Two of the emails ended with the words ‘Regards, Nick’, and the third email ended with the words ‘Thanks, Nick’. The fraudsters sent three separate emails to the FSP instructing that amounts be transferred to specified accounts. The client’s email account was hacked by fraudsters.

In terms of the client’s written mandate to the FSP, the FSP was engaged to act as the client’s agent and invest money on his instructions, provided that such instructions would be sent by fax or email ‘with client’s signature’. The client’s claim arose out of amounts transferred by the FSP in response to fraudulent email instructions ostensibly sent by the client. If instructions do not fully conform to the mandate, the FSP will be liable to pay back the money unlawfully transferred. It is clear that FSPs must carefully assess every instruction for authenticity and strictly comply with any agreed conditions. Everyone must be vigilant to the possibility of hackers emulating clients for financial gain. This decision is a warning signal to FSPs whose clients may be targeted by hackers and social engineers. The FSP therefore acted without receiving proper instructions and contrary to its mandate. On 18 March 2020 the Supreme Court of Appeal found that funds were improperly transferred by a financial services provider (FSP) when it received fraudulent instructions from a hacker posing as its client because there was no signature on the instruction as required by the mandate.

By Rosalind Lake (ZA) and Priyanka Naidoo on MaPosted in General

Explicit Hacked Client