You Are the Target: How Proofpoint Essentials Protects South African SMEs from Business Email Compromise
Why one convincing email is now the biggest cyber risk for small businesses, and what a people-centric defence looks like
In 2019 a Johannesburg homeowner received an email from her conveyancing attorneys with the bank details for the final payment on her property. The email looked right and the timing was right, so she paid R5.5 million. The email wasn't from her attorneys. Criminals had got into her email account, watched the conversation and swapped in their own banking details. The money was gone.
That case, Hawarden v Edward Nathan Sonnenbergs, went all the way to the Supreme Court of Appeal. It's one of South Africa's best-known examples of business email compromise (BEC), but the same basic trick hits SMEs across the country every week. Ask any attacker where the easiest way into a business is, and the answer won't be a firewall. It'll be an inbox. Email is the source of more than 90% of malware attacks, and around 95% of cybersecurity issues can be traced back to human error.
What is business email compromise?
BEC is a form of fraud where criminals impersonate someone you trust, such as a supplier, your CEO, your attorney or a client, to trick you into sending money or sensitive information. Unlike most cyberattacks, a BEC email often contains no malware, no dodgy attachment and no suspicious link. It's just a well-written message with a plausible request. That's exactly why so many email filters let it through, and why BEC now accounts for more than half of all cybersecurity losses.
The most common forms we see in South Africa are:
Invoice and supplier fraud. A "supplier" says they've changed banks and asks you to update their details before the next payment. The email may come from a look-alike domain or from the supplier's real, hacked mailbox.
CEO or executive fraud. An urgent message from "the MD" asks finance to make a confidential payment today, often while the real executive is travelling.
Property and conveyancing fraud. Criminals target the large, predictable payments in property transfers, intercepting emails between buyers, sellers, agents and attorneys.
Payroll diversion. An "employee" asks HR to change the account their salary is paid into.
Account takeover. Attackers phish a Microsoft 365 or Google login, then quietly read the mailbox for weeks, learning who pays whom and when, before striking from a genuine address.
AI-assisted impersonation. SABRIC warns that criminals now use AI to write error-free phishing emails and WhatsApp messages, and to clone voices for deepfake calls that "confirm" a fraudulent request.
BEC rarely travels alone. The same inboxes are targeted by ransomware, advanced phishing (malicious links hidden in complex redirect chains, QR codes and fake support-line scams) and data loss. More than two-thirds of a typical organisation's intellectual property travels by email, so one misdirected or unencrypted message can mean fines, bad press and lost customer trust.
The numbers: why this matters in South Africa
The Number | What it Tells Us |
R1.888 billion | Digital banking fraud losses in South Africa in 2024, up 74% on 2023 (SABRIC). |
97,975 | Reported digital banking fraud incidents in 2024, an 86% jump in one year. SABRIC says each one involved criminal's exploiting human error through social engineering, not technical hacking. |
143,600 | Commercial crime cases recorded by SAPS in 2024/25, almost double the 76,744 of 2013/14. |
1 in 3 | South African SMEs that have fallen victim to a cyberattack (SHA Risk Review). |
US$250,000+ | Average cost of a cyberattack for a small business, with 1 in 3 small businesses hit in 2024 (Proofpoint). |
26% | South African commercial entities with cybercrime insurance. SMEs lag furthest behind (Santam). |
US$3.05 billion | Global BEC losses reported to the FBI in 2025 alone, from 24,768 complaints: an average of about US$123,000 (roughly R2 million) per incident. |
66 million | Targeted BEC attacks Proofpoint detects every month worldwide. |
INTERPOL's 2025 Africa Cyberthreat Assessment found that BEC incidents rose significantly across the continent, driven by organised syndicates, and South Africa recorded the highest number of ransomware detections in Africa. SABRIC's latest report specifically calls out criminals "impersonating CEOs or suppliers to trick companies into making payments" and intercepting invoices to change banking details. SAPS doesn't publish BEC as a separate crime category, and many businesses never report an incident, so the true local figure is almost certainly higher than any single statistic shows.
Why SMEs, and why built-in security isn't enough
Big corporates have treasury teams, layered payment approvals and dedicated security staff. Criminals know most SMEs don't. The gaps we see time and again include:
One person does everything. The same person receives invoices, loads beneficiaries and releases payments.
