Edward Nathan Sonnenberg Inc v Judith Mary Hawarden

Full case name: Edward Nathan Sonnenberg Inc v Judith Mary Hawarden

Citation: 2024 (5) SA 9 (SCA); [2024] ZASCA 90

Court: Supreme Court of Appeal of South Africa

Date of decision: 10 June 2024

Bench composition: Dawood AJA (Ponnan, Dambuza, Goosen JJA and Tlaletsi AJA)

The shift towards digital commercial transactions has created new cyber-risks, compelling South African courts to reassess established boundaries of delictual liability. The Supreme Court of Appeal addressed this issue in Edward Nathan Sonnenberg Inc v Hawarden [2024] ZASCA 90[1], which involved a case of business email compromise concerning the fraudulent interception of electronic conveyancing information. This ruling focused on delictual wrongfulness and liability for pure economic loss due to an omission. It limits the expansion of liability for electronic security failures specifically to commercial entities. By ruling that a law firm was not liable for a client’s compromised transaction, the court determined that a creditor does not have a legal obligation to protect a debtor from third-party cyber-fraud if the debtor has the resources to manage the risk independently.

Facts of the case

On 23 May 2019, Ms. Judith Mary Hawarden entered a contract to buy a residential property from the Davidge Pitts Family Trust for R6 million. Pam Golding Properties (PGP), the estate agency representing the seller, emailed Ms. Hawarden to congratulate and request a R500,000 deposit to be wired into its trust account. This email included warnings about the prevalent threats of cybercrime and scams, advising Ms. Hawarden to confirm PGP’s banking details by calling Mr. Prince Lukhele, a representative of the agency[2]. Ms. Hawarden verified the information and successfully made the deposit[3]. On 24 May 2019, PGP emailed Edward Nathan Sonnenberg Inc (ENS) with Ms. Hawarden’s confirming receipts of the deposit and attaching the signed sale agreement, ENS replied that their employee Ms. Ambaram, would handle the documents for transferring and registering the property[4].

On 20 August 2019, Ms. Eftyhia Maninakis, a secretary at ENS emailed Ms. Hawarden with a letter outlining the bank guarantee requirements for the remaining R5.5 million, however a cybercriminal had recently accessed Ms. Hawarden’s email account and intercepted this message[5]. August 21, Ms. Hawarden received a fraudulent email from the cybercriminal which closely resembled the authentic correspondence but altered the account details to the fraudster’s information. Afterward, Ms. Hawarden called Ms. Maninakis to enquire if she could transfer the remaining balance directly to ENS, Ms. Maninakis confirmed this was allowable and said she would send two documents which are a formal letter to Standard Bank and a file from First National Bank with ENS’s trust account details for direct transfers[6].

On 21 August 2019, Ms. Maninakis sent the genuine documents, however this email did not reach Ms. Hawarden. Instead, the cybercriminal sent a manipulated email that slightly altered the ENS email domain and replaced the banking details with fake ones. Ms. Hawarden did not notice the typo in the email[7]. Ms. Hawarden went to the bank and decided to proceed with a direct EFT after being told that obtaining bank guarantees would require 14 working days[8]. Ms. Hawarden completed an electronic transfer of R 5.5 million to the fraudster’s FNB account thinking it was ENS. The cybercriminals intercepted the proof of payment[9] and the investment mandate to mislead both parties[10]. This cyber fraud was uncovered on 29 August 2019.

Legal issues

Issue 1: is that whether Edward Nathan Sonnenberg Inc which has more understanding of the increasing threat of business email compromise in real estate transactions have a legal obligation to inform Ms. Hawarden about these cyber-fraud risks before sending her trust bank details via unencrypted email?

Issue 2: is that does Edward Nathan Sonnenberg Inc’s choice not to use secure communication options or to issue a verbal verification warning amount to a wrongful omission when it opted for an insecure method to process a R5.5 million transaction?

Issue 3: Whether Edward Nathan Sonnenberg Inc failed in their duty of care to Judith Mary Hawarden by not offering sufficient legal guidance concerning the financial transaction? This issue involves aspects of professional negligence, the expected standard of care for legal professionals, and the scope of fiduciary responsibilities owed to the client.

