What to do if your personal information was exposed in a data breach

In the wake of a data breach, South Africans suffered significant losses totaling R2.4 billion, as reported by the South African Banking Risk Information Centre (SABRIC). Among these losses, banking app-related crimes comprised a substantial 89% of reported cases, and contributed to 70.5% of the total claimed amount. Scammers employed various tactics such as impersonation, phishing, remote-access software, and false payment instructions to deceive customers into disclosing sensitive information or approving transactions.

To safeguard your identity and finances, consider these five essential steps. First, update your passwords as swiftly as possible to mitigate potential risks. Focus on banking applications and online banking profiles, your email accounts (often used to reset passwords), and any platforms where you reuse the same login credentials. Opt for strong, unique passwords for each platform, and avoid reusing old ones.

Impersonation fraud poses a significant threat following a data breach. Scammers frequently pose as your bank, incorporating genuine personal details to appear authentic and urgently request verification or account security. Remember, legitimate banks will never request your PIN, password, or full OTP codes. If something seems amiss, hang up and contact your bank directly through official channels.

Monitor your bank transactions and notifications from your banking app for any unfamiliar debit orders. Even small or "test" transactions can indicate fraudulent activity. Additionally, be vigilant about potential identity theft, which can extend beyond banking. Be wary of unexpected credit approvals or rejections, calls from lenders about unopened accounts, or letters and emails regarding unfamiliar financial activity. Periodically check your credit record for any unusual entries.

Above all, remain cautious when sharing personal information, such as ID numbers, banking details, One-time PINs (OTPs), and account login credentials. If the conversation wasn't initiated by you, treat it as potentially suspicious until you can verify its legitimacy.