“If you suspect deceit, hit delete!” (Online cybersecurity slogan)
October is Cybersecurity Awareness Month, a good time to note that as cybercrime continues to grow, more and more businesses and individuals are falling victim to the dreaded “BEC” or “Business Email Compromise” fraud.
The million-dollar question: Who takes the hit?
Typically in a BEC fraud, email or other electronic communications between a creditor and debtor (often a seller and buyer, or service provider and client) are hacked by criminals, who con the debtor into paying what they owe into the fraudster’s bank account. By the time the parties realise they’ve been had, the criminals are long gone, and all that remains is the million-dollar (sometimes quite literally!) question: “Which one of us takes the hit?”
Until now we have been faced with conflicting High Court decisions on this point, but now the SCA (Supreme Court of Appeal) has settled it: The risk is the debtor’s.
A car dealership must pay twice over
It was a classic case of BEC: A dealership bought two Hyundai Nissan NP200 vehicles from another dealership for R145,000 each. The seller issued invoices showing its banking details. The buyer paid by EFT and sent proof of payment to the seller, which happily (without checking that the funds had actually landed in its account) delivered the vehicles to the buyer.
As always with these cases, one can imagine the sinking feeling that greeted the parties’ realisation that the seller’s emails and the attached invoices had been intercepted, and the banking details subtly altered. As a result, the buyer had paid the full R290,000 to the criminals’ bank account.
Long story short, a real seesaw of a legal battle ensued. The buyer said, “I’ve already paid you”. The seller retorted, “No you haven’t, you paid the criminals,” and sued the buyer for the R290k. The seller won in the Regional Court, lost on appeal to the High Court, but then turned the tables again and celebrated victory in a further appeal to the SCA.
Verify, verify, verify
The SCA’s findings amount to this:
The onus is always on you as buyer to prove, on a balance of probabilities (i.e. more likely than not), that you have paid the seller.
When you pay by EFT, you must show that the seller actually got the money. In other words, that you paid into the correct bank account.
Creditors (recipients) have no legal duty to protect debtors (payers) from the possibility of their accounts being hacked where the debtor could have taken steps to protect itself but failed to do so.
The obligation therefore is on you as debtor to ensure that the bank account details in the invoice are in fact correct and verified because “it is the debtor’s duty to seek out his creditor”. Fail to follow basic verification steps, and your payment to the wrong account does not remove your liability to pay the debt — you still have to pay your creditor.
Bottom line, the buyer in this case should have verified the banking details given in the emailed invoices before paying. It didn’t, so it couldn’t prove that it had paid into an account authorised by the seller.
It must pay the seller the R290k, with interest and doubtless substantial legal costs.
Don’t make the same mistake
These scams grow more sophisticated by the day, fuelled now by AI-perfected deep fakes, cloned websites and social engineering. Treat all emails, all electronic messages, and all electronic invoices with great suspicion — even if they appear to come from businesses you have known and trusted for decades. Verify bank account details (preferably by speaking to the creditor directly on a number you know to be correct) before paying a cent.
Property sales are particularly vulnerable
Be especially vigilant when buying or selling property because these high-value sales are a particular focus for cybercriminals worldwide. There are rich pickings in the offing, and the opportunities for baddies to intercept and falsify emails is multiplied by the range of trusted role players involved — typically several sets of attorneys, estate agents, and banks as well as the buyers and sellers themselves.
A final note on online security
Let’s end off with a note to everyone: Keep reminding your whole team (not just your accounts department) that securing your computer and email systems against bad-actor compromise is no longer a nice-to-have, it’s essential. This whole unhappy saga could all have been avoided if everyone involved had followed basic security protocols. Prevention is always better than cure.
Give us a call if you need any help.
Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact us for specific and detailed advice.
“An ounce of prevention is worth a pound of cure.” (Benjamin Franklin’s warning to fire-threatened Philadelphians in 1736)
Cases of Business Email Compromise (BEC) fraud continue to surge, and recent High Court decisions have confirmed that it’s up to you to verify that you are paying into the correct bank account.
