The Risk of Email Compromise: The Duties of a Debtor in Electronic Payments

The matter pursuant to a vehicle sale agreement in terms of which Northcliff Nissan sold to Hyundai Louis Trichardt two Nissan vehicles for R145 000.00 each. In terms of the agreement between the parties, two invoices would be generated in respect of each of the vehicles, which would reflected the particulars of the vehicles, the price, the delivery address, and, of significance, the banking details of Northcliff Nissan. It was agreed between the parties that upon receipt of the invoices that were sent by email, that Hyundai Louis Trichardt would effect payment of the purchase price by way of an electronic funds transfer (“EFT”) into the bank account of Northcliff Nissan.  Upon receipt of payment, Hyundai Louis Trichardt would take delivery of the vehicles.

On 30 October 2018, Northcliff Nissan emailed the invoices for the vehicles to a representative of Hyundai Louis Trichardt. Unbeknown to the parties, Northcliff Nissan’s email to Hyundai Louis Trichardt had been compromised by cybercriminals who substituted the banking details on the invoices. On 31 October, Hyundai Louis Trichardt emailed a proof of payment for the first vehicle, and Northcliff Nissan released and delivered the vehicle without confirming the funds in its correct account. The same process took place in respect of the second vehicle. Shortly thereafter, it was discovered that both payments had been made into a fraudulent account. On this basis Northcliff Nissan demanded payment from Hyundai Louis Trichardt, while Hyundai Louis Trichardt maintained that payment had been made based on the invoices.

The court a quo found that the payments had been erroneously made into an incorrect account and that Northcliff Nissan had not received the purchase price. It held that Hyundai Louis Trichardt was obliged to verify Northcliff Nissan’s banking details before affecting payment and, on that basis, ordered Hyundai Louis Trichardt to pay the principal sum, mora interest, and costs. Hyundai Louis Trichardt appealed this decision, and the High Court upheld the appeal, substituting the order and finding that Hyundai Louis Trichardt had discharged its payment obligations by paying the purchase price of the vehicles into the account reflected on the invoices. The High Court held that the risk of loss associated with the use of EFT payments and email lay with Northcliff Nissan, and Hyundai Louis Trichardt’s obligation to pay must be deemed fulfilled.

On appeal the SCA considered whether a purchaser who, due to fraudulent substitution of banking details, paid the purchase price into an account other than the seller’s without authority had discharged the onus of proving payment. The Court held that effective payment requires the payee to obtain an unrestricted right to the immediate use of the funds, otherwise, payment is incomplete. Of importance the court held in the case of an EFT, payment occurs only when the funds are received in the seller’s account.

The SCA further confirmed that there is an obligation on the purchaser to ensure that the bank account details contained in the invoice are correct and verified, and that payment is made to the seller and not an unknown third party.  Payment into an incorrect bank account does not extinguish the purchaser’s obligation and liability to pay the debt. The SCA in relying on the decision of Edward Nathan Sonnenberg Inc. v Judith Mary Hawarden [2024] ZASCA 90 reaffirmed the courts ratio that the “risk is the debtor’s since it is the debtor’s duty to seek out his creditor”.

This case highlights critical implications for commercial transactions involving electronic payments and business email compromise. It sends a clear message that purchasers bear the responsibility to verify the seller’s banking details and ensure that payment is made into the correct account. The SCA made it clear that payment into an unauthorised or fraudulent account does not discharge the purchaser’s obligation, even where the error results from cybercrime, or business email compromise. The judgment reinforces that effective payment occurs only when the seller obtains an unrestricted right to the funds, and the risk of incorrect payment is carried by the purchaser, who needs to verify the banking details of the seller before making payment.