South African Court Orders PSG Wealth to Compensate Client for Cybercrime Fraud Losses

PSG Wealth Financial Planning has been ordered to pay a client more than R800,000 stolen by fraudsters through email cybercrime.

The South Gauteng High Court in Johannesburg ruled in favor of Jan Jacobus Gerber, who sued PSG Wealth Financial Planning for the loss he sustained due to the unlawful electronic transfer of money intended for his retirement that he had invested with the company. The fraudsters had hacked a client’s email and requested via email for the client’s investment shares and some of his wife’s investment to be paid out to a new bank account.

PSG argued that while it had a duty to protect the client’s money, it could not be liable for loss under circumstances in which the client had been hacked. However, the judge found that PSG had not complied with its own policy to protect its clients from cybercrime.

Judge Denise Fisher said it had become routine for business to be conducted via email, and it had now become common for these emails to be accessed remotely by fraudsters. She said business email compromise (BEC) had become rife, and that both parties had been victims of the fraud. “The question is, who should bear the losses,” she said.

Gerber had a share portfolio managed by PSG, through its representative Jonathan Fisher, for more than a decade. Gerber had a share and cash portfolio with investments totaling R855,413 as of September 2019, which could be liquidated and paid out at Gerber’s request.

In October 2019, there was a “somewhat unusual request” when Fisher received an email, purportedly from Gerber, requesting to liquidate R250,000. The email also provided details of a new bank account with FNB. Fisher emailed back, asking for confirmation of the new account. An email was sent back, containing a letter, ostensibly from FNB, which appeared to have an official bank stamp and reflected that the account had been opened in 2002.

Judge Fisher said PSG branches were run on a franchise system, and as part of that agreement, were given access to a central client service that could verify bank account details. The FNB account details were sent for verification. The report came back that the identity attached to the FNB account did not match Gerber’s details. It showed that the account had in fact only been opened less than three months prior, and the phone number and email address were not valid.

However, Fisher said these verification reports were often unreliable. His personal assistant Jocelyn van Stavel emailed Gerber to confirm that this was his account. “Unsurprisingly, came the response from the hijacked email that the payment should be made into it,” Judge Fisher said.

When Van Stavel made a “courtesy” call to Gerber to let him know the money had been paid, Gerber had been driving and responded “goed so” (“that’s fine”) – although he did not know what she was referring to.

A second email from the hacker soon followed, asking for more money, which was paid out, effectively wiping out Gerber’s investment.

Judge Fisher said the emboldened hacker was alerted by Van Stavel that Gerber’s wife also had an investment account. The hacker then requested R400,000 from his wife’s account. But when that email arrived, Van Stavel testified that “something didn’t look right”. Fisher then contacted his clients, who both confirmed they had not asked to withdraw any funds.

A subsequent investigation revealed that Gerber’s email had been hacked, and all the emails to and from PSG were diverted to a separate file that did not appear in his inbox or outbox.

PSG argued that while it had a duty to protect Gerber’s money, it could not be liable for loss under circumstances in which his computer