What is actually happening, in numbers

The South African Banking Risk Information Centre — SABRIC, the body the banks fund to track exactly this — released its 2025 crime statistics on 11 August 2026. Digital banking client claim losses came to R2,41 billion across 110 074 reported incidents, up 29,2% on the year before. The average loss was R21 865, and nearly nine in ten cases ran through a banking app.

How it happened matters more than any of those figures. Almost none of it was hacking. SABRIC’s summary of the year, reported by TechCentral in August 2026: the fraud often “began outside the banking platform, when criminals impersonated trusted organisations, created urgency or guided customers through transactions in real time”.

Guided. In real time. Nobody broke anything — somebody was talked through it, by a calm voice, on an ordinary afternoon. So if one of these has caught you, or nearly did, put the self-blame down. These scripts are engineered to catch a careful person on a busy day, and a busy day arrives for everyone.

The six, and what each one sounds like

Six scripts do most of the damage here right now. Each gets the same three things: what it sounds like from the inside, why it works, and the single check that ends it.

1. The fraud department calls you

Good afternoon, I'm calling from the fraud
department. We've stopped a card payment of
R14 300 to an electronics shop in Durban. Was
that you?

No? Right. I'll need to secure the account. I'm
moving your balance to a holding account in your
name while we cancel the card.

SABRIC’s 2025 report describes this almost word for word: victims “may be informed that an account is at risk… or that funds must be transferred to a so-called safe account”, while criminals “coached victims during live telephone engagements”.

Why it works. The caller hands you bad news and then rescues you from it, so within twenty seconds you are on the same side against a common enemy. Grateful people do not interrogate their rescuer.

The check. No bank in South Africa has a safe account, a holding account or a secure account for your money. Capitec puts it on its own fraud page: “We will never call and ask you to do the following to stop or reverse fraud, or unauthorised debit orders: Do a send cash transaction, transfer money to a safe account or perform any other transaction in our app.” Anyone asking you to move money in order to protect it is running a scam.

2. The one where they ask you to install something

To block it from our side I'll need you to install
our security tool. It's in the app store - tap
install, open it, and read me the number on the
screen.

SABRIC again: victims “were persuaded to install remote-access software or enable screen-sharing functionality under the pretence of” technical support, after which criminals can “capture credentials, or facilitate transfers to newly added beneficiaries”. FNB lists it too, usually as the second half of scam number one.

Why it works. It does not feel like giving money away. It feels like following IT instructions, something most of us have done a hundred times with nothing bad happening.

The check. Your bank does not repair your account through your phone screen, and nobody legitimate needs to watch that screen to stop a payment. If a caller steers you towards an install or a number to read out, the call is over.

3. The message that looks exactly right

[Your bank]: A new beneficiary was loaded on your
profile at 14:02. If this was not you, stop it
here: [link]

And the local speciality, which lands hardest between July and October:

SARS: Your assessment shows a refund of R6 214
due to you. Confirm your banking details to
release payment: [link]

SARS logged a false notice of assessment on 5 August 2026 and a fake tax return notification in late July, and government’s news service carried a SARS warning on 30 July 2026 about spoofed emails built “to entice unsuspecting taxpayers to part with personal information, such as bank account details”. SARS never asks for passwords, one-time PINs or eFiling logins by email, SMS or phone, and does not send you links to other websites.

Why it works. Neither message asks you for money. One asks you to stop something bad, the other to collect something good. Both feel like they expire.

The check. Never reach your bank or SARS through a link. Close the message and open the app you installed yourself — SABRIC’s wording is “never access your Bank’s website from a link in an email or SMS”. If a beneficiary really was added, your app will show it in ten seconds.

4. The SIM swap

This one has no script at all. What you get is this:

[Your phone, 09:40 on an ordinary Tuesday]

No service.

Someone contacts your mobile operator posing as you and has your number moved onto a SIM they hold, so every SMS one-time PIN arrives on their phone. FNB, Nedbank and Capitec all list it. Capitec also describes a street version: a stranger posing as a promoter asks to borrow your phone to load airtime, removes the SIM while holding it, and gets you to pose for a selfie later used to activate banking on their own device.

Why it works. There is nothing to be suspicious of — no call, no message, no decision. By the time you notice the silence, your OTPs have been landing somewhere else for an hour.

The check. Sudden loss of signal, where you always have signal, is a banking emergency and not a network glitch. Vodacom’s own advice: “If you suddenly can’t make calls or get messages, contact Vodacom immediately and ask if there has been a SIM swap on your number.” Borrow someone else’s phone and do it now. And never hand your own phone to a stranger, however good the reason sounds.

