Entity Email Compromise: Allocating Loss for Fraudulent Bank Transfer under Commercial Law and Delictual law

A client who follows payment instructions exactly as they appear in an email from their bank, attorney, or financial advisor should not bear the loss when that email turns out to have been intercepted and altered by a fraudster. Yet courts and commentators often default to penalising the client who simply followed the instructions given to them. That is not justice — it shifts liability from the party best placed to control cybersecurity risk to the party least able to detect it. This article argues that the entity responsible for the compromised system, not the client who acted in good faith, should ordinarily bear the loss. The entity, as designer and manager of its own communication and payment systems, carries the responsibility to keep those systems secure. Where it fails to do so, liability for resulting losses should fall on the entity rather than the client.

This article is structured in three parts: first, the legal basis for holding the entity liable; second, practical measures entities can take to protect their clients; and third, the steps available to a client seeking to recover a loss, considered under both the law of delict and commercial law (breach of contract).

Entities are, as a rule, far better equipped than individual clients to absorb losses, obtain insurance, and implement protective measures against cybercrime. Holding a client liable for a fraudulent transfer that originated within the entity’s own systems is, on this reasoning, unfair.

Reason for the entity’s liability and legal support

Where a client has fulfilled their side of a transaction, the entity should generally be held liable for losses arising on its side of the exchange — even where the immediate cause was internal fraud by an employee or an external hacker. Entities that fail to implement reasonable security measures to protect client data or financial assets may be sued for civil damages.¹ Section 43(5) of the Electronic Communications and Transactions Act 25 of 2002 (ECTA) requires a supplier to use a payment system that is sufficiently secure by reference to accepted technological standards at the time of the transaction.² Arguably, by analogy, this reflects a broader legislative expectation that entities offering electronic payment facilities bear responsibility for keeping those facilities secure, and that a failure to do so should attract liability for resulting losses. It is worth noting this provision sits within ECTA’s consumer-protection chapter and was drafted with online, website-based transactions in mind, so its direct application to email-based EFT instructions is an extension of the provision’s underlying logic rather than a settled point of law.

Section 19 of the Protection of Personal Information Act 4 of 2013 (POPIA) requires organisations to protect the security and integrity of personal information in their possession, guarding against loss, damage, unauthorised destruction, and unlawful access.³ Where an entity fails to implement the safeguards this section requires, that failure constitutes a direct breach of its legal obligations. Had the entity complied with these requirements, its internal systems would likely have been better placed to resist the kind of interception that exposes clients to fraud.

Courts have grappled directly with this allocation-of-loss question in the context of business email compromise (BEC). In Hawarden v Edward Nathan Sonnenbergs Inc (13849/2020) [2023] ZAGPJHC 14 (16 January 2023), the Gauteng High Court, Johannesburg initially found in favour of the plaintiff, a property purchaser whose email was intercepted and altered, awarding her R5.5 million in damages against the law firm handling the transfer.⁴ That decision, however, was overturned on appeal in Edward Nathan Sonnenberg Inc v Hawarden [2024] ZASCA 90 (10 June 2024): the Supreme Court of Appeal held that because the plaintiff had been warned of BEC risk and could reasonably have verified the banking details herself, she was not “vulnerable to risk,” and no legal duty to warn her arose. The reversal is a useful caution rather than a defeat for this article’s argument — it shows that a court will decline to shift loss onto an entity where the client had a realistic, practical opportunity to verify the instruction and failed to take it. Where no such opportunity existed, or where the entity’s own conduct actively obscured the risk, the balance of authority still favours the client.

A stronger and undisturbed example is Gerber v PSG Wealth Financial Planning (Pty) Ltd (36447/2021) [2023] ZAGPJHC 270 (23 March 2023), in which the fraudsters intercepted the client’s own email and used it to instruct the defendant, a financial services provider, to liquidate investments and transfer the proceeds to a fraudulent account. The court held PSG liable for the resulting loss — not simply because a client’s instruction was compromised, but because PSG had failed to follow its own contractually prescribed internal verification protocol before acting on the instruction. This case supports the article’s central point more directly: where an entity has the means to verify unusual payment instructions and does not do so, liability for the resulting loss should rest with the entity, regardless of where the initial interception occurred.

What are the recommended actions for the entity to protect their clients?

