{"id":255922,"date":"2023-03-31T20:04:24","date_gmt":"2023-03-31T18:04:24","guid":{"rendered":"https:\/\/www.groundup.org.za\/article\/financial-services-company-ordered-to-pay-a-client-more-than-r800000-lost-in-cybercrime-fraud\/"},"modified":"2023-03-31T20:04:24","modified_gmt":"2023-03-31T18:04:24","slug":"financial-services-company-ordered-to-pay-client-more-than-r800000-lost-in-cybercrime-fraud","status":"publish","type":"post","link":"https:\/\/www.myza.co.za\/press\/financial-services-company-ordered-to-pay-client-more-than-r800000-lost-in-cybercrime-fraud\/","title":{"rendered":"Financial services company ordered to pay client more than R800,000 lost in cybercrime fraud"},"content":{"rendered":"<div id=\"article_body\">\n<p><a class=\"bigger-image\" href=\"https:\/\/www.groundup.org.za\/media\/uploads\/images\/photographers\/Ashraf%20Hendricks\/joburg_highcourt-9127hr_extra_large.jpg\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" alt src=\"http:\/\/www.myza.co.za\/press\/wp-content\/uploads\/2023\/03\/financial-services-company-ordered-to-pay-client-more-than-r800000-lost-in-cybercrime-fraud.jpg\"><\/a><\/p>\n<p class=\"caption\">The High Court in Johannesburg has ordered PSG Wealth Financial Planning to pay a client more than R800,000, plus interest, which was stolen by fraudsters through email cybercrime. Archive photo: Ashraf Hendricks<\/p>\n<ul>\n<li>PSG Wealth Financial Planning has been ordered to pay a client more than R800,000 stolen by fraudsters through email cybercrime.<\/li>\n<li>The fraudsters had hacked a client\u2019s email and requested via email for the client\u2019s investment shares and some of his wife\u2019s investment to be paid out to a new bank account.<\/li>\n<li>PSG argued that while it had a duty to protect the client\u2019s money, it could not be liable for loss under circumstances in which the client had been hacked.<\/li>\n<li>But the Judge found that PSG had not complied with its own policy to protect its clients from cybercrime.<\/li>\n<\/ul>\n<p>The High Court in Johannesburg has <a href=\"https:\/\/www.groundup.org.za\/media\/uploads\/documents\/270_1.pdf\">ordered<\/a> a financial services company to pay a client more than R800,000 stolen by fraudsters through email cybercrime.<img loading=\"lazy\" decoding=\"async\" alt class=\"leave\" height=\"1\" id=\"gu_counter\" src=\"http:\/\/www.myza.co.za\/press\/wp-content\/uploads\/2023\/03\/financial-services-company-ordered-to-pay-client-more-than-r800000-lost-in-cybercrime-fraud.gif\" width=\"1\"><\/p>\n<p>Judge Denise Fisher ruled in favour of Jan Jacobus Gerber who sued a PSG Wealth Financial Planning for the loss he sustained due to the unlawful electronic transfer of money intended for his retirement that he had invested with the company.<\/p>\n<p>Judge Fisher said it had become routine for business to be conducted via email and it had now become common for these emails to be accessed remotely by fraudsters. She said business email compromise (BEC) had become rife and that both parties had been victims of the fraud.<\/p>\n<p>\u201cThe question is, who should bear the losses,\u201d she said.<\/p>\n<p>Judge Fisher said Gerber had a share portfolio which had been managed by PSG, through its representative Jonathan Fisher, for more than a decade.<\/p>\n<p>Gerber had a share and cash portfolio with investments totalling R855,413 as at September 2019. This could be liquidated and paid out at Gerber\u2019s request.<\/p>\n<p>The Judge said that the contact between Fisher and Gerber was rare. The dealings entailed no more than a monthly statement, detailing his account activity, sent via email to Gerber.<\/p>\n<p>Then, in October 2019 there was a \u201csomewhat unusual request\u201d when Fisher received an email, purportedly from Gerber, requesting to liquidate R250,000. The email also provided details of a new bank account with FNB.<\/p>\n<p>Fisher emailed back, asking for confirmation of the new account. An email was sent back, containing a letter, ostensibly from FNB, which appeared to have an official bank stamp and reflected that the account had been opened in 2002.<\/p>\n<p>Judge Fisher said PSG branches were run on a franchise system, and as part of that agreement, were given access to a central client service which could verify bank account details. The FNB account details were sent for verification. The report came back that the identity attached to the FNB account did not match Gerber\u2019s details. It showed that the account had in fact only been opened less than three months prior, and the phone number and email address were not valid.<\/p>\n<p>However, Fisher said these verification reports were often unreliable. His personal assistant Jocelyn van Stavel emailed Gerber to confirm that this was his account.<\/p>\n<p>\u201cUnsurprisingly, came the response from the hijacked email that the payment should be made into it,\u201d Judge Fisher said.