How does BEC work and who is at risk?
BEC fraud involves cybercriminals impersonating your trusted contacts (e.g. suppliers and professional advisors) in fraudulent emails that look genuine. The idea is to trick you into making payment into the scammer’s account.
Everyone’s at risk, but BEC is particularly rife in transactions where large amounts of money are in play. Favourite targets are commercial operations and their customers, as well as all role-players in property sales – buyers, sellers, conveyancers and estate agents.
How do these scams work? For a snapshot of a classic BEC sting, have a look at this recent High Court case…
“But I paid you the R890k!”
Two Cape Town companies, who had been trading happily and successfully with each other for seven years, fell out over who should bear a loss of R886,726.25 after scammers stole the customer’s payment for a consignment of valves. Here’s how it went down:
The customer had always made payments to the supplier’s Standard Bank account in the past. So far, so good.
But then, enter stage left, our villain: Joe Scammer. Joe intercepts the supplier’s email correspondence and, pretending to be the supplier’s managing director, asks the customer to make all payments to an Absa bank account from now on.
The customer asks for a bank confirmation letter, which Joe (still in his guise as MD) gladly supplies.
Reassured, the customer makes payment to the Absa account. The fraud is only discovered when, three days later, the supplier emails asking for payment.
Joe is of course now long gone with his loot, leaving customer and supplier to fight it out over who must bear the loss.
Blaming the supplier won’t work – you must “seek out” your creditor
The customer, sued by the supplier for the outstanding amount, contended that the blame lay with the supplier, whose own negligence in failing to secure its IT systems against email interception caused the fraud.
That’s a defence often raised by BEC victims, and indeed our courts have stressed in the past the need for suppliers and professionals to ensure that their own computer systems are properly secured at all times. But it cut no ice in this case.
Rather, said the Court, (emphasis supplied), “it is the debtor’s obligation to ‘seek out his creditor’ and … until payment is duly effected, the debtor carries the risk that the payment may be misappropriated or mislaid.”
The real cause of the loss in this case, held the Court, was not any hacking of the supplier’s emails (if there was in fact a hack – the supplier denied it), but the customer’s failure to take the steps that a “prudent debtor” would have taken to ensure that it was paying into the correct account.
Our unfortunate customer must now pay the supplier, plus a raft of legal costs to boot.
Pick up the phone!
Our courts will have no sympathy for you if you fall victim by not protecting yourself. A factor that counted against our customer here was (emphasis supplied): “the fact, known to any persons in business and making use of computer-based methods of communication and payment, that cyber crime is rampant and that care must be taken at all times to limit its impact.”
The good news is that a few simple preventative measures can provide everyone involved with a strong layer of protection:
Put in place strong policies and procedures to ensure that your IT systems and emails are secured against breach and interception.
You, and all of your staff, must remain constantly vigilant against the techniques which the scammers use. They are particularly adept at exploiting trust-based and long-standing relationships, for instance with suppliers you have dealt with for years, and professionals like attorneys, accountants and financial advisors etc.
Most importantly, perhaps, given the current attitude of our courts, is to always verify payment details via contact with your creditor through another communication system. As our courts have pointed out, “a simple telephone call” can be enough to avoid falling victim to fraud.
If you need help reviewing your fraud prevention and payment verification procedures, please feel free to contact us.
Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact us for specific and detailed advice.
“In defence of Madiba’s legacy, we will continue to wage a relentless war on corruption…” (President Cyril Ramaphosa)
You may have seen mention of the new amendment to the Prevention and Combatting of Corrupt Activities (POCCA) Act that imposes severe penalties for any failure to report corruption. If you did see it, you quite possibly thought “Doesn’t apply to me, I’m just a small business”.
Wrong! Let’s have a look at who the new law applies to, what it requires of you, the risk you run if you don’t pay it due attention, and how you should manage this new risk.
Who does the new reporting requirement apply to?
