overberg.tech logo

overberg.tech

Fake invoices and banking app scams: how small businesses in the Overberg can stop payment fraud

11 November 2026

A red envelope hanging from a fishing hook on a desk, beside a laptop.

Summary: Most banking fraud in South Africa starts with a convincing message or phone call, so a few habits and account settings stop most of it before money leaves your account.

South Africans reported R2.4 billion in digital banking fraud claims in 2025, according to the South African Banking Risk Information Centre (SABRIC). That is 29.2% more than in 2024 and more than double the 2023 figure. SABRIC is clear about the cause. In most cases the banks were not hacked. Criminals persuaded customers or their staff to hand over details, approve access or make the payment themselves.

That matters for anyone who pays suppliers, runs payroll or banks on a phone, which covers almost every small business and household in Hermanus, Grabouw, Caledon, Kleinmond and the towns around them. Most of the defences are habits and account settings, and you can put them in place this week.

What the 2025 numbers show

SABRIC's Annual Crime Statistics Report for 2025 recorded 110 074 digital banking crime investigations. Banking apps were the channel in about 89% of cases and 70.5% of the money claimed. SABRIC notes that this does not mean the apps were compromised. The fraud usually began outside the bank, with someone impersonating a trusted organisation, creating urgency and guiding the victim through a transaction in real time.

Internet banking on a computer made up fewer than 9% of cases but 28.6% of the value claimed. SABRIC links this to larger once-off payments, supplier payments and business transactions. Fewer cases, bigger losses. That is the pattern a small business should worry about.

The scams aimed at businesses

The report names several methods that hit businesses directly.

Supplier mandate fraud and business email compromise. A criminal sends an email that looks like it comes from a supplier you already pay, saying their banking details have changed. Sometimes they have broken into the supplier's mailbox, so the message arrives in a real thread with a real invoice attached. The next payment goes to a mule account and moves on within hours.

Fake "bank" or "fraud department" calls. SABRIC reports that vishing (voice phishing) led to authorised payment fraud as a dominant pattern in 2025. The caller says your account is at risk and talks you through moving money to a "safe account", often to several new beneficiaries in quick succession.

Remote access in the name of tech support. Victims were persuaded to install remote access software or share their screen for "technical support" or "account verification". Once the criminal had control, money usually went out in one large transfer to a newly added beneficiary.

Cloned voices. SABRIC notes that AI makes phishing emails and messages more polished, and that there have been isolated cases of cloned voices used to impersonate bank officials and company executives. A voice note from "the boss" asking for an urgent payment is no longer proof of anything.

SIM swaps. Your cellphone number receives your banking OTPs. If a criminal moves it to their SIM, they get your codes. SABRIC says SIM swap fraud was less common than in earlier years, but it still appears in account takeover cases.

Habits that stop most of it

Each of these takes a minute of checking, and each one interrupts the script these scams rely on.

  1. Verify every change of banking details by phone, using a number you already have. Use the number on file or on an old invoice, never the one in the email asking for the change. SABRIC's own advice is that payment instructions received by email, WhatsApp or telephone should be independently verified through a trusted channel before money moves.
  2. Use two people for new beneficiaries. If your bank's business profile allows it, set one person to capture a payment and another to authorise it. A criminal then has to fool two people.
  3. Hang up and call back. If someone claiming to be your bank calls, end the call and phone the number on the back of your card. A bank will not ask you for your PIN, password or OTP, and it will not ask you to move money to a safe account.
  4. Never install software because a caller asked you to. No bank needs to see your screen. If you are unsure about a support request, contact your own IT support first.
  5. Treat urgency as a warning sign. "Pay before 3pm or the order is cancelled" and "your account will be closed today" are pressure tactics. A real supplier will wait ten minutes while you confirm.
  6. Act fast if your phone loses signal for no reason. SABRIC advises contacting both your bank and your mobile network straight away if you get an unexpected SIM swap notification, stop receiving verification messages or suddenly lose signal.

Settings that close the gaps

Business email compromise starts with a stolen email password. These settings make a stolen password far less useful.

Turn on multifactor authentication for email

Microsoft states that multifactor authentication combined with blocking legacy sign-in methods stops more than 99.9% of common identity attacks. For Microsoft 365, the simplest route for a small business is security defaults. An administrator signs in to the Microsoft Entra admin center, goes to Entra ID, then Overview, then Properties, selects Manage security defaults and sets it to Enabled. Every user then has to register for multifactor authentication, and old sign-in protocols that skip it are blocked. Microsoft also recommends signing everyone out once so they have to register on their next sign-in.

For Google Workspace, a super administrator opens the Google Admin console and goes to Security, then Authentication, then 2-step verification. Google's deployment guide suggests telling staff beforehand what is changing and by when, letting them enrol, tracking who has done so, and then enforcing it. For a personal Gmail account, open your Google Account, go to Security and sign-in, and turn on 2-Step Verification. Google also supports passkeys, which live only on your devices and cannot be written down or handed to a scammer the way a password can.

Stop criminals sending email as you

SPF, DKIM and DMARC are three records on your domain that tell other mail servers which senders are genuinely yours. Microsoft describes them as building blocks that work together and says anything less than all of them gives substandard protection against spoofing. Without them, a criminal can send an invoice that appears to come from your domain to your own clients. If you are not sure whether your domain has these records, we can check for you.

Keep devices updated and protected

Remote access scams and malicious links work best on old, unpatched computers and phones. Automatic updates, reputable antivirus and a password manager remove a lot of easy openings, and they matter most on the devices you bank on.

If something has already gone wrong

Speed matters because stolen money moves through mule accounts within hours.

There is also a legal step that many small businesses miss. If a criminal got into a mailbox or system holding personal information about your clients or staff, section 22 of the Protection of Personal Information Act (POPIA) requires you to notify the Information Regulator and the people affected. Since 1 April 2025 the Regulator only accepts these reports through its eServices portal. Its fact sheet says there is no threshold, so even low risk compromises must be reported, and you do not have to finish investigating before you report. Your organisation and its Information Officer need to be registered on the portal to submit a report, so it makes sense to register before you need it.

How we can help

We set up multifactor authentication, email domain protection and payment safeguards for homes and small businesses across Hermanus, Gansbaai, Stanford, Greyton, Swellendam and Bredasdorp, and we help clean up and lock down accounts after an incident. If you would like us to check your email security or talk your team through these scams, WhatsApp us or email [email protected].

Sources