Email is trusted for money matters. Bank details are routinely sent and changed by email, and nobody picks up the phone to check.
Accounts without multi-factor authentication. A single stolen password gives an attacker full access to a mailbox.
"It won't happen to us." Santam's research found SMEs lag furthest behind on cyber insurance, partly because many owners believe they're too small to be targeted.
Microsoft 365 and Google Workspace are excellent platforms, and their popularity is exactly what makes them a prime target. Their native security relies largely on traditional techniques such as IP reputation, volume analysis and signature-based antivirus. That's a solid baseline for spam and known malware, but it struggles with a plain-text message from a look-alike domain or a compromised supplier. The answer isn't to replace the platform you already use. It's to add a dedicated security layer on top of it.
Who carries the loss? What South African courts have said
Many business owners assume the bank, supplier or attorney will cover a BEC loss. South African case law shows it's far from guaranteed:
Hawarden v ENS. In 2023 the Johannesburg High Court held the law firm liable for the R5.5 million. In June 2024 the Supreme Court of Appeal overturned that ruling, finding the firm owed her no legal duty. She had previously been warned about exactly this risk and could easily have verified the details, so she bore the loss herself.
Gerber v PSG Wealth Financial Planning. In 2023 the High Court ordered PSG to repay a client roughly R800,000 after a fraudster hacked the client's email and instructed a withdrawal, finding PSG had a contractual duty to use appropriate procedures and technology to prevent fraud.
Fourie v Van der Spuy and De Jongh Inc. Transfer attorneys were held liable after R1.74 million was paid into a fraudster's account, because they hadn't exercised the diligence required given how common this fraud had become.
Whether you can recover a loss depends on contracts, warnings and the specific facts, and litigation is slow and expensive. POPIA also requires reasonable security measures to protect personal information, so a compromised mailbox can create regulatory problems on top of the financial loss. Prevention is far cheaper. (This is general information, not legal advice.)
How Proofpoint Essentials stops BEC and other email threats
Proofpoint Essentials brings enterprise-grade email security to smaller organisations. It's powered by the same AI platform, Proofpoint Nexus, that protects 85% of the Fortune 100 and more than two million customers worldwide. Nexus learns from the more than 3.5 billion emails Proofpoint scans every day, combining behavioural AI, relationship graphs, machine learning, computer vision and semantic analysis to stop 99.99% of email threats, spam and graymail before, during and after delivery.
Because BEC emails often carry no malicious payload, Proofpoint looks at who is sending, how, and whether it fits normal behaviour:
Advanced BEC Defence: AI and machine learning, trained on trillions of data points, that detect impostor tactics such as look-alike domains, display-name spoofing and header manipulation, with no complex configuration.
Email warning tags: clear banners on risky messages, like a first-time sender or an external email pretending to be internal, so staff think twice before acting.
Automated remediation: malicious messages that use time-delay tricks or slip past the first layers are pulled from every inbox automatically, even after delivery.
Advanced threat protection: URL and attachment sandboxing that safely detonates suspicious content before it reaches users, stopping ransomware at the front door.
Data loss prevention and encryption: sensitive information such as banking details, financial or health data is detected and encrypted automatically. Users can also encrypt a message by adding a tag to the subject line, and recipients read it through a secure web portal.
And because Essentials is a complete platform rather than a spam filter, it also covers:
Email continuity: if your email provider goes down, users keep working through an emergency inbox for up to 30 days, so staff don't fall back on personal email.
Email archiving: unlimited storage and up to 10 years of retention, with legal hold, e-discovery and self-service search from Outlook or a browser.
Social media protection: monitoring of your business social accounts for malicious links and abuse.
Turning employees into your last line of defence
SABRIC's data is clear: social engineering, not technical hacking, drives the losses. Technology can't stop everything, which is why training matters. Proofpoint Essentials Security Awareness delivers the right training to the right people at the right time. Realistic phishing simulations, drawn from Proofpoint's own threat intelligence and refreshed every week, show who is most at risk. Anyone who falls for a simulated attack gets instant "just-in-time" coaching and can be enrolled in follow-up training automatically.
Modules take five to fifteen minutes, work on any device, are available in more than 35 languages and meet accessibility standards. Clear reporting shows how behaviour improves over time, and organisations using this approach can reduce successful phishing attacks and malware infections by up to 90%.