While government regulation exists to punish and deter cybercrime, entities themselves carry the primary responsibility for protecting their clients through secure practices. Some straightforward measures include:

• Educating clients about the dangers of email interception and how to distinguish fraudulent emails from the entity’s genuine communications.
• Actively monitoring systems for intrusions and keeping them current against emerging threats.
• Separating employee duties to prevent internal fraud and make it harder for any one individual to compromise the system from within.⁵
• Ensuring ongoing compliance with South African regulatory requirements.⁶
• Implementing active response protocols to notify clients immediately of any suspected fraudulent activity.

Fraudsters operating in South Africa frequently target invoices sent through an entity’s email system, exposing clients to financial risk. Entities that reduce their reliance on invoices requiring manual EFT payment can meaningfully reduce the vulnerabilities fraudsters exploit during email interception. Where a fraud incident does occur, the entity should collaborate with the client immediately to report it, giving authorities the best chance of locating the funds before they are moved beyond recovery. This approach protects both the client and the entity’s own reputation, and demonstrates that the entity takes the incident seriously and is committed to rectifying its failures.

Steps for clients to recover their losses

A client should contact their bank immediately upon discovering that funds have been fraudulently redirected. Reporting within 24 hours gives the bank the best chance of recovering the money. Banks can attempt to reverse a transfer by contacting the receiving institution, which may involve freezing the destination account or recovering partially withdrawn funds.⁷ The client should also gather evidence — all emails received from the entity and relevant bank statements — to demonstrate that the funds were transferred strictly in accordance with the instructions provided.

If the bank cannot recover the funds, the client has two further legal avenues: a delictual claim, or a claim for breach of contract. Each is addressed in turn below.

Delictual claim

A client pursuing a delictual claim must establish five elements.

Omission

The client must present evidence that the fraudulent email originated from, or was made possible by, a failure within the entity’s own systems, demonstrating that the entity did not comply with the security safeguards required under section 19 of POPIA.⁸

Wrongfulness

An entity carries a legal responsibility to protect its digital and physical assets. Where it neglects basic cybersecurity and leaves a client’s private information and transaction details exposed, and fails to warn the client that their communications may have been intercepted, this constitutes a direct violation of section 19 of POPIA and renders the entity’s inaction wrongful.

Fault

Email fraud is a well-known and foreseeable danger. A reasonable entity should anticipate that fraudsters will exploit any weakness available to manipulate client payments. Where an entity’s failure to meet required security standards allows fraudsters to intercept and alter a payment instruction, that failure demonstrates a careless disregard for the client’s financial security and satisfies the requirements for negligence.

Damage

Damages are calculated by comparing the client’s actual, reduced financial position to the higher position they would have enjoyed had the entity acted responsibly. This calculation demonstrates to the court both the extent of the harm caused and the amount needed to restore the client to their proper financial position.

Causation

Where proper email security would have prevented the interception, alteration, and fraudulent redirection of a payment instruction, the entity’s failure to maintain that security is the direct cause of the client’s loss. Where the entity also failed to warn the client of known fraud risks, the client’s reasonable assumption that the email was genuine follows directly from that failure — and since BEC fraud is a predictable consequence of poor cybersecurity, the entity’s carelessness satisfies the causation requirement.

Commercial law (breach of contract) claim

A breach of contract occurs when one party fails to fulfil an obligation under a valid contract with another party. To succeed, the client must prove the entity breached a specific term of their agreement — here, that the entity failed to deliver the product or service the client paid for, because a fraudulent email exploited its own system.

Types of breach in South African law

• Mora debitoris — the debtor obligated to perform or pay postpones their duty beyond the agreed deadline.⁹
• Mora creditoris — the creditor entitled to receive performance obstructs the debtor from meeting their obligations.¹⁰
• Positive malperformance — the debtor completes the task or provides the service, but does so inadequately, incompletely, or otherwise not in accordance with the contract’s requirements.¹¹
• Repudiation — one party clearly indicates, verbally or through unmistakable conduct, that they no longer intend to honour the contract or fulfil their responsibilities.¹²
• Obstruction of performance — either party takes action that renders fulfilment of the contract impossible.¹³

A client should examine the contract thoroughly to anticipate potential legal disputes. A formal letter of demand should be sent to the entity, outlining the breach and demanding rectification.¹⁴ All relevant documents and supporting evidence should be gathered and organised before any legal proceedings begin, and the client’s case should be grounded in one of the recognised types of contractual breach set out above.

