SABRIC recorded R2.4bn in South African digital banking fraud claims in 2025, driven by phishing, fake bank calls and SIM swaps. What the numbers mean.
Social Engineering Examples·10 sources
South Africa's digital banking fraud more than doubled in two years, by SABRIC's count. The South African Banking Risk Information Centre's 2025 report records R2,406,728,972 in client claims for digital banking crime in 2025, across 110,074 investigations. That's up 29.2% on 2024. SABRIC says social engineering, not hacked bank systems, drives most of it: phishing messages, phone calls from fake bank "fraud departments", and SIM swaps that steal one-time PINs. Status: Industry statistics; no single perpetrator.
| Year | Investigations | Client claims |
|---|---|---|
| 2023 | 52,588 | R1,085,896,934 |
| 2024 | 97,547 | R1,862,633,862 |
| 2025 | 110,074 | R2,406,728,972 |
In 2025, banking apps made up R1,696,418,377 (70.5%), internet banking R688,287,956 (28.6%) and mobile banking R22,022,639 (0.9%).
A note on sources. SABRIC's earlier annual reports gave slightly different figures for 2023 and 2024. This page uses the comparative series in the 2025 report. A separate "R3.9 billion" figure that circulates hasn't had its scope confirmed, so it's left out.
| Pattern | What happens |
|---|---|
| Phishing, then a call | An email or SMS that looks like your bank sends you to a fake login page. Soon after, a "fraud department" caller, with the bank's real number spoofed on caller ID, says your account is compromised and asks for the OTP to "secure" it. They use it on the spot |
| SIM swap | Using stolen ID details, criminals convince a mobile network to move your number to their SIM. Every OTP now goes to them |
| "Safe account" call | No phishing step. The caller talks you into moving money into a "secure" account, or approving an Instant Money or EFT payment, because yours is "under attack" |
Standard Bank's Dr Belinda Rathogwa said scammers also went after older clients near retirement, with fake high-return investment pitches on top of the same urgent-call playbook. SABRIC and the banks have also pointed to AI-written phishing and early voice-cloning in some calls.
Tip: lost signal for no reason, or an OTP that never arrived? Absa warns that can mean a SIM swap. Call your network and your bank straight away.
Banks and SABRIC work with SAPS and the Southern African Fraud Prevention Service, which ran a "Just Say Goodbye" anti-vishing campaign in November 2025. No single gang or indictment is tied to the overall rise.
See also vishing examples and how to prevent vishing.
R2,406,728,972 in client claims across 110,074 investigations, up 29.2% on 2024.
No. The totals cover all digital banking crime reported by participating banks. They don't separate out vishing or SIM swaps.
SABRIC says no. Most fraud starts outside the app, through impersonation and pressure, and the victim is then guided to act.
Criminals get your mobile number moved to their SIM card, so your bank's one-time PINs go to them.
Social Engineering Examples. “South Africa's digital banking fraud surge: SABRIC's numbers (2023 to 2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/sabric-vishing-sim-swap-banking-fraud-surge-2023-2025
SABRIC's reporting is consistent with attackers typically building a partial profile of the intended victim (name, bank, phone number, and some real account or personal details) from prior data breaches, social media, or a preceding phishing response, giving a later phone call enough real detail to sound legitimate.
personal-data exposure from social media and third-party data breaches is very hard for a bank to eliminate at the source; the realistic control assumes attackers already hold some real victim details and instead hardens the verification steps later in the chain that this information gets used against.
before contact, operators typically stand up look-alike phishing domains that closely mimic a bank's real login page and acquire caller-ID spoofing capability so a vishing call appears to originate from the bank's genuine fraud-department number; SABRIC's 2024 and 2025 statements describe criminals increasingly using generative-AI tools to draft error-free phishing emails and AI-generated WhatsApp lures, and early voice-cloning services to make follow-up calls more convincing.
the nearest practical controls sit at the mobile network operator (stronger identity verification, PIN, or biometric confirmation before any SIM port or number transfer is processed) and at brand-protection monitoring for newly registered look-alike banking domains, rather than at the tooling stage itself, which is largely invisible to the victim or bank beforehand.
