Recovering money from cyber scams
If you have lost money as part of an online scam or wider cybercrime then this guide can help. You may have been tricked into sending money to a criminal’s account, a criminal may have logged into your online banking and tricked you into enabling payments, you may have been tricked into putting money into a scam investment or been sending money to a romance scammer (catfish). Regardless of how the money was stolen, follow the steps below.
The advice provided in this guide is designed to cover all kinds of financial losses resulting from cyber scams.
We want to better understand the impact of you experiencing this issue, can you share your experience by filling in this online form? This will help us better protect future victims.
Recovering money from cyber scams - Do this first!
Contact your bank - If your bank account or payment card was involved, contact your bank's fraud department immediately.
Explain what has happened and ask the bank to:
Begin a fraud investigation.
Attempt to recall or repatriate the funds where possible.
Contact the receiving bank if the payment has already been sent.
Freeze the funds if they are still in transit (where possible).
If action is taken quickly enough, the receiving bank may be able to freeze or recover the funds before they are withdrawn. Recovery is never guaranteed, but acting immediately gives the best chance of success.
Your bank will usually require:
A SAPS case number.
A copy of your affidavit or statement where applicable.
Supporting evidence of the scam.
If someone accessed your online banking without your permission, also:
Ask the bank to secure or freeze your account if necessary.
Report every unauthorised transaction.
Change your online banking password immediately.
Enable multi-factor authentication (MFA) where available.
Secure any affected devices before using online banking again.
Report the crime to South African Police Service- Report the incident to the South African Police Service (SAPS) as soon as possible.
You should obtain:
A SAPS case number.
A copy of your affidavit or statement where available.
These documents may be required by your bank during its investigation.
Reporting the matter also assists law enforcement in identifying scam trends and investigating offenders where possible.
Report the scam to the Southern African Fraud Prevention Service (SAFPS) - Where appropriate, report the scam through the Yima scam reporting service operated by the Southern African Fraud Prevention Service (SAFPS).
Reporting may help:
Identify emerging scams.
Disrupt fraudulent activity.
Support wider fraud prevention efforts.
If your identity information has been compromised, contact SAFPS to request a Protective Registration on your identity profile.
Preserve evidence - Keep copies of:
Payment confirmations
Bank statements
Transaction references
Account numbers
Cryptocurrency wallet addresses (if applicable)
Emails
SMS messages
WhatsApp messages and chat history
Screenshots
Usernames
Phone numbers
URLs
For WhatsApp scams, where possible preserve:
The scammer's phone number.
Their WhatsApp profile name and profile information.
The full conversation.
Payment requests.
Payment confirmations.
Voice messages.
Images or documents sent by the scammer.
Links sent through WhatsApp.
Screenshots showing the date and time of messages.
Any message where the scammer impersonated another person.
Do not delete evidence before saving copies where possible.
This information may assist SAPS, your bank and other organisations investigating the fraud.
Beware of recovery scams - After stealing money, criminals often target victims again by pretending to be:
Your bank
SAPS
Financial investigators
Lawyers
Money recovery specialists
Cybersecurity or account-recovery specialists
They may contact you through WhatsApp, SMS, phone calls, email or social media.
They may ask you to:
Move money into a "safe" account.
Pay an upfront recovery fee.
Provide banking credentials or one-time passwords (OTPs).
Provide WhatsApp verification codes.
Install remote-access software.
Pay cryptocurrency to "unlock" recovered funds.
Never trust unsolicited calls or messages.
Contact organisations using verified contact details.
Never pay anyone who promises to recover stolen money.
Never provide banking credentials, OTPs or WhatsApp verification codes.
Do not give remote access to your device to someone claiming they can recover your money.
Legitimate banks and law enforcement agencies will not charge victims to recover stolen funds.
Approaches to dealing with cybercrime-related financial loss
How you can try and get your money back very much depends on how the money was stolen. Here we are going to focus on four different approaches:
You were coerced into making a payment
You have been impersonated with a financial organization
The criminal carried out the payment using your accounts
The money was transferred by a credit or debit card payment
1) You Were Tricked into Making a Payment (Authorised Payment)
This applies where you authorised the payment yourself because you believed you were dealing with a legitimate person or organisation.
Examples include:
Investment scams
Romance scams
Business email compromise
Impersonation scams
Marketplace scams
WhatsApp impersonation scams
Fake WhatsApp payment requests
Fake emergency requests from someone pretending to be a friend or family member
Fake employer, supplier or customer payment requests
Example
A criminal may obtain or create a WhatsApp account using the name or profile photograph of someone you know.
They may send a message such as:
"I've changed my number. Please save this one."
They may then claim they urgently need money and ask you to make a payment.
The fact that the WhatsApp profile appears to belong to someone you know does not prove that the request is genuine.
Before sending money:
Verify the request through another communication channel.
Call the person using a number you already trust.
Do not rely only on the WhatsApp conversation.
Be particularly cautious of urgent requests, