Banking Scams in South Africa and How to Protect Your Money

Banking scams in South Africa

Imagine this hypothetical situation: someone calls to warn that money is being stolen from your account. They sound organised, understand banking terminology and tell you to act quickly. You open your genuine banking app, follow their instructions and approve a transaction. You believe you are protecting your savings.

You have actually paid the person deceiving you.

That possibility exposes a difficult problem for customers and banking professionals alike. A security process can establish that an instruction came through an authenticated channel without explaining whether the person giving it understood the truth about the transaction.

Banking scams are therefore not only a question of stolen passwords or unsafe websites. They are also a question of trust: who created it, what the customer believed, where the money went, and whether anyone had a realistic opportunity to interrupt the deception.

This guide explains the South African risks, the practical checks that can help, and the questions that matter when a loss is investigated. It is for individuals protecting their savings, businesses authorising payments, and banking professionals concerned with prevention and fair outcomes.

What the South African figures show

SABRIC’s 2025 annual report records 110,074 digital banking incidents and approximately R2.41 billion in gross losses, compared with 97,547 incidents and R1.86 billion in 2024. The loss amount increased by approximately 29.2%.

Banking apps accounted for 70.5% of the 2025 digital claim value. That does not mean the apps were necessarily hacked: the report describes fraud beginning outside the platform through deception and manipulation.

The figures represent client claims and investigations reported by participating institutions. They are not a count of unique victims, a complete total for every South African institution, or the amount finally left unrecovered after refunds and other recoveries. They cover 2025, not the whole of 2026. SABRIC Annual Crime Statistics 2025, pages 6 and 7.

The Banking Association South Africa also reports that card fraud losses rose by 18% in 2025, to approximately R1.7 billion. These categories should not simply be added together and presented as a national scam total without establishing their coverage and possible overlap. BASA report announcement.

The scale warrants attention. The numbers do not, however, tell us that every bank has the same exposure or that a particular bank is safer than another.

Account takeover and payment deception are different

In an account takeover, someone gains access and operates banking facilities without the customer’s intended instruction. The investigation needs to establish how access was obtained, which devices were involved and what authentication occurred.

In a payment made under deception, the customer may personally create or approve the payment. The falsehood concerns its purpose, the beneficiary or the underlying deal. The customer could be paying an impersonator, a nonexistent supplier or a fake investment while using genuine banking facilities.

Card misuse, wallet enrolment, identity theft and debit order abuse raise further questions. More than one mechanism can appear in the same incident.

These distinctions matter because the response must fit the exposure. Blocking a card is not the same as securing a compromised banking profile. Changing a password does not recover a transfer already made. Identifying an approval does not, by itself, explain the full circumstances of a disputed loss.

The fake bank fraud department

One particularly troubling approach turns a person’s wish to prevent fraud into the reason they make a fraudulent payment.

Absa warns about callers who claim an account is compromised and instruct customers to open another account and transfer money. It expressly warns against this supposed protective arrangement. Absa vishing warning.

Capitec describes another version: customers are coached into payments supposedly intended to reverse fraud or refund unauthorised debit orders. Instructions can include scanning a QR code, sending cash or switching off notifications. Capitec scam guidance.

The decisive question is not whether the caller sounds like a banker. It is what they are asking you to do.

If a supposed fraud official wants you to transfer money, create an unfamiliar beneficiary or approve a transaction you did not independently intend, stop. End the call and contact the bank through its app or an independently obtained official number. Do not use the number or link supplied during the suspicious conversation.

Banks do contact customers. The useful rule is not that every bank call is fraudulent; it is that an incoming caller must not control both the alarming story and the route you use to verify it. We look at this tactic in more detail in bank impersonation scams.

Auto diallers and robocalls

The first voice you hear may not belong to a person speaking live. Automated calling can be part of ordinary business communication, unwanted marketing or a scam. Those are different situations.