Not just big companies and multinational businesses. It applies not only to all members of “incorporated state-owned entities” but also to all persons and entities in the private sector. The definition here is very broad indeed, and it includes all types and sizes of businesses from sole trader up, all types of entity large and small, all companies, every “body of persons” and every “other legal person”.
In short, it applies to you!
What does it require of you?
Simply put, you must report any corruption or attempt at corruption. Of course, we all know what the common-sense definition of “corruption” is. If you need an exhaustive legal definition, we can certainly help you with that.
But in practice just be aware that it applies to any agreement or offer by an “associated” person (including employees, independent contractors and the like) to give anyone else any unlawful “gratification”. What’s more, “gratification” is so widely defined as to include every possible form of monetary or non-monetary advantage (or avoidance of disadvantage) you can think of. Naturally the agreement or offer in question must relate to an attempt to either obtain or retain a business advantage of some sort.
On another warning note, POCCA penalises not just active knowledge of corruption and wrongdoing, but also brings in concepts of “should have known” and “turned a blind eye”.
Put simply, you must report any form of “corruption”. Full stop.
What penalties apply?
In theory, the sky’s the limit here – unlimited fines and life imprisonment! In practice, courts will of course tailor the punishment to fit the crime. The bottom line: there are very clear indications that the authorities mean business, so beware.
How should you protect yourself?
The new law pulls no punches. But fortunately there’s a solid defence included in the new provision: to escape liability you only need to show that you “had in place adequate procedures designed to prevent” the corruption. There’s no definition of what this might entail, so it’s up to you to use common sense based on your particular business and circumstances. Local experts suggest that to be safe we follow the UK’s “Six Principles” – proportionality (procedures tailored to the level of your risk), top-level commitment, risk assessment, due diligence, communication, and monitoring and review.
Need help with drafting a corruption prevention protocol? Shout if we can help.
Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.
“It’s important to remember your competitor is only one mouse click away” (Doug Warner)
Your website, social media profiles, and other online platforms play a vital role in your business strategy and in staying ahead of your competition at all times.
However, it’s not just about marketing effectively. Ensuring compliance with regulations is equally crucial, although often overlooked.
Why is Compliance Important?
Compliance ensures that your business:
Meets all legal requirements.
Reduces risks associated with user engagement.
Enhances your brand’s image.
Builds trust and loyalty with users.
Safeguards your reputation.
Prevents unnecessary costs.
A Checklist for Website Compliance
Website compliance involves adhering to various laws, regulations, and standards governing online operations and content. Here’s what it entails:
Legal Compliance: Your website must follow local, national, and international laws, covering online business, intellectual property, and consumer protection requirements.
Accessibility Compliance: Websites should be accessible to people with disabilities, as mandated by some countries’ laws.
Cookie Compliance: Inform users about cookies and obtain their consent before placing them on their devices, as required by many countries.
Privacy Compliance: Comply with privacy regulations when collecting user data, such as POPIA in South Africa and (where applicable) GDPR in the EU.
Security Compliance: Implement security measures like encryption and secure logins to protect user data and prevent unauthorized access.
Content Compliance: Ensure content doesn’t violate copyright or trademark laws.
Financial Compliance: Adhere to regulations for online payments and financial transactions if your website conducts such activities.
Advertising Compliance: Ensure ads meet advertising standards and regulations to avoid deception or violation of laws.
Terms of Service/Supply and Policies: Make legal documents clear, transparent, and legally sound for users to agree to.
Industry-Specific Compliance: Some industries have specific regulations, like healthcare websites complying with health information privacy laws.
Integrate compliance into step 1 of your website’s development
Integrate compliance into the very earliest developmental stage of your website, focusing not only on content but also design and process. This ensures that your online presence remains compliant from the outset, reducing the risk of non-compliance issues down the line.
Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.
