Festive Scams & Personal Cybersecurity:
How to Verify Before You Trust

According to SABRIC’s 2025 annual crime statistics, digital banking crime cost South Africans about R2.4 billion in 2025, up from roughly R1.9 billion the year before, with more than 100 000 reported incidents. The important finding is not the number. It is how it happened: mainly through social engineering — impersonation, phone calls, remote-access software and false payment instructions — rather than by breaking into bank systems.

In other words, the attack surface is you. That is good news, because it means the defence is a habit you control. This guide explains the scams you will see this December, the one verification routine that defeats almost all of them, and what to do in the first hour if you are caught.

The Rule That Stops Most Scams: Stop, Separate, Verify

1. Stop. Urgency is the tell. “Your account will be closed in 30 minutes”, “the parcel will be returned today”, “I’m in trouble, please send money now”. Every scam needs you to act before you think.
2. Separate. End the contact. Hang up, close the chat, don’t click the link. Never verify a request through the same channel it arrived on.
3. Verify. Contact the organisation or person through a channel you choose: the number on the back of your card, the bank’s own app, the official website typed in yourself, or the number already saved for your family member.

Professional protection teams run exactly this routine for every unexpected request touching a principal: a call from “the hotel”, a change to a pick-up time, a new driver’s name. If it didn’t come through a known channel, it isn’t confirmed.

Eight Scams to Expect This December

1. The “bank fraud department” call

A caller who knows your name, and sometimes your card’s last digits, says there is suspicious activity. To “reverse” it, you must read out an OTP, approve a notification in your app, move money to a “safe account”, or install an app so they can “help”. Your bank will never ask for any of these. Hang up and call the number on the back of your card — ideally from a different phone, or after waiting a minute, in case the line is held open.

2. Delivery and customs SMS

“Your parcel is on hold, pay R25 customs fee” with a link. The small amount is a decoy; the real goal is your full card details and OTP. Track deliveries only in the retailer’s or courier’s own app.

3. WhatsApp account takeover

“Sorry, I sent you a code by mistake, please forward it.” That code is WhatsApp’s verification code for your number. Once they have it, they take over your account and message your contacts asking for money. Turn on two-step verification in WhatsApp settings today; it adds a PIN that the code alone can’t bypass.

4. SIM swap

A criminal persuades your network to move your number to their SIM, then receives your OTPs. The warning sign is your phone suddenly losing signal for no reason. Phone your network and your bank immediately from another phone. Ask both about SIM-swap protection, and prefer app-based approvals over SMS OTPs where your bank offers them.

5. Fake holiday rentals and event tickets

A beautiful coastal house at a good price, available only if you pay a deposit by EFT today. Book through established platforms and pay inside them, ask for a live video walk-through, and never pay a deposit to a personal account. Buy event tickets only from the official seller.

6. Fake online stores and marketplace “buyers”

Black Friday falls on 27 November 2026, and copy-cat stores appear weeks before it. Check the domain carefully, look for reviews off the store’s own site, and pay by card rather than EFT so your bank can dispute the charge. Selling on a marketplace? A “buyer” who sends you a link to “receive payment” or arranges “their courier” is phishing for your card details.

7. “Hi Mum, this is my new number” and AI voice clones

A message or even a voice note that sounds like your child or parent, in an emergency, needing money now. Voice cloning makes this far more convincing than it used to be. Agree a family code word, and always call back on the number you already have.

8. Changed banking details on an invoice

For small businesses and anyone paying a builder or school: an email, apparently from a supplier you know, says their banking details have changed. Before you pay any new details, phone the supplier on the number you already had — not the one in the email.

Harden Your Accounts in 30 Minutes

• Password manager and a unique password for every account. Reused passwords are how one breach becomes ten.
• Two-factor authentication on email, banking and social media, using an authenticator app or passkey rather than SMS where available. Your email account is the master key to everything else; protect it first.
• Banking app limits and notifications: low default transfer limits, and an alert for every transaction.
• A separate card for online shopping, or your bank’s virtual card, with a low limit.
• WhatsApp two-step verification and a SIM PIN.
• Update your phone and apps, and only install apps from the official stores.
• Lock down what you share publicly: ID number, date of birth, home address, children’s schools, and the pet’s name you use in your security questions.
• Avoid banking on public Wi-Fi; use mobile data.

If It Has Already Happened: The First Hour

1. Call your bank’s fraud line using the number on the back of your card and ask them to block cards and accounts. Speed matters more than anything else.
2. Change passwords from a device you trust, starting with email, then banking, then everything else. Sign out of all other sessions.
3. Call your network if you suspect a SIM swap.
4. If your ID was exposed, apply for free Protective Registration with the Southern African Fraud Prevention Service (SAFPS) so lenders know to check that it is really you.
5. Open a case at SAPS. Cyber fraud is a crime under the Cybercrimes Act 19 of 2020, and your bank and insurer will usually need the case number.
6. Keep the evidence: screenshots, numbers, links, bank references. Don’t delete the chat.

For Executives and High-Profile Families

For people with a public profile, the digital and physical threat are the same threat. A criminal who plans a hijacking or kidnapping usually starts online: your address from a property listing, your routine from your children’s social media, your travel from a conference agenda. A serious threat assessment should look at what a hostile person can learn about you from open sources, before it looks at the fence.

Save These Numbers

Put them in your phone now, and in the phones of anyone in your household old enough to use one.

Frequently Asked Questions

Sources: SABRIC Annual Crime Statistics 2025 (published August 2026); Southern African Fraud Prevention Service; Cybercrimes Act 19 of 2020.