Fourie v Van der Spuy and De Jongh Inc   

Cybercriminal hacked emails and attorney failed to discharge her duty to pay the balance in the trust account to the correct person and should have checked and had a verification process in place. 

“The rate at which cybercrime occurs makes the internet a very unsafe working area. Perhaps a time will come when monies will be transferred in the presence of a client, client will have to waive the nicety of EFT’s being done without client being present, alternatively client being phoned, however, this is not the function of the court to make plans how to curtail the absolute low-minded, yet deceptive cyber criminals.” [para 25]

Essence

Cybercriminal hacked emails which meant that attorney paid money from trust account to incorrect person without first verifying the change of bank account.

Decision

(65609/2019) [2019] ZAGPPHC 449 (30 August 2019)

Order

1. The Respondents, jointly and severally, the one to pay the other to be absolved, to pay R1 744 599.45 to the Applicant.
2. Interest on the said amount at a rate of 10% per annum a tempore morae to date of final payment.
3. Costs of the application.

Judges

Matthew Klein AJ.

Reasons

“2nd Respondent has failed to discharge her obligation to the Applicant to pay him. The 2nd Respondent’s defence that a fraud occurred that released her from paying the Applicant is no defence as she is as principal obliged to account to the applicant for the funds, a duty 2nd Respondent thus far has failed to discharge. It is irrelevant that emails similar to that of the Applicant was sent to her, the common law position pertaining to trust funds as set out above is clear. The duty of care, owed to a client and the mandate to pay as principal, point to the attorney as the one who , in this case, is liable.” [para 31]

Discussion by GilesFiles
Quotations from judgment

Note: Footnotes omitted and emphasis added

[1] This is a judgment on a matter pertaining to cybercrime, it is a matter of innocent people being dragged into cases where emails are hacked and payments are made to unknown hackers. The victims then litigate against one another.

[2] In this matter the Applicant claims payment of R1 744 599.45 from the respondents, jointly and severally, the one to pay the other to be absolved. The amount claimed represents the balance due to the Applicant as a result of certain mandates done by 2nd Respondent for the Applicant. Applicant was her client.

[3] The 1st Respondent is a law firm of the 2nd and 3rc1 Respondents who are practicing attorneys. The Attorneys Act, 53 of 1978, section 23 (1) (a), is applicable: and rules that all present and past shareholders, partners or members, as the case may be, are liable jointly and severally together with the company for the debts and liabilities of the company contracted during their period of office.

[4] It is not in dispute that the payments were made erroneously. It is not in dispute that the money was paid over to the trust account of the 1st Respondent to be retained for the benefit of the Applicant. The 2nd Respondent rendered professional services to the Applicant and was instructed to keep money until and when the Applicant gives instructions as to what 2nd Respondent is to do with same.

[5] The Respondents’ heads reflect that the crux of the lis between the parties lies therein that “a dispute exists regarding payment instructions (real or perceived) received from the Applicant over a period of time.” The Respondents then say that “It is on this point that the First and Second Respondents claim that there is an existence of a real bona fide dispute. This dispute is incapable of being resolved on the papers.”

LEGAL POSITION: DISPUTES OF FACT

[6] It is a well-established principle that in the event where material facts are in dispute, a final order will only be granted on notice of motion if the facts as stated by the Respondent, together with the facts alleged by the Applicant that are admitted by the Respondent, justify such an Order.

[7] If the Court is satisfied as to the inherent credibility of the Applicant’s factual averment, it may proceed on the basis of the correctness thereof and include these facts among those upon which it determines whether the Applicant is entitled to the final relief sought. In suitable cases the Court will adopt a “robust common sense approach” to the dispute of fact. It is also within a Court’s discretion to refer the application for the hearing of oral evidence or trial where the dispute is within a narrow ambit.

CONCLUSION PERTAINING TO DISPUTES OF FACT

[8] The Respondents aver that the factual disputes are whether the Applicant could not possibly have been involved in the cybercrime, whether Applicant’s refusal to deny the Respondents access to his laptop, could be indicative of a fraud, whether it should be further investigated or not. Also, perhaps the emails did come from the Applicant.

[9] The whole debacle about this could have been easily resolved, as counsel for the Applicant indicated, the 2nd Respondent deposed to an affidavit at the police, opening a fraud case, yet now wants to aver that it might not have been a fraud case. This is creating a dispute of fact. although mere speculation without proper proof. What we do see is that 2nd Respondent wanted police action, so did the Applicant, however, the Applicant launched an investigation and an urgent application to freeze accounts and demanding Fica documents from the banks concerning the accounts wherein the monies were deposited. One can actually assume that all the Fica documents would be false, all account holders untraceable.

