insists on bringing in lawyers - they are a lost cause at that point, as all the trust has been broken, inadvertently or intentionally.


It seems you have been bending over backwards to accommodate the client - and it has not been reciprocated. While accommodating a client is a reasonable thing to do, at the first hint of problems, I would try to maintain some sort of leverage over them - like partial delivery.

Prior to an actual legal threat, the most useful course of action would be determined by your financial situation and the long-term prospects with the problematic client. If there are no long-term prospects, you're free to either lawyer up on them or walk away if that seems the better option.

I have actually kept some clients despite needing to go into partial-delivery mode; the awkward power struggle can sometimes create a workable balance. However - anyone threatening with actual legal action, is a lost cause, meaning you go into damage control.


I certainly hope your company has the proper business insurance for this type of scenario.

As for what to do, my suggestion would be that you cease all direct communication with this client.

If you feel you need to pursue final payment then engage an attorney to work on your behalf to get final payment.

As for the client threatening to sue you, I'd suggest doing nothing until and unless you're served notice of the lawsuit. If that happens then engage your attorney to address the matter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.