VAT scam warning in South Africa

TymeBank warned South African banking clients about fraudsters using notifications about the looming value-added tax (VAT) increase to scam victims.

George Wandsella, head of operational risk and fraud at TymeBank, said criminals are targeting a wide range of people with this phishing scam.

Phishing and vishing are cybercrime tactics in which attackers impersonate legitimate institutions, such as banks or service providers.

This is done to trick individuals into revealing personal or financial details, including passwords, card numbers, or one-time passwords (OTPs).

These scams often come via emails, SMSes, or fake websites made to resemble genuine services.

The latest VAT phishing scam goes beyond banking clients and target anyone with an account or subscription where VAT is payable.

This includes subscriptions to mobile service providers, retailers, healthcare service providers, and online services.

The fake VAT notifications create a sense of legitimacy and urgency, urging users to click on links to “learn more”, “see updated fees”, or “verify their accounts”.

These links typically lead to phishing sites, which mimic the service providers’ websites and are used to steal user login credentials.

This latest trend highlights the growing threat of opportunistic cybercrime, with fraudsters also taking advantage of certain times in the year, such as holidays and tax filing seasons.

Discovery’s SpendTrend25 report showed that 63% of South Africans have experienced or know someone affected by card fraud, with over 75% having received scam emails, texts, or calls.

Standard Bank recently warned of a fraudulent WhatsApp group circulating on social media that claims to be affiliated with some of the bank’s services.

In an email sent to clients, Standard Bank Online Share Trading urged individuals to be vigilant against potential threats.

Capitec has also warned that it is seeing several common scams in South Africa which can lead to serious financial losses.

“The most prevalent scams targeting consumers include authorised push payment fraud, where victims unknowingly initiate payments to fraudsters,” the bank said.

Capitec explained that advance fee scams are also common at the moment. These scams require victims to pay a fee upfront for a job, loan, prize, or inheritance that doesn’t exist.

How to protect yourself against online scams

South African banks said consumers should take several actions to mitigate the risk of falling victim to these scams.

They advised users to be sceptical of offers that seem too good to be true, especially those promising quick or high returns.

TymeBank also reminded South Africans of the essential security practices below to ensure their safety online.

• Verify all communication: Never share personal passwords, PINs, or OTPs. TymeBank—and all reputable banks—will never request this information via phone, email, or SMS.
• Activate multiple authentication factors: Use biometric authentication, such as fingerprint or facial recognition, on your banking app to enhance account security.
• Be alert to SIM swap fraud: Pay attention to unexpected loss of mobile signal, SMS delivery issues, or unfamiliar SIM notifications. These may indicate a SIM swap. Contact your mobile provider immediately and notify TymeBank if you are a customer.
• Verify unexpected callers: Even if the caller ID appears to show your bank’s number, remain cautious. Fraudsters can spoof numbers to look legitimate. Hang up and call the bank using verified contact details.
• Maintain device security: Keep your smartphone’s operating system and banking app updated to the latest version to benefit from security enhancements.
• Monitor your accounts: Check your transactions regularly and enable real-time notifications to spot any unusual activity quickly.
• End suspicious interactions immediately: If you receive a suspicious or high-pressure call, SMS, or email, end the interaction immediately and report it to your bank directly.
• Be wary of urgency tactics: Scammers often create a false sense of urgency. Always take time to verify requests, no matter how urgent they seem.

The banks said double-checking things is generally a good rule of thumb to avoid falling for scams like the VAT changes or investment offers.