South Africans now live with a reflex that would have seemed strange a decade ago: an unknown number rings, and the phone goes unanswered. The behaviour is rational. Between spoofed "bank fraud department" calls, WhatsApp investment groups, fake SARS refunds and SIM-swap attacks, the country has become one of the most heavily targeted telephone and digital fraud markets in the world.
This article looks at the scale of the problem, how the main scams actually work, what the law and the banks are doing about it, and the practical steps that make the biggest difference.
The numbers: a problem measured in billions
Two datasets tell the story from different angles.
Banking losses. The South African Banking Risk Information Centre (SABRIC) reported that digital banking crime cost South Africans roughly R2.4 billion in 2025, up from about R1.9 billion in 2024, across more than 110,000 reported incidents. That works out to an average loss of around R21,800 per incident. Banking-app crime accounted for close to 89% of cases and about 70% of the money lost. Card fraud rose a further 18% to around R1.7 billion, dominated by "card-not-present" transactions where stolen card details are used online. The only good news in the report was on the physical side: ATM attacks and bank robberies continued to fall sharply.
Spam calls and messages. Truecaller's data for the first half of 2026 identified 17.47 billion spam calls in South Africa, a 25% increase on the same period in 2025, along with 3.71 billion spam SMS messages (up nearly 59%). Its community reporting network flagged 559 million new spam numbers between March and June alone. For context, the company estimated around 30 billion spam calls for the whole of 2025, so 2026 is on track to exceed that comfortably.
There is one encouraging signal in the Truecaller figures: the share of identified spam calls that people actually answered fell from 10.2% to 7.8% year on year. South Africans are learning. Unfortunately, so are the criminals.
Why South Africa is such an attractive target
Several conditions combine to make the country unusually fertile ground for fraudsters.
Leaked personal data. Years of large data breaches, including credit bureau and government-linked leaks, mean that ID numbers, cellphone numbers, addresses and even banking relationships are freely traded. A scammer who already knows your bank and your surname sounds credible in the first ten seconds of a call.
Cheap, industrial-scale calling. Voice-over-IP technology and caller-ID spoofing let a syndicate place tens of thousands of calls a day at almost no cost, and make them appear to come from a local 011 or 021 number, or even from your bank's real customer-service line.
Weak enforcement of RICA. South Africa's SIM registration law is widely regarded as ineffective. Pre-registered SIMs are easy to obtain, which undermines both call attribution and the fight against SIM-swap fraud.
High mobile-banking adoption with uneven digital literacy. Banking apps are the primary channel for most South Africans, but the security habits needed to use them safely have not spread as fast as the apps themselves.
Economic pressure. High unemployment and cost-of-living stress make "guaranteed returns", instant loans and job offers unusually persuasive.
The scams that actually cost people money
Most South African fraud losses come from a small number of well-rehearsed playbooks.
1. The fake bank fraud department
The most damaging scam in the country. You receive a call, often from a number that displays as your bank, from a calm, professional "fraud consultant" who says suspicious transactions have been detected on your account. To "secure" your money, you are asked to approve a notification on your banking app, read out a one-time PIN, or move funds to a "safe account". Every one of those actions hands the criminal control. Banks will never ask you to move money, share an OTP, or approve an app notification to stop fraud.
2. SIM-swap fraud
Criminals use stolen personal details to convince a network operator (or a corrupt insider) to port your number to a SIM they control. Your phone loses signal, and within minutes they are receiving your OTPs and resetting your banking passwords. A sudden, unexplained loss of network coverage should be treated as an emergency: call your bank and your network immediately from another phone.
3. Phishing, smishing and vishing
Emails, SMSes and WhatsApp messages impersonating SARS, the Post Office, Takealot, Netflix, Eskom or your bank, with a link to a convincing clone site. Generative AI has removed the spelling mistakes and awkward phrasing that used to give these away. SABRIC has warned specifically about AI-written phishing content and early cases of deepfake voice calls impersonating bank officials.
4. Investment and crypto scams
Typically run through WhatsApp or Telegram groups, often using the name and photo of a real, well-known investor or financial personality. Small early "profits" are paid out to build trust before the victim is encouraged to invest a large sum, which then disappears. Any offer of guaranteed monthly returns is a scam. The FSCA maintains a public register; if the entity isn't licensed, walk away.
5. Marketplace and "payment reversed" scams
On Facebook Marketplace, Gumtree and OLX: fake proof-of-payment screenshots, overpayment scams, and buyers who insist on a courier "they've already paid for". Sellers should only release goods once the money reflects as cleared in their own banking app, not on a screenshot or SMS.
