The globalised economy means that online fraud has become globalised too, with organised syndicates from all corners of the globe trying out new scams all the time. Wojtek Wierzycki, Sygnia’s Head of Systems & Development, outlines the top scams to be on the lookout for.
The globalised economy means that online fraud has become globalised too, with organised syndicates from all corners of the globe trying out new scams all the time. Wojtek Wierzycki, Sygnia’s Head of Systems & Development, outlines the top scams to be on the lookout for.
Another day, another scam. That’s what it feels like in financial services, a top target for global fraudsters due to the sector’s digital-first approach and, of course, its direct access to money. It’s increasingly tough to keep up with evolving, sophisticated and increasingly creative cons, so I recommend everyone educate themselves on how to spot a scam 6 tips to spot a scam and add extra layers of security by following my 15 extra ways to safeguard yourself from scams.
Automated attacks
An automated attack is when tools or programs (bots) are used to make simultaneous and persistent attempts to compromise accounts or websites. The best way to prevent these is to make sure your passwords are complex, use biometrics (where available) and enable two-step authentication. The harder you make it for the bots, the quicker they will fail and move along.
“Overnight” online brokers
ETFs are a legitimate investment vehicle, but only if provided by a legitimate, reputable investment provider (like Sygnia!). We have seen a rise in fraud by fake forex brokers online, who rope clients into investing in ETFs. You may receive a legitimate-looking contract, bank details and other credentials, but when you ask questions or want to withdraw money, you will find the account is suddenly frozen, you have no access or your account simply does not exist.
Google Voice scam
The fraudster sees a post you’ve made online, for example when you’re selling something. They call and say they want to verify your legitimacy, asking you to read back the Google verification number they have sent to your phone. What they’re really doing is setting up a Google Voice account in your name, giving them free reign to impersonate you and pull off various frauds in your name.
Moral of the story: Never give a verification code to anyone in any format.
The pay direct pick-up
You are contacted by someone purporting to be from your bank, financial advisor or investment firm with an amazing investment offer “just for you”. They convince you to invest in this incredible opportunity (usually in haste) and provide bank details. You do the EFT, only to later find out it was a direct deposit into the fraudster’s account.
Don’t be sucker-punched: Always pay direct (using the verified website’s payment gateway, electronic collection or direct EFT).
The Covid con
The Coronavirus pandemic has presented yet another opportunity for fraudsters. Signing up for a vaccine, filling in a survey, setting close contact alert apps or applying for Covid-19 relief grants? These all often ask for personal information, including your address, phone number, identification number and email, so always check the source of the sender before handing over such details.
The SIM swap swindle
Someone calls pretending to be from Vodacom, MTN, Cell C or whichever service provider you use. They tell you someone is trying to do a SIM swap for your phone, and in order to stop it they need to ask you some security questions. Through this they gain personal information such as your birth date, address and identity number, which they use to hack your accounts or steal your identity! Sophisticated fraudsters may also steal your mobile number and assign it to a new SIM card in a phone they already control. They then use information sent to your mobile number (OTPs and other verification/authentication codes) to reset login details and steal your money. This is why it’s important to have biometric and/or two-step authentication on any devices and online platforms you use.
The SARS swindle
Nothing scares people quite like the taxman calling, which is why fraudsters have so much success impersonating agents of the South African Revenue Service (SARS). Threatening hefty fines or arrest, they try to scare you into sharing personal information or paying money, or they may take the “good cop” approach and tell you your massive tax bill can be settled by paying a lesser amount into “this account”… right now!
Only communicate with SARS via official channels and verify any form of communication you receive that purports to be from “the dreaded taxman”.
Crypto scams
As the popularity of cryptocurrencies increases, so do the scams. The modus operandi, however, isn’t too different from traditional money scams: the fraudster uses phishing or automated attacks to trick you into giving out personal information, such as your digital wallet.
South Africa is behind the times in accepting cryptocurrencies for payments for mainstream services and utilities, but it’s coming – and so too are the fraudsters. There are countless cases in the United States of people paying a fee, bill or handling charge via cryptocurrency to people pretending to be government officials, investment brokers, utility agents and the like.
The fraudsters may also impersonate popular cryptocurrency websites to lure victims into sending them money, sharing login information or "investing" in a project.
Unfortunately, once you make a crypto-payment it’s untraceable, and there’s virtually zero chance of getting any of it back.
OTP scam 1: Automated bots
Fraudsters use so-called OTP (one-time password) bots to trick people into sharing text or email verifications or the authentications provided by a two-step authentication app.
