This case highlights the importance of verifying banking details before making electronic payments, especially when receiving a change of instructions.

Who should care about this judgment and why?

Essentially all businesses face the threat of business email compromise. This judgment provides legal grounds for victims to recover losses from negligent payers.

What could you do about it?

  • Read the full judgment by downloading it.
  • Access other relevant cybercrime judgments by joining the Michalsons Cybercrime programme.

Our insights on the judgment

Verification is crucial: Businesses should establish clear procedures to verify bank details before making electronic payments, particularly following any changes in payment instructions. This case underscores the risk of BEC scams, where fraudsters impersonate a legitimate business to trick victims into sending money to fraudulent accounts. Businesses can significantly reduce the risk of falling victim to such scams by verifying bank details directly with the payee.

Liability for BEC scams: This case clarifies that victims can recover losses if they can prove the recipient’s negligence. In this instance, the court found K2K negligent for failing to verify the new bank details before making the payment, even though the fraudulent emails originated from a scammer pretending to be Pinnacle Micro.

Digest

Facts

  • Pinnacle Micro (the seller) believed they had a valid agreement to sell a server to K2K (the buyer).
  • A scammer impersonating Pinnacle Micro sent K2K an email with fraudulent bank account details.
  • K2K made the payment for the server to the scammer’s account.
  • Pinnacle Micro never received the payment and sued K2K for the lost money.

Reasoning

The court found K2K negligent for not verifying the bank details before making the payment. Even though the emails with new bank details were fraudulent, K2K should have confirmed the change directly with Pinnacle Micro.

Order

The court ordered K2K to pay Pinnacle Micro the amount owed for the server, and to disclose some financial information to Pinnacle Micro.

Details of Pinnacle Micro Proprietary Limited v Govender

Universal Citation: [2024] ZAKZDHC 23
Case Number: D12090/2022
Full Name: Pinnacle Micro Proprietary Limited v Govender (D12090/2022; D12091/2022) [2024] ZAKZDHC 23 (14 May 2024)

Please note: This judgment summary is not intended for a general audience. It is specifically drafted for the members of the Michalsons Cybercrimes programme.