Vishing: Smooth cybercriminals find sophisticated ways to steal your money

First published in the Daily Maverick 168 weekly newspaper.

Because of the Covid-19 pandemic, South Africans were asked to stay at home between April and September last year. This sudden change in circumstance was mirrored by changes in the way consumers spent their money. Over the six months, 20% of all credit card transactions by Standard Bank customers were carried out online, while 17% were contactless payments (against a 7% pre-lockdown baseline), with purchases made using tap-to-pay or via a mobile device.

Ethel Nyembe, head of card and payments at Standard Bank, says there was a dramatic shift in consumer behaviour with an 84% increase in the value of online spend at supermarkets and grocery stores year-on-year. The increase in value of spend at online general merchandise stores increased by 458% from the previous year.

With the change in consumer behaviour, she says voice phishing or vishing scams have become an increasing point of concern.

Jimmy Sounes, head of forensic services at Capitec, says vishing accounts for about 99% of fraud cases in the country.

“Fraud is not just a South African issue, it’s a global one. Vishing is a social engineering attack that sees fraudsters convince you to trust them and then share your personal and/or banking information. For example, the criminal might read you your account number or ask you if you still have a debit order for a certain store.

“They will already know something personal about you. Then they shock you by telling you something is wrong. They pretend to be your bank’s forensic department and guide you through the steps to avoid the ‘fraud’,” he says.

Sounes says these steps could include telling you to transfer your money to a separate “safe account” where the bank will ringfence the funds against fraud.

“These are not your petty criminals but sophisticated syndicates with entire call centres working for them… Unfortunately, consumers are often in such a panicked, emotional state that they are not thinking logically but just desperate to protect their money and, in the process, end up inadvertently authorising fraudulent transactions.”

Giuseppe Virgillito, FNB’s head of digital banking, says remote living and working have meant that most people are communicating digitally – and criminals are using this development to their advantage to gain people’s trust to steal sensitive information.

Virgillito says vishing attacks are not limited to individuals, but tend to target vulnerable consumers, such as the elderly.

However, the US Consumer Security, Privacy and VPN Usage Report 2021 shows that millennials (born between 1981 and 1996) and generation Zers (born between 1997 and 2012) are more likely to fall for phishing operations than older generations – 23% of the youngsters have fallen prey to these email scams compared to just 9% of baby boomers (born between 1946 and 1964). Gen Zers and millennials are also more likely to have their passwords stolen or have their social media accounts hacked, while Gen Xers are most likely to experience identity theft.

Spotting a scam

Your bank will call you to confirm a transaction that is deemed suspicious (for example, a large amount or several purchases in a short space of time, or a transaction that does not fit your profile such as buying four tickets to London), or the bank’s collections department may contact you to follow up on an outstanding credit card payment.

However, the bank will never call you to:

• Reveal your PIN;


• Approve an online transaction;


• Transfer money to another account;


• Create a beneficiary on your account; or


• Request the details from your bank card, including the three-digit CVV (card verification value) on the back of your card.