<\/p>\n<p>When Van Stavel made a \u201ccourtesy\u201d call to Gerber to let him know the money had been paid, Gerber had been driving and responded \u2018goed so\u2019 (\u2018that\u2019s fine\u2019) \u2013 although he did not know what she was referring to.<\/p>\n<p>A second email from the hacker soon followed asking for more money, which was paid out, effectively wiping out Gerber\u2019s investment.<\/p>\n<p>Judge Fisher said the emboldened hacker was alerted by Van Stavel that Gerber\u2019s wife also had an investment account. The hacker then requested R400,000 from his wife\u2019s account. But when that email arrived, Van Stavel testified that \u201csomething didn\u2019t look right\u201d.<\/p>\n<p>Fisher then contacted his clients, who both confirmed they had not asked to withdraw any funds.<\/p>\n<p>A subsequent investigation revealed that Gerber\u2019s email had been hacked, and all the emails to and from PSG were diverted to a separate file which did not appear in his inbox or outbox.<\/p>\n<p>PSG argued that while it had a duty to protect Gerber\u2019s money, it could not be liable for loss under circumstances in which his computer system had been hacked. This was a \u201ctacit term\u201d of the agreement, it said.<\/p>\n<p>But Judge Fisher said to import such a term would be counterintuitive. \u201cThe protection against technological fraud would be meaningless if the client had to assume the obligation to prevent hacking. After all, [PSG] is paid handsomely for the services provided, including the provision of fraud protection,\u201d she said.<\/p>\n<p>\u201cThere is no evidence that [Gerber] did anything or failed to do anything to protect his system from being hacked. He testified that his system was password protected and that he had an effective virus protection installed. This was not challenged.\u201d<\/p>\n<p>Judge Fisher said the contracts dictated that instructions had to be given via email and \u201carguably [PSG] thus assumed the risk of employing this system of communication\u201d.<\/p>\n<p>The Judge said the call to Gerber had been a \u201ccourtesy call\u201d, not one seeking confirmation that the monies were to be paid into another bank account.<\/p>\n<p>PSG had not established that it complied with its contractual obligations to protect Gerber against cybercrime, she said. Judge Fisher ordered PSG to pay Gerber R811,488.98, plus interest and the costs of the application.<\/p>\n<\/p><\/div>\n<div id=\"article_copyright\">\n<p>\u00a9 2023 GroundUp. This article is licensed under a <a href=\"http:\/\/creativecommons.org\/licenses\/by-nd\/4.0\/\" rel=\"license\">Creative Commons Attribution-NoDerivatives 4.0 International License<\/a>.<\/p>\n<p>You may republish this article, so long as you credit the authors and GroundUp, and do not change the text. Please include a link back to the original article.<\/p>\n<p>We put an invisible pixel in the article so that we can count traffic to republishers. All analytics tools are solely on our servers. We do not give our logs to any third party. Logs are deleted after two weeks. We do not use any IP address identifying information except to count regional traffic. We are solely interested in counting hits, <b>not tracking<\/b> users. If you republish, please do not delete the invisible pixel.<\/p>\n<\/p><\/div>\n<p><img decoding=\"async\" src=\"http:\/\/www.myza.co.za\/press\/wp-content\/uploads\/2023\/03\/financial-services-company-ordered-to-pay-client-more-than-r800000-lost-in-cybercrime-fraud.jpg\"><a href=\"https:\/\/www.groundup.org.za\/\">Source: GroundUp<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The High Court in Johannesburg has ordered PSG Wealth Financial Planning to pay a client more than R800,000, plus interest, which was stolen by fraudsters through email cybercrime. Archive photo: Ashraf Hendricks PSG Wealth Financial Planning has been ordered to pay a client more than R800,000 stolen by fraudsters through email cybercrime. The fraudsters had [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":255923,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","ngg_post_thumbnail":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[9928],"tags":[28001],"class_list":{"0":"post-255922","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-groundup","8":"tag-groundup","9":"entry"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/www.myza.co.za\/press\/wp-content\/uploads\/2023\/03\/financial-services-company-ordered-to-pay-client-more-than-r800000-lost-in-cybercrime-fraud.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/posts\/255922","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/comments?post=255922"}],"version-history":[{"count":0,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/posts\/255922\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/media\/255923"}],"wp:attachment":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/media?parent=255922"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/categories?post=255922"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/tags?post=255922"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}