“Owning one’s own business is an adventure – enjoy it every step of the way.” (From the SME Toolkit article referenced below)
First, three questions to ask yourself…
If you dream of going into business for your own account in 2023, ask yourself these questions before you get started –
Am I an entrepreneur? You have an amazing idea, you can’t wait to launch your new business, success and wealth beckon! But wait a second – are you really suited for the hurly-burly of entrepreneurship? It can be hugely rewarding, not just in the financial sense but also in terms of lifestyle and life satisfaction. But it also carries far more risk than the classic “9 to 5 employee” option, so think long and hard before choosing. There are many online quizzes to help you decide – try for example DeLuxe’s “Quiz: Are you ready to start your own business?” here.
What’s my plan? Without a plan you sail rudderless through some very treacherous and shark-infested waters. Start-up failure rates are high, but luckily there is plenty of advice available to help you plan your course. Read for example the Business Partners “Ten Simple Rules For a Successful Start-up” on SME Toolkit.
What legal entity should I use to trade? Don’t make the rookie mistake of setting sail in just any old boat. Starting off in the wrong entity and then having to change mid-stream will mean a lot of unnecessary expense, hassle and risk. Rather plan long term – ask yourself where you want your business to be in 5 or 10 years, how big it will be, what your exit plan will be and so on.
We set out below some brief thoughts on the various alternatives available to you, but upfront professional advice, specific to your particular needs and circumstances, is a real no-brainer here.
So, what are your choices?
…and four business vehicles to choose from
You have four main options –
A sole proprietorship (“sole trader”). You are the business, trading for your own personal profit and loss, perhaps under a trading name such as “Syd Smith trading as ‘Syds Plumbing’”.
A partnership of 2 to 20 individuals or entities, pooling resources to carry on a trade, business or profession for a share of the profits.
A private company (“Pty Ltd”) with any number of shareholders. Controlled and administered by directors.
A trust (number of trustees and beneficiaries not restricted). There are various types of trust, with trustees controlling and managing trust assets and/or trading for the benefit of beneficiaries.
Note that you might be advised to combine one or more of these entities in a corporate structure, and that there are other specialised types of entity available to, for example, non-profit organisations (charities etc), professionals (lawyers, accountants, doctors etc) and the like.
The pros and the cons of each
Have a look at the illustrative table below for a summary of the advantages and disadvantages of each of these options.
Don’t forget the tax and estate planning implications!
Each of your choices carries with it a mixed bag of positives and negatives when it comes to both tax and estate planning implications. For an overview, have a look at SARS’ “Starting a business and tax” webpage, with a link to its “Tax Guide for Small Businesses” PDF.
That Guide is 102 pages long, and unless you are comfortable with the complexities involved, professional advice specific to your circumstances is again essential.
In a nutshell –
Estate planning: You may be advised to use companies and trusts for tax-efficient and practical transfer of wealth to future generations, as well as for asset protection from creditors both before and after you die. Both companies and trusts are “perpetual” in the sense that they survive changes in directors/trustees (resignation, removal, retirement, insolvency, death etc), with potential multi-generational savings in estate duty and avoidance of the cost and delays inherent in deceased estate administration.
Tax efficiency: Sole traders and partners are taxed at individual rates; trusts other than special trusts at a flat rate of 45%; companies at a flat rate of 27% (27% for years of assessment ending on 31 March 2023 and later, previously 28%) with 20% dividends tax when you take profits out. There are a host of other factors to take into account here, including aspects such as Capital Gains Tax inclusion rates, exclusions, exemptions, small business breaks and the “trust conduit principle” all being highly relevant to the ultimate question – will you be better off being taxed as an individual or will some form of corporate and/or trust structure be more tax efficient for you?
Take that professional advice!
Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.
“Strategy is the art of carefully selecting where a business applies its focus and resources in order to achieve its ultimate aim. A large part of the work is in selecting what not to do rather than what’s to be added.”
Strategic planning is an essential part of optimising your business for success. Without it you will drift rudderless, unfocused and wasting effort and resources with no clear destination in mind.
Jon Cherry’s article “The Four Strategies” on his Cherryflava website lists four key areas to consider – in combination, they will help drive your business forward, inspiring all the work, and the people, that hold your “North Star” vision close.
Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
