Social engineering a growing cyber security headache for SA

Social engineering poses a significant threat to South Africans, accounting for the majority of the R2.4 billion lost to digital banking crime in 2025, according to the South African Banking Risk Information Centre (SABRIC). The number of incidents increased by 29.2% compared to the previous year, totaling over 110,000 cases. Richard Ford, group CTO at Integrity360, warns that criminals often use social engineering tactics, such as persuading individuals to approve payments or share access, especially through payment requests on WhatsApp.

To protect themselves, users should verify such requests through a trusted source before transferring money. A more sophisticated threat involves criminals taking over a WhatsApp account by obtaining the six-digit registration code sent via SMS. Once they have control, they can send messages to everyone in the victim's contact list, exploiting the trust already established.

Shayimamba Conco, solution architect for SASE: Africa at Check Point Software Technologies, notes that cybercriminals exploit the human element more than ever, preying on trust, urgency, and emotion. The financial impact of these attacks is substantial, but the reputational and operational consequences can be even greater. Ford emphasizes that the official figures may be conservative, as some victims do not report their losses.

He attributes the high number of incidents to the fact that many occurrences go unreported due to embarrassment. Ford also highlights the risk of account takeover, where criminals gain access to an account and its entire contact list. They can then send messages to all contacts, making it difficult for the victim to realize the breach.

To combat these threats, Ford advises individuals to independently verify any requests for money and to establish a family rule for confirming such requests through a trusted channel. Additionally, he recommends enabling WhatsApp's two-step verification and never sharing the registration code. Conco emphasizes the importance of following zero trust principles, complemented by strong identity protection, device security, email and browser security, threat prevention, and continuous user education.

He advises people to slow down, verify unexpected requests through an independent channel, avoid clicking links in suspicious messages, and never share passwords or OTPs. Legitimate organizations should also adhere to these principles, as a single compromised account can lead to a significant security incident.