The final weeks of the financial year are traditionally chaotic for accounts departments across South Africa. As businesses rush to settle accounts before closing for the December holidays, finance teams face a deluge of paperwork, tight processing deadlines, and skeletal holiday staffing.
Predictably, syndicates look forward to this period. They launch sophisticated invoice spoofing and supplier communication interception scams, knowing that hurried employees are far more likely to overlook minor anomalies when processing year-end payments.
How the Interception Occurs
Supplier invoice fraud is rarely a random attack. It is usually the result of long-term cyber- compromise or business email compromise (BEC). Fraudsters quietly monitor the email traffic of either your business or one of your regular suppliers. They bide their time, waiting for a high- value transaction such as a year-end retainer, a major procurement order, or a festive inventory restock.
Once a large invoice is issued, the scammer intervenes using one of two primary methods:
●The Spoofed Domain: The fraudster registers an email address that looks identical to your supplier’s actual domain, altering only a single, easily missed character. For example, they might change orders@supplier.co.za to orders@suppl-ier.co.za.
●The ‘Updated Banking Details’ Notification: Using the stolen layout, logos, and signatures of your real supplier, they send an urgent letter stating that their finance department is undergoing an audit or changing banks. They instruct your team to update the banking profile immediately to ensure holiday delivery.
The payment is made, the money enters a mule account, and it is withdrawn within minutes. This often happens long before the real supplier calls to ask why their account is still outstanding.
Essential Vetting Protocols for Finance Teams
Defending your cash flow against invoice interception requires enforcing a culture of strict verification. A polished email or an invoice that ‘looks exactly like the old one’ is no longer proof of authenticity
●Enforce Independent Telephonic Verification: Never use the contact phone number printed on the ‘updated’ invoice or contained within the email signature. If a supplier requests a change of banking details, look up their telephone number from your original, historical records or their official website. Call a known contact at the company to verbally confirm the change.
●Examine Email Headers Thoroughly: Train your accounts payable team to hover over the sender’s name to reveal the actual underlying email address. Look for subtle spelling variations, hyphenations, or changes in the domain extension, such as using .com instead of .co.za.
●Implement a Dual-Authorisation Shield: Ensure that no single employee can both alter banking details on your accounting software and release the payment. Splitting these responsibilities forces a second pair of eyes to review the transaction.
●Match Invoices to Original Purchase Orders: Cross-reference every year-end invoice against an approved, internal Purchase Order (PO) and a signed delivery note. If an invoice arrives completely unannounced, flag it immediately for review.
Legal and Liability Implications
When a business mistakenly pays a fraudster, a critical legal question arises: who bears the loss? Does it fall on the client who paid the wrong account, or the supplier whose communications were compromised?
Under South African law, the position is clear. The debtor bears the risk of misdirected electronic payments resulting from cybercrime and email interception. This principle was firmly reinforced by the Western Cape High Court in Gripper & Company (Pty) Ltd v Ganedhi Trading Enterprises CC ([4725/2024] ZAWCHC 352; 2025 (3) SA 279 (WCC)).
In this matter, fraudsters intercepted email communications and sent fake banking details. They instructed Ganedhi to pay R866,725.25 into an unauthorised Absa account instead of Gripper’s long-standing Standard Bank account. Ganedhi argued that they were innocent victims of business email compromise. However, the court ruled that a debtor has a strict legal duty to “seek out their creditor” and ensure that payment actually reaches them.
The court found that Ganedhi acted negligently by failing to independently verify Gripper’s sudden change in banking details. A quick phone call to Gripper would have exposed the fraud, especially given the seven-year established payment pattern, urgency red flags, and domain irregularities. Consequently, Ganedhi was ordered to pay the full capital amount plus interest and legal costs, resulting in a devastating double payment.
Strengthen Your Financial Controls
Safeguarding your business from catastrophic payment errors requires clear, legally robust internal policies. At Rasiluma TD Attorneys Inc., we guide businesses through corporate governance risk assessments, cyber-risk liability management, and internal financial control compliance. Our legal experts help you draft comprehensive, foolproof payment verification policies that protect your capital and shield your business from legal liability.
Contact our offices today to secure your corporate accounts against festive financial fraud.
Disclaimer: The information contained in this article is for informational purposes only and does not constitute formal legal advice. For tailored legal counsel regarding cybersecurity compliance, POPIA, or financial control protection, please contact our offices directly.
Read the full judgment on SAFLII: Gripper & Company (Pty) Ltd v Ganedhi Trading Enterprises CC (https://www.saflii.org/za/cases/ZAWCHC/2024/352.html)
