The scams that cost South Africans the most are often the hardest to spot. The caller sounds exactly like your bank, and by the time anything feels wrong, the money has already moved. That makes what you set up in advance as important as anything you might catch in the moment.
“Fraud in South Africa has become more personal. Criminals steal phones to get into the banking apps on them, card details leak in data breaches, and in some cases, people are forced to open their banking app, and make transfers under threat. These are crimes designed to bypass the usual cybersecurity precautions, so consumers need to think about limiting access to their money as well as spotting suspicious activity,” says Carla Wilby, co-founder and CTO of Orca Fraud.
“Customer education can only do so much when the scam itself is engineered to be imperceptible, even to trained professionals. But there’s still more cybersafety that South Africans can practise, beyond the simpler things,” she says.
When someone is talking you through your banking app
Digital banking crime claims reached R2.4 billion in 2025, up 29% in a year, according to the South African Banking Risk Information Centre (SABRIC). The banking app accounted for 89% of cases. SABRIC notes this doesn’t mean the apps were compromised. In many cases, criminals guided customers through the payments in real time.
Keep only what you need for short-term spending in your everyday account, and move the rest into a notice deposit account, which takes time to access. A scammer can only move money that’s within reach. It matters most in the fastest scams. A notice period puts time between the instruction and the money leaving, which is time for you or your bank to notice something is wrong.
Where your banking app allows it, hide the balances and accounts you don’t use day to day. Someone coaching you over the phone, or looking over your shoulder, works with what’s on the screen. A large balance tells them how much to ask for. It won’t stop a determined scammer, but it means less is on show.
When an online shop or subscription service you used is breached
Card-not-present fraud, where card details are used online, was the biggest source of card fraud losses in South Africa last year, at R780 million. Some of those details are handed to scammers directly. Others leak from somewhere you’ll never see, like a breached online shop or subscription service, and being careful at checkout doesn’t prevent that.
A virtual card limits the damage to one place. All of the big five banks offer them free, and you can create one for each service. If a merchant is breached, delete that card. Your main card remains untouched and safe.
When your phone is taken
SABRIC has warned that criminals steal phones to get into the banking apps on them. For many South Africans, the phone is where the banking app, saved passwords, ID copies and one-time PINs all live, so a stolen phone hands a thief most of what they need.
Remote lock stops anyone using it. Remote wipe clears it if it isn’t coming back. Both only work if they were on before the phone went missing, so switch them on now. After a theft, block the SIM separately. It keeps receiving one-time PINs for anything linked to that number.
Face ID and your PIN sit on top of a real username and password. If your phone is lost or stolen, that login is how you get into your banking from another device to block your cards and stop payments. If you haven’t typed it since the day you set up the app, check you still know it. Then keep it somewhere safe that isn’t your phone, like a password manager.
When a voice you trust asks for money
Account takeover fraud usually starts with a phishing message or a call from someone posing as the bank. Last year, losses rose 67% on credit cards and more than quadrupled on debit cards.
AI voice cloning can make a call sound like someone you know, and a “hi Mum, this is my new number” message doesn’t need a voice at all. Agree a family safe word that has never appeared anywhere public, so not a pet’s name, street or birthday. Pair it with a rule: if a call or message asks for money, hang up and call back on a number you already have. A cloned voice or a new number can’t get past that call-back. The same rule works for your bank.
Awareness still matters. But many of today’s scams give you nothing to look out for, so the best protection is what you set up before they happen. Each of these steps takes a few minutes and puts one more thing between a scammer and your money.
