WhatsApp fraud warning for South Africans 

Criminals are increasingly using WhatsApp as their weapon of choice to trick South Africans into sending them money.

South Africans lost R2.4 billion to digital banking crime in 2025, up 29.2% from the previous year, according to the South African Banking Risk Information Centre’s (SABRIC) 2025 Annual Crime Statistics Report.

The losses were recorded across 110,000 incidents. SABRIC said much of the fraud involved social engineering. 

This is a scam tactic where criminals persuade victims to approve transactions or provide access to their accounts themselves.

The organisation warned consumers to verify payment requests received through platforms such as WhatsApp before sending money.

One common scam starts with a message that appears to come from a family member.

For example, “Hi Mom, my phone broke. This is my new number, please save it.”

The criminal then asks for money, often claiming that their banking app is not working on the new phone or that there is an urgent expense to pay.

The request is designed to create a sense of urgency before the recipient has time to question it.

“A criminal has no need to hack anything when a parent will open the banking app for them,” explained Integrity360 Group CTO Richard Ford.

“The whole trick runs on ten minutes of panic. They invent an emergency and count on the parent paying before anyone picks up the phone to check.”

A simple call to the family member’s existing number can expose the scam. As such, Ford said families should make verification a habit before money changes hands.

“Set a family rule now, while nobody is panicking. Any request for money gets confirmed by a call you make to a number you already trust, however urgent it sounds. Some families add a code word only they know,” he said.

“A child who really is stranded will understand why you want to hear them first. If you can’t reach them, wait until someone else has confirmed it.”

Criminals are taking over real WhatsApp accounts

Unfortunately, the scam becomes more difficult to detect when criminals compromise a legitimate WhatsApp account. 

In this case, the criminal may persuade the account owner to share the six-digit registration code that WhatsApp sends by SMS.

Once the criminal gains access, they can message people in the victim’s contact list using the genuine account, profile picture, and existing conversation history.

“Your daughter’s name and photo sit at the top of the chat, with years of family messages underneath,” Ford said.

“Parents trust that thread completely, and whoever has taken over the account inherits all of that trust.”

This can make the request appear more legitimate than a message from an unknown number. Criminals can also use information available on social media to make their messages more convincing.

Posts about a child’s matric dance, gap year, new job, or travel plans can provide enough information to create a believable emergency.

Criminals can gather information from social media, public profiles, and other online conversations.

To avoid falling victim to these scams, Ford advised consumers not to rely on a WhatsApp message, voice note, or incoming call from a new number to verify a payment request.

Instead, the person receiving the request should make the call themselves using a number they already have saved.

For a compromised WhatsApp account, the family member can also be contacted via SMS, a regular phone call, or by someone else who is physically with them.

Ford added that voice cloning has also made voice messages less reliable as proof of identity.

“Voice cloning means ‘it sounded just like him’ has stopped being a safe test. A code word is the one thing a criminal can’t lift from a voice note or a video posted online,” he said.

How South Africans can secure their own WhatsApp accounts

Consumers should also protect their own WhatsApp accounts. WhatsApp registration codes should never be shared with anyone, even if they claim to be helping with an account issue.

Users can also enable two-step verification, which requires a password and adds another layer of protection if a criminal obtains the registration code.

“If your WhatsApp account has been compromised, warn your contacts through another channel so they don’t fall for the same scam, and tell the family about any attempt, even if nobody paid,” Ford said.

This is important because the criminals may immediately begin contacting people in the compromised account’s contact list.

Consumers who have already transferred money should contact their bank’s fraud department immediately. They should use the fraud number listed in the bank’s official app or on the back of their bank card.

SABRIC said criminals often move stolen funds rapidly through several accounts, meaning delays can make it harder for banks to trace and potentially recover the money.

The risk also extends beyond families. When an employee’s WhatsApp account is compromised, criminals can use it to contact colleagues, customers, or suppliers who may already trust the account holder.

Ford stressed that businesses need incident-response procedures for compromised accounts in place before an attack occurs, because the response becomes time-sensitive as soon as the incident is detected.