To protect yourself from online banking scams in South Africa, never follow a payment link or share a password, PIN, card security code or one-time password because a caller or message asks you to. Open your bank’s app yourself, check payments before approving them, and call the number printed on your card if something feels wrong. These habits block many common attempts to steal money or take over an account.

Scams change their story, but they often rely on urgency: a parcel fee, a suspicious transaction, an account that will be blocked or an investment that must be paid for now. Use the checks below to assess a message, call or payment request, then act quickly if you have already shared details or sent money.

How to spot online banking scams in South Africa

Online banking scams in South Africa commonly use impersonation, fake links and pressure to get you to hand over access or approve a transaction. The sender’s name or caller ID is not reliable proof of identity, so verify through a channel you choose yourself.

1. Open your bank’s app instead of following a link

A text or email may claim that your account is locked, a payment is waiting or your card needs to be verified. Don’t tap its link, even if the message includes your name or looks like a familiar bank notice. Open the official app already installed on your phone, or type your bank’s web address yourself.

Look for spelling errors, an unfamiliar web address and requests to sign in after clicking through. A convincing page can copy a bank’s colours and logo. The web address matters more than the design.

2. Treat unexpected calls as unverified

A caller may claim to work for your bank’s fraud team and say your money is at risk. They might know your name or some account details, then ask you to read out a one-time password, approve a notification or move funds to a “safe account”. End the call and contact your bank using the number on your card or inside its official app.

A one-time password is for you to enter into a transaction or service you started, not to read to someone on the phone. A caller who tells you to keep the conversation secret or stay on the line while you move money is giving you another reason to stop.

3. Check every payment approval

Read the amount and recipient shown in an app notification or on your banking screen before you approve anything. A scammer may be trying to register a new device, add a beneficiary or authorise a payment, not merely “cancel” a transaction.

If the details do not match something you initiated, decline the request and contact the bank. Don’t approve a notification simply to make it disappear. Repeated approval requests can be a sign that somebody is trying to wear down your resistance.

Protect your login, phone and card

Secure both your banking credentials and the phone number used for account verification. A strong password won’t help if someone can take over your SIM or persuade you to approve their transaction.

4. Keep passwords, PINs and one-time passwords private

Don’t share your banking password, PIN, card security code or one-time password with a caller, message sender or person claiming to help you. Banks may need to verify you, but you should start the call using a trusted number rather than disclose a secret to an unexpected caller.

Use a banking password that you don’t reuse on email, shopping or social media accounts. If you reuse one and another service is compromised, criminals can try the same login elsewhere. Keep your email account secure too, since it may be used to reset other passwords.

5. Protect your phone number from a SIM swap

In a SIM swap, a criminal tries to move your number to a SIM they control, which can expose calls or text messages sent to that number. If your phone suddenly loses network service without a clear reason, contact your mobile provider through its official channel and ask whether a SIM change or number transfer has been requested.

Contact your bank promptly if you suspect your number has been taken over. Ask it to secure your digital banking access and check recent activity. Don’t wait for a payment alert to confirm that something is wrong.

6. Don’t install remote-access apps at a caller’s request

Someone posing as bank staff or a technical support agent may ask you to install an app so they can “fix” a problem. Remote-access tools can let another person see or control parts of your device. Don’t install one because of an unexpected call, and never log in to banking while a stranger can view or control your screen.

If you have already installed a tool, end the session, disconnect the phone from the internet if you can, and contact your bank from another trusted device or phone. Ask the bank to secure your account. Remove the app only when you are confident the person no longer has access, and consider having a trusted technician check the device.

Make transfers and everyday banking safer

Slow down at the point where money leaves your account. A small pause to check the recipient and the reason for payment can prevent a mistaken transfer or a payment to a fraudster.

7. Verify new beneficiaries and changed payment details

Before paying a new person or business, confirm the account details through a separate channel. If a supplier emails new banking details, phone a number you already have on file rather than the number in that email. For a personal payment, confirm the recipient and amount directly with the person.

Some banks offer a beneficiary verification or account-name check during payment setup. If your bank shows one, read the result and stop if the name does not make sense. Such checks can reduce mistakes, but they do not prove that a deal is genuine or that a recipient is trustworthy.

Say you intend to pay a legitimate supplier R8,000, but a fake email gives you a criminal’s account details. If you transfer the money without checking, the payment can be difficult to reverse. A brief call to the supplier on a previously verified number is a better safeguard than relying on the email thread.

8. Use safer habits on shared devices and public Wi-Fi

Use your own trusted phone or computer for banking where possible. Avoid saving banking passwords on a shared device, and log out when you finish. Keep your phone’s operating system and banking app updated through the official app store, not through a link in a message.

Public Wi-Fi is not a reason to enter banking details into a page reached from an unsolicited message. If you need to bank while away from home, use your mobile network or another connection you trust, and check that you are in the bank’s genuine app or website. Don’t leave your phone unlocked where someone else can use it.

What to do if you have been scammed

Contact your bank immediately using its official app, card number or website, and report the specific transaction or account access you did not authorise. Ask it to block or secure the affected card, digital banking profile or beneficiary, and to attempt to stop or recall a transfer if possible. The bank may not be able to recover money once it has moved onward, so speed matters.

Change your banking password from a device you trust, and change it anywhere else you reused it. If you shared email access or a password reset code, secure that email account as well. Tell your mobile provider straight away if your phone lost service or you suspect a SIM swap.

Keep the message, phone number, payment reference, time of the call and any screenshots. Don’t delete them while the bank reviews the incident. Report the matter to the South African Police Service and keep the case details; your bank may ask for supporting information as it investigates.

Don’t pay a second person who promises to recover the money for an upfront fee. Recovery offers that arrive after a scam can be another attempt to take your money or personal information. Ask your bank what documents it needs and use only contact details you have checked independently.

If you sent R8,000 to a fraudulent beneficiary, for example, report it to the bank as soon as you notice and give it the payment reference and recipient details. The bank can investigate and may try to contact the receiving institution, but a recall is not guaranteed. A later complaint does not automatically mean the money will be refunded, so keep records and follow the bank’s complaint process.

For a disputed transaction, ask the bank to explain its decision and the steps available through its complaints process. If you remain dissatisfied, check whether the matter falls within the remit of the relevant financial ombud or regulator, and confirm the current process through that organisation’s official site. General information here cannot decide your liability or legal position; a licensed financial services provider or the relevant regulator can advise on your circumstances.

Set up a simple routine before the next alert

Choose one trusted route to your bank now: its official app or the telephone number printed on your card. Use that route whenever a message claims that your account is at risk, and never rely on a number or link supplied in the message itself.

Then check your transaction notifications and account activity regularly, and make sure your bank has a phone number and email address you can access. If you see a transaction you don’t recognise, contact the bank immediately. If you receive an urgent request to approve a payment, stop and verify it independently first.