Every employee should know the classic BEC red flags:
A request to change banking details, especially close to a payment date.
Urgency, secrecy or pressure: "Please do this before 3pm and keep it between us."
A sender address that's almost right, or a "reply-to" that goes somewhere different.
A request that bypasses normal process or arrives through an unusual channel.
A voice call or WhatsApp voice note "confirming" a request that arrived by email.
Back it up with a secure payment process
Verify every banking detail change by phone, using a number you already have on file, never one from the email.
Use your bank's account verification service before paying a new or changed beneficiary. Most South African banks offer one.
Require two people to approve payments above a set amount, and for any new beneficiary.
Tell customers and suppliers that you will never change your banking details by email. The Hawarden judgment shows that warnings matter.
Switch on MFA and email authentication. Multi-factor authentication on every mailbox, plus properly configured SPF, DKIM and DMARC, makes it much harder for criminals to take over accounts or spoof your domain.
Simple to deploy, easy to manage
Getting started doesn't require a big IT project. For Microsoft 365, the API-based deployment takes just a few clicks and doesn't require changing your MX records. For other providers, including Google Workspace, a gateway deployment routes mail through Proofpoint before it reaches your users. Everything is managed from a single interface with sensible out-of-the-box policies, so it really can be "set it and forget it".
Consolidating email security, BEC defence, encryption, archiving, continuity and training with one vendor also means fewer contracts, fewer consoles and lower overall cost. With a single BEC incident costing an average of around R2 million globally, preventing one attack can pay for protection many times over.
If you think you've been hit
Call your bank immediately. The sooner the bank can try to stop or recall the payment, the better the chance of recovery.
Change passwords and enable MFA on affected mailboxes, and check for hidden mail-forwarding rules attackers often set up.
Preserve the evidence. Keep the emails, including full headers, and payment records.
Report it to SAPS and tell affected suppliers or clients.
Consider your POPIA obligations. If personal information was accessed, you may need to notify the Information Regulator and the people affected.
Don't wait for the R5.5 million email
Business email compromise works because it targets people, trust and busy days, not software. A simple verification process, trained staff and Proofpoint Essentials' BEC-specific protection close most of the gaps. If your business pays suppliers, runs payroll or handles client funds by email, and relies on Microsoft 365 or Google Workspace's built-in security alone, talk to the IHuman Hub team. We can run a threat assessment to show what's getting through today and help you put the right protection in place.
Sources
SABRIC Annual Crime Statistics 2024: https://www.sabric.co.za/wp-content/uploads/2025/09/CRIME-STATISTICS-REPORT-2024.pdf
FBI IC3 2025 Internet Crime Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
INTERPOL 2025 Africa Cyberthreat Assessment: https://www.interpol.int/en/News-and-Events/News/2025/New-INTERPOL-report-warns-of-sharp-rise-in-cybercrime-in-Africa
Edward Nathan Sonnenberg Inc v Hawarden [2024] ZASCA 90: https://www.saflii.org/za/cases/ZASCA/2024/90.html
Gerber v PSG Wealth Financial Planning [2023] ZAGPJHC 270: https://www.saflii.org/za/cases/ZAGPJHC/2023/270.html
De Rebus, The dangers of business e-mail compromise: https://www.derebus.org.za/the-dangers-of-business-e-mail-compromise/
Daily Maverick, commercial crime (March 2026): https://www.dailymaverick.co.za/article/2026-03-22-how-commercial-crime-quietly-became-sas-most-dangerous-growth-industry/
IOL, One in three SMEs fall victim to a cyber attack: https://iol.co.za/business/advice/2025-01-28-south-african-smes-at-risk-one-in-three-smes-fall-victim-to-a-cyber-attack/
Proofpoint 2024 State of the Phish: https://www.globenewswire.com/news-release/2024/02/27/2835744/35374/en/Proofpoint-s-2024-State-of-the-Phish-Report-68-of-Employees-Willingly-Gamble-with-Organizational-Security.html
Proofpoint, Why choose Proofpoint Essentials as your Microsoft security partner (2025), plus Essentials Email Archive, Email Encryption and Security Awareness datasheets. https://www.proofpoint.com
Comments