South Africa’s R2.4bn Digital Banking Fraud Problem Puts Payment Security in Focus

By Contributor

South Africans lost R2.4 billion to digital banking crime in 2025, up from R1.9 billion the previous year, according to the South African Banking Risk Information Centre (SABRIC). Banking app-related crime accounted for over 70% of reported losses, underscoring the risks of expanding digital financial services.

The figures pressure banks to move beyond post-incident response and detect suspicious activity before money leaves customer accounts. Criminals increasingly exploit trust through impersonation and social engineering, persuading victims to share credentials or approve transactions themselves.

Learning from Vietnam’s Warning System

At BPC’s client conference in Cape Town, industry executives and a Vietnamese central bank representative discussed technology, information sharing and customer education as countermeasures.

Vietnam recorded over US$300 million in online fraud losses in 2025, according to Nguyen Trung Anh of the State Bank of Vietnam. The country’s Suspicious Transaction Information Management System (SIMO) lets financial institutions share data on accounts, cards and merchants flagged for suspected fraud. When customers initiate transfers, participating institutions can check recipient risk status and warn them before completion.

By July 2026, SIMO had issued 4.9 million warnings, with customers cancelling or pausing 1.6 million suspected scam transactions, protecting approximately US$200 million. Vietnam also uses biometric verification and national population database checks for customer identification.

South Africa already has industry collaboration against scams, and the Reserve Bank’s Payments Ecosystem Modernisation programme addresses interoperability and fraud frameworks. However, this does not constitute a national warning system equivalent to SIMO.

Cross-Channel Detection Needed

Imran Vilcassim, BPC’s global chief commercial officer for digital banking, argued banks should adopt integrated approaches covering digital banking, card payments and internal systems rather than treating each channel separately. He suggested starting with priority channels and expanding capabilities over time.

Ilyas Berrajaa, BPC’s managing director for Africa, noted fraud methods differ across channels, requiring systems that account for those variations. AI and machine learning can identify unusual patterns, but must form part of broader fraud management strategies.

Banks face a commercial balancing act: stronger checks prevent losses but poorly designed controls delay legitimate payments. Neither executive provided independently verified figures on AI’s fraud reduction impact in South Africa.

Liability Questions

When customers are tricked into authorising payments, responsibility depends on circumstances. Vilcassim said sharing OTPs despite warnings may place responsibility on customers, while bank negligence may shift liability to institutions. Investigations are needed to establish facts.

Berrajaa emphasised customer and employee education alongside technology investment, though education alone cannot replace security controls.

Financial Inclusion Implications

As digital services expand, banks must serve customers without smartphones or reliable internet. Vilcassim cited agent banking—partnerships with local businesses—as a way to reach older people and rural communities. Open banking could simplify experiences by consolidating accounts from different institutions, though data protection questions arise.

Cross-Border Challenges

Cross-border payments face varied regulatory requirements and systems across African countries. BPC offers a unified payment hub supporting SWIFT, ISO 20022 and international remittances. Vilcassim said BPC plans to establish a South African subsidiary and develop local talent, identifying Standard Bank as a customer. These remain stated intentions.

South Africa’s R2.4 billion in reported losses demonstrates the problem’s scale. The test for banks and policymakers is whether better information sharing, stronger detection and clearer safeguards can prevent losses before transfers become irreversible.