5. The card swap at the ATM

Sorry, this machine is slow today. Press cancel
and go again - no, that button there. Ag, these
ATMs.

FNB warned about exactly this on 19 August 2026, telling MyBroadband that as chip-and-PIN made skimming less profitable, criminals moved to taking the physical card instead. One person distracts you, another swaps your card for a lookalike, and your PIN was watched over your shoulder before the swap happened. SABRIC’s report confirms the pattern: this fraud “often involves the physical theft of a card at an ATM through card swapping, distraction or similar methods”.

Why it works. Ordinary politeness. Being short with a stranger who appears to be helping you feels worse, in the moment, than the two seconds it takes to lose your money.

The check. Nobody helps you at an ATM. Capitec’s wording is the rule to memorise: “Do not allow anyone to help you at the ATM. Rather go into a branch if you need help.” Cover the keypad. If the card does not come back out, do not leave — freeze it in your banking app while you are standing there.

6. The voice you recognise

Ma, it's me. I'm okay, but there's been an
accident and my phone is broken - this is
someone else's. Please don't tell Dad yet. I
need money now. I'll explain everything later.

SABRIC’s 2025 report records “isolated cases involving cloned voices” in South Africa so far, potentially enabling criminals to impersonate “bank officials, company executives or other trusted parties”. Read that as a timeline, not as reassurance. The United States Federal Trade Commission set out what a criminal needs back in 2023: “a short audio clip of your family member’s voice — which he could get from content posted online — and a voice-cloning program”. A voice note in a family group is the whole shopping list.

Why it works. It has nothing to do with judgement. Your body responds to a distressed voice you love before your mind is consulted, and the script keeps it out — hence “don’t tell Dad yet”, which removes the one person who might have said wait.

The check. A family code word, agreed out loud at a dinner table this week: something short and odd that has never been typed into a chat. Any distress call asking for money gets asked for it. Then hang up and phone the person back on the number you already have — the FTC’s wording is “Don’t trust the voice… Use a phone number you know is theirs.”

The one rule that beats all six

Every row of that table collapses into one habit, and it takes about ten seconds.

End the call. Find the number yourself. Phone it.

“Yourself” is the load-bearing word. It means the number printed on the back of your bank card, or the contact screen inside the app you installed from the app store, or the bank’s website typed in by hand. It does not mean the number that called you, the number in the SMS, or the number at the top of a search results page — that slot is sold to advertisers.

SABRIC’s consumer guidance says the same thing in its own words: “If you receive a phone call requesting confidential or personal information, do not respond and end the call.” It works everywhere because it costs you nothing when the call is genuine. A real fraud department finds your case in seconds and thanks you for checking — it is what they are trained to hope you do. If there is a second phone in the house, use that one, or wait a full minute before dialling.

Urgency is the tell

Urgency is not a sign that something is wrong with your account. It is a sign that something is wrong with the call.

Every script above needs you to act inside the next few minutes, because those minutes are the only window in which it works. Given an hour, you would phone your daughter. Given a night’s sleep, you would phone the bank. The pressure is not a side effect of the emergency — it is the product, which is why SABRIC lists “created urgency” alongside impersonation as the core of the method. Real banks move at the pace of a real bank: they stop the card, they send an SMS, they wait for you.

Why knowing your details proves nothing

This is the part that catches sensible people. The caller opens with your full name, your ID number, your branch and the last three digits of your card. It feels like proof. It is not. Your details sit in dozens of databases you never chose to be in — a medical aid, a school, a gym, a courier, an estate agent, a competition form at a shopping centre. Some have leaked, and leaked data gets bought and sold. A caller who opens with your ID number has told you one thing: they have a database.

Proof runs in one direction. You verify them. Any caller who begins by asking you to confirm your identity has reversed the correct order, and that reversal is worth noticing on its own.

What a bank will never do is published and settled. Nedbank states it will never ask for your login and password, card PIN, security code or OTP, and will never send an email or SMS link into online banking. FNB states it will never ask you to share a one-time PIN “to reverse pending transactions or to block your banking profile”.

What AI changed, and what is still a tell

A lot of widely repeated scam advice stopped being true, and repeating it now is worse than saying nothing — it teaches people to relax at exactly the wrong moment.

Bad spelling is dead as a signal. The old rule — look for typos, odd greetings, strange phrasing — was reasonable while these messages were typed at speed by someone working in a second or third language. SABRIC’s 2025 report closes that chapter: “Artificial intelligence is making some scams more convincing by helping criminals create polished messages, realistic images and believable voice recordings.” A clean, correctly punctuated message is now evidence of nothing. Say that plainly to anyone you are protecting, because the residue of the old rule is the dangerous part.

