A South African online banking fraud case involving approximately R21.55 million provides a useful illustration of how modern scams combine several familiar tricks.
According to the National Prosecuting Authority, the scheme involved WhatsApp impersonation, a fake bank fraud department and malicious links. Victims were persuaded to interact with people pretending to be legitimate banking personnel before money was transferred without authorisation.
None of those techniques is particularly new on its own. The danger comes from combining them.
A scammer does not necessarily need to defeat a bank's technical security directly. Instead, the attacker can try to persuade a person to reveal information, approve an action or follow a link. The scam then uses the victim's legitimate access to move closer to the money.
The case is a reminder that a message appearing to come from a bank is not proof that it actually came from the bank. Caller ID, WhatsApp profiles, logos and professional-looking websites can all be used to create false confidence.
The safest response to an unexpected fraud warning is to stop the conversation and contact the bank through a trusted channel you already know. Do not use the telephone number, link or email address supplied by the suspicious message.
The NPA case also demonstrates that digital fraud can become a criminal and asset-recovery matter long after the initial transfer has happened. For users, the best opportunity to stop the loss is still before the money moves.