Don’t Let Cybercriminals Haunt You – Verify…

“An ounce of prevention is worth a pound of cure.” (Benjamin Franklin’s warning to fire-threatened Philadelphians in 1736)

Cases of Business Email Compromise (BEC) fraud continue to surge, and recent High Court decisions have confirmed that it’s up to you to verify that you are paying into the correct bank account. 

 How does BEC work and who is at risk?

BEC fraud involves cybercriminals impersonating your trusted contacts (e.g. suppliers and professional advisors) in fraudulent emails that look genuine. The idea is to trick you into making payment into the scammer’s account.

Everyone’s at risk, but BEC is particularly rife in transactions where large amounts of money are in play. Favourite targets are commercial operations and their customers, as well as all role-players in property sales – buyers, sellers, conveyancers and estate agents.

How do these scams work? For a snapshot of a classic BEC sting, have a look at this recent High Court case…

“But I paid you the R890k!”

Two Cape Town companies, who had been trading happily and successfully with each other for seven years, fell out over who should bear a loss of R886,726.25 after scammers stole the customer’s payment for a consignment of valves. Here’s how it went down:

• The customer had always made payments to the supplier’s Standard Bank account in the past. So far, so good.
• But then, enter stage left, our villain: Joe Scammer. Joe intercepts the supplier’s email correspondence and, pretending to be the supplier’s managing director, asks the customer to make all payments to an Absa bank account from now on.
• The customer asks for a bank confirmation letter, which Joe (still in his guise as MD) gladly supplies.
• Reassured, the customer makes payment to the Absa account. The fraud is only discovered when, three days later, the supplier emails asking for payment.
• Joe is of course now long gone with his loot, leaving customer and supplier to fight it out over who must bear the loss.

Blaming the supplier won’t work – you must “seek out” your creditor

The customer, sued by the supplier for the outstanding amount, contended that the blame lay with the supplier, whose own negligence in failing to secure its IT systems against email interception caused the fraud.

That’s a defence often raised by BEC victims, and indeed our courts have stressed in the past the need for suppliers and professionals to ensure that their own computer systems are properly secured at all times. But it cut no ice in this case.

Rather, said the Court, (emphasis supplied), “it is the debtor’s obligation to ‘seek out his creditor’ and … until payment is duly effected, the debtor carries the risk that the payment may be misappropriated or mislaid.”

The real cause of the loss in this case, held the Court, was not any hacking of the supplier’s emails (if there was in fact a hack – the supplier denied it), but the customer’s failure to take the steps that a “prudent debtor” would have taken to ensure that it was paying into the correct account.

Our unfortunate customer must now pay the supplier, plus a raft of legal costs to boot.

Pick up the phone!

Our courts will have no sympathy for you if you fall victim by not protecting yourself. A factor that counted against our customer here was (emphasis supplied): “the fact, known to any persons in business and making use of computer-based methods of communication and payment, that cyber crime is rampant and that care must be taken at all times to limit its impact.”

The good news is that a few simple preventative measures can provide everyone involved with a strong layer of protection:

1. Put in place strong policies and procedures to ensure that your IT systems and emails are secured against breach and interception.
2. You, and all of your staff, must remain constantly vigilant against the techniques which the scammers use. They are particularly adept at exploiting trust-based and long-standing relationships, for instance with suppliers you have dealt with for years, and professionals like attorneys, accountants and financial advisors etc.
3. Most importantly, perhaps, given the current attitude of our courts, is to always verify payment details via contact with your creditor through another communication system. As our courts have pointed out, “a simple telephone call” can be enough to avoid falling victim to fraud.

If you need help reviewing your fraud prevention and payment verification procedures, please feel free to contact us. 

Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact us for specific and detailed advice.

© LawDotNews

“In defence of Madiba’s legacy, we will continue to wage a relentless war on corruption…” (President Cyril Ramaphosa)

You may have seen mention of the new amendment to the Prevention and Combatting of Corrupt Activities (POCCA) Act that imposes severe penalties for any failure to report corruption. If you did see it, you quite possibly thought “Doesn’t apply to me, I’m just a small business”.

Wrong! Let’s have a look at who the new law applies to, what it requires of you, the risk you run if you don’t pay it due attention, and how you should manage this new risk.

Who does the new reporting requirement apply to?

