Inside the playbook: how scammers and cyber criminals target South Africans
23 October 2026 · Omnitrace
Problem: most people picture a scammer as a lone chancer. Agitate: today's fraud is organised. Syndicates have call scripts, shared lists of leaked personal data, "mules" to move money and insiders who sell information. They don't need to hack your bank. They only need you to trust them for two minutes. Solution: once you understand their playbook, you can see each step coming and stop it.
Step 1: They research you
Criminals buy leaked data from breaches, scrape social media and even pick through discarded documents. Your name, ID number, address, employer and your children's names make their story believable. Break the chain: keep profiles private, avoid posting your location in real time, and shred anything with your ID number on it.
Step 2: They make contact
The first message looks normal: an SMS from "your bank", an email from SARS, a WhatsApp from a "recruiter" or a call from a spoofed number that really does show your bank's name. Break the chain: treat any unexpected contact as unverified until you have called back on a number you looked up yourself.
Step 3: They create panic or excitement
Fear ("your account is being emptied right now") or greed ("you've won", "20% a month") switches off careful thinking. A deadline adds pressure. Break the chain: urgency is the signal to slow down. No real bank or government office needs an answer in five minutes.
Step 4: They ask for the key
The goal is always the same: an OTP, a PIN, an app approval, remote access to your device ("install AnyDesk so we can help"), your login, or a payment to a "safe account". Break the chain: never share codes, never approve something you didn't start, and never let a stranger control your phone or computer.
Step 5: They move the money fast
Stolen funds are split across mule accounts, often belonging to students or job seekers recruited with "easy money" offers, and are withdrawn or turned into crypto within minutes. Break the chain: if you've been caught, call your bank's fraud line straight away, then open a SAPS case. Speed matters. And never let anyone use your bank account to "receive a payment"; mules face criminal charges too.
Businesses are targets too
Fake supplier invoices, changed banking details, CEO impersonation on email and WhatsApp, ransomware and fraudulent applications using stolen IDs cost South African businesses heavily. Verify every new client's identity, confirm bank account changes by phone, and train staff to report suspicious messages.
This article is general information, not legal or financial advice.
Keep reading
- SARS refund SMS and email scams: "Your refund is ready" is the bait
- "This is SARS, you owe R38,000": fake SARS calls and debt threats
- eFiling hijacks and fake tax returns: when criminals file in your name
- Phishing in South Africa: how to spot a fake email, link or login page
- Banking app fraud: how criminals empty accounts, and how to stop them
- Fake SMSes and calls: when the "bank" is not your bank
- Crypto and investment scams: the promise of quick riches
- Online shopping, marketplace and courier scams in South Africa
- 7 habits that keep your personal information out of criminal hands
- Your ID number is gold to fraudsters. Here is how to guard it
- The most common South African scams and how to spot them
- Fake job offers and human trafficking in South Africa: the warning signs