The scams costing South Africans the most are often the hardest to spot, according to Carla Wilby, co-founder and chief technology officer of fraud prevention company Orca Fraud.

The caller sounds exactly like your bank, and by the time something feels wrong, the money has gone. "These are crimes designed to bypass the usual cybersecurity precautions, so consumers need to think about limiting access to their money as well as spotting suspicious activity," she says.

Her advice for Cybersecurity Awareness Month is to set up protection before the scam happens.

The numbers explain why spotting the scam is no longer enough. Digital banking crime claims reached R2.41 billion in 2025, up 29.2% in a year, according to the South African Banking Risk Information Centre. The banking app was involved in 89% of cases, but SABRIC says that does not mean the apps were hacked. In many cases, criminals talked customers through legitimate payments in real time.

Wilby's first step targets exactly that: keep only short-term spending money in your everyday account and move the rest into a notice deposit account, which takes time to withdraw from. A scammer can only move money within reach, and the notice period gives you or your bank time to notice. Where the app allows it, hide balances you do not use day to day, so a caller coaching you through the app cannot see how much to ask for.

Second, use virtual cards. Card-not-present fraud was the largest source of card fraud losses last year at R780.5 million, and many card details leak through breached online shops rather than anything the customer did. All five big banks offer free virtual cards, so create one per service and delete it if that merchant is breached.

Third, switch on remote lock and wipe now, because neither works if you enable it after the phone is stolen, and block the SIM separately after a theft. Make sure you still know your actual banking username and password, not just your face scan, since that is how you block cards from another device.

Fourth, agree on a family safe word that has never appeared anywhere publicly, paired with a rule: if any call or message asks for money, hang up and call back on a number you already have. That defeats a cloned voice and a "new number" message alike.

SABRIC's 2025 Annual Crime Statistics Report is the source of the claim and card fraud figures, and notes that digital banking crime moved rapidly from first contact to financial loss. BusinessTech reported that account takeover losses rose 66.7% on credit cards and more than quadrupled on debit cards, usually starting with phishing or calls from fake bank officials. IOL carried SABRIC's warning that social engineering, impersonation and AI-enabled scams now drive most digital banking crime rather than attacks on bank systems.

This is the practical end of an argument we made when we looked at why scam advice keeps failing: when a fraudulent call looks identical to a real one, telling people to be vigilant puts the job on the person least able to do it. Wilby says as much herself: "Customer education can only do so much when the scam itself is engineered to be imperceptible, even to trained professionals."

What makes her list useful is that none of it depends on noticing anything in the moment. Each step is a one-off setting that limits how far a scammer can reach, and most take a few minutes.

Banks are building their own defences too, from Capitec's beneficiary scoring to in-app call verification, but the cheapest protection is still a notice account most customers do not know they should have.

For businesses, the family safe word idea transfers directly: any payment request by phone or message, however familiar the voice, gets verified by calling back on a known number.

You might also like our piece on AI-built SARS eFiling scams, Truecaller's free scam checker, and the RelyComply breach that exposed identity data held by a compliance provider.

Get more SA tech and business news and subscribe to The Open Letter.