Not just big companies and multinational businesses. It applies not only to all members of “incorporated state-owned entities” but also to all persons and entities in the private sector. The definition here is very broad indeed, and it includes all types and sizes of businesses from sole trader up, all types of entity large and small, all companies, every “body of persons” and every “other legal person”.

In short, it applies to you!

What does it require of you?

Simply put, you must report any corruption or attempt at corruption. Of course, we all know what the common-sense definition of “corruption” is. If you need an exhaustive legal definition, we can certainly help you with that.

But in practice just be aware that it applies to any agreement or offer by an “associated” person (including employees, independent contractors and the like) to give anyone else any unlawful “gratification”. What’s more, “gratification” is so widely defined as to include every possible form of monetary or non-monetary advantage (or avoidance of disadvantage) you can think of. Naturally the agreement or offer in question must relate to an attempt to either obtain or retain a business advantage of some sort.

On another warning note, POCCA penalises not just active knowledge of corruption and wrongdoing, but also brings in concepts of “should have known” and “turned a blind eye”.

Put simply, you must report any form of “corruption”. Full stop.

What penalties apply?

In theory, the sky’s the limit here – unlimited fines and life imprisonment! In practice, courts will of course tailor the punishment to fit the crime. The bottom line: there are very clear indications that the authorities mean business, so beware.

How should you protect yourself?

The new law pulls no punches. But fortunately there’s a solid defence included in the new provision: to escape liability you only need to show that you “had in place adequate procedures designed to prevent” the corruption. There’s no definition of what this might entail, so it’s up to you to use common sense based on your particular business and circumstances. Local experts suggest that to be safe we follow the UK’s “Six Principles” – proportionality (procedures tailored to the level of your risk), top-level commitment, risk assessment, due diligence, communication, and monitoring and review.

Need help with drafting a corruption prevention protocol? Shout if we can help.

Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.

© LawDotNews

“It’s important to remember your competitor is only one mouse click away” (Doug Warner)

Your website, social media profiles, and other online platforms play a vital role in your business strategy and in staying ahead of your competition at all times.

However, it’s not just about marketing effectively. Ensuring compliance with regulations is equally crucial, although often overlooked.

Why is Compliance Important?

Compliance ensures that your business:

• Meets all legal requirements.
• Reduces risks associated with user engagement.
• Enhances your brand’s image.
• Builds trust and loyalty with users.
• Safeguards your reputation.
• Prevents unnecessary costs.

A Checklist for Website Compliance

Website compliance involves adhering to various laws, regulations, and standards governing online operations and content. Here’s what it entails:

• Legal Compliance: Your website must follow local, national, and international laws, covering online business, intellectual property, and consumer protection requirements.
• Accessibility Compliance: Websites should be accessible to people with disabilities, as mandated by some countries’ laws.
  
• Cookie Compliance: Inform users about cookies and obtain their consent before placing them on their devices, as required by many countries.
  
• Privacy Compliance: Comply with privacy regulations when collecting user data, such as POPIA in South Africa and (where applicable) GDPR in the EU.
  
• Security Compliance: Implement security measures like encryption and secure logins to protect user data and prevent unauthorized access.
  
• Content Compliance: Ensure content doesn’t violate copyright or trademark laws.
  
• Financial Compliance: Adhere to regulations for online payments and financial transactions if your website conducts such activities.
  
• Advertising Compliance: Ensure ads meet advertising standards and regulations to avoid deception or violation of laws.
  
• Terms of Service/Supply and Policies: Make legal documents clear, transparent, and legally sound for users to agree to.
• Industry-Specific Compliance: Some industries have specific regulations, like healthcare websites complying with health information privacy laws.

Integrate compliance into step 1 of your website’s development

Integrate compliance into the very earliest developmental stage of your website, focusing not only on content but also design and process. This ensures that your online presence remains compliant from the outset, reducing the risk of non-compliance issues down the line.

Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.

