Cybercrime in EFT Payments: Who Bears the Risk When Fraud Strikes?

 

Written by Roy Bregman, an admitted attorney with over 51 years’ experience in commercial litigation and contract law. Learn more about Roy’s expertise.

The recent Supreme Court of Appeal ruling in Intengo Imoto v Zoutpansberg Motor Wholesalers confirms that the risk of EFT fraud rests with the payer. Businesses must verify banking details before making payment, as failure to do so does not discharge the debt, even if fraud was involved. This case highlights the legal imperative for due diligence in electronic transactions.

Introduction

Electronic Funds Transfer (EFT) fraud is an increasing risk in commercial transactions. The Supreme Court of Appeal of South Africa’s recent judgment in Intengo Imoto v Zoutpansberg Motor Wholesalers (Case 474/2024) clarifies a critical legal principle: debtors bear the responsibility to verify banking details before payment. This ruling establishes that payment into a fraudulent account—even due to intercepted emails—does not discharge the debtor’s obligation.

Legal Principles: Payment Obligations in EFT Transactions

South African contract law imposes strict duties on debtors regarding payment:

• Place of payment: Funds must reach the creditor’s designated account. As established in Bush v Kruger, EFT payment is only complete when received in the payee’s account.
• Risk allocation: The debtor assumes responsibility for ensuring correct payment. The court cited Mannesman Demag v Romatex, affirming that “the risk is the debtor’s since it is the debtor’s duty to seek out his creditor.”
• Onus of proof: The payer must prove valid payment. Failure to do so leaves the original debt enforceable.

This framework places the burden squarely on purchasers to mitigate cybercrime risks through due diligence.

Case Analysis: Intengo Imoto v Zoutpansberg Motor Wholesalers

Background Facts

• Parties:
• Appellant: Intengo Imoto (vehicle seller)
• Respondent: Hyundai Louis Trichardt (purchaser)
• Agreement: Hyundai bought two vehicles (R290,000) via EFT, with banking details provided in emailed invoices.
• Fraud: Hyundai paid into fraudulent accounts instead of Intengo’s actual account due to intercepted emails.
• Outcome: Intengo never received payment and sued for the purchase price.

Lower Court Decisions

• Regional Court: Ruled for Intengo, ordering Hyundai to pay R290,000 plus interest. The court emphasized Hyundai’s failure to verify account details.
• High Court: Overturned the ruling, claiming Intengo failed to prove contractual breach.

Supreme Court of Appeal’s Key Findings

1. Onus of proof: Hyundai bore the burden to prove valid payment but failed.
2. Verification duty: Businesses must confirm banking details pre-payment. The court cited Mosselbaai Boere Dienste, stating, “The golden thread... places an obligation on the purchaser to ensure that the bank account details... are correct.”
3. Risk allocation: Hyundai’s argument that Intengo “assumed risk” via email communication was rejected. The court affirmed that cybercrime liability rests with the payer.

Final Ruling: Hyundai’s appeal was dismissed, reinstating the regional court’s judgment.

FAQs: EFT Payment Risks After Intengo v Hyundai

Q: What steps prevent EFT fraud?

A: Always verify account details via phone call; avoid relying solely on emailed invoices.

Q: Who is liable if payment goes to a fraudulent account?

A: The purchaser remains liable unless the seller authorized the incorrect account.

Q: How does this ruling affect standard business practices?

A: Businesses must implement payment verification protocols to avoid liability.

Conclusion

The Intengo judgment crystallizes a critical precedent: Due diligence in payment verification is non-negotiable. Businesses ignoring this duty risk significant financial exposure. As cybercrime evolves, this ruling underscores that courts will enforce purchaser accountability, rejecting “email interception” as a defence for non-payment. Proactive measures are now a legal imperative.