Arguments presented

Appellant’s arguments

ENS contended that is had no legal obligation who was not a client[11]. The underlying reason for the pure economic loss was a cybercriminal who hacked into the buyer’s personal email rather than any issue with ENS’s system[12]. Additionally, the respondent was not in a position of risk, as she could have simply confirmed the banking information over the phone. ENS relied on the established South African legal principle that there is no general obligation to compensate for pure economic loss resulting from an omission, claiming that broadening liability could subject businesses to unpredicted risks. To demonstrate that its actions were not wrongful, ENS invoked the constitutional “vulnerability to risk” criterion, contending that Hawarden was not at risk because she had the practical ability to prevent the fraud by verifying the account details through a phone call.

Respondent’s argument

Ms. Hawarden argued that a conveyancing firm has a distinct legal duty of care to an external buyer who deposits money into its trust account[13], claiming that her pure economic loss was directly caused by ENS’s negligent choices[14]. To demonstrate her exposure to risk based on public policy principles, she asserted that an inexperienced consumer should not be expected to foresee or intercept sophisticated cyber fraud without professional help. She therefore argued that holding a large, technologically advanced law firm responsible for failing to prevent a highly predictable Business Email Compromise is consistent with consumer protection ideals and does not create an indefinite liability issue.

Court’s reasoning and analysis

The Supreme Court of Appeal (SCA) determined that there was no legal obligation to inform Ms. Hawarden about cyber-fraud risks before sending her trust bank details[15]. ENS is a large, technologically advanced law firm, but that does not by itself create a legal obligation to alert a non-client. Evidence showed that Ms. Hawarden was already aware of cyber-fraud risks as they had previously received a specific warning from the state agent Pam Golding Properties and had acted by confirming their information over the phone. In addition, since the buyer’s email account was already intercepted at the time ENS contacted them, any warning given then would have been intercepted and ineffective. This court’s determination was to protect the entity’s legal obligations from being exploited by a non-client.

The Court also determined that there was no wrongful omission on ENS’s side[16]. According to South African delict law, an omission that leads to pure economic loss is considered wrongful only if the plaintiff is vulnerable to risk, which means they lack reasonable or realistic options to safeguard themselves. The SCA determined that Ms. Hawarden was not in a vulnerable position since she was aware of the risks before the transaction even took place. She was under professional care at her bank branch and had an easy way that carried no risks to protect her funds which was to contract ENS to confirm the account details prior completing the electronic funds transfer. Since she had sufficient means to prevent the harm but did not act, the law of delict will not intervene to redistribute the loss.

The SCA determined that there was no duty to care or fiduciary responsibility was breached by ENS. Ms. Hawarden was not a client of ENS, the firm was hired solely by the seller’s trust and acted only on their behalf. There was no attorney-client relationship or duty of care between Ms Hawarden and ENS[17]. The court concluded that applying a professional standard of care to protect a non-client third party from their own negligence would improperly alter the boundaries of tort law. This approach would place creditors at risk of undefined liability, creating an unreasonable and unmanageable legal burden for all professionals engaging in electronic communication. Making legal professionals responsible to those who are non-clients in this situation would have introduced a significant risk of unlimited financial liability to multiple entities such as law firms that are in South Africa.

Judgement and Ratio Decidendi

The decision:

The SCA ruled that the plaintiff failed to prove the necessary element of wrongfulness for a delictual claim regarding pure economic loss from an omission. The court concluded that the appellant had no duty to warn or protect a non-client from a third-party cyber interception, as the non-client had the knowledge and means to safeguard themselves. The appeal was unanimously upheld, and the SCA replaced the Gauteng Division of the High court’s order with a dismissal of the plaintiff’s claim, including the cost for two counsels. The court’s decision shifted the financial responsibility to the respondent.

Ratio decidendi:

The court held that the failure resulting in pure economic loss is not inherently wrongful. A legal duty is not imposed to protect a plaintiff from cyber-fraud interrupting payments if the plaintiff had reasonable means to mitigate a known risk. In such cases, the plaintiff is not legally vulnerable, and policy reasons prevent extending liability due to the potential for excessive and unpredictable commercial liability.

