What to do if you’ve been scammed (South Africa)

If you’ve just realised you were scammed, speed matters more than anything else: banks can sometimes stop a payment or block a card if you call within minutes, and much less often after a day. Don’t feel embarrassed; these scams are run by professionals and fool careful people every day. Work through the steps below in order. Not sure yet whether it’s a scam? Paste the website or link into the website legit checker first.

In the first hour

Call your bank’s fraud line now. Use the number on the back of your card or in your banking app, never a number the scammer gave you. Ask them to block the card, stop or recall the payment, and freeze online banking if you shared a password or OTP. Write down the reference number they give you.
Card payment? Ask for a chargeback / dispute. Card payments to online shops that never deliver can often be disputed. EFTs and instant payments are much harder to reverse, which is exactly why scammers ask for them, but ask the bank to try a recall anyway.
Shared a password? Change it on the real website (type the address yourself), then change it anywhere else you used the same one. Turn on two-step verification. A password generator plus a password manager makes unique passwords easy.
Phone suddenly has no signal? That can be a SIM swap. Call your network from another phone immediately, and tell your bank.
Lost your WhatsApp? Re-register it with your number (you’ll get a new SMS code), turn on two-step verification, and warn your contacts not to send money to “you”. See WhatsApp and SMS scams.
Installed an app the scammer asked for (AnyDesk, TeamViewer or an .apk file)? Uninstall it, disconnect the device from the internet, and have it checked before you use banking on it again.

Keep the evidence

Before you block anyone, take screenshots of the chat, the website, the advert, and the payment confirmation. Save the website address, the phone numbers, the bank account the money went to, and dates and amounts. The bank and the police will ask for these. A redirect checker result shows the real address of a link without opening it.

Protect your identity

Gave your ID number, ID photo or bank statements? Apply for free Protective Registration with the Southern African Fraud Prevention Service (SAFPS, safps.org.za). Lenders and banks check it before opening accounts, which makes it much harder for criminals to take out loans or contracts in your name.
Check your credit report. You’re entitled to a free credit report every year from each credit bureau (such as TransUnion, Experian and XDS). Look for accounts or enquiries you don’t recognise, now and again in a few months.
Watch for follow-up scams. Victims are often contacted again by “recovery agents”, “lawyers” or “police” who promise to get the money back for a fee. That’s the same scammers, or their friends. Real police and banks never charge you to recover money.

Where to report it in South Africa

SAPS: open a case at your local police station and get a case number (your bank or insurer may need it). Fraud and cyber fraud are crimes under the Cybercrimes Act.
Your bank: report the account the money was paid into, even if you paid from another bank; banks share this information to close mule accounts.
Investment or crypto scams: report them to the FSCA (Financial Sector Conduct Authority, fsca.co.za), which also lists unregistered firms and warnings. Check the FSCA register before investing with anyone.
The bank won’t help? You can complain to the Ombudsman for Banking Services (free) once you’ve gone through the bank’s complaints process.
A real business that didn’t deliver (rather than a fake shop): the Consumer Goods and Services Ombud handles complaints against registered businesses.
The platform: report the advert, profile or number on Facebook, Instagram, Marketplace or WhatsApp so it gets taken down.

How to report a scam website

Reporting a fake shop or a fake bank login page gets it blocked for other people, often within hours.

Google Safe Browsing: report it at safebrowsing.google.com (“Report phishing page”). Once Google lists it, Chrome, Android, Firefox and Safari show a red warning to everyone.
Microsoft: report it through Microsoft’s “Report an unsafe site” page, which feeds the warnings in Edge and Outlook.
The domain registrar: look the site up in the WHOIS lookup. It shows the registrar and usually an abuse email address. Send them the address of the site and a short description; registrars suspend domains used for fraud.
The hosting company: find the server’s owner with the IP lookup (or WHOIS on the site’s IP address), which shows the hosting network and its abuse contact.
The brand being copied: if the site pretends to be your bank, SARS, a courier or a shop, tell the real company. Most banks and big retailers have a phishing report address on the fraud or security page of their website.

When reporting, give the exact web address, a screenshot, and what the site did (asked for card details, took payment and didn’t deliver). Don’t enter any more information on the site to “test” it.

Next time: a 30-second check

Paste unknown shops and links into the website legit checker: a website registered a few weeks ago that sells big brands at 80% off is the classic fake shop.
Never share an OTP, PIN or WhatsApp code, with anyone.
Pay new online shops by card or with a service that offers buyer protection, never by EFT.
If a message creates panic or urgency, stop and phone the company on a number you find yourself.

Frequently asked questions

Can I get my money back after being scammed?

Sometimes. Card payments can often be disputed through a chargeback, and banks can occasionally stop or recall a transfer if you report it within minutes. Payments you authorised by EFT or with an OTP are much harder to recover, so call your bank’s fraud line immediately.

Should I open a police case for an online scam?

Yes. A SAPS case number is often needed by your bank or insurer, and reports help police link cases to the same criminals and bank accounts.

What should I do if a scammer has my ID number?

Apply for free Protective Registration with the Southern African Fraud Prevention Service (SAFPS), check your credit report for accounts you don’t recognise, and be extra wary of calls or messages that already know your details.

How do I report a fake website?

Report it to Google Safe Browsing and Microsoft so browsers warn other people, and send the address to the domain registrar’s abuse contact, which you can find with a WHOIS lookup. Also tell the company the site is pretending to be.

Someone says they can recover my money for a fee. Is that real?

Almost certainly not. “Recovery” offers are a common second scam aimed at people who’ve already lost money. Police, banks and regulators never charge a fee to recover stolen money.