Cybercrime hits Toyota dealership

The dangers posed by computer hacking and cybercrime to electronic fund transfers has been highlighted in a Supreme Court of Appeal case between two Toyota vehicle dealerships.

The case involved Mosselbaai Boeredienste (Pty), trading as Mosselbaai Toyota, which had filed a notice of appeal in the Bloemfontein High Court against the judgment of the Bultfontein Magistrate’s Court to a dispute it had with OKB Motors CC, trading as Bultfontein Toyota.

Mosselbaai Toyota failed to file the record of proceedings and other documents necessary to prosecute the appeal timeously and, in terms of the Rules of Court, the appeal consequently lapsed.

Read: SA auto industry to award tender for EV charging stations

Mosselbaai Toyota then applied to the Bloemfontein High Court for condonation for failing to prosecute the appeal timeously, which in November 2021 dismissed the application with costs.

Special leave to appeal

The Supreme Court of Appeal (SCA) this month set aside the high court judgment and granted Mosselbaai Toyota condonation for its failure to comply with the provisions of the uniform rules of court.

Judge Zeenat Carelse, with judges BC Mocumie, A Schippers, PA Meyer and G Goosen concurring, granted Mosselbaai Toyota special leave to appeal the judgment and referred it to the full court of the Free State Division of the High Court to determine the merits of the appeal.

The background to the case is that Bultfontein Toyota entered into a verbal agreement to purchase a Toyota Etios 1.5 Sprint from Mosselbaai Toyota.

In terms of this agreement, payment had to be made into Mosselbaai Toyota’s bank account before it would release the motor vehicle to Bultfontein Toyota.

Proof of payment

After email and telephonic communication between relevant employees of the two dealerships, the sales manager at Mosselbaai Toyota, Mr Maritz, sent a copy of the invoice to Bultfontein Toyota sales assistant Ms Marlie Steyn.

Bultfontein Toyota effected payment of the purchase price of R159 353.76 into the bank account reflected on the invoice after Ms Steyn requested Mr Maritz to provide her with Mosselbaai Toyota’s banking details.

Read: Another Ford Kuga catches fire

Proof of payment was then sent via email to Mr Maritz and the vehicle, in which the original invoice was placed, was released to Bultfontein Toyota and driven to its premises in Bultfontein.

Fraud detected

However, a few days later it was discovered that the invoice received by Ms Steyn was in fact a fraudulent document on which the banking details of Mosselbaai Toyota were substituted with someone else’s banking details and the purchase price was deposited into that bank account.

In addition, the banking details on the proof of payment sent to Mr Maritz by Ms Steyn were also altered to now reflect the correct bank account number of Mosselbaai Toyota and not the account into which the money was deposited.

The dealerships unsuccessfully attempted to resolve the issue, resulting in Mosselbaai Toyota issuing summons against Bultfontein Toyota in the Bultfontein Magistrate’s Court for payment of the purchase price.

Read: 83 days to get vehicle back from [another Ford] dealership

The Bultfontein Magistrate’s Court ruled against Mosselbaai Toyota. This resulted in the appeal against that judgment and the application for condonation, which was dismissed by the High Court in Bloemfontein and led to the subsequent appeal to the SCA.

Criminals target banking system

Judge Carelse said there are four issues to consider in this matter in determining whether there are prospects of success in the appeal.

She said the facts in this case may be akin to the interception of cheques, adding that it is well known that banking systems are targeted by criminals.

Judge Carelse said cheques, which were once the preferred method of payment, have become obsolete but the principles to be applied in cases where cheques have been intercepted in the post and misappropriated by a thief have been reaffirmed.

“The question that arises in this case is whether the same legal principles should find application, namely where the debtor remains liable until payment has been credited to the creditor’s bank account.

“The question concerning the interception of a creditor’s banking details sent by electronic means has yet not been decided by this court,” she added.

“A further reason for granting special leave to appeal, is that there are conflicting high court judgments on the question as to who should bear the loss where a payment is electronically made to a creditor, which is fraudulently intercepted by a third party.”

Debtor responsibility

Judge Carelse referred to one judgment where the high court held that the debtor is responsible for verifying the creditor’s banking details.

She referred to a second judgment where the high court held that the defendant had a general duty of care to the plaintiff, the purchaser of immovable property, and concluded that the purchaser could not be held liable for the electronic transfer of funds into a banking account where the bank details had been fraudulently changed.

In a third judgment, the high court held that the proximate cause of the loss was not the hacking, it was the failure to employ the necessary and contractually prescribed vigilance when monies held in trust were paid into a different account.

In a fourth judgment, said Judge Carelse, the high court held that the electronic transfer of funds into the incorrect account did not absolve the debtor from payment.

Negligence

Judge Carelse added that Bultfontein Toyota raised the defence of estoppel – a judicial device in common law legal systems whereby a court may prevent a person from making assertions, or from going back on their word – which was upheld by the trial court.

She said Bultfontein Toyota’s case is that Mosselbaai Toyota had negligently misrepresented to it that the banking details on its invoice were the correct banking details.

She added that it is common cause between the IT experts that the interception was on the side of Mosselbaai Toyota and that its email system was “spoofed”.

Judge Carelse added that Mosselbaai Toyota was aware of cybercrime in the motor industry and failed to take measures to guard against this and, as a result, the trial court held that Mosselbaai Toyota was ‘estopped’ from “denying that the altered bank details were not those of the plaintiff [Mosselbaai Toyota]”.

Material contradiction

Judge Carelse said the trial court heard that Ms Steyn testified that she had not verified the correctness of Mosselbaai Toyota’s bank details, while another witness had testified that she had verified the correctness of these bank details.

She said this was a “material contradiction” that was not considered by the trial court.

Other issues the SCA must consider in determining whether there are prospects of success in the appeal include:

•  The failure by the trial court to consider whether the alleged negligence was the proximate cause of the payment having been electronically transferred by Bultfontein Toyota into the incorrect banking account; and

• The failure by the trial court to consider whether the damage or loss that was caused by the third party – the interceptor – was foreseeable.