An auto-dialler places calls automatically and may connect an answered call to an agent. A robocall delivers a recorded message; an interactive menu may then ask for a keypad response. The US Federal Trade Commission describes robocalls and publishes recorded examples of impersonation scams. These are technical explanations and overseas examples, not evidence of South African frequency or South African legal rules. FTC robocall examples.

Dialling automation is also different from caller-number spoofing, which disguises the number displayed, and from AI-generated or cloned speech. A scam can combine them, but a recorded voice does not establish that AI is involved.

The recorded fraud warning

An overseas example shows the banking risk clearly. On 3 February 2025, Natco Credit Union in the United States warned that members had received automated calls appearing to come from its own number. The message claimed an attempted purchase and instructed recipients to press 1 if it was not theirs. The credit union identified the calls as a scam. This is a documented US incident, not a confirmed incident at a South African bank. Natco automated phone scam warning.

Consider a hypothetical continuation: a recording announces a suspicious payment, then directs you to a supposed fraud specialist. That person asks for an OTP or tells you to approve a payment to stop the loss. Moving from a recorded announcement to a live operator does not independently authenticate either stage.

Automation can make the contact look like an established bank process. It can also separate the alarming opening message from the person who asks for the damaging action. The request still needs the same independent checks as a live impersonation call.

South African bank warnings document phone impersonation and caller-number spoofing, but they do not establish how many local banking losses began with robocalls. No South African robocall-specific loss figure is claimed here. Standard Bank phone impersonation and spoofing warning.

Silence and keypad prompts are not proof

A brief silence or a call that disconnects can result from a call-centre dialler rather than deliberate targeting. UK regulator Ofcom explains this distinction. A silent call alone does not establish that your bank account has been compromised. Ofcom explanation of unwanted and silent calls.

Likewise, a menu asking you to press a number is not, by itself, proof of a scam. Do not use the professional sound of the menu as proof that it is genuine either.

If an unexpected recording claims a banking emergency, do not enter confidential information or follow its transfer instructions. End the call and check through your bank’s app or independently obtained official contact details. For a suspicious robocall, do not rely on its keypad option to unsubscribe or reach a verification team. The FTC warns that responding to unwanted robocall prompts can lead to further calls. FTC robocall guidance.

Call blocking and spam labels may help reduce interruptions; they are not an identity guarantee. Retain the call time, displayed number and message details if you need to report the incident. A displayed number may be spoofed, so avoid publicly accusing its genuine owner on that evidence alone.

Unwanted marketing and South African privacy rules

Unwanted marketing is not automatically banking fraud. South Africa’s Information Regulator guidance addresses automatic calling machines under POPIA’s electronic direct-marketing provisions. Consent requirements, a conditional existing-customer exception and opportunities to object matter; it is inaccurate to say that every automated call is illegal. These marketing provisions do not determine whether a particular fraud alert is genuine. Information Regulator direct marketing guidance, sections 7.2 and 7.3.

For suspected banking fraud, contact the bank urgently. For persistent unwanted marketing or misuse of personal information, use the identified business’s independently verified complaints route and the Information Regulator’s guidance, rather than assuming the bank’s fraud team handles every nuisance call.

Read what an approval actually authorises

A one-time password, or OTP, is not a general certificate that a conversation is safe. Nor is every app notification asking you to approve the same thing.

An instruction might concern a payment, a new beneficiary, a device, a card linked to a wallet or a debit order mandate. Before approving it, establish the actual action, recipient and amount where applicable.

Do not let someone else’s explanation override the transaction displayed by the bank. If a caller says you are cancelling fraud but the screen is asking you to authorise a payment, that discrepancy needs independent verification.

Keep passwords, PINs and OTPs private. But also recognise the wider risk: a person can be deceived into operating their own account without ever reading an OTP aloud. The protection must include understanding the instruction, not only protecting the code.

Fake statements and login pages

FNB warns about imitation banking communications and payment confirmations that lead to fake login pages and requests for credentials or OTPs. FNB scam explanations.

The message may arrive by email or SMS and appear to concern something plausible: a payment, statement, blocked account or update to records. Phishing uses deceptive communications to obtain information; smishing is the SMS version.