6. Loan, job and "you've won" scams
Fake loans that require an upfront "admin fee", job offers that need a "vetting payment", and lottery or competition winnings that require a release fee. The tell is always the same: you have to pay first.
7. Spoofed local numbers and robocalls
Not every spam call is a scam; much of the volume is aggressive telemarketing from companies that acquired your number from a leaked or resold database. But the two blur together, and the sheer volume trains people to ignore calls entirely, which is itself a problem when a genuine hospital, school or courier needs to reach you.
What the law and the banks are doing
POPIA and the Information Regulator. The Protection of Personal Information Act restricts direct marketing to people who have consented or are existing customers. The Information Regulator has escalated a number of unlawful direct-marketing matters to its enforcement committee and says more referrals are being prepared.
Consumer Protection Act amendments. In April 2026 the Minister of Trade, Industry and Competition amended the CPA regulations to formalise a national opt-out registry administered by the National Consumer Commission, with enforcement powers against marketers who ignore consumer preferences.
Banking industry measures. Banks have rolled out AI-driven fraud detection, behavioural biometrics, in-app confirmation of payments, and delayed processing of large new-beneficiary payments. SABRIC coordinates intelligence sharing between banks and the SAPS.
The honest assessment is that regulation is lagging. The Truecaller and network data show spam volumes rising, not falling, despite these interventions. For the foreseeable future, the individual is the last line of defence.
Practical protection: what actually works
Screen your calls
The single most effective habit is not answering unknown numbers blind. A caller-identification and spam-blocking app fills the gap between "answer everything" and "answer nothing". Truecaller is the most widely used option in South Africa: it identifies who is calling, shows how many other users have flagged a number as spam, colour-codes calls (red for reported spam, green for verified businesses), and can automatically block numbers with a high spam score before your phone even rings. The community-reporting model matters here: Truecaller's models now filter newly reported spam numbers within hours, which is why the app blocked over seven billion calls in South Africa in the first half of 2026 alone. The paid tier adds an AI call-screening assistant that asks unknown callers to state their name and reason before the call is put through.
Two caveats worth knowing. First, Truecaller's contact-uploading practices have drawn scrutiny from the Information Regulator, so review the app's permissions and privacy settings when you install it. Second, legitimate businesses occasionally get wrongly flagged by users, so a "spam" label is a strong signal rather than proof. You can get it via this link.
Disclosure: the Truecaller links in this article are affiliate links. The author may earn a commission if you sign up, at no cost to you.
Harden your banking
- Never approve an app notification, share an OTP, or move money because someone on the phone told you to. Hang up and call your bank on the number printed on your card.
- Set up transaction notifications and daily limits in your banking app.
- Use a unique, long password for banking and email, and enable biometric login on the app.
- If your phone suddenly loses signal for no reason, assume a SIM swap and act immediately.
Protect your identity
- Register for free credit-bureau alerts (TransUnion, Experian and others offer them) so you're notified when an account is opened in your name.
- Consider a Protective Registration with the Southern African Fraud Prevention Service (SAFPS) if your ID has been compromised.
- Limit what you share publicly: your ID number, birthday and cellphone number should never appear on social media.
Verify before you trust
- Check any investment offer against the FSCA's register of licensed financial service providers.
- Type website addresses yourself rather than clicking links in messages.
- On marketplaces, only release goods when funds show as cleared in your own app.
- Be suspicious of urgency. "Act now or your account will be closed" is the fraudster's most reliable tool.
Report it
- Report fraud to your bank immediately; the faster the report, the higher the chance funds can be frozen.
- Open a case with the SAPS (you'll need the case number for the bank and insurers).
- Report unlawful direct marketing to the Information Regulator, and register your number on the national opt-out registry.
- Flag spam numbers in your caller-ID app so the next person is protected.
The bottom line
South Africa's fraud problem is structural: leaked data, cheap calling technology, weak SIM controls and slow regulation have created an environment where criminals operate at industrial scale. The banks are spending heavily on detection, and the law is slowly catching up, but the R2.4 billion lost to digital banking crime in 2025 shows the gap is still wide.
The good news is that the defences that work are cheap and simple: screen your calls, never act on instructions from an inbound call, verify independently, and report what you see. The 2026 data already shows South Africans answering fewer scam calls. Turning that awareness into habit is how the country wins the next round.
Sources: SABRIC Annual Crime Statistics 2024 and 2025; Truecaller South Africa spam reports (H1 2026); Information Regulator of South Africa; Department of Trade, Industry and Competition CPA amendments (April 2026); reporting by MyBroadband, TechCentral, BusinessTech, IOL and The Citizen.
