South Africans lost R2.4 billion to digital banking crime in 2025, spread across just over 110 000 incidents recorded by SABRIC. That works out to roughly R21 800 per incident, and the figure has more than doubled since 2023, when the total sat at R1.09 billion. The pattern behind those numbers is not a sophisticated breach of bank systems. It is people. Social engineering, impersonation and manipulated trust account for the bulk of the losses, and generative AI is now doing the heavy lifting for the criminals, producing e-mails, voice notes and instructions that read and sound exactly like the real thing.
For businesses, the sharpest edge of this trend is business e-mail compromise (BEC), where criminals impersonate or take over a trusted e-mail account to trick a business into paying them. It isn't even counted in that R2.4 billion. A supplier's invoice arrives with new banking details. A “CEO” instructs finance to release an urgent payment. A law firm's trust account correspondence is intercepted and the beneficiary details quietly changed. The e-mail looks right because, in most cases, it is the real thread, hijacked mid-conversation after a mailbox was compromised somewhere upstream. By the time the payment clears, the money is gone and the argument over who pays for it begins.
That argument increasingly ends up in court, and South African case law is starting to draw the line on where liability sits. In Edward Nathan Sonnenberg Inc v Hawarden (2024), the Supreme Court of Appeal held that a firm sending banking details by e-mail does not owe a duty of care to a non-client third party for losses caused by fraud further down the chain. The recipient had been warned about cyber crime risk and had the means to verify the details independently, by phone or at the bank, and did not.
Contrast that with Gerber v PSG Wealth Financial Planning (2023), where a financial services provider was held liable on contractual grounds for acting on payment instructions from a client's hacked e-mail account without verifying them. The distinction is the relationship. Where there is no mandate, the sender's duty is limited and the burden falls more heavily on the party making the payment. Where there is a direct client relationship, particularly one involving a mandate to handle funds, the standard expected of the business rises sharply, and failing to follow a verification process becomes the basis for a finding against you.
Shielding a business from BEC liability starts well before a claim is filed, through documented, consistently applied protocols: independent verification of any change to banking details, callback confirmation on a number sourced independently rather than one supplied in the suspect e-mail, two-factor authentication on e-mail and banking accounts, and a clear internal policy that finance staff can point to when asked why a payment was released. Courts have shown they will look closely at whether that standard was actually exercised, not merely whether a policy sat in a folder somewhere.
None of that, though, addresses the actual point of entry. Verification protocols only work if someone notices there is something to verify, and the entire design of a BEC attack is to make sure nobody does. Most BEC e-mails carry no malware, no malicious link and no attachment. Many come from a real thread on a legitimate account that has been compromised, so they pass the SPF, DKIM and DMARC checks that confirm an e-mail was sent from an authorised source. Others come from lookalike domains that attackers have set up and authenticated themselves. Those checks confirm where an e-mail came from, not what it is asking for, and there is no obvious red flag for a keyword-based filter to catch.
Cyberwin looks at e-mail security in layers: people, policy, process and tool. Most businesses Cyberwin speaks to have invested in one or two of them, and BEC lives in the gaps between. This is where the technical layer has to do work that a policy document cannot. LibraCyber's e-mail security platform is built around this problem. Rather than scanning for known signatures or suspicious keywords, it uses semantic analysis to assess the intent behind a message, which lets it flag a payment-redirection request or an executive impersonation attempt even when the e-mail contains nothing a conventional filter would recognise as malicious. It detects domain spoofing, flags account takeover behaviour and intercepts brand impersonation before the message lands in an inbox where a rushed staff member might act on it. The platform can run locally or in a chosen cloud environment, which matters for businesses that need to keep data under their own control for POPIA purposes, and it integrates with Microsoft 365, Google Workspace and Exchange without disrupting how staff already work.
BEC is not a single, sophisticated hack. The money is taken a transaction at a time, through inboxes that look ordinary until the payment goes out. Businesses that want to avoid becoming the next statistic need both halves of the answer: a documented verification standard that holds up in court, and technology at the e-mail gateway capable of catching what a human under pressure will miss.
William Despard is Chief Information Officer at Cyberwin, a specialist cyber security distributor working exclusively through MSP and reseller partners across South Africa, Africa and the UK (cyberwin.co.za).
Sources
R2.4 billion stolen from South Africans – over R21,800 per person – BusinessTech
Inside SA’s R2.4bn digital fraud epidemic – News24
Business Email Compromise: Who bears the risk of liability? – ENSafrica
Business Email Compromise (Email Interception) – IRMSA
What is business email compromise (BEC)? – Cloudflare
Annual Crime Statistics 2025 – SABRIC
Share