Critical analysis

Significance of the decision

This judgement serves as a landmark decision in the context of delictual law and will undoubtedly be used by future courts to resolve similar issues since the SCA developed its use appropriately and answered the questions left unanswered when the case was held by the High Court. The court clearly outlined the elements of wrongfulness, emphasizing the necessity of properly satisfying this requirement on a balance of probabilities to prove a delict was committed. By rectifying the misdirection of the High Court, the SCA demonstrated that while the law can be argued from different legal perspectives, the correct analytical principles will ultimately prevail.

Implications and impact

This decision directly affects entities that utilize electronic communication with the public, as well as third parties involved in commercial transactions by shielding them from delictual liability when cyber-fraud occurs. It influenced a significant shift in legal practice since it clarified for both individual and the courts that an entity cannot be held liable for pure economic loss suffered by a non-client. This framework was applied in Ross and Another v Nedbank limited [2024] ZAGPJHC 1146, where the court invoked the Hawarden principles to evaluate wrongfulness and vulnerability concerning business email compromise.

Critical evaluation

The SCA’s strength is its strict adherence to delictual principles, differentiating negligence from wrongfulness by stating that the plaintiff was not vulnerable to risk if they have self-protection options. However, the court neglected the opportunity to promote safer, standardized payment practices within the legal profession. The decision of the SCA criticized the lower court’s logic that requires all entities to protect their debtors from being at cyber-fraud risk. Although the court could have acknowledged a legal duty and addressed contributory negligence to apportion fault, it chose to reject this to avoid the potential instability associated with indetermined liability.

This landmarking case arose from Ms. Hawarden that fell victim to business email compromise, and this resulted in losing huge funds to fraudsters. While the High Court held that Edward Nathan Sonnenberg Inc was liable, the supreme court of appeal overturned the decision dismissing the delictual claim for pure economic loss. The most important takeaway is that entities cannot be held liable for the loss of non-clients that was a result of email interception. This case is remembered of upholding strict boundaries against expanding liability for pure economic loss caused by omission protecting entities that are facing the same issue. However, the judgement does not address key vulnerabilities. Although it protects entities, revealing a significant gap in regulations concerning cybersecurity responsibilities. There are still unanswered questions about how future legal actions under POPIA could alter the legal requirements for safeguarding digital communications, making the issue of cyber-fraud liability ready for legislative action.

REFERENCE(S):

Case

Edward Nathan Sonnenberg Inc v Judith Mary Hawarden [2024] ZASCA 90 https://www.saflii.org/za/cases/ZASCA/2024/90.html accessed 28 June 2026

Secondary sources

Webber Wentzel, ‘Caught in the cyber crosshairs: ENS v Hawarden’ (Webber Wentzel, 13 June 2024) https://www.webberwentzel.com/News/Pages/Caught-in-the-cyber-crosshairs-ens-v-hawarden.aspx accessed 1 July 2026

[1] Edward Nathan Sonnenberg Inc v Judith Mary Hawarden [2024] ZASCA 90 https://www.saflii.org/za/cases/ZASCA/2024/90.html accessed 28 June 2026

[2] Ibid [2]

[3] Ibid [3]

[4] Ibid [3]

[5] Ibid [4]

[6] Ibid [4]

[7] Ibid [5]

[8] Ibid [6]

[9] Ibid [8]

[10] Ibid [9]

[11] Ibid [15]

[12] Webber Wentzel, ‘Caught in the cyber crosshairs: ENS v Hawarden’ (Webber Wentzel, 13 June 2024) https://www.webberwentzel.com/News/Pages/caught-in-the-cyber-crosshairs-ens-v-hawarden.aspx accessed 1 July 2026

[13] Hawarden (n X) [13]

[14] Webber Wentzel, ‘Caught in the cyber crosshairs: ENS v Hawarden’ (Webber Wentzel, 13 June 2024) https://www.webberwentzel.com/News/Pages/caught-in-the-cyber-crosshairs-ens-v-hawarden.aspx accessed 1 July 2026

[15] Hawarden (n X) [21]

[16] Ibid [19]

[17] Ibid [20]