Open banking independently rather than signing in through an unsolicited message. A familiar logo or sender display name does not establish who is behind the request. A website padlock indicates an encrypted connection, not that the business operating the website is trustworthy.

The same principle applies to supposed requests to update customer information. A legitimate need to maintain records does not make a particular message genuine. Check the requirement through the bank’s own channel before disclosing documents or details.

Remote access and screen sharing

Absa warns against downloading remote-access software or allowing someone to control your device. Absa phishing guidance.

A support tool can be legitimate software and still be used for a fraudulent purpose. Be particularly cautious when an unsolicited caller asks you to install an app, share your screen or open banking while they guide you.

If a suspicious person is controlling your device, stop the session and disconnect it from the network if necessary. Contact the bank using a separate trusted device where possible. Secure affected accounts and obtain appropriate technical help.

Preserve useful evidence, but do not delay stopping ongoing access just to collect screenshots. Changing credentials while the same person can still observe or control the device may leave the underlying problem unresolved.

SIM swaps and stolen phones

Standard Bank explains how control of a mobile number can be combined with compromised banking information in a SIM-swap scam. Unexpected loss of service or missing security messages can be warning signs. Standard Bank consumer scam guidance.

A network outage is not proof of fraud. But unexplained loss of service alongside suspicious banking activity deserves urgent checks with both the network and the bank. Restoring your mobile connection does not establish that banking access has been secured.

A stolen phone also requires more than replacing the handset. Ask the bank about removing the device and securing relevant facilities. Absa, for example, provides device-management guidance for unlinking a lost or stolen phone. Absa app guidance.

Protect the device lock and email account as well as banking credentials. Know how you would contact your bank if your usual phone were unavailable. After a theft, ask whether unfamiliar devices, beneficiaries or transactions appeared.

Digital wallets and virtual cards

Standard Bank describes fraud in which stolen card information is linked to a wallet on someone else’s device, with authentication obtained at enrolment. That initial linking step must be distinguished from subsequent purchases. Standard Bank wallet scam guidance.

Virtual cards raise a related but separate issue: who created the card and how its creation and use were approved. These technologies should not be treated as inherently fraudulent or as immune to fraud.

Report an unfamiliar card or wallet enrolment promptly. Ask which device, card or token is involved and what must be disabled. An investigation should reconstruct enrolment and use rather than looking only at the final debit.

Nedbank also warns about false courier and Post Office messages requesting payment to release a parcel. Nedbank parcel scam warning. A small advertised fee is no reassurance about the risk of submitting card details. Verify a delivery through an independently obtained tracking channel; if you have already disclosed details, contact the bank rather than waiting for a larger transaction.

Supplier payment diversion and invoice fraud

For businesses, one of the most important checks concerns changes to a known supplier’s bank details.

Nedbank’s fraud awareness booklet describes intercepted communications and altered invoices. Its guidance is to verify changes independently using contact information already held for the supplier. Nedbank fraud awareness booklet.

Consider a hypothetical invoice that matches a genuine purchase in every respect except the beneficiary account. The amount is expected, the supplier name is familiar and the payment is due. Checking only the commercial details leaves the substituted account untested.

Replying to the same email thread is not an independent check if that conversation has been compromised. A telephone number printed on the changed invoice is also part of the claim being verified.

Use a previously verified contact. Record the confirmation and separate the person changing beneficiary details from the person approving payment. Exceptional urgency should trigger more scrutiny, not permission to abandon the process.

Standard Bank’s business guidance discusses account verification services alongside independent confirmation of changed details. Standard Bank business fraud guidance.

An account verification result is useful, but answer the right question with it. A matching account name does not independently prove that an invoice is genuine or that the recipient is entitled to that payment. Verification of the account belongs inside verification of the transaction. For a worked example, read The invoice was genuine. The bank account wasn’t.

Fake proof of payment and suspicious refunds

FNB warns about payment confirmation and refund scams. FNB payment and refund guidance.

