Confirmed — Stellenbosch students’ fraud frailty warning on Sassa grant system

The South African Social Security Agency's IT system vulnerabilities to fraud have been confirmed, yet the agency still hasn’t formed an action plan to address the chaos.

Vulnerabilities in Sassa’s IT system were confirmed at a parliamentary social development committee meeting on 27 November 2024, following a 30-day investigation requested by Social Development Minister Sisisi Tolashe. However, Sassa's failure to present an implementation plan has left the investigation incomplete.

People queue for social grants outside the Sassa office in Eerste River, Cape Town. (Archive photo: Ashraf Hendricks)

The investigation confirmed the allegations made by Stellenbosch University first-year computer science students Veer Gosai and Joel Cedras, who discovered fraudulent activity and vulnerabilities in the Social Relief of Distress (SRD) grant IT system.

Gosai and Cedras found the major problems in the system included:

• A lack of rate limiting, allowing them to run queries through the system thousands of times a minute;


• No way to update an application once it was fraudulently made;


• A general lack of verification of details and biometric verification, allowing for “mass grant and identity fraud”, according to Gosai.

Sassa CEO Busisiwe Memela-Khambula said that due to the urgent need for the SRD grant, the system was “implemented quickly” and that they were “building the system as we [went]”.

“This has created challenges in ensuring it was done properly,” she said.

The SRD grant was introduced during the Covid-19 pandemic to assist people aged 18-59 who found themselves in dire need of financial assistance. The grant is currently R370 a month.

Masegare and Associates, an external service provider appointed by Sassa, was unable to complete the investigation due to time constraints and “huge” amounts of data, according to company CEO Peter Masegare.

Sassa admitted that of the five external service providers specialising in auditing and cybersecurity who had been invited to submit proposals to complete the investigation, only one responded. Tolashe said all due processes had been followed in vetting the service provider.

Read more: Reboot needed after students discover massive fraud in Sassa’s Social Relief of Distress grant system

‘Two-phase investigation lacks urgency’

The faults found by Masegare and Associates, appointed by Sassa on 11 November, to do a comprehensive investigation of all its grant systems, including but not limited to child support, disability, old age pension and foster-child grants, revealed an extensive scope of work required to address Sassa’s IT system faults.

Due to “higher volumes of data than anticipated”, the company said the investigation would be split into two phases.

Altia Sthembile Hlongo (ANC) said the two-phase plan “lacks urgency”, further delaying an investigation into an issue with national import.

The faults found so far by Masegare and Associates determined that Sassa’s SRD grant system fell into the “medium” risk category, while the implication of system infiltration carried significant consequences for the public.

The faults found and recommendations provided by Masegare and Associates include:

• Multiple applicants per cellphone number, allowing fraudulent applications. (Recommendation: Sassa should strengthen the link between ID numbers and associated phone numbers.)


• OTP-based authentication makes the system vulnerable to SIM-swap fraud, with a lack of OTPs at certain points of the application process. (Recommendation: Sassa should implement multifactor authentication and combine OTPs with biometrics.)


• Mobile money and Cash Send allow fraudulent beneficiaries to divert funds. (Recommendation: regular auditing of mobile money mechanisms.)


• The location of the server and access control hosting system remains vulnerable to insider threats. (Recommendation: implement strict access control and insider threat mitigation by conducting regular audits and insider threat training.)


• The system may not detect shared or reassigned cellphone numbers (Recommendation: Sassa should perform periodic re-evaluations of cellphone ownership.)


• Lack of clear data encryption for sensitive data, such as ID numbers and banking details. (Recommendation: implement end-to-end encryption for all sensitive information both in transit and at rest.)

No action by Sassa

Memela-Khambula confirmed that addressing the issues in the report was still a “work in progress”, with Sassa having not yet engaged in dialogue with Masegare and Associates.

Tshilidzi Munyai (ANC) said Sassa was “leaving doors open” by leaving issues unresolved while the investigation was ongoing.

Altia Sthembile Hlongo (ANC) said Sassa should urgently present an intervention plan to restore public trust.

“We can’t now wait for students to come and identify a problem,” she said.

Read more: Legitimate Social Relief of Distress grant applicants pay the price for fraudsters

Kerileng Tlhong (ANC) agreed that the department needed to present an action plan for how Sassa and the Department of Social Development would collaborate. She also pointed out the lack of an impact assessment, with no indication of how many people had been affected by fraudulent activities and how they might be remunerated.

A crime that ‘knows no borders’

Minister Tolashe said collaboration between public, expert and governance bodies was ever more critical, pointing to the rapidly increasing risks to cybersecurity worldwide.

“This is one crime that knows no borders,” she said.

Tolashe cited the South African Banking Risk Information Centre Annual Crime Statistics report for 2023, which revealed that South African banks lost R3.3-billion to digital fraud, card fraud and contact crimes.

“We want to be better than the banks,” said Deputy Minister of Social Development Ganief Hendricks.

While Tolashe recognised the urgency of the matter, she said the 30-day time period requested was too short to either complete the investigation or effectively resolve any problems.

“We underestimated the task at hand,” she said. DM