A bot will make a robocall (a recorded message) or send a text imitating a real company, such as your bank. The robocall/text will ask you to authorise a charge to your account or to input a code you’re texted if it’s a charge you do not recognise. It seems very legitimate, but in reality the bot is attempting to log in to your account, which triggers the system to send you the verification code. When you share the code, the scammer can log straight into your account.
The way to avoid this very sophisticated scam is to always check the source of the information (call/text) and to have two-step authentication.
OTP scam 2: Real time
Someone calls from your bank saying a hacker is trying to get into your account, requiring you to act immediately. The caller keeps you on the line while you receive one or more OTPs (one-time passwords), which they tell you to read out so they can stop the hack. In fact, however, you are giving the scammer an all-access pass to your accounts, and by the time you’ve put down the phone your accounts will have been drained to an untraceable bank account. Again, never give your OTP to anyone, no matter how desperate the situation may seem.
The social media pyramid scheme
A charismatic fraudster or an old school friend who’s fallen for the same fraud slides into your DMs to tell you about “an amazing financial opportunity” that promises “unbelievable returns to a small group of investors”. To be part of this elite group you just have to pay a small amount and recruit a certain number of family and friends to sign-up for this “amazing opportunity”. Once you’ve reached your recruiting target, you get your “returns”. Sometimes you do, sometimes you don’t; either way, it’s just a digital version of the age-old pyramid scheme, where someone always loses.
The money flip
Money-flipping scams are rife on social media, promising to double or triple your money via forex trading, binary options or offshore property opportunities in a very short period. The social media account you got the message from may look legit, and they may even go so far as to send you “investment reports” to encourage you to invest even more. It all looks good until you ask to cash out, at which point you will receive a series of excuses and delays and, eventually, the social media account will be deleted and you’ll be left high and dry.
Good old phishing
Phishing is still preferred by online fraudsters, because it works so well! Whether it’s a direct message on a social media platform, an email or “smishing” (an SMS purportedly from your bank or financial services provider), the syndicates cast their lines out daily.
The best way to avoid being caught on a phisher’s hook is to be vigilant and to check the source of any and all communication. Remember to check URLs before clicking on links, to never do anything in haste and to always verify before acting.
The imposing imposter
Imposter scams are still number one in most countries, because they have such a high success rate. It could be someone pretending to be from your bank, the tax collector, your utility service, a sweepstakes competition… literally anyone with access to your personal information, which, unfortunately, is relatively easy to get hold of as a result of online data leaks. These scams work because the fraudsters are masters of disguise – so how can you protect yourself? Familiarise yourself with how to spot a scam – e.g. a problem or reward at stake; a heightened sense of urgency; you are asked to divulge personal information; you are asked to make a payment (more red flags here [6 tips to spot a scam]. If there are any red flags, verify the source and the information provided before doing anything else.
The big payout
Congratulations, you’ve won the Euro Millions! No, not really; this is just another scam that people unfortunately fall victim to every day: you’ve won some amazing lottery, sweepstakes or prize (that you never entered). You’re so thrilled by this windfall that you divulge personal information or cover the cost of taxes and processing before receiving your massive payout… and there goes your money.
“Favour for a friend” fraud
You receive an email or text from a “friend” asking you to help her out. She’s having trouble with her credit card while buying something online or, worse, she’s in hospital and urgently needs money for a life-saving operation. Will you help her out by giving her your credit card details? Because of course she’ll pay you right back… Don’t fall for it – pick up the phone and call your friend to verify, and if you can’t get hold of him/her, take no action.
The “dead domestic” scam
This is a particularly macabre and cruel scam that’s quite popular in South Africa. You get a call from your domestic worker’s family member, claiming she has suddenly died. You’re in a state of shock. You want to help. And the scamsters ask for a Checkers/Shoprite Money Market or e-wallet cellphone payment to “make funeral arrangements”.
How did they get your phone number and the name of your domestic worker? Easy: they called her a few weeks back and phished for details, asking for the name and number of her employer.
The funeral fakers
Fake funeral parlours or funeral insurers offer a policy for a small amount each month. Multiply that by thousands of people every month for years and you can see why it’s such a lucrative con. Best yet for the scammer, the ruse is only uncovered when the loved one dies and their family discovers that the funeral parlour/insurance no longer exists.
Have you heard of or been the victim of any of these or other scams? Share your story with us so we can raise awareness about them. Email INSERT with the subject line ‘Scams’.