Do not release goods or issue a refund solely because someone has sent a screenshot, PDF or email claiming payment. Check through banking records. If an unexplained overpayment appears, investigate before returning it, especially if the proposed refund destination differs from the original payer.

An unfamiliar credit is not an invitation to move money on someone else’s instructions. Ask the bank how to handle a suspicious payment. That precaution protects against turning a business into an intermediary in another person’s loss.

Debit orders and DebiCheck

Not every debit order follows the same approval process. PASA distinguishes DebiCheck, Registered Mandate and EFT debit orders. DebiCheck involves electronic customer confirmation with the bank; the other streams differ. PASA debit payment explanation.

PASA’s FAQ says a bank will not send a link or request a card PIN or password for DebiCheck approval. PASA debit order FAQ.

Query unfamiliar deductions promptly. Ask which payment stream applied, who the collector is and what mandate supports the collection. Follow the applicable dispute procedure and time limits rather than assuming every debit can be reversed in the same way.

Stopping a collection and cancelling the underlying contract are different matters. A dispute should establish what was agreed, not merely whether a deduction is inconvenient.

Investments and relationships that turn into payments

In October 2025, the FSCA warned about people impersonating Capitec Bank and misusing its identity and genuine financial services provider number to promote purported investments. FSCA Capitec impersonation warning.

Finding a real licence number is therefore not enough. Establish that you are actually dealing with the licensed institution or representative and that the proposed service is legitimate. Contact the genuine institution independently.

The payment route is not an endorsement. Money sent to an account at a recognised bank can still be money sent to a scammer.

Capitec’s guidance also covers romance scams that build a relationship before requesting money, and job scams that seek upfront payments or confidential information. Capitec social media scam guidance.

In these situations, securing the banking app is only part of prevention. The person or opportunity behind the payment must be checked. A genuine transfer can fund an entirely false relationship, job or investment.

Someone worried about a friend’s payments should offer calm help with independent checks, rather than humiliation. The objective is to create room to reconsider the story and stop further loss. See also fake investment and trading apps and romance scams.

Money mules and identity misuse

The NFO’s April 2026 warning highlights account misuse, fraudulent credit applications and consequences including restrictions on accounts. NFO money mule and credit application warning.

Do not lend an account, bank card or banking access to someone else. Treat an offer to receive and forward money for a fee as a serious warning, not an ordinary side income. If someone asks you to move an unexpected credit, contact the bank first.

For investigators, receiving accounts matter as much as the first deceptive message. But an unusual transaction does not automatically establish that an account holder knowingly committed a crime. Account restrictions, a fraud allegation and a criminal conviction are different things.

If your identity has been misused, report it to the affected institution and SAPS. SAFPS offers free Protective Registration, intended to prompt additional identity checking by participating members. It is a protective measure, not a universal credit freeze or guarantee against further fraud. SAFPS Protective Registration.

SARS messages and physical banking scams

SARS maintains warnings about fake communications and requests for confidential information. Verify an apparent tax problem through independently accessed official channels instead of entering credentials through a message. SARS scam information.

SARB separately warns against stories involving supposed private accounts at the Reserve Bank, lottery releases and clearance documents requiring fees. Official-looking language does not make such a demand genuine. SARB fraud guidance.

Physical cards still need protection. Capitec warns about ATM distraction, card swapping, skimming and PIN exposure. Capitec card and ATM guidance. Shield the PIN, reject unsolicited assistance and report a missing or retained card promptly. Do not confront a suspected criminal or put personal safety at risk to retrieve a card.

AI makes identity checks more important

Standard Bank’s March 2026 warning describes AI-assisted impersonation alongside caller-number spoofing and other deception. A displayed bank number is not sufficient proof of the caller’s identity. Standard Bank AI and spoofing warning.

This warrants caution, not an unsupported claim that AI explains most South African banking losses. The warning does not quantify its national contribution.

The practical response is a verification process that does not depend entirely on appearance or familiarity. Use a known callback route. Independently confirm unusual instructions. Give a second approver enough information to challenge a transaction. Do not rely on spelling errors to identify fraud or on a convincing voice to establish legitimacy.

