The Supreme Court of Appeal ("SCA") delivered a judgment yesterday which provides much needed clarity on the liability for losses suffered as a result of a business email compromise.
Business email compromise occurs when a fraudster hacks into a party's email account, and intercepts and then alters correspondence between the parties.
Ms Hawarden, who was a victim of a business email compromise, instituted an action against ENS for the recovery of ZAR5.5 million after her emails were hacked. The basis of Ms Hawarden's claim was one of pure economic loss caused by an alleged wrongful omission. Ms Hawarden contended that ENS owed her a legal duty to, amongst others, warn her of the dangers of business email compromise and the increase in business email compromise-type fraud. ENS denied that it owed any such duties to Ms Hawarden.
The High Court found in favour of Ms Hawarden and ENS appealed to the SCA.
The SCA focused its determination on whether Ms Hawarden had established the element of wrongfulness for a delictual claim arising out of an omission causing pure economic loss. The SCA correctly pointed out that our law does not generally hold persons liable in delict for loss caused to others by omission.
In dismissing the appeal, the SCA highlighted the following:
- Ms Hawarden was not a client of ENS at the relevant time and there was no contractual relationship between Ms Hawarden and ENS. In other words, the loss that Ms Hawarden suffered occurred at a time when there was no attorney-client relationship between them;
- The loss Ms Hawarden suffered was as a result of her email account being compromised. The hackers had infiltrated Ms Hawarden's email account and fraudulently diverted her payment into their account;
- Ms Hawarden had previously been warned about the risk of business email compromise by the estate agent; and
- Ms Hawarden failed to take any steps to verify ENS' bank account details. She could have done so by calling ENS representatives or requesting her bank's assistance to do so. No explanation was proffered as to why such steps were not taken.
The SCA held that the court a quo's judgment incorrectly found that all creditors in the position of ENS owe a legal duty to their debtors to protect them against business email compromise. The effect of such a finding would be that creditors are required to protect their debtors against the risk of interception of their payments. This has the potential to result in indeterminate liability. The risk of indeterminate liability has been recognised by the Constitutional Court as the main policy consideration that militates against the recognition of liability for pure economic loss.
Further, it is settled law that where a plaintiff has taken, or could reasonably have taken, steps to protect itself from or to avoid loss suffered, is an important factor against a finding of wrongfulness. On the facts of this matter, there was "more than sufficient protection available to Ms Hawarden". Ms Hawarden could reasonably have avoided the risk by asking ENS representatives to verify the account details or by asking her bank to verify ENS' account details. The SCA held that there were means available to Ms Hawarden and she must take responsibility for her failure to protect herself against a known risk. Consequently, the SCA upheld the appeal and replaced the High Court's order with an order dismissing Ms Hawarden's claim and she was ordered to pay the costs, including the costs of two counsel.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.