The Supreme Court of Appeal (SCA) recently handed down judgment in the case of Edward Nathan Sonnenberg Inc v Judith Mary Hawarden (421/2023) [2024] ZASCA 90 (10 June 2024) relating to pure economic loss as a result of insufficient or inadequate cybercrime security measures.
The SCA has overturned the South Gauteng High Court ruling which had imposed a duty of care on attorneys to safeguard clients from dangers of cyber hacking, intercepting and or spoofing of emails containing important information such as bank account details.
Edward Nathan Sonnenberg Inc (ENS) had been appointed as conveyancers to attend to the transfer and registration of the property into the name of the Respondent Ms Hawarden. The purchase price was R6 million in which a deposit of R500 000.00 was to be paid into the estate agent trust account. The Respondent was sent an email by the estate agent enclosing banking details and such email further contained warnings on potential cybercrimes and email hacking. Before making payment of the deposit, she telephonically confirmed banking details with the estate agent and thereafter effected payment.
Subsequent to ENS being appointed as transferring attorneys, numerous emails were exchanged between the Respondent and the authorised employees of ENS. In one of the emails sent by the employee of ENS, the Respondent was furnished with a PDF document enclosing banking details wherein the balance of the purchase price was to be paid. The email containing the banking details was intercepted by cyber criminals and the banking details of ENS were fraudulently changed. As a result the Respondent paid the balance of the purchase price to the bank account of the cyber criminals.
The Respondent then instituted legal action against the ENS in the High Court for damages amounting to R5.5 million, claiming that ENS and the authorised employee had a duty of care to warn her of the dangers of hacking and spoofing of emails. The High Court found that ENS as the conveyancing attorney owed a duty of care towards the Respondent to ensure that they warn her of the dangers of email hacking and interceptions. The court stated that the law firm failed to take the necessary steps to safeguard the Respondent against threats of Business Email Compromise.
Therefore, the High Court concluded that the ENS’s omission was negligent and consequently ordered that the Respondent be compensated for the loss suffered in amount of R5.5 million.
However, the SCA has overturned the ruling of the High Court by finding that the Respondent was aware of the dangers of email hacking as she previously made payment of the deposit to the estate agent after confirming banking details telephonically. The SCA found that the Respondent had numerous options at her disposal to verify the banking details of the Appellant but failed to take reasonable steps to do so. The SCA further stated that Respondent had a duty to protect herself from the well-known risks of cybercrime. The court therefor concluded that her loss was of her own accord.
The SCA has now placed a duty on private individuals or anyone making payments to ensure that they take precautionary steps before effecting payment. It is of paramount importance that clients and customers who receive banking details via email or any form of electronic communication, verify these details telephonically with an authorised employee of the firm.
To ensure that you are protected from cybercrime, BBB Attorneys suggests the following:
- Clients are advised to specifically deal with the individual who has dealt with their matter from inception.
- Take note that emails may contain a fraudulent phone number, so do NOT call the number given in such an email if it does not correspond to the firm’s website, Google page and social media pages (if applicable).
- Request a Bank confirmation letter on the banks letterhead.
- Note that PDF attachments to emails containing sensitive information, are NOT invulnerable to being compromised.
- Calling our office on the number listed on our website and verifying account details received via email with one of our staff, who may also be listed on our website. Alternatively, you can request your bank to verify and confirm our account number.
- Alternatively or in addition, checking account details with our offices in person.