a mass phishing email or SMS made to resemble legitimate bank communication is sent to a large pool of customers, directing anyone who clicks through to the spoofed banking site, where they unknowingly enter their username and password.
customer education to distrust links in unsolicited SMS, WhatsApp, or email and to navigate to banking sites directly or via the official app, combined with bank-side email-authentication standards (SPF/DKIM/DMARC) and a policy of never sending transactional login links, reduces how many recipients reach the spoofed page.
in the vishing path, a fraudster calls posing as bank fraud-department staff, using the spoofed caller ID and the details already gathered, and manufactures urgency to get the victim to read out an OTP or approve a transaction prompt; in the parallel SIM-swap path, the same harvested personal/ID information is used to convince a mobile network operator's customer-service agent to port the victim's number to a SIM the criminals control, silently rerouting future OTP/SMS codes.
SABRIC and every major bank's core, repeated advice is that a bank will never ask a customer to read out a PIN, password, OTP, or CVV by phone, and will never ask a customer to move money into a new 'safe' account; customers are told to hang up and call back only on the number from the bank's official app or website, never a number the caller supplies, and Absa specifically flags sudden loss of cellphone signal as a SIM-swap indicator to escalate to the network operator immediately.
the fraudster uses the stolen credentials together with the live-relayed OTP (vishing path) or the intercepted OTP stream (SIM-swap path) to log into the banking app or authorize a funds transfer in real time, completing the technical bypass of MFA.
authentication methods resistant to being relayed over a phone call, such as in-app push approvals that display the actual transaction details for the customer to confirm, biometric verification, and Standard Bank's dedicated in-app vishing-alert feature (launched Aug 2024), are harder for a live vishing caller to talk a victim through than a plain numeric OTP.
SABRIC describes the proceeds typically being moved quickly into money-mule accounts or via Instant Money/EFT payments to frustrate tracing, which is consistent with why, per Standard Bank's Rathogwa, most victims recover little or none of the money even with bank assistance.
bank and SABRIC-level transaction monitoring, mule-account detection, and cross-bank/SAPS collaboration can sometimes freeze or trace funds quickly, but SABRIC's own outcome data shows this rarely helps individual victims recover money once funds have moved, since the customer authorized the transaction themselves under deception; this stage is where the case's own reporting shows the defense is weakest in practice.
Browse by what this case has in common with others in the library.
A fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the…
A Pakistan national in Sydney allegedly ran a vishing scheme impersonating telecommunications support, using maintenance or upgrade pretexts to obtain…
MGM Resorts, September 2023. A caller reportedly talked the IT help desk into resetting an employee's access, and the shutdown…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A caller posing as Standard Bank got an 18-year-old to move her R438,900 education fund to a 'safe' account in…
An Atlantic City woman called grieving widows posing as a life insurer, demanding gift cards to clear policy "arrears". 17+…
An unidentified operator jailbroke Anthropic's Claude Code with a fake "authorized bug bounty and penetration test" pretext, then defeated its…
The FBI's 2025 Internet Crime Report tracked AI fraud for the first time: 22,364 complaints and $893M lost. What the…
Colombian police say 'Los Cyber' posed as bank fraud staff, got victims to share their phone screens and took COP…
iSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed…
Anthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most…
US prosecutors charged 28 people over an alleged $65M scheme where callers faked refunds to trick seniors into sending cash.…
Evaldas Rimasauskas posed as supplier Quanta Computer to get Google and Facebook to wire about $122M. How the fake-invoice scam…
In March 2022, LAPSUS$ (DEV-0537) leaked an archive it said held 37GB of Microsoft source code. Microsoft only confirmed that…
A judge called it an AI-driven fraud, but police couldn't confirm voice cloning. How the Saskatchewan grandparent scam worked and…
Fraudsters spoofing the French CEO's "personal" email talked Pathé's Dutch management into wiring €19.2M for a fake secret Dubai acquisition,…
DOJ/FTC alleged that Citizens Disability and subsidiary CD Media made 109 million-plus illegal telemarketing calls, including 25.7 million-plus to Do-Not-Call…
Social Engineering Examples