The number on your screen is not a tell. SABRIC notes criminals can mask their telephone numbers so a call appears to come from a legitimate company. Caller ID is a label, not an identity. Nor is the sender name on an SMS, which is why a fraudulent message can drop into the same thread as your bank’s real ones.

A voice you recognise is not a tell. What used to need a recording studio now needs a clip of someone talking. You cannot keep your voice off the internet and it is not worth the energy to try — build the check instead of the wall.

What has not changed is the last step. The money still has to move, and it still moves through an action only you can take: approving, sending, installing, reading a code aloud. AI writes better messages and makes better voices, but nothing in it reaches into a South African bank account without a person on this end doing something. That step is where you live, and it is why a ten-second habit still beats a technology that improves every month.

So stop grading the message and grade the request. Five things end the conversation, and you never need to work out which scam you are in:

1. You are asked to move money — anywhere, for any reason.
2. You are asked for a PIN, password or OTP, including “to cancel” or “to reverse” something.
3. You are asked to install something, or to let someone see your screen.
4. You are asked to stay on the line while you do it.
5. It has to happen now.

The first hour

If it has already happened, the order matters more than the speed of any single step. Work down this list.

1. Phone your bank’s fraud line. Not the branch, not the app chat, not tomorrow. The fraud line, from the back of your card or the contact screen in the app. Absa publishes its fraud line as running 24 hours a day, seven days a week; FNB’s fraud and security line is listed as 24 hours too.
2. Freeze the card and the profile. Most South African banking apps stop a card in two taps, and you can do it while you are still on hold.
3. Get off the compromised device. If you installed anything, or let anyone see your screen, treat that phone or laptop as unsafe. Delete what you installed, change your banking password from a different device, and tell the bank what the app was called.
4. If your signal died, phone your network from another phone. Vodacom publishes 082 135, or 135 from a Vodacom phone. For MTN, Telkom or Cell C, take the number from the network’s own website or a shop — never from an SMS.
5. Write it down while it is fresh. The time of the call, the number that showed, the name used, what you were told, what you did, every amount and reference — then the name and time of every bank employee you speak to afterwards. This is the most useful thing you can do for your own claim.
6. Open a police case. SAPS is 10111 in an emergency, otherwise the nearest station. Your statement goes onto the crime administration system and you get a CAS number by SMS or over the phone. Keep it — the bank, the ombud and your insurer will each ask for it.
7. If your identity is exposed, apply for a Protective Registration. The Southern African Fraud Prevention Service runs it free on 011 867 2234 or protection@safps.org.za, and issues a reference number within 48 hours. It flags your ID so member institutions take extra care before granting credit in your name.

Then tell one other person, and not for a practical reason. People who have been scammed often say nothing for days out of embarrassment, and days is exactly what the scam was built to buy. The person who took your money does this for a living. It was not a fair fight.

Where to report, with the numbers

Every number below was taken from the organisation’s own published page in August 2026. Numbers do change, so treat the back of your bank card as the real authority — it is the one source no scammer can edit.

One condition on that last row: take it to your own bank first. The ombud picks it up once you have raised it with the bank and it is still unresolved — you do not have to wait for a final letter before you escalate. Raise it in writing, because the paperwork you keep in the first hour is what the ombud reads later.

What you can get back

If you pushed the payment yourself, you are in the hardest category. A payment you authorised, even under instruction from someone lying to you, is treated differently from one made without you, and South African banks are not generally obliged to refund the first kind. Anyone who tells you recovery is likely is guessing, or selling something.

Speed is the only lever you hold. Money paid into a receiving account is usually moved on again or drawn as cash within a short window. If your bank can reach the receiving bank before that happens, some of it can sometimes be held. After that it is generally gone — which is why the fraud line comes before the police station on the list above.

The ombud is real, free, and worth using. The National Financial Ombud Scheme opened a little over 50 000 cases in 2025 and recovered R443 million for consumers across all its divisions, the banking share being R53 million, on figures reported by the Daily Maverick in June 2026. That reporting also noted a large share of the banking fraud awards turned on banks not having acted quickly enough once they were told — a second reason to phone inside the hour, and to write down the exact minute you did.

If someone contacts you afterwards offering to recover your money for an upfront fee, that is the second half of the same scam. No legitimate route charges you: the ombud is free, a Protective Registration is free, opening a police case is free.

If the amount is large, if a business account is involved, or if your bank’s final response is a refusal you believe is wrong, speak to someone who does this for a living. We write about technology — we are not attorneys, and none of this is legal or financial advice.