In short: Criminals target online banking with phishing, malware and SIM swaps so they can steal logins and OTPs. Your bank will not ask you to “confirm” your full password or OTP in a random email, SMS or WhatsApp. If money moves without your say-so, call your bank’s fraud line immediately, then open a SAPS case. Practical tips below follow SABRIC’s stay-safe guidance. Not financial advice.
Source: SABRIC — How to Stay Safe.
What criminals try
SABRIC groups common internet-banking attacks like this:
- Phishing: fake bank emails or sites that harvest usernames, passwords, card details or OTPs
- Malware: software on your phone or computer that steals banking credentials or keystrokes
- SIM swap / number port: taking over your number so OTPs, TVCs or RVNs go to the criminal
- Vishing / SMishing: phone calls or SMS messages that pressure you into sharing confidential details or tapping a bad link
Once criminals have your login and an OTP, they can add beneficiaries and move money. Speed of reporting matters more than long explanations.
Practical checklist
- Type your bank’s website address yourself — do not tap links in unexpected emails or SMSs, and do not rely on a bookmarked link that might be old
- Never share passwords, PINs or OTPs with anyone, including people claiming to be “bank security” or “tech support”
- If an OTP arrives when you did not start a transaction, do not read it out — call the bank on a number from your card or app
- Keep your phone’s OS and banking app updated; use a screen lock; log off when you finish
- Avoid banking on public computers or open Wi‑Fi hotspots
- Install reputable antivirus / antispyware and keep it current; be wary of “free antivirus” offers in unsolicited messages
- Register for SMS or push transaction notifications and check them against what you actually did
- Watch for sudden loss of mobile signal (possible SIM swap) and contact your network and bank if it happens while you bank
- Choose unusual PINs and passwords; change them if you think someone saw them; do not write them on the card or phone case
- Review statements regularly and query unknown payments the same day
If you suspect fraud
- Phone your bank’s official fraud number (from the back of your card or the bank app — not from the suspicious message)
- Ask them to freeze cards / online access as needed
- Change banking passwords from a clean device
- Open a case at SAPS and keep the case number
- Tell your mobile network if the phone or SIM was stolen or swapped
SABRIC also notes that banks will not ask you to confirm confidential information over the phone. Caller ID can be faked — hang up and redial the published fraud line.
Bank fraud hotlines (from SABRIC)
- Absa: 0860 557 557
- Capitec Personal: 0860 10 20 43
- FNB: 087 575 9404
- Nedbank: 0800 110 929
- Standard Bank: 0800 020 600 or 0860 033 269
- African Bank: 0860 000 000 or 011 256 9988
- Investec: 0860 110 161
- Postbank: 0800 53 54 55
Confirm the number on your card or bank app before you save it — scammers fake caller ID and WhatsApp profiles.
Related
Make money online — what’s legit · Crypto regulations
Last checked: September 2026 against SABRIC How to Stay Safe. Confirm fraud numbers with your bank. Not financial advice.