Section 11 of ECTA grants data messages — including emails, PDFs, and digital records — the same legal validity as traditional paper documents.¹⁵ Where an entity has failed to meet its contractual commitments, its failure to deliver represents a material breach of contract, even where it was not the direct sender of the deceptive email. A legally enforceable contract exists once the entity dispatches an invoice electronically and the client fulfils their corresponding obligation; any security breach originating within the entity’s own communication infrastructure is not attributable to the client — particularly where the client received no warning of fraudulent activity or system weakness that might have justified withholding payment.

Damages

In South African law, damages for breach of contract serve a compensatory function: their purpose is to restore the innocent party to the precise financial position they would have occupied had the agreement been properly performed.¹⁶ A client who has suffered a loss during a contract with an entity is, on this basis, entitled to compensation for that loss.

In Gerber v PSG Wealth Financial Planning (Pty) Ltd (36447/2021) [2023] ZAGPJHC 270 (23 March 2023), fraudsters intercepted the client’s own email and instructed the defendant financial advisor to liquidate investments and transfer the proceeds to a different account. The court ordered the defendant to refund the stolen funds, together with interest and costs.¹⁷ This case supports the proposition that clients are entitled to claim damages from entities arising from cyber-fraud, and — importantly — that liability does not turn on whether the fraudulent interception originated on the entity’s side or the client’s. Where the facts show the entity failed to meet its contractual duty of care, there is a strong likelihood the client will be compensated and the entity held liable.

This article has examined who should bear the loss when an entity’s email is compromised, arguing that the entity — not the unsuspecting client who had no control over the situation — should ordinarily be held liable. It is more reasonable to hold the entity liable than the client, given the entity’s far greater capacity to intercept fraud through mandatory verification protocols. The article has considered the prevention measures an entity could reasonably implement, and the remedies available to a client seeking to recover a loss under both delictual and contract law. Cybersecurity standards required by law should be complied with by every entity to keep clients safe from these risks and to prevent electronic transactions from being intercepted by fraudsters.

Courts should continue to scrutinise closely any tendency to default to holding clients liable in cyber-fraud disputes of this kind, particularly given the far greater resources and technical capacity entities hold by comparison with an individual client. Where administrative or security failures allow this kind of harm to occur, the entity should ordinarily be required to compensate the client for the loss, rather than the burden falling on the party least equipped to bear it.

Reference(S):

Legislation

Protection of Personal Information Act 4 of 2013.

Electronic Communications and Transactions Act 25 of 2002.

Cases

Gerber v PSG Wealth Financial Planning (Pty) Ltd (36447/2021) [2023] ZAGPJHC 270 (23 March 2023).

Hawarden v Edward Nathan Sonnenbergs Inc (13849/2020) [2023] ZAGPJHC 14 (16 January 2023).

Edward Nathan Sonnenberg Inc v Hawarden (421/2023) [2024] ZASCA 90 (10 June 2024).

Journal articles

Snail, SL, ‘An overview of South African e-consumer law in the context of the Electronic Communications and Transactions Act (part 2)’ (2007) 15(2) Journal of Business Law (JBL) 54–57.

Online sources and articles

Burger Green & Durban Attorneys, ‘Contractual damages in South African law’ (31 July 2023), available at bgdattorneys.co.za (accessed 22 June 2026).

Compli-Serve, ‘Legal recognition of electronic documentation’ CompliNEWS (2 September 2019), available at jutacomplinews.co.za (accessed 22 June 2026).

De Beer Attorneys, ‘Breach of contract’ (13 February 2023), available at debeerattorneys.com (accessed 22 June 2026).

Dentons, ‘E-commerce transactions under the Electronic Communications and Transactions Act and Consumer Protection Act’ (26 August 2022), available at dentons.com (accessed 22 June 2026).

Dippenaar, S, ‘Breach of contract – legal implications’ Simon Dippenaar & Associates (15 November 2023), available at sdlaw.co.za (accessed 22 June 2026).

Dippenaar, S, ‘The relentless rise of cybercrime’ Simon Dippenaar & Associates (21 May 2026), available at sdlaw.co.za (accessed 19 June 2026).

Human Focus, ‘How to reduce fraud risks in the workplace’ (2024), available at humanfocus.co.uk (accessed 19 June 2026).

Tech4Law, ‘Payment fraud: steps to take if your business gets scammed’ (4 April 2022), available at tech4law.co.za (accessed 19 June 2026).