Auto-dialling and recorded messages do not require AI. Treat the method of placing the call, the displayed identity and the voice content as separate parts of the verification problem.

Two Ombud cases show why evidence matters

A virtual card claim that did not result in reimbursement

In an August 2025 account, the National Financial Ombud Scheme South Africa described a customer deceived by a caller posing as a bank official. Banking credentials were disclosed, virtual cards were created and purchases totalling R500,000 followed. The customer retained the phone, and the evidence included in-app authentication. The Ombud found no demonstrated bank maladministration or security failure warranting reimbursement on those facts. NFO virtual card case.

That is not a universal rule that every authenticated transaction must become the customer’s loss. It is a specific outcome based on specific evidence. Nor does it establish that virtual cards are generally unsafe.

A bank that lifted fraud holds despite warning signs

In an older Ombud case, now hosted by the NFO, a bank detected suspicious activity and placed holds on an account. A caller pretending to be the customer obtained their removal. The consultant became suspicious during the verification conversation, but the holds were lifted. The Ombud found that the bank had failed to exercise reasonable care. The bank accepted the findings and reimbursed the customer. Ombud case titled It Wasn’t Me.

The lesson is different: a scripted verification process cannot be considered in isolation from warning signs in the interaction. Neither case identifies a universal outcome for all victims, and neither should be attributed to a named bank without evidence.

Who bears the loss

There is no responsible one-sentence answer covering every scam.

The NFO’s August 2026 guidance says the investigation considers the evidence and whether the bank acted fairly, reasonably and in line with its legal and contractual obligations before and after the fraud was reported. Authentication records, devices, communications and recovery action can matter. NFO digital fraud and redress guidance.

Customers should not assume reimbursement is automatic. Banks should not be discussed as automatically free of responsibility merely because an approval occurred. The facts, applicable obligations and causal sequence require examination.

Product promises also have conditions. Absa’s linked digital fraud warranty FAQ, for example, distinguishes unauthorised transactions from customer-initiated scam payments. A customer should confirm the terms applicable to their incident rather than rely on the word warranty alone. Absa warranty FAQ.

Deposit insurance is a separate protection. SARB’s CODI scheme concerns qualifying deposits when a bank fails, with coverage up to R100,000 per qualifying depositor per bank. It is not a general refund scheme for banking scams. SARB CODI FAQ.

What to do immediately after suspected fraud

Stop and contact the bank

End the suspicious interaction. Do not approve another payment described as a refund, reversal or investigation step.

If you responded to a recorded menu, tell the bank exactly what you entered, disclosed or approved. Pressing a key alone does not establish that banking access was compromised; sharing security details or approving an instruction calls for an urgent, exposure-specific response.

Contact the bank urgently through its independently obtained fraud channel. State what happened, the transaction times and amounts, and whether a phone, card, credentials, wallet or remote-access session may be involved. Ask what needs to be blocked and request an immediate attempt to trace and recover funds. Obtain a reference number and record the time you reported the incident.

Do not wait to finish a police report before alerting the bank. A fraud report is urgent even if you do not yet understand the mechanism.

Standard Bank’s PayShap guidance says payments are paid and cleared within minutes and warns that PayShap payments cannot be reversed. Standard Bank PayShap guidance. Do not assume a completed payment can simply be cancelled. Still report suspected fraud immediately and ask about tracing funds, possible recovery and the appropriate dispute process. None of those requests guarantees repayment.

Secure access and preserve evidence

Use a trusted device where possible. Follow the bank’s instructions on securing devices, cards, wallets and credentials. Contact the mobile network if SIM control is in doubt, and secure affected email access.

Retain messages, payment details, account information, URLs, call times, approval notifications and complaint correspondence. Write down the sequence while it is fresh. Preserve records safely rather than posting them publicly.

Report the suspected crime to SAPS and keep the case reference. SAPS provides reporting through police stations; 10111 is an emergency channel, not a banking reimbursement service. SAPS crime reporting.

