South Africa (ZA)
South Africa combines English-friendly professional life, major finance and tech hubs, relatively affordable private healthcare and housing, world-class nature, wine regions and a complex but vibrant post-apartheid society.
Scam Warnings
Common scams targeting expats in South Africa.
South Africa has one of the world's highest rates of SIM-swap fraud — accounting for nearly 60% of mobile banking breaches — and the telecommunications industry lost an estimated R5.3 billion to SIM-swap and related identity fraud in 2024 alone. Scams combine sophisticated social engineering, impersonation of SARS, banks, SAPS, Home Affairs, and couriers, with physical threats including express kidnapping. South Africa is NOT in SEPA; EU consumer-protection reversal rights do not apply. Report financial fraud to your bank first, then SAPS (10111). SAFPS (safps.org.za) provides identity-fraud protection listings. FIC (fic.gov.za) handles money-laundering and financial-crime intelligence.
SIM swap fraud — phone number hijacked to drain bank accounts
criticalCriminals obtain enough personal information (often from data leaks or social engineering) to convince a mobile operator (MTN, Vodacom, Cell C, Telkom) to port or duplicate your SIM. They then intercept all bank OTP codes and approve transactions, emptying accounts before the victim realises. Nearly 60% of mobile banking fraud in South Africa is SIM-swap related. South Africa deployed the Scam Signal platform in October 2025 — a collaboration between banks and operators — to detect fraudulent SIM swaps in real time.
- - Your phone suddenly loses all signal (no calls, no data, no SMS) unexpectedly
- - You receive an unexpected "SIM swap completed" SMS from your operator
- - Bank login alerts or transaction notifications arrive when you did not initiate anything
- - You can no longer receive OTPs for banking
- - Social engineering call fishing for personal details (ID number, banking passwords) preceding the swap
Vishing — "bank fraud department" phone scam
criticalCaller claims to be from your bank's fraud team, warns of a suspicious transaction, and asks you to "verify" by approving a transaction on your banking app, sharing an OTP, or installing AnyDesk/TeamViewer remote access. The caller may know your partial ID number, last 4 card digits, or recent transaction amounts from purchased data.
- - Urgent pressure: "act now or your account is compromised"
- - Asked to approve a transaction to "reverse" or "cancel" fraudulent activity
- - Remote-access app download request (AnyDesk, TeamViewer, QuickSupport)
- - Caller knows partial personal details but cannot verify your full banking password
- - Call arrives from an unusual number or spoofs your bank's number
Rental fraud in Cape Town, Johannesburg and Durban
criticalSouth Africa's severe housing shortage makes rental fraud extremely prevalent. Fake listings use stolen photos to advertise attractive properties at below-market prices. Scammers impersonate estate agents, demand deposits before viewings, and disappear. Particularly targets newly arrived expats and foreign students who cannot easily do in-person checks.
- - Landlord or agent claims to be overseas and cannot show the property in person
- - Deposit or holding fee requested before a signed lease or viewing
- - Price significantly below comparable properties in that area
- - Listing photos appear on other sites (reverse-image search)
- - Agent cannot provide PPRA (Property Practitioners Regulatory Authority) registration number
- - Only communicates via WhatsApp with constant pressure
SARS refund / tax debt phishing
criticalFake SARS emails or SMS messages claim you are owed a refund or owe urgent tax debt, linking to convincing phishing pages that capture eFiling credentials and card details. Threats of immediate arrest or asset seizure are used to panic victims.
- - Link in message is not sarsefiling.co.za
- - SARS never sends refund links by SMS or contacts you from a personal mobile number
- - Threats of immediate arrest — SARS uses formal legal processes, not same-day threats
- - Requests card details or banking credentials
- - Sender email domain does not match sars.gov.za
Debit order fraud / unauthorised debit orders
criticalOne of South Africa's most common banking frauds: your bank account details are used to load fraudulent debit orders by fake "subscription" services or criminal networks. Often discovered only after multiple monthly deductions. Particularly affects accounts where EFT details have been exposed online or in data breaches.