© LawDotNews

 “Owning one’s own business is an adventure – enjoy it every step of the way.” (From the SME Toolkit article referenced below)

First, three questions to ask yourself…

If you dream of going into business for your own account in 2023, ask yourself these questions before you get started –

1. Am I an entrepreneur? You have an amazing idea, you can’t wait to launch your new business, success and wealth beckon! But wait a second – are you really suited for the hurly-burly of entrepreneurship? It can be hugely rewarding, not just in the financial sense but also in terms of lifestyle and life satisfaction. But it also carries far more risk than the classic “9 to 5 employee” option, so think long and hard before choosing. There are many online quizzes to help you decide – try for example DeLuxe’s “Quiz: Are you ready to start your own business?” here.
2. What’s my plan? Without a plan you sail rudderless through some very treacherous and shark-infested waters. Start-up failure rates are high, but luckily there is plenty of advice available to help you plan your course. Read for example the Business Partners “Ten Simple Rules For a Successful Start-up” on SME Toolkit.
3. What legal entity should I use to trade? Don’t make the rookie mistake of setting sail in just any old boat. Starting off in the wrong entity and then having to change mid-stream will mean a lot of unnecessary expense, hassle and risk. Rather plan long term – ask yourself where you want your business to be in 5 or 10 years, how big it will be, what your exit plan will be and so on.

   We set out below some brief thoughts on the various alternatives available to you, but upfront professional advice, specific to your particular needs and circumstances, is a real no-brainer here.

   So, what are your choices?

…and four business vehicles to choose from

You have four main options –

1. A sole proprietorship (“sole trader”).  You are the business, trading for your own personal profit and loss, perhaps under a trading name such as “Syd Smith trading as ‘Syds Plumbing’”.
2. A partnership of 2 to 20 individuals or entities, pooling resources to carry on a trade, business or profession for a share of the profits.
3. A private company (“Pty Ltd”) with any number of shareholders. Controlled and administered by directors.
4. A trust (number of trustees and beneficiaries not restricted). There are various types of trust, with trustees controlling and managing trust assets and/or trading for the benefit of beneficiaries.

Note that you might be advised to combine one or more of these entities in a corporate structure, and that there are other specialised types of entity available to, for example, non-profit organisations (charities etc), professionals (lawyers, accountants, doctors etc) and the like.

The pros and the cons of each

Have a look at the illustrative table below for a summary of the advantages and disadvantages of each of these options.

Don’t forget the tax and estate planning implications!

Each of your choices carries with it a mixed bag of positives and negatives when it comes to both tax and estate planning implications. For an overview, have a look at SARS’ “Starting a business and tax” webpage, with a link to its “Tax Guide for Small Businesses” PDF.

That Guide is 102 pages long, and unless you are comfortable with the complexities involved, professional advice specific to your circumstances is again essential.

In a nutshell –

• Estate planning: You may be advised to use companies and trusts for tax-efficient and practical transfer of wealth to future generations, as well as for asset protection from creditors both before and after you die. Both companies and trusts are “perpetual” in the sense that they survive changes in directors/trustees (resignation, removal, retirement, insolvency, death etc), with potential multi-generational savings in estate duty and avoidance of the cost and delays inherent in deceased estate administration.
• Tax efficiency: Sole traders and partners are taxed at individual rates; trusts other than special trusts at a flat rate of 45%; companies at a flat rate of 27% (27% for years of assessment ending on 31 March 2023 and later, previously 28%) with 20% dividends tax when you take profits out. There are a host of other factors to take into account here, including aspects such as Capital Gains Tax inclusion rates, exclusions, exemptions, small business breaks and the “trust conduit principle” all being highly relevant to the ultimate question – will you be better off being taxed as an individual or will some form of corporate and/or trust structure be more tax efficient for you?

Take that professional advice!

Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.

© LawDotNews

“Strategy is the art of carefully selecting where a business applies its focus and resources in order to achieve its ultimate aim. A large part of the work is in selecting what not to do rather than what’s to be added.”

Strategic planning is an essential part of optimising your business for success. Without it you will drift rudderless, unfocused and wasting effort and resources with no clear destination in mind.

Jon Cherry’s article “The Four Strategies” on his Cherryflava website lists four key areas to consider – in combination, they will help drive your business forward, inspiring all the work, and the people, that hold your “North Star” vision close.

Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.

© LawDotNews

When company directors are locked in dispute, one of them may be tempted to cut off the other’s access to emails and to the business server – a tactic likely to have immediate and serious consequences for the director thus cut off.

Its appeal as a tactic to force the other director to the negotiating table is obvious, but the question is whether the director thus deprived has any legal remedy available to force immediate restoration of access.

A recent Supreme Court of Appeal matter saw a director in that exact position trying to get his access back urgently with a “spoliation order” application.