[10] The Respondents say that the dispute between the parties lies therein that “a dispute exists regarding payment instructions (real or perceived)’. Yet, the payment instructions are clear: those that were legally done and those that were done due to hacking, are clearly distinguishable.

[11] It is overwhelmingly clear that there is no dispute of fact, the Respondents could not convince the court regarding this, the facts are straightforward, Respondents held money in their trust account on behalf of the Applicant, the amounts due and balances are easily calculated, Applicant was owed a certain amount, payments were made and a nett balance is due.

[12] The crucial question that could be asked, is this: who must take the knock for the loss? Should it be the client or the attorney, in other words the Applicant or the Respondents?

NATURE OF TRUST ACCOUNT

[13] In the case of Wypkema v Lubbe 2007 (5) SA 138 (SCA) , the court considered the nature of an attorney’s trust account, as was summarised in Fuhri v Geyser and Another 1979(1) SA 747(N) at 749C-E, as follows by Hefer J:

‘(D)espite the separation of trust money from an attorney’s assets thus affected by s 33(7), it is clear that trust creditors have no control over the trust account; ownership in the money the account vests in the bank or other institution in which it has been deposited (S v Kotze 1965 (1) SA 118 (A) at 124), and it is the attorney who is entitled to operate on the account and to make withdrawals from it (De Villiers NO v Kaplan 1960 (4) SA 476 (C). The only right that trust creditors have, is the right to payment by the attorney of whatever is due to them, and it is to that extent that they are the attorney’s creditors. This right to payment plainly arises from the relationship between the parties and has nothing whatsoever to do with the way in which the attorney handles the money in his trust account.’

[14] The Court accordingly held that

“when an attorney draws a cheque on his trust account, he exercises his right to dispose of the amount standing to the credit of that account and does so as principal and not in a representative capacity”.

This is a huge shift in contractual responsibility concerning monies paid to an attorney, this means that the attorney, as principal, has full control and responsibility concerning such money.

[15] The Applicant was obliged as a practising attorney to account to his client for the funds and as such did so as principal. It would not be a defence to a claim by the attorney to submit that he/she had paid as was instructed when he/she did not verify the instructions.

This is deducted from the case of Frikkie Pretohus Inc and Another v Glass 2011 (2) SA 407 KZP at par 19 where the court said-

“ln considering the duty of an attorney in dealing with trust money the Court in Aeroquip SA v Gross and others held-
An attorney who holds an amount of money in his trust account on behalf of a client is obliged to use it for no other purpose than he is instructed by the client. It is trite that it must always be available to the client. In Law Society, Transvaal v Matthews 1989 (4) SA 389 (T) at 394 the court said: ‘I deal now with the duty of an attorney in regard to trust money. Section 78(1) of the Attorneys Act obliges an attorney to maintain a separate trust account and to deposit therein money held or received by him on account of any person. Where trust money is paid to an attorney it is his duty to keep it in his possession and to use it for no other purpose than that of the trust. It is inherent in such a trust that the attorney should at all times have available liquid funds in an equivalent amount…”

[16] The Eastern Cape Local Division of the High Court was recently called upon to adjudicate a matter where the plaintiffs suffered a loss following a cybercrime being perpetrated in a conveyancing transaction. In this case, where there were almost identical facts as in the present case, the Honourable Tokota, J relied on two cases, to conclude that the attorney was liable.

The first case is that of Margalit v Standard Bank of South Africa and another 2013 (2) SA 466 (SCA) where paragraphs 23 and 24 were relied on. I merely quote the essential part:

“As was remarked many years ago by De Villiers CJ, in a dictum recently followed by this court:

‘I do not dispute the doctrine that an attorney is liable for negligence and want of skill. Every attorney is supposed to be reasonably proficient in his calling, and if he does not bestow sufficient care and attention, in the conduct of business entrusted to him, he is liable; and where this is proved the Court will give damages against him.'”

The second case is that of Lillicrap, Wassenaar and Partners v Pilking Brothers (SA) (Pty) Ltd 1985 (1) SA 475 (A) page 499 D-E:

“In applying the test of reasonableness to the facts of the present case, the first consideration to be borne in mind is that the respondent does not contend that the appellant would have been under a duty to the respondent to exercise diligence if no contract had been concluded requiring it to perform professional services.”

[17] The two legs would thus be a mandate/contract and a common law requirement of sufficient care and attention, in the conduct of business entrusted to the attorney.

MANDATE TO ATTORNEY

[18] The relationship between an attorney and his client is based on a contract of mandate. This contract, inter alia, imposes fiduciary obligations on the attorney and an attorney has a duty of care to his client.