- - Unexplained debit orders appearing on your statement from companies you do not recognise
- - Multiple small deductions (R99–R299) from unfamiliar service names
- - Bank statement shows a debit order you never authorised
- - Victim has recently shared banking details online or via phishing
Advance-fee / "419" fraud and lottery scams
criticalSouth Africa is both a major origin and target country for advance-fee fraud. Victims are told they have won a lottery, inherited wealth, or can share a large fund — but must pay upfront "fees," "taxes," or "legal costs" to release the money. Losses escalate as victims are convinced to pay increasingly large sums.
- - Unexpected notification of a lottery win, inheritance, or business opportunity you did not enter
- - Request for upfront "processing fee," "customs clearance," or "legal tax"
- - Pressure not to tell family or attorneys
- - Contact escalates in urgency and fee amounts
- - Requests wire transfer, gift cards, or cryptocurrency
Ponzi and investment scheme fraud
criticalSouth Africa has a high rate of Ponzi and pyramid scheme fraud. The NPA's Asset Forfeiture Unit reported multiple cases in 2025, including fake "ant farm" and "livestock investment" schemes. Schemes often target communities via social media, church networks, and WhatsApp groups, with early investors paid out from new recruits' funds to build credibility.
- - Guaranteed monthly returns of 10–40% — no legitimate regulated investment offers this
- - Referral bonuses for recruiting new investors
- - Investment "platform" is not licenced by the FSCA (Financial Sector Conduct Authority)
- - Cannot independently verify where funds are invested
- - Withdrawal requests are delayed or met with excuses
ATM card skimming and "helpful stranger" distraction
criticalSkimming devices fitted to ATM card slots clone your card; a hidden camera captures your PIN. Separately, strangers offer to "help" at ATMs, distracting you to observe your PIN or swap your card. Both result in card credentials being used to drain accounts.
- - ATM card slot feels loose, bulkier than usual, or has an extra attachment
- - A stranger approaches to offer help, even if friendly
- - Shoulder surfing — someone standing unusually close
- - Card is retained by the machine unexpectedly
- - ATM is standalone in a poorly lit or unmanned location
Home Affairs / visa fixer scam
criticalAgents claim to have "internal contacts" at Home Affairs (DHA) who can guarantee visa approvals, speed up permit processing, or bypass official queues for cash payments (R5,000–R50,000+). Many are complete fraudsters; some are corrupt insiders. Victims lose money and may have fraudulent applications submitted in their name.
- - Guarantees a specific visa outcome — no legitimate practitioner can guarantee this
- - Requests original passports to be held for extended periods
- - Cash-only and no written mandate or receipt
- - Offers to submit false information on your behalf
- - Cannot show accreditation with the Immigration Practitioners Association of South Africa (IPASA)
Fake proof of payment (POP) in marketplace transactions
warningA buyer sends a WhatsApp screenshot of a fake bank transfer confirmation. The seller hands over goods before checking their account. By the time the fraud is discovered, the buyer has disappeared. Common on Facebook Marketplace, Gumtree, and peer-to-peer deals.
- - Payment not reflected in your banking app after the screenshot is shown
- - Screenshot shows an odd time or incorrect reference
- - Buyer creates urgency to take the goods before payment clears
- - Email confirmation of payment comes from a non-bank domain
Reporting
Where to report: Police emergencies: 10111 (SAPS). Cybercrime tips: SAPS cybercrime unit — saps.gov.za. Financial fraud: your bank's fraud line immediately, then SAPS 10111. SAFPS (Southern African Fraud Prevention Service) for identity-fraud listings: safps.org.za. FIC (Financial Intelligence Centre) for money-laundering and financial crime intelligence: fic.gov.za. FSCA for investment fraud: fsca.co.za. NCC (National Consumer Commission) for consumer disputes: thencc.org.za.
Consumer helpline: SAPS: 10111 (emergency) | Ambulance: 10177 | Universal emergency: 112. SAFPS: safps.org.za. FIC: fic.gov.za. NCC: thencc.org.za or thencc.gov.za. FSCA (investment fraud): 0800 110 443 | fsca.co.za. SARS phishing: phishing@sars.gov.za.