Legal Recourse for Scams: Protecting SMEs in a Digital Age

The Rising Threat to SMEs

Despite the recent uptick in cyber security incidents, reported financial losses declined to $5.7 million, down from $7.8 million the previous quarter. While this reduction offers some reassurance, the number of incidents demonstrates how vulnerable individuals and businesses remain in today’s digital economy.

The Human Factor in Cyber Attacks

The report highlights the persistence of social engineering tactics. Cyber criminals are increasingly contacting helpdesks, posing as staff members to gain access to accounts. As Mike Jagusch of the NCSC explained, “They use social engineering techniques to sound more convincing. This might be using a sense of urgency, appealing to authority, or tricking you into feeling sympathy towards them”.

Such attacks exploit human behaviour rather than technical weaknesses. For SMEs, this creates significant risk, as limited resources often mean training and monitoring are not as robust as in larger organisations. The legal consequences of a breach can also be severe, particularly if customer or employee data is exposed.

Legal Recourse for Scams: What It Means for Businesses

The phrase legal recourse for scams goes beyond recovering financial losses. It encompasses a range of legal issues including:

• Contractual obligations: Businesses must consider whether they remain liable to customers if data is lost or services are disrupted.
• Privacy compliance: Under the Privacy Act, organisations are required to protect personal information. A failure to do so can lead to complaints, investigations, and penalties.
• Employment responsibilities: If employees are implicated, whether through negligence or misuse of systems, employers may face complex questions of liability and discipline.
• Insurance disputes: Many SMEs discover too late that their policies contain exclusions for cyber incidents, leading to disputes over coverage.

Understanding these legal dimensions is crucial. An incident that begins with a scam email or a fraudulent phone call can escalate into contractual disputes, regulatory investigations, and reputational damage.

Why Estate and Commercial Planning Matters

Although cyber fraud may seem unrelated to broader business planning, it intersects with how enterprises manage risk and continuity. Just as individuals turn to estate planning to secure their legacy, businesses must proactively plan for the possibility of cyber threats. Strong governance, clear policies, and legal frameworks can help shield SMEs from the full fallout of online scams.

Building a Legal Safety Net

SMEs are the backbone of New Zealand’s economy, yet they are increasingly in the crosshairs of sophisticated cyber criminals. As the NCSC warns, awareness alone is not enough—practical steps and clear planning are essential. For businesses, this includes knowing what legal recourse for scams is available when prevention falls short.