“Cut off his email and server access”

When the two directors fell out, one (let’s call him ‘A’) applied for liquidation of the company on the grounds of deadlock. Director B opposed this application, and, alleging that A had resigned his directorship, instructed the web hosting entity hosting the company’s server and email addresses to cut off A’s ‘email and company network/server access’ with immediate effect.

A, denying hotly that he had resigned, immediately applied to court for a “spoliation order” restoring his email and server access to him.

Spoliation – a quick and effective way to get back possession, but only if…

• The spoliation process is designed to stop disputing parties from taking the law into their own hands and provides a quick and effective way of regaining possession of something if you have been wrongfully deprived of it. It’s a quick and effective remedy because “[T]he injustice of the possession of the person despoiled is irrelevant as he is entitled to a spoliation order even if he is a thief or a robber. The fundamental principle of the remedy is that no one is allowed to take the law into his own hands”. In other words, you can get an immediate spoliation order without having to prove your right to possession of the thing – all you have to prove is the wrongful dispossession.
• So that would have been an ideal outcome for A, giving him immediate restoration of his access to his emails rather than having to fight his way slowly through a full trial proving his rights to email and server access. But it was not to be. His problem was that, in order get a spoliation order, one of the first things you must prove is that you were in “peaceful and undisturbed possession” of something.
• Now A would have been able to prove such possession if he had for example been wrongfully deprived of use of a company car or even of an “incorporeal” right to use property (such as “quasi-possession” of a right of access under a servitude). But he was unable to convince the Court that his email/server access fell into any such category.
• As the Court put it: “Thus only rights to use property, or incidents of occupation, will warrant a spoliation order.” A’s prior use of the email address and server was not an “incident of possession of movable or immovable property”, it is purely “a personal right enforceable, if at all, against [the company].”
• In a nutshell, A must now prove his legal right to email and server access – perhaps he will be advised to apply for an ordinary interdict, perhaps he will sue for damages and/or re-instatement, but whichever course he chooses he will need to accept the inevitable delays. In other words, if B’s tactic was to put immediate and substantial pressure on A in the short term it worked – at least for now.

Don’t however take any action like this without professional advice – it could come back to bite you badly if it misfires.

Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.

© LawDotNews

“A man who procrastinates in his choosing will inevitably have his choice made for him by circumstance.” (Hunter S. Thompson)    

Since 2005 businesses have been repeatedly told “get your PAIA (Promotion of Access to Information Act) manual sorted now, the deadline is approaching”. And every 5 years since then, those (mostly smaller) businesses temporarily exempted from lodging manuals have been given yet another extension – usually at the very last minute.

“Crying Wolf” again?

With government “Crying Wolf” so often, small business owners can certainly be forgiven for treating this whole process with a great deal of scepticism. Perhaps though this deadline is one to take seriously, particularly since the related POPIA (Protection of Personal Information Act) is now fully in place and new PAIA Regulations have been promulgated to tie in with POPIA.

What businesses are currently exempt?

PAIA itself requires all public and private bodies to prepare, lodge and publish (including on any website you have) a PAIA information manual.  Every business operation, no matter how small, falls into that net – the definition of “private body” includes any person or partnership who carries on or has carried on “any trade, business or profession”, together with any “former or existing juristic person” and political parties.

In other words, all businesses of all types and sizes must have a PAIA manual once the current exemption comes to an end.

You are probably currently exempt if you are a smaller business, specifically a “private body”, including any private company.

But the exemption does not apply to any non-private company, nor to any private company in any of the business sectors listed below with either –

• 50 or more employees, or
• An annual turnover of or above specific thresholds – see the table below for details.

Do your Manual now anyway!

Even if the deadline is once again extended, you will almost certainly still have to comply somewhere down the line, and at least by getting this done now you have got rid of one annoying little red tape item from your Action List. Procrastinating, as Hunter S Thompson pointed out, just means having the choice made for you down the line.

Prepare your PAIA manual now; if you already have one, update it regularly.

Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.

© LawDotNews

Bizly’s “Start a business: How to get going fast, the lean start-up way” here shares some ideas for “action planning using rapid, feedback loops to get the business off the ground quickly and with minimal risk.”  Answer 6 preliminary questions, complete a one-page business plan, and prepare for launch!

Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.

© LawDotNews

Learn how to –

• “Build a virtual board table” (“creating a virtual seating arrangement” and so on),
• “Mitigate meeting day glitches” (we’ve all wasted time on fiascos!), and 
• “Keep it confidential” (paramount).

Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.

© LawDotNews