ENS v Hawarden

Business Email Compromise & Delictual Liability
A Supreme Court of Appeal Case Study
Edward Nathan Sonnenberg Inc v Judith Mary Hawarden
(421/2023) [2024] ZASCA 90
📚 IRM1501 Assignment 2 ⚖️ South African Law of Delict 📅 2024

Overview

The Parties
  • Appellant: Edward Nathan Sonnenberg Inc (ENS) — premier SA law firm
  • Respondent: Judith Mary Hawarden — property purchaser
  • Court: Supreme Court of Appeal
  • Judge: Dawood AJA (unanimous)
At a Glance
  • Amount lost: R5.5 million
  • Property price: R6 million
  • Crime: Business Email Compromise
  • Legal issue: Wrongfulness for omission

The Core Question

Can a law firm be held delictually liable for failing to warn a third party about BEC fraud risks — when no attorney-client relationship existed?

The Facts: The Property Deal

Setting the Scene

  • 2019: Ms Hawarden agreed to purchase a property for R6 million
  • ENS was appointed as the seller's conveyancers — not her attorneys
  • No attorney-client relationship existed between ENS and Hawarden
  • ENS sent a legitimate email in August 2019 with banking details for the deposit

The PGP Warning

  • Ms Hawarden's bank, Standard Bank, had issued a warning about BEC fraud (Property Group Purchase scams)
  • She had successfully verified and paid an earlier deposit — confirming she was aware of the verification process
  • The remaining R5.5 million deposit still needed to be transferred

The Facts: The Cyber Attack

⚠️ The Business Email Compromise (BEC) Attack

Fraudsters gained access to Ms Hawarden's personal email account — not ENS's systems — and intercepted the legitimate banking details email sent by ENS.

How It Unfolded
  • Fraudsters intercepted & read ENS's email
  • Created a spoofed email with fraudulent account details
  • Ms Hawarden received fake banking details
  • She visited Standard Bank to process the transfer
The Transfer
R5.5M
transferred into the **fraudsters' account** — not ENS's trust account

The money was never recovered.

The Facts: High Court Proceedings

Hawarden's Claim

Ms Hawarden sued ENS in the High Court, claiming ENS was delictually liable for:

  • Failing to warn her about the risk of BEC fraud
  • Failing to take steps to protect her when sending banking details by email

High Court Finding

  • The High Court found in favour of Ms Hawarden
  • Held that ENS owed her a legal duty not to cause pure economic loss by omission
  • ENS was ordered to pay damages

ENS Appeals

  • ENS appealed to the Supreme Court of Appeal
  • The SCA had to determine whether wrongfulness had been established
Did Ms Hawarden establish the element of wrongfulness for a delictual claim for pure economic loss arising from ENS's omission to warn her of BEC fraud risks?
Elements of Delict at Issue
  • Conduct — omission (failure to warn)
  • Wrongfulness — was there a legal duty?
  • Pure economic loss (no physical harm)
  • No pre-existing attorney-client relationship
Secondary Question

Should a legal duty to warn be imposed on creditors who send banking details by email to third parties?

(Policy implications for every business in SA)

Ratio Decidendi: The Reasoning

Wrongfulness & Omissions

  • Wrongfulness for an omission causing pure economic loss requires public/legal policy justification
  • Courts ask: Is it reasonable, fair and just to impose liability?
  • The boni mores (legal convictions of the community) test applies

Factors Against Imposing Liability

  • ⚠️ Risk of indeterminate liability — every business sending banking details by email could be liable
  • ⚠️ No attorney-client relationship — ENS owed no fiduciary duty to Hawarden
  • ⚠️ The compromise originated in Hawarden's own email — not ENS's systems
  • ⚠️ She had already taken verification steps earlier in the same transaction

Ratio Decidendi: Policy Considerations

The Indeterminate Liability Problem

If ENS were held liable, any party who sends banking details by email could face delictual liability to the recipient — regardless of whether a professional relationship exists. This would create an unworkable and open-ended duty of care across commerce.

The Self-Protection Principle

  • Ms Hawarden knew about BEC risks — her bank had warned her
  • She had successfully verified banking details earlier in the same deal
  • The simple verification step she had previously taken would have prevented the loss
  • Imposing liability on ENS would undermine personal responsibility

The Finding

✓ Appeal Upheld — ENS Wins
SCA Held
  • Wrongfulness not established by Ms Hawarden
  • No legal duty on ENS to warn her of BEC risks
  • Public policy does not support imposing liability in these circumstances
  • High Court judgment set aside
Hawarden's Claim
  • Delictual claim dismissed in full
  • Ordered to pay costs of the appeal
  • R5.5 million loss remained unrecovered
  • Liability rested with the fraudsters (and arguably, herself)

Key Takeaways

For the Law of Delict

  • Omissions require stronger policy justification than positive acts
  • Pure economic loss claims face a higher threshold for wrongfulness
  • The absence of a legal relationship is a decisive factor against liability
  • Courts guard against indeterminate liability in open-ended duty-of-care cases

For Cybercrime & Commerce

  • Victims of BEC fraud may have limited legal recourse against third parties
  • The duty to verify banking details rests primarily with the transferring party
  • Professional relationships (attorney-client) are crucial to establishing duties
  • Self-protection measures matter — courts consider what victims could have done

Summary

The Case
R5.5M lost to BEC fraud. Hawarden sued ENS for failing to warn her — despite ENS not being her attorney.
The Question
Was ENS's failure to warn wrongful? Did it owe a legal duty to a third party with no attorney-client relationship?
The Reasoning
No relationship + indeterminate liability risk + Hawarden's own email was compromised + she could have verified.
The Outcome
SCA: **No wrongfulness.** ENS appeal upheld. Claim dismissed with costs. (Dawood AJA, unanimous)
ENS v Hawarden (421/2023) [2024] ZASCA 90 · IRM1501 · 2024