How omission of basic email authentication controls may create delictual risk
In our previous blog, “Where Delict and Cyber Security Meet”, we explained the importance for businesses, policymakers and individuals alike to examine how delict principles apply in the digital realm. Here we provide a scenario analysis of how a delict may take shape:
Scenario Overview
Criminals use email to impersonate trusted organisations and trick recipients into sharing information or making payments. Domain spoofing means forging the sender’s domain to make an email appear to come from a legitimate organisation.
DMARC works with SPF and DKIM to help receiving mail systems identify emails that falsely use your domain. It also lets you specify how those systems should handle messages that fail DMARC checks. For example, you can ask them to send these messages to spam or reject them.
Without an enforcing DMARC policy, your domain may offer impersonators an opportunity to misuse your organisation’s identity. This scenario shows how that can affect your business and its customers.
The Incident
- The Email
Jane receives an email that appears to be from ABC Insurance Brokers (a Category 1 FSP), and a reputable business she knows and trusts. The sender’s domain looks authentic, with no spelling errors or inconsistencies. Confident that the email is legitimate, Jane opens it. - The Attachment
The email asks Jane to open an attachment to update her client details. However, opening it triggers malicious code on her computer. First, it steals personal and client data and then it installs ransomware that locks her files. - The Impersonation
Jane does not realise that a cybercriminal sent the email using ABC Insurance Brokers’ domain to impersonate the company. The broker had no enforcing DMARC policy to tell receiving mail systems to quarantine or reject emails that fail DMARC checks.
The Legal Perspective: Delictual Liability
Jane considers legal action against ABC Insurance Brokers. She argues that its failure to implement an enforcing DMARC policy contributed to her loss. Her claim would need to satisfy each element of delictual liability.
- Conduct
Jane could identify the broker’s failure to implement an enforcing DMARC policy as an omission, meaning a failure to act. However, identifying an omission does not, by itself, establish liability. - Wrongfulness
To establish wrongfulness, Jane must show that ABC Insurance Brokers’ omission violated a legal duty to protect its customers and stakeholders from foreseeable harm. In this case, Jane’s personal information and computer system was compromised. The question would be whether a legal duty existed to implement reasonable email authentication controls, given the known and documented risk of domain spoofing. - Fault
Fault would be assessed based on negligence. Jane’s legal team could argue that ABC Insurance Brokers failed to exercise reasonable care by neglecting to implement a fully compliant DMARC policy, despite its well-known and widespread use in preventing domain spoofing. Given the widespread recognition of DMARC, SPF, and DKIM as standard email authentication mechanisms, a court could consider whether failure to implement them fell below a reasonable standard of care. - Harm
Jane must show that she suffered legally recognised harm or loss. Depending on the evidence, this could include:
– Lost income while her business cannot operate
– Costs to restore data and systems
– Stolen funds
– Financial losses from misuse of personal data - Causation
Jane must establish a causal link between the broker’s omission and her loss. A court would consider whether a properly configured, enforcing DMARC policy would probably have prevented the harmful email from reaching her. This assessment would depend on the evidence, including how her receiving mail system would have handled the message.
Key Considerations for Businesses
This scenario highlights the legal (and reputational) risks businesses may face when they fail to secure their email domains adequately. Organisations can materially reduce direct email spoofing risk by implementing an enforced DMARC policy. This will prevent unauthorized entities from sending emails on behalf of the company’s domain. For domain-owning organisations, DMARC has become one of the foundational email authentication controls.
Conclusion
This scenario analysis underscores the growing intersection of delict and cyber security. A failure to adopt reasonable preventive measures may expose an organisation to legal scrutiny where harm results. By understanding their legal obligations and proactively securing their digital infrastructure, businesses can avoid such liability. This will protect their stakeholders, and foster trust in their operations.
The cost of negligence in the digital age extends far beyond financial damages. It erodes credibility and exposes businesses to legal scrutiny. Implementing baseline authentication controls such as DMARC may increasingly be viewed as part of an organisation’s reasonable standard of care in digital communications.
Organisations should assess their email authentication posture and ensure alignment with evolving legal and regulatory expectations.
ARMD.digital provides structured DMARC implementation and visibility reporting to support this process.