Pursue the correct dispute process

Ask the bank which procedure applies to the particular transaction. A card purchase, debit order and bank transfer should not be treated as the same dispute.

If the matter remains unresolved, submit a factual written complaint with the chronology, evidence, bank references and the outcome you seek. For a qualifying banking dispute, the NFO offers a free complaint service subject to its rules and jurisdiction. NFO complaint process.

If you disagree with an NFO outcome, its guidance points to internal objection or escalation processes where applicable and other appropriate forums. The FSCA and Ombud Council do not overturn its individual decisions. NFO explanation of disputed outcomes.

Be cautious about unsolicited recovery offers. Verify anyone promising to recover funds, and do not disclose banking access or make a new payment merely because they claim to represent an authority. SAFPS says its public services are free and warns against people claiming to recover money in its name. SAFPS service information. Be wary of anyone who later offers to recover the money for an upfront fee; recovery scams target people who have already lost money.

Controls businesses should test

A policy is useful only if people can follow it during a convincing, urgent request. Nedbank’s business guidance supports independent verification and account checks. Nedbank business cybercrime guidance.

For a practical review, test these controls:

• Confirm supplier bank-detail changes through a previously verified contact.
• Separate beneficiary amendments from payment approval, with access rights that support the separation.
• Make changes visible to the second approver instead of presenting only the payment amount.
• Apply additional verification to unusual senior-management instructions rather than treating rank as an exception.
• Verify payment through banking records before releasing goods or refunding money.
• Reconcile promptly and direct alerts to someone authorised to act.
• Maintain a response plan that still works when the usual finance manager is absent.

These are proposed safeguards, not guarantees or a claim that every one is legally required in every business. Test their performance with safe exercises: a changed supplier account, an apparently urgent instruction or a convincing payment confirmation. Do not use real funds or expose customer information in the test.

A discussion worth having within banking

Customer education matters. So do the design of approval screens, the handling of fraud warnings and the response after a report.

For banking professionals, the most useful questions are specific:

• Does the customer understand exactly what the instruction authorises?
• Can a customer independently verify a genuine automated fraud alert, without relying on the recording or an operator reached through it?
• What additional scrutiny applies when a new device and new beneficiary appear together?
• How is a suspicious or potentially coached interaction handled?
• What safeguards apply before a fraud hold is lifted?
• How quickly does a report reach the people able to contact the receiving institution?
• Does a rejected claim explain the evidence and reasoning, rather than only state that authentication succeeded?
• Do lessons from disputes lead to changes in staff training and controls?

These questions are not allegations that every bank has failed. Controls must also avoid unnecessary exclusion and false alarms that obstruct legitimate customers. The point is to examine effectiveness and fair treatment, not choose between blaming every victim and blaming every institution.

Verify the instruction as well as the identity

The most useful habit is to ask what the requested action will actually do.

Who receives the money? Why have the details changed? What permission am I granting? How have I checked this independently?

A familiar brand, genuine app or successful security check cannot answer all those questions. The transaction and the story behind it both need attention.

For current and former banking colleagues, this is an invitation to contribute to a practical conversation about prevention, response and fair resolution. Share professional insight without disclosing confidential information or making unsupported allegations about individual cases.

Before you pay, check beyond the advert, the message and the caller. Verify the person, the purpose and the destination.

If you suspect you have been caught by one of the banking scams in South Africa described here, contact your bank immediately through its official channels, stop further payments and preserve the evidence. Follow our guide, What to Do Immediately After Being Scammed, for practical next steps. If a seller, business or advertised offer was involved, an AdUncovered Comprehensive Report can examine its public history, claims and available evidence, alongside the transaction details and refund information you provide. The report does not replace urgent bank action, recover money or guarantee a refund.

This article provides general scam-awareness information, not individual legal or financial advice. Sources are linked beside the claims they support. Bank processes and terms can change; use current official channels for an incident. AdUncovered is independent and is not speaking on behalf of any bank.