[19] This fiduciary duty, its nature and extent, are questions of fact to be determined from a consideration of the substance of the relationship between the parties as well as any relevant circumstances. Essentially the scope of a mandate depends on its terms.

[20] An attorney bears a legal duty to deal with the money in her trust account without negligence. It is a term of the mandate that the attorney will exercise the skill, adequate knowledge and diligence expected of an average practising attorney and an attorney may be held liable for negligence even where she committed an error of judgment on matters of discretion if she failed to exercise the required skill, knowledge and diligence.

[21] At best the 2nd Respondent can claim that she intended to pay the Applicant but paid the wrong person. This however is no defence as it was succinctly stated in Potgieter v Capricorn Beach Homeowners Association and Another [2012] ZAWCHC 66 [GF note: upheld on appeal to SCA] :

“In the present case the Applicant, as a practising attorney, was intent on making payment to his client pursuant to the completion of a conveyancing transaction whereby his client sold immovable property to one Manyama and with the proceeds of the sale payable to the client. The Applicant was obliged as a practising attorney to account to his client for the funds and as such did so as principal. It would not be a defence to a claim by the client for the attorney to submit that he paid the wrong person and therefore he had discharged his duty to his client.”

[22] In Nissan South Africa (Pty) Ltd v Marnitz NO & Others 2005 (1 )SA 441 the Supreme Court of Appeal dealt with the question as to what are the consequences of mistakenly transferring money to an incorrect bank account?.

The Court found that “payment is a bilateral juristic act requiring the meeting of two minds.”

CONCLUSIONS

[23] It is common cause that 2nd Respondent has failed to pay over the balance due to the Applicant. In this respect the 2nd Respondent has failed to discharge her obligation to the Applicant and that should be the end of the matter.

[24] It cannot be disputed by the Respondents that had the 2nd Respondent confirmed or verified the new bank details with the Applicant the fraud simply would not have occurred. It is abundantly clear from the facts that no verification process was followed and that the firm would have to carry the loss, not the Applicant.

[25] The rate at which cybercrime occurs makes the internet a very unsafe working area. Perhaps a time will come when monies will be transferred in the presence of a client, client will have to waive the nicety of EFT’s being done without client being present, alternatively client being phoned, however, this is not the function of the court to make plans how to curtail the absolute low-minded, yet deceptive cyber criminals.

[26] The court noted with interest that the emails of 1st Respondent has a notice that reads that the 1st Respondent will not change its banking details per email. It is perhaps time that attorneys add that they will not accept email notifications concerning banking details from any client.

[27] It is also cumbersome to read that the attorneys are targeted in this regard.

In Risk Alert Feb 2017 practitioners were warned about the risks:

“Cyber related risks are on the increase and attorneys must: (i) ensure they have adequate risk mitigation/avoidance measures in place to deal with cyber related risks”

[28] It also says:

“The warnings have, unfortunately, either gone unheeded in many cases or reached the intended recipients too late as can be gleaned from the more than 137 cybercrime related claims notified to the insurance company since 1 July 2016 when the cybercrime exclusion (clause 16(0)) was implemented in the Master Policy.”

[29] And it continues:

“The value of repudiated cybercrime claims now exceeds R85 million. This figure only represents those claims that are reported to the LPIIF. The number and value of cybercrime claims reported by legal practitioners to the commercial market are not made publically available as is the data for such claims where members of the profession have to bear the losses as a result of not having appropriate risk transfer measurers (insurance or otherwise) for this risk.”

[30] The 2nd Respondent was negligent and failed to exercise the requisite skill, knowledge and diligence expected of an average practising attorney and thus failed to discharge her fiduciary duty to the Applicant by transacting via e-mail whilst full-well knowing that fraud is prevalent in her profession and not employing any measures to ensure that neither she, nor the Applicant will fall victim to fraud.

[31] 2nd Respondent has failed to discharge her obligation to the Applicant to pay him. The 2nd Respondent’s defence that a fraud occurred that released her from paying the Applicant is no defence as she is as principal obliged to account to the applicant for the funds, a duty 2nd Respondent thus far has failed to discharge. It is irrelevant that emails similar to that of the Applicant was sent to her, the common law position pertaining to trust funds as set out above is clear. The duty of care, owed to a client and the mandate to pay as principal, point to the attorney as the one who , in this case, is liable.

This Court according orders-

1. The Respondents, jointly and severally, the one to pay the other to be absolved, to pay R1 744 599.45 (one million seven hundred and forty four thousand and five hundred ninety nine rand and forty five cents only) to the Applicant.
2. Interest on the said amount at a rate of 10% per annum a tempore morae to date of final payment.
3. Costs of the application.