There’s been a concerning increase recently in the number of scamsters targeting South African consumers. This includes scamsters pretending to be representatives of your bank or your cellphone provider.

There are SMS and email scams claiming your crypto wallet will be locked, or offering an exciting business opportunity, or saying that there’s a parcel waiting for you and you need to pay duties to get it released.

Many emails or SMSs appear to come from trusted sources asking you to click on a link.

What is concerning is how well targeted these scams are, often containing detailed information about the potential victim.

The more information the scamster has on their victim, the more plausible the scam becomes. A consumer believes that if this person has sufficient information about them, it must genuinely be their bank or mobile provider.

Scamsters benefit from recent data breaches

One theory is that this increase in scams is related to the data breaches of credit bureaus in recent years.

The latest data breach in April of credit bureau TransUnion provided criminal syndicates with detailed information of South African consumers, including information such as telephone numbers, email addresses, identity numbers, physical addresses, and some credit scores.

There have been reports by the Information Regulator that syndicates have also been selling this information to direct marketing businesses.

According to the Information Regulator, while it cannot confirm that the activity of selling personal information is as a result of the TransUnion breach, it is “conducting compliance assessments which are currently underway into some companies, which have been reported to the Regulator to be involved in such practices.”

Under the Protection of Personal Information Act (POPIA) it is illegal to sell personal information and according to the Regulator “even the purchasing of contact details of data subjects from data brokers is unlawful.”

Increase in vishing scams

The South African Banking Risk Information Centre (SABRIC), has seen significant increases in cybercrimes, although SABRIC CEO, Nischal Mewalall says it too cannot confirm whether these increases are due to recent data breaches.

With regards to specific cybercrimes, SABRIC has seen increases in calls from scamsters impersonating bank officials (known as “vishing”). This is when an individual seeks to have a conversation with the victim to persuade them to give away sensitive information so that the fraudster can use this information to defraud the victim.

Although the acquisition of sensitive information by the criminal does not guarantee them access to people’s banking profiles or accounts, criminals can use this information to trick people into disclosing their confidential banking details.

Take these steps to protect yourself:

• Report the numbers used in vishing scams to your bank immediately.
• Never disclose personal information such as passwords and PINs when asked to do so by anyone via telephone, fax or even email. A bank will never ask you to share your password or PIN.
• Change your password regularly and never share it with anyone else.
• Verify all requests for personal information and only provide it when there is a legitimate reason to do so.
• Never use any information that may have been compromised and rather make use of other personal information that has not been used previously to confirm your identity in future.
• Apply for a free Protective Registration listing with the Southern Africa Fraud Prevention Service (SAFPS). This service alerts SAFPS members, which includes banks and credit providers, that their identity has been compromised and that additional care needs to be taken to confirm that they are transacting with the legitimate identity holder. Consumers wanting to apply for a Protective Registration can contact SAFPS at protection@safps.org.za

How does a cellphone scam work?

A fraudster will call claiming to be from your cellphone company and tell you that your phone has had a SIM swap attempt.

They use your number to log into the cellphone provider’s app and convince you to give them your OTP. They then purchase data for a large amount.

Never share your OTP with anyone. If you are not sure whether it is a genuine call, contact your service provider directly.

Email scams

This is when you get an email from what appears to be a trusted source, asking you to click on a link in the email. In some cases, it is a phising scam, trying to obtain personal information from you, or it may contain malicious malware that can infect your computer.

For example, an email that appeared to be from the Managing Director of the Banking Association was sent out to journalists with a link to complete a form.  The Banking Association confirmed it was a fraudulent email and warned recipients to delete it immediately.

The best advice is to never click on a link directly in an email unless you have independently contacted the sender telephonically to confirm the email’s legitimacy.

This article first appeared in City Press.