New Alert for SA Mobile Banking App Users

South Africans who rely on banking applications on their mobile devices are once again being urged to exercise heightened caution whenever they are asked to approve a payment.

Key Takeaways

• Customers, not systems, are now the target: Banks have hardened their defences against direct account hacking, so criminals have shifted to manipulating customers into approving fraudulent payments or transfers themselves, often via social engineering rather than technical breaches.
• Speed is critical after losing a card or phone: Fraudsters can exploit a lost or stolen device within minutes, so immediately blocking the card through the banking app and contacting the bank’s fraud team without delay is essential to limiting damage.
• Scam-related complaints are climbing fast: Digital banking fraud complaints to the National Financial Ombud Scheme rose 73% year on year, with virtual card fraud (enabled by phishing, smishing and vishing) emerging as a particularly costly and growing risk.

Discovery Bank Sounds The Alarm

Discovery Bank has flagged this issue, explaining that criminals are increasingly steering away from attempting to hack into customer accounts directly, and are instead tricking account holders into authorising fraudulent transactions with their own hands.

In a fraud notice issued recently, the bank cautioned its customers that criminals are capable of exploiting a stolen phone or bank card in a matter of minutes if the account holder fails to act without delay.

The bank stressed that customers should always scrutinise any request to approve a payment or a card purchase before confirming it, and reminded them that a bank will never contact a customer to ask them to approve the reversal of a transaction that was fraudulent.

It further advised that anyone whose card or phone goes missing should lock their card without hesitation using the banking application, if this option is accessible to them, and should get in touch with the bank’s fraud department as a matter of urgency.

Discovery Bank reiterated that as long as a customer still has access to their banking app, the first step should be to block the card and then reach out to the fraud team immediately, since criminals are able to take advantage of a lost card or device within a very short window of time.

What To Do If Your Card Or Phone Goes Missing

• Lock or block the card immediately through the banking app, if accessible.
• Contact the bank’s fraud team without delay.
• Change passwords linked to banking and email accounts as a precaution.

Fraud Specialist Warns Of Growing Pressure On Banks

The warning arrives alongside new findings from fraud-prevention firm BioCatch, which has revealed that banks across South Africa are under mounting strain from scams that are becoming ever more sophisticated and that increasingly target customers directly rather than attacking banking infrastructure itself.

Based on the company’s most recent research, the majority of banking leaders in South Africa, some 85%, reported that they have witnessed a rise in attempted fraud against their institutions.

Key Findings From The BioCatch Research

Finding	Percentage / Figure
Banking leaders who saw a rise in fraud attempts	85%
Banking leaders who said fraud losses are climbing	79%
Institutions estimated to lose over $5 million (roughly R82 million) annually to fraud	81%

Roughly 79% of respondents indicated that losses attributable to fraud are on the rise, while around 81% believed that their organisations lose in excess of $5 million, equivalent to approximately R82 million, to fraudulent activity annually.

According to the research, these figures point to a shift in criminal tactics, largely because banks have made significant strides in closing off the traditional route of unauthorised account takeovers.

Jonathan Frost, who serves as Director of Global Advisory at BioCatch, observed that this shift is not unique to South Africa but is instead a pattern playing out across numerous countries. He remarked that the challenge is one being felt broadly, not only locally but throughout most developed economies.

Frost went on to note that because banks have become so effective at guarding against unauthorised fraud, customers have unfortunately become the primary target for criminals looking to extract funds.

Banks Are Bolstering Their Fraud Detection Capabilities

Rather than attempting to break directly into bank accounts, criminals have now pivoted towards manipulating victims so that the victims themselves either transfer the funds or approve fraudulent transactions through their own banking applications.

Frost explained that account security has generally reached such a high standard that the only viable way for a criminal to extract money is to effectively manipulate the customer into authorising the transfer on the criminal’s behalf.

The swift expansion of digital banking and instant payment systems has undoubtedly made banking quicker and more convenient for ordinary users, but this same convenience has simultaneously handed scammers additional opportunities to pressure victims into approving transactions before they have a chance to pause and think things through.

Frost cautioned that this threat is expected to intensify further as criminals lean more heavily on artificial intelligence to craft scams that are increasingly convincing and difficult to detect.

He indicated that the situation is likely to deteriorate before it improves, describing the current period as the start of a new and evolving phase in the threat landscape.

In light of this, banks are taking steps to reinforce their fraud detection systems. Bonolo Sebolai, who holds the position of Head of Fraud at GoTymeBank, pointed out that banking security today reaches well beyond simple passwords and one-time PINs.

Sebolai also urged customers to take responsibility for their own protection by only downloading banking applications from official, verified app stores, by hanging up and independently contacting their bank whenever a call or message appears even slightly suspicious, and by acting swiftly the moment they suspect their device may have been compromised.

Practical Advice From GoTymeBank

• Only download banking apps from official app stores.
• Hang up on suspicious calls and contact the bank directly using a verified number.
• Act immediately if a device is suspected to be compromised.

Enable two-factor or biometric authentication wherever your banking app offers it, and avoid using the same PIN or password across multiple financial or email accounts.

Growing Risks Linked To Virtual Cards

Nerosha Maseti, who serves as Lead Ombud for Banking and Credit, explained that although virtual cards themselves remain a secure payment method, they can still be exploited by criminals who first manage to gain entry into a customer’s banking app through phishing, smishing or vishing scams.

Maseti noted that fraudsters are able to generate virtual cards of their own and subsequently use the resulting card credentials to carry out transactions, once they have gained access to a customer’s digital banking profile after that customer has unknowingly shared a one-time PIN or approved an authentication prompt.

A Quick Guide To The Scam Terminology Used

• Phishing refers to fraudulent emails designed to trick a person into revealing personal or banking details.
• Smishing refers to the same tactic but carried out through text messages rather than email.
• Vishing refers to fraud attempted over a voice call, often with a criminal posing as a bank employee.

Whatever the channel, a genuine bank will never ask a customer to read out a one-time PIN over the phone or type it into a link sent via SMS or email. If this happens, treat it as a certain sign of fraud and end contact immediately.

Conclusion

As digital banking becomes faster and more convenient, it is also becoming a bigger target for scammers who rely on manipulation rather than technical hacking to get what they want, which means the strongest line of defence is no longer just the bank’s security systems but the customer’s own vigilance. By staying alert to suspicious calls, messages and payment requests, never sharing OTPs or approving unfamiliar authentication prompts, and acting immediately if a card or phone is lost, South Africans can significantly reduce their exposure to a threat that, by all accounts, is only expected to grow more sophisticated as criminals increasingly turn to tools like artificial intelligence to make their scams more convincing.