Authored by Tamlyn van der Merwe | 13 May 2025

A pertinent question in an age where cyber-fraud and business email interception is on the rise is who bears the risk of loss if payment is made to the incorrect party consequent to an email intercepted by a cyber-criminal containing incorrect banking details.

In our article published on 24 March 2024 (see: https://rhkattorneys.co.za/2024/03/12/cyber-fraud-and-business-email-compromise-liability-and-duties-in-high-value-transactions/) we discussed the High Court’s decision per Mudau J in Hawarden v Edward Nathan Sonnenbergs Inc 2023 (4) SA 152 (GJ) (16 January 2023) relating to a conveyancing transaction in which the purchaser made a payment of R5.5 million rand, being the balance of the purchase price of immovable property, to a cyber-criminal believing it to be the conveyancer. Payment was made after the purchaser received an email from the conveyancer which had been intercepted by the cyber-criminal who replaced the conveyancer’s banking details with its own. The conveyancer was ordered to pay R5.5 million rand to the purchaser, and the decision imposed a duty on a conveyancer to warn a purchaser against the risk of cyber fraud and business email compromise, and to take the necessary precautions against it.

The High Court judgment was appealed by the conveyancer and the SCA upheld the appeal, overturning the decision of the High Court in favour of the conveyancer on the grounds set out below.

 

WRONGFULLNESS

The SCA was not satisfied that the element of wrongfulness was established when taking into account that[1]:

a. There was no attorney-client or contractual relationship between the conveyancer and the purchaser;

b. The loss suffered by the purchaser was as a result of her email account having been compromised by the cyber-criminal; and

c. The purchaser could have taken steps to verify the bank account details of the conveyancer. This factor has been previously held by our courts to be an important indicator against imposing a duty on a party to prevent the economic loss of another party.[2]

The similar case of Gripper & Company (Pty) Ltd v Ganedhi Trading Enterprises CC 2025 (3) SA 279 (WCC) (6 November 2024) is recent authority supporting the notion that a party making a payment (a “debtor”) must take steps that a prudent debtor would take to ensure that payment is effected properly, i.e., to the correct recipient.[3]  

The court in Gripper considered the question “who should bear the risk of loss?” in cases such as this, making the following noteworthy remarks:

a. until such time that payment has been made to the correct recipient, the debtor carries the risk that the payment may be misappropriated; [4]

b. an intercepted email is not the proximate cause in cases such as this, but rather, it is the decision to make payment without verifying the bank account details of the intended recipient;[5]

c. it is not most relevant which party’s system has been hacked;[6]

d. a debtor making payment into the incorrect bank account by failing to verify the bank account details of the intended recipient does not extinguish the debtor’s obligation to pay the debt.[7]

THE DANGER OF INDETERMINATE LIABILITY

Indeterminate liability, being “liability in an indeterminate amount for an indeterminate time to an indeterminate class” has been recognised by the Constitutional Court[8] as the main policy consideration in cases of liability for pure economic loss. The SCA in Hawarden v Edward Nathan Sonnenbergs Inc acknowledged that upholding the judgment of the High Court would create a danger of indeterminate liability for all types of creditors using email as a means of sharing their banking details.[9]

Accordingly, the appeal was upheld in favour of the conveyancer and the order of the High Court was set aside.

CONCLUSION

The SCA exercised caution in casting the net too wide and imposing ‘indeterminate liability’ which could have a far-reaching impact on creditors. However, creditors should still exercise care in sharing their banking details and bring awareness to business email compromise when doing so.  

The key takeaway of the SCA judgment and Gripper judgment is that a debtor must be proactive and take any available steps and measures to verify the banking details of a creditor prior to making payment to the creditor. The easiest step and the one that would make all the difference is for a debtor to contact the intended recipient telephonically and confirm their banking details. Should the debtor suffer economic loss as a result of cyber-fraud beyond the control of the creditor, it is not the default position that the creditor will be held liable for such loss, especially in the instance that the debtor could have taken reasonable steps to prevent the loss.

Whilst every effort was made to ensure that the content of this article is updated and correct at the time that this article is published, the information and material published on this website is provided for general purposes only and does not constitute legal advice. RHK Attorneys Inc. accepts no responsibility for any loss or damages, whether direct or consequential, which may arise from reliance on the information contained in this article. Please contact our offices with regards to any specific legal problem or matter. For permission to reproduce an article or publication, please contact reception@rhkattorneys.co.za.

[1] Hawarden v Edward Nathan Sonnenbergs Inc 2023 (4) SA 152 (GJ) (“Hawarden v Edward Nathan Sonnenbergs Inc SCA judgment”) at par 20.

[2] Country Cloud Trading CC v MEC, Department of Infrastructure Development, Gauteng [2014] ZACC 28 (“Country Cloud Trading CC case”) at par 51 and Trustees for the Time Being of Two Oceans Aquarium Trust v Kantey & Templer (Pty) Ltd [2005] ZASCA 109 at par 23. 

[3] Gripper & Company (Pty) Ltd v Ganedhi Trading Enterprises CC 2025 (3) SA 279 (WCC) (“Gripper case”) at par 31.

[4] Gripper case at par 26.

[5] Gripper case at par 28.

[6] Gripper case at par 29.

[7] Gripper case at par 27.

[8]Country Cloud Trading CC case.

[9] Hawarden v Edward Nathan Sonnenbergs Inc SCA judgment at par 21.