A caller posing as Standard Bank got an 18-year-old to move her R438,900 education fund to a 'safe' account in 20 minutes. What happened and what's disputed.
Social Engineering Examples·3 sources
On 23 May 2026, an 18-year-old in South Africa's North West province got a call from a man claiming to be from Standard Bank. Her late father's R438,900 education fund had just landed in her account, and the caller said it needed moving to a "safer" account so it wouldn't be misused. She made three transfers to a Capitec account. Within about 20 minutes the money was gone. Standard Bank says she may have been a victim of vishing and that its systems weren't breached; her family suspects a leak. Status: Reported incident, disputed.
Her father had set up a trust account to pay for her university studies. After she finished school, the R438,900 was paid into her Standard Bank account. A day later, the call came.
| Date | Event |
|---|---|
| 13 May 2026 | A Capitec account is added as a beneficiary on her digital banking profile, using her device (bank's account) |
| 22 May 2026 | The education fund is deposited into her account |
| 23 May 2026 | A caller posing as Standard Bank tells her to move the money to a "safe" account. She sends R48,900, R190,000 and R200,000 in about 20 minutes |
| About a day later | The fraud is flagged. R406 remains in the receiving account |
| 20 July 2026 | TimesLive reports the case; the family has gone to the National Financial Ombud and police have opened a fraud case |
Her sister later checked the caller's number on Truecaller. It was already flagged as a scam number.
| Standard Bank says | The family says |
|---|---|
| The beneficiary was added from her device ten days before the payments, and her valid credentials authorised the transfers | Only relatives knew about the deposit, and the call came a day later, so they suspect an insider leak |
| She "could have been a victim of a vishing (voice-phishing) scam" | A Capitec investigator told them that bank found no fault on its side |
| Its findings don't support a systems breach or an internal information leak just before the payments | The claim is with the ombud |
Standard Bank made a goodwill settlement offer. The report doesn't say how much, or whether it was accepted. None of the reporting resolves who added the beneficiary on 13 May.
Standard Bank's own guidance says a bank will never ask for PINs or passwords, and that being told to move money to a "safe" account is a hallmark of this scam.
Tip: if a bank caller wants you to move money, hang up and call the number on the back of your card. A real bank will never ask you to send money somewhere to protect it.
See also how to prevent vishing.
R438,900, sent in three transfers of R48,900, R190,000 and R200,000 to a Capitec account within about 20 minutes.
The bank says no. It found her device and credentials were used and said she may have been a victim of vishing. The family disputes this.
Not as of July 2026. Standard Bank made a goodwill offer of an unreported amount, and the family's claim was with the National Financial Ombud.
A caller posing as your bank says your money is at risk and must be moved to a "safe" account. That account belongs to the criminals.
Social Engineering Examples. “Standard Bank teen loses R438,900 education fund to a 'safe account' call (2026)”. Accessed 3 November 2026. https://socialengineeringexamples.com/standard-bank-capitec-education-fund-vishing-2026
the attacker (or an accomplice) plausibly knew that a large, one-time deposit, an education trust fund, had just landed in an 18-year-old's account, information the victim's uncle suspects came from an insider leak since only relatives knew of it. This is unconfirmed; Standard Bank said its findings did not support an internal information breach immediately preceding the transactions, so it is stated here only as a live, unresolved possibility rather than a fact; more broadly, fraud rings that run this style of scam are documented as watching for large or unusual deposits, whether via insider tips, data leaks, or opportunistic account monitoring.
a bank cannot fully prevent information about a customer's finances from leaking, whether through an insider, a data breach elsewhere, or opportunistic monitoring; the realistic control is treating any account that just received an unusually large, one-time deposit as elevated-risk for outbound transfers for a defined window, regardless of how the information reached an attacker.
Standard Bank said the receiving Capitec beneficiary was added to the customer's digital banking profile on May 13, 2026 using her device. The report does not establish who operated the device or support an attacker pre-staging claim.
consider a cooling-off period and an independent alert when a new beneficiary is added. This is a recommended safeguard, not proof of who created the beneficiary in this incident.
a caller phoned the victim claiming to be a Standard Bank representative, one day after the trust deposit landed, a timing that itself suggested some visibility into her account activity.
caller-ID spoofing makes inbound-call authenticity very hard to verify in the moment, so the realistic control is customer education, reinforced by the bank's own published policy, that any inbound caller claiming to be the bank should be treated as unverified by default and the customer should hang up and call the bank's official number instead.
the caller told her the money needed to be moved to a different, 'safe' account so it would not be misused, pressuring her to act immediately over the phone rather than visit a branch or call the bank's published number to verify.
the same 'never move funds to a safe account' customer education applies here, and can be reinforced with an in-app warning that triggers specifically when a large transfer to a new beneficiary follows soon after a phone call, naming the 'safe account' pretext explicitly.
the family reported three payments of R48,900, R190,000 and R200,000 within about 20 minutes. Standard Bank said the customer's device and applicable security credentials and authentication mechanisms were used. The reporting does not specify OTP-based authentication.
step-up verification or a bank-initiated outbound callback to the customer's registered number before authorizing large transfers to a newly created beneficiary, plus velocity/anomaly flags for multiple large transfers within minutes of each other, would have interrupted this stage directly.
the funds were moved out of the receiving Capitec account before the fraud was flagged roughly a day later, by which point only R406 remained, completing the alleged theft before either bank or the family could intervene.
faster fraud-flagging (same-day rather than roughly a day later) and real-time cross-bank freeze cooperation could shrink the cash-out window, but once funds clear to another bank within about 20 minutes this is the hardest stage to fully stop after the fact; the more reliable backstop is preventing the transfer at Stage 5 in the first place.
Browse by what this case has in common with others in the library.
A retired bank manager in Johor Baru lost RM936,000 after callers posing as an insurer, police and a prosecutor had…
A caller posing as Carnival's IT security team got an employee's login in April 2026. The attacker copied data on…
Attackers made Microsoft's own Azure Monitor send a fake $459.90 Windows Defender bill that passed SPF, DKIM and DMARC. A…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
SABRIC recorded R2.4bn in South African digital banking fraud claims in 2025, driven by phishing, fake bank calls and SIM…
A 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above…
Anthropic says one criminal used Claude Code to breach 17 organisations, price ransoms from their own books and write the…
The CEO of a UK energy firm was tricked into wiring €220,000 (~$243,000) to a Hungarian account in March 2019…
An unidentified operator jailbroke Anthropic's Claude Code with a fake "authorized bug bounty and penetration test" pretext, then defeated its…
Anthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most…
The FTC warned in 2023 about fake QR codes on parking meters and in texts. What it said, the Texas…
OpenAI says a Russian-speaking actor used throwaway ChatGPT accounts to build Windows malware, spread as a fake Crosshair-X gaming tool.…
A fraudster posing as AFGlobal's CEO, backed by a fake KPMG "attorney," pressured the accounting director into wiring $480,000 to…
Attackers hijacked the New Haven school COO's email, quietly monitored a real $5.9M bus-contract payment thread, then posed as the…
Binance's comms chief said scammers used an AI "hologram" of him on Zoom calls. The impersonation is real; the deepfake…
A victim searching for the AnyDesk remote-access tool hit a typosquatted site with a fake Cloudflare Turnstile that, instead of…
Criminals posing as a vendor redirected $4.92M in North Dakota school building-fund payments in 2026. The FBI seized $4.86M. How…
Social Engineering Examples