EFT scam in South Africa

What to do if your bank transfer payment is intercepted by a hacker

A few years ago a foreign woman in Johannesburg who was moving back to her home country disposed of large household items via Gumtree. She was slightly concerned when the buyer of her double bed asked to meet her on a street corner to collect the bed rather than coming to her home, but she had already received the proof of payment so she ignored her own disquiet. When the money had still not reached her bank account a few days later, she did a bit more digging and realised the proof of payment was inconsistent with the format used by that particular bank and was a complete fabrication. She was defrauded out of the money owed to her for the bed, and the “buyer” most likely sold it on and pocketed the cash. The converse may also happen: you make a purchase (often online) from a legitimate retailer and pay by EFT, but your funds are diverted to a hacker’s account. You only discover the fraud when you chase your supplier for your missing delivery. The knowledge that you may have paid money into a scammer’s account produces a sinking feeling, often followed by panic. It happens quickly: an invoice or proof of payment looks genuine (like our Johannesburg bed seller), a WhatsApp message creates urgency, or a trusted email thread turns out to have been intercepted.

If you have been caught in an EFT scam in South Africa, the uncomfortable truth is that recovery is not guaranteed. EFT payments are usually difficult to reverse once the money has cleared and moved on. But early, organised action can make a difference. The first 24 to 72 hours are about speed, evidence and escalation.

What counts as an EFT scam?

An EFT scam is any fraud where you are prompted to transfer money electronically to the wrong person or account. The payment may have been authorised by you, but the authorisation was obtained by deception.

Common examples include fake proof of payment scams, online marketplace scams, supplier bank detail changes, business email compromise, fraudulent invoices, fake rental deposits, romance scams, investment scams, or scammers pretending to be a bank, attorney, estate agent, supplier or government department.

In law, the issue is not simply that money was transferred. The offence is the misrepresentation that caused the transfer. In many cases the conduct may constitute fraud in South African law. Where computers, email interception, false digital documents or compromised access credentials are involved, the Cybercrimes Act may also be relevant.

First 24 hours: contact your bank immediately

Your first call should be to your bank’s fraud department. Do this immediately, even if you are embarrassed, unsure, or still hoping the payment will resolve itself. The longer you wait, the greater the chance the money will be withdrawn, transferred again, converted, or layered through other accounts.

Ask the bank to log the matter as suspected fraud, attempt an urgent recall, contact the receiving bank, and place any available hold on the funds if they are still traceable. Use the bank’s official fraud hotline or app support channel. Do not use phone numbers supplied in the suspicious email, invoice or WhatsApp message. Give the fraud department:

• Transaction date and time
• Amount paid
• Recipient account name, bank, branch code and account number
• Proof of payment or transaction reference
• The email, invoice, message, advert or document that invited payment
• Any cell phone numbers, email addresses, URLs or social media profiles used by the scammer
• Your contact details and ID information if required by the bank

Ask for a case or reference number. Write down the time of each call, the name of the person you spoke to, and what the bank agreed to do. This record may matter if there is a dispute about whether the bank responded properly.

Do not assume the bank can reverse the EFT

Many victims are surprised to learn the transfer cannot be reversed. A credit card payment may sometimes have a chargeback route. An ordinary EFT is different. According to the National Financial Ombud, chargeback rules deal with card transactions, not internet banking transfers. In practical terms, an EFT is treated like a cash transfer once it has cleared.

However, the bank is not powerless. A bank may still be able to assist with an urgent recall request, beneficiary bank notification, fraud investigation, account restriction, or internal escalation. Ask the bank to attempt an urgent recall and fraud hold. But don’t assume there is a guaranteed right of reversal.

First 48 hours: report the matter to SAPS

Once the bank has been notified, report the matter to SAPS. Take evidence with you. SAPS will take your statement, open a case docket and register the matter on the Crime Administration System. You will receive a CAS number, which you will need for bank escalations, insurance claims, legal correspondence and follow-up.

It is not enough to say, “I was scammed.” Explain who contacted you, what was represented, what you believed, what payment you made, when you discovered the fraud, and what steps you have already taken with the bank.

If the matter involves email interception, false digital documents, unauthorised access to an account, fake proof of payment, or use of access credentials, mention the possible cybercrime element. The Cybercrimes Act criminalises conduct such as cyber fraud, cyber forgery and unlawful use of passwords or access codes in appropriate cases.

First 72 hours: preserve evidence properly

Evidence can be damaged by measures taken in a panic. Despite the understandable desire to remove the suspicious email from your system, resist the urge to delete it. Don’t block anything without taking screenshots or reset any devices before preserving the trail. If your email may have been compromised, get technical help. But first preserve what you can.

