Over R500m lost in SA debit card scams

Gross losses due to fraud committed on South African-issued debit cards amounted to R520,5 million in 2020 – an increase of 26.5 percent compared to 2019.

This is according to 2020 crime statistics released by the SA Banking Risk Information Centre (Sabric) yesterday.

The impact of Covid-19-related work and lifestyle changes created new opportunities for scammers in the debit card space.

Digital crime incidents increased by 33 percent in 2020 compared to 2019.

Financial uncertainty prompted people to rather use debit cards as opposed to buying on credit, as they were more comfortable spending money they already had. Buying behaviour also shifted as consumers opted more for online platforms due to the Covid-19 lockdown restrictions. Debit cards were, therefore, enabled to allow for e-commerce transactions.

This is further reflected in credit card fraud having decreased by 27 percent in 2020 compared to 2019, according to the report.

"The large-scale move to remote working [led] to unprecedented technical vulnerabilities related to network security and the uptake of online collaboration platforms.

Social vulnerabilities resulting from fear and confusion caused by the pandemic and adjusting to lockdowns were also exploited by criminals. The Covid-19 lockdown itself resulted in an increased uptake and use of the digital banking channels by the public as they were limited in their ability to visit a physical branch,.

For example, debit card fraud amounting to 1.6 million rand was accomplished by using account takeovers; 4.8 million rand using false applications; 278 million rand using a "card not present" method; 193 million rand due to lost or stolen debit cards; 39.5 million rand due to counterfeit debit cards; and 484 983 rand due to non-receipt of issued debit cards.

Almost half of the card fraud took place outside of South Africa. Top countries where debit card fraud took place were Canada, the US, UK, Germany, Luxembourg, India, Indonesia and Australia.

Social engineering remains the primary method used by criminals when targeting victims.

This involves the use of deception to manipulate an individual to provide confidential or personal information. Phishing is the use of a fraudulent email, which looks legitimate, to try and obtain personal information including passwords and card numbers. Vishing is the use of fraudulent phone calls or SMS phone messages for the same purpose.  One of the ways criminals used was spoof emails offering Personal Protective Equipment like masks, sanitiser,  or vaccines.