Major warning for people who bank, shop online in South Africa

 By Myles Illidge

In 2024, digital fraud incidents grew at an alarming rate in South Africa, with phishing, online shopping scams, and mobile malware being some of the biggest online threats to consumers and businesses in the country.

Incidents of banking app and SIM swap fraud have also risen significantly.

According to data from TransUnion, nearly 5% of all attempted digital transactions originating in South Africa in 2024’s first half were suspected to be fraudulent.

It also cites a survey in which six in 10 respondents said they were recently targeted by fraud, with many attacks arising from the telecommunications, financial, and online communities.

For reference, online communities include forums and online dating platforms.

TransUnion’s data shows that digital fraud attempts within the telecommunications sector where the most prevalent.

While it doesn’t specify the most common methods of committing fraud in the telecommunications sector, a potential contributor is a substantial loophole in mobile operators’ SIM swap procedures.

In November 2024, the Communication Risk Information Centre (Comric) warned about a surge in SIM swap fraud in South Africa, with CEO Advocate Thokozani Mvelase calling for more vigilance in the space.

Through vulnerabilities in SIM swap processors, malicious actors can take control of a victim’s phone number to intercept sensitive communications, such as one-time PINs for transactions and banking credentials.

This enables fraudsters to steal funds from bank accounts and commit identity theft.

The vulnerability stems from a loophole where a SIM swap requires the account holder to actively opt out of a SIM swap request; otherwise, it will be approved.

This is problematic when customers are travelling internationally without SMS roaming or when they’re staying in different time zones and aren’t awake to opt out of the SIM swap.

Businesses and consumers in South Africa are vulnerable to this form of attack, which is a significant concern in the country’s fight against fraud.

“This is a direct attack on the trust and security of our digital systems,” said Mvelase.

“The emotional and financial impact on victims is devastating, and the consequences ripple through families, businesses, and the broader economy.”

Comric noted that this was already a significant problem last year, with data from the South African Banking Risk Information Centre showing that SIM swap incidents accounted for almost 60% of mobile banking fraud cases in 2023.

Comric also warned about a marked increase in phishing attacks, social engineering scams, and fake investment schemes.

In October 2024, Kaspersky principal security researcher David Emm told MyBroadband that phishing, online shopping scams, and mobile malware were also of significant concern.

“Regardless of intent or cause, the consequences of a web threat may damage both individuals and organisations,” he said.

Emm said South Africa ranked 28th in the world in terms of risk of being attacked by web-borne threats during the period between July and September 2024.

He said Kaspersky products blocked nearly 3.4 million different Internet-borne threats on computers connected to the Kaspersky Security Network in South Africa.

“Overall, 23.8% of users were attacked by web-borne threats during this period,” added Emm.

Emm listed several proactive measures South African residents and businesses can take to protect themselves from various kinds of cyber threats.

This includes keeping software up-to-date, verifying URLs and senders, and being aware of the types of threats out there.

Kaspersky recommends only opening emails and links when they are sure they can trust the sender. However, if the sender is legitimate but the content is unusual, it is best to contact the person via another form of communication to confirm.

Regarding online shopping scams, it is best to check URLs closely to ensure there are no typos that you may miss at first glance.

“If you have any doubt, don’t click the link; instead type the address yourself using the known, trusted URL for that online service,” said Emm.

To protect yourself from malware, it is best to only download software for computers or mobile devices from official stores or the vendor’s website.

However, he noted that while apps on app stores aren’t always failsafe, they are monitored by moderators, so there is some form of filtration.

“Not every app can get onto these stores,” said Emm.

Furthermore, it is important to check the permissions granted to apps on your devices and to think carefully before providing apps with high-risk permissions, such as Accessibility Services.

Source: MyBroadband