• Save emails in original form where possible, not only as screenshots
• Export or preserve WhatsApp chats with timestamps
• Keep the invoice, proof of payment, advert, URL, profile and all bank notifications
• Take a screenshot of the account details before any advert or page is removed
• Record phone numbers and call logs
• Do not communicate further with the scammer except on legal advice

If a business email compromise is suspected, the email headers and metadata may become important. A forensic IT consultant may investigate larger matters, especially where a business, conveyancing transaction, supplier payment or high-value invoice was involved.

What about a fake proof of payment?

Fake proof of payment scams are common in online sales and small business transactions. A scammer sends a convincing payment confirmation and pressures the seller to release goods before the funds clear. The proof may contain bank logos, a reference number and seemingly correct details. That does not make it real, as our bed seller found out to her cost.

The rule is simple: do not release goods, services or documents just because someone sends proof of payment. Confirm that cleared funds are available in your account. If the buyer is creating urgency, sending a driver, refusing to wait, or asking for a refund based on an “overpayment”, treat the matter as high risk.

What if the scam involves changed banking details?

Scams concerning changed bank details are particularly dangerous because they exploit trust. A fraudster may intercept an email thread, alter an invoice, spoof a supplier, or pretend that a known creditor has changed bank accounts.

The safest practice is to verify bank details through a separate channel before making payment. Phone a known contact number already on record, not the number in the suspicious email. For businesses, internal payment controls should require independent verification for new beneficiaries or changed banking details.

Should you complain to the bank or the National Financial Ombud?

If you have a genuine basis for complaining about the bank’s conduct, lodge a formal complaint with the bank through its internal complaint process. Ask for a written response. If the complaint is not resolved, you may be able to escalate it to the National Financial Ombud.

The complaint needs to be specific. For example: did the bank delay after being notified? Was there failure to action a fraud hold? Was there a system or communication breakdown? Did the bank neglect to follow its own fraud reporting process? Be clear about the bank’s actions and your expectations.

Can a lawyer help recover the money?

Legal recovery depends on speed, traceability, evidence and proportionality. If the recipient account is known and funds could still be present, urgent correspondence or court action may be considered. If the scammer can be identified, a civil claim may be possible. If the money has moved through multiple accounts or offshore platforms, forensic tracing might be indicated.

But legal action cannot guarantee restitution. In smaller matters, the cost of urgent litigation may exceed the likely recovery. In higher-value cases, especially business email compromise, property transactions, supplier fraud, investment fraud or cryptocurrency scams, early legal advice can preserve the evidence and help determine the correct course of action.

Identity protection and secondary fraud

If you gave the scammer your ID, proof of address, bank statements, login credentials, OTPs, SIM information or other personal documents, the risk may not end with the first payment. You may also face identity theft, accounts opened in your name, fraudulent credit applications, or further impersonation attempts.

In that situation, consider protective steps through the South African Fraud Prevention Service. SAFPS offers Protective Registration for people whose identity information may have been compromised. You should also change passwords, secure your email account, enable multi-factor authentication, notify your bank, and monitor your credit profile.

Practical checklist: the first 24-72 hours

• Immediately: phone your bank’s fraud department and request an urgent recall, fraud hold and beneficiary bank notification
• Same day: collect the transaction reference, proof of payment, invoice, messages, emails, phone numbers and account details
• Within 24 hours: open a SAPS case and obtain a CAS number
• Within 48 hours: lodge a formal written complaint or follow up with the bank if its fraud response is unclear
• Within 72 hours: preserve digital evidence, secure your email and banking access, and consider SAFPS Protective Registration if identity documents were shared
• For higher-value matters: obtain legal advice before evidence is lost or funds move further

How SD Law can help

At SD Law, we assist victims of fraud, cybercrime and urgent financial disputes. Depending on the facts, this may include advising on evidence preservation, bank escalation, SAPS reporting, urgent correspondence, civil recovery options, or coordination with forensic or regulatory channels.

If you have lost money through an EFT scam, fake proof of payment or business email compromise, act quickly. Contact Simon on 086 099 5146 or email sdippenaar@sdlaw.co.za for a confidential discussion.

Frequently asked questions

SD Law – Simon Dippenaar & Associates Inc.

Attorneys, Notaries & Conveyancers

SD Law is a Cape Town law firm with a strong practice in divorce and family law, urgent eviction matters, antenuptial contracts, liquor licence applications and selected commercial disputes. Clients instruct us when the matter is urgent, high-stakes or strategically sensitive, and when they want direct, clear legal advice backed by practical litigation experience.

Read articles