What does business email compromise look like in a law firm?
It looks like an ordinary email about money. A criminal gains access to a mailbox, or registers a domain that looks like the firm's, watches a matter progress, and at the right moment sends a client an email with new banking details for a transfer balance, a deposit or a payout. The client pays, and the money is moved on quickly.
Law firms are attractive targets because they move large sums, often on predictable dates, and because clients are used to receiving payment instructions by email. Conveyancing is the clearest example, but litigation settlements, estate distributions and trust account refunds follow the same pattern. The compromised mailbox can be the firm's, the client's, or an estate agent's. The client usually cannot tell the difference.
Is a law firm liable if a client pays a fraudster?
Not automatically. The Supreme Court of Appeal's 2024 decision in the Hawarden matter is the leading recent authority, and it found the firm was not liable on those facts. But that answer depends on facts, the case may not be the last word, and a firm can still lose the client, its reputation and time even when it is not legally liable. Whether your firm would be liable in a given case is a question for an attorney.
The High Court
Ms Hawarden bought a property for R6 million in May 2019 from a family trust; Edward Nathan Sonnenberg Inc (ENS) were the seller's conveyancers. She paid the balance of R5.5 million after receiving an email with altered banking details. According to the SCA, criminals had gained access to her own email account and diverted the payment meant for ENS. The Gauteng Division of the High Court, Johannesburg upheld her claim for R5.5 million in pure economic loss against ENS. She had argued that ENS should not have sent its banking details by unprotected email.
The Supreme Court of Appeal, 2024
On 10 June 2024 the SCA overturned that order. The court held that holding creditors in ENS's position liable would expose them to indeterminate liability for pure economic loss, and that Ms Hawarden could reasonably have protected herself by verifying the banking details. She had been warned about cybercrime by the estate agent, whose own details she had verified by phone. The court noted that the interference happened because her own email account had been compromised, not because of any failure in ENS's systems.
Was there a further appeal?
Some commentators said Ms Hawarden might seek leave to appeal to the Constitutional Court. We could not confirm from the court's records whether she did or what happened. If it matters to a decision you are making, ask your attorney to check the current position.
What the SCA ruling does not mean
It does not mean firms can ignore the risk. The judgment turned on its facts, including a compromised client mailbox and an earlier cybercrime warning from the estate agent. A firm whose own mailbox was compromised, or whose processes invited the loss, could be in a different position. Separately from delictual liability, a compromised firm mailbox is a POPIA security compromise, and clients who lose money tend to blame the firm whatever a court later says. Prevention is cheaper than any of those outcomes.
Which email controls should a firm have in place?
At minimum, publish SPF, DKIM and DMARC records for the firm's domain and move DMARC to an enforcing policy. These do not stop a criminal who is inside a real mailbox, and they do not stop lookalike domains, but they make it much harder to send email that claims to come from your exact domain. For broader security basics, see website security basics for SMEs.
How to check your own domain
DMARC is a DNS TXT record published at _dmarc. followed by your domain, for example _dmarc.yourfirm.co.za. Any free DNS lookup tool will show whether it exists and what it says. Check the p= value and whether a rua= address is set to receive aggregate reports. Without reports, you cannot see who is sending mail in your name.
Moving from p=none to quarantine or reject
Under the DMARC specification, p=none asks receiving servers to take no particular action, p=quarantine asks them to treat failing mail as suspicious, and p=reject asks them to refuse it. Many domains publish p=none and never move on, which gives reports but no protection. Use the reports to confirm that every legitimate sender (your mail platform, practice management system, accounting software, newsletter tool) passes, then move to quarantine and, once stable, to reject.
Which payment process controls matter most?
The controls that matter most are the ones that do not rely on email at all. A client who has been told, repeatedly and in advance, that your banking details will never change by email, and who knows to phone a number they already have, is much harder to defraud. That was the gap in the Hawarden facts: the details were not independently verified.
- A banking-details warning in three places. Put a short, plain statement on your website, in every email footer and in your engagement letter: the firm will never change its banking details by email, and clients must confirm details by phone on a known number before paying.
- Call-back verification before every payout. Before the firm pays a client or third party, confirm the account by phone on a number taken from the file or an independent source, never from the email that supplied the details. Record who called, when and on what number.
- Treat any change of banking details as a red flag. Whoever it comes from, a change request should stop the payment until it is verified by phone and signed off by a second person.
- Bank account verification where available. Use your bank's account verification service for new beneficiaries if it offers one.
- Multi-factor authentication and forwarding rules. Turn on MFA for every mailbox, including shared and former staff mailboxes, and check regularly for mailbox rules that forward or hide messages. Hidden forwarding rules are a common sign that a mailbox has been taken over.
These steps also support your POPIA section 19 duty, which requires reasonable technical and organisational measures, regular checks that safeguards work, and updates as new risks appear. For how client data more broadly fits into that duty, see how law firms should handle client data under POPIA. The firm's Information Officer is the person who deals with the Regulator; see how to register your Information Officer.
What should a firm do in the first hour after a suspected compromise?
Act on the money first, then contain the mailbox, then record everything. The chance of recovering funds falls quickly once they leave the receiving account, so the bank call comes before the investigation.
- Call the bank immediately. Phone the paying bank's fraud line (yours, or tell the client to call theirs) and ask for the payment to be stopped or recalled. Note the time and reference number.
- Secure the mailbox. Reset the password, sign out all sessions, confirm MFA, and remove any forwarding or hiding rules. Keep a copy of the rules and sign-in logs before changing them.
- Preserve the evidence. Keep the fraudulent email with full headers, the payment confirmation, and logs from your mail provider. Do not delete anything to tidy up.
- Report to SAPS. Open a case and give the client the case number. Banks and insurers usually ask for it.
- Notify your insurer. Check your professional indemnity and any cyber policy for notice requirements and time limits, and notify early.
- Assess POPIA section 22. If there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person, notify the Information Regulator and the affected people as soon as reasonably possible, in writing, with enough information for them to protect themselves.
- Warn other clients on live matters. Anyone in the compromised mailbox's recent correspondence may receive a similar email. Phone them and repeat the banking-details warning.
Section 22(3) allows notice to the affected person to be delayed only where a public body responsible for investigating offences, or the Regulator, determines that notice would impede a criminal investigation. For what can follow when the Regulator gets involved, see POPIA fines explained.
What goes on a one-page checklist for practice managers?
Keep it short enough to pin up. Most items cost little beyond staff time; moving DMARC to reject takes a few weeks of monitoring.
- SPF, DKIM and DMARC published; DMARC at quarantine or reject, with reports going to someone who reads them.
- MFA on every mailbox, including shared and dormant ones.
- Monthly check for mailbox forwarding and hiding rules.
- Banking-details warning on the website, in email footers and in the engagement letter.
- Written call-back procedure, on a known number, before every payout and after every change of details.
- Two-person sign-off on any changed beneficiary details.
- Incident contacts listed: bank fraud line, SAPS, insurer, Information Officer, IT provider.
- A drafted POPIA section 22 notice template, ready to adapt.
The website items sit alongside the others on our law firm website checklist.
Frequently asked questions
Is a law firm liable if a client pays into a fraudster's account?
Not automatically. In the Hawarden matter the Supreme Court of Appeal found the conveyancing firm was not liable, on facts that included the buyer's own compromised mailbox and an earlier cybercrime warning from the estate agent, whose details she had verified by phone. Different facts, such as a compromised firm mailbox, could lead to a different result. Take advice from an attorney on any specific case.
What did the SCA decide in Hawarden v ENS?
On 10 June 2024 it set aside the High Court's order that ENS pay R5.5 million. It held that imposing liability would create indeterminate liability for pure economic loss, and that the buyer could reasonably have protected herself by verifying the banking details. We could not confirm from the Constitutional Court's records whether any further appeal was brought.
What is DMARC and does my firm need it?
DMARC is a DNS record that tells receiving mail servers what to do with email that claims to come from your domain but fails SPF and DKIM checks. Any firm that sends payment-related email should publish one and move it to quarantine or reject. It does not protect against lookalike domains or a hijacked real mailbox, so payment controls are still needed.
What should we put on our website about banking details?
A short, prominent statement that the firm will never change its banking details by email, and that clients must confirm details by phone on a known number before paying. Repeat it in email footers and engagement letters so clients see it before the moment of payment.
What must we do under POPIA if a mailbox is compromised?
If there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person, POPIA section 22 requires you to notify the Information Regulator and the affected people as soon as reasonably possible. Notice to people must be in writing and give enough information for them to protect themselves.
Check your own firm
The getohdit law firm assessment reviews your public website, including its privacy, conduct and security basics. It is a technical check, not legal advice: getohdit is not a law firm, and questions of liability or notification on your own facts belong with an attorney.
Primary sources
- Protection of Personal Information Act 4 of 2013 (sections 19 and 22)
- Edward Nathan Sonnenberg Inc v Hawarden (421/2023) [2024] ZASCA 90; 2024 (5) SA 9 (SCA) (Supreme Court of Appeal, 10 June 2024; PDF via De Rebus)
- Constitutional Court of South Africa (check here for the status of any leave to appeal application)
- RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC) (since updated by newer RFCs)
- Information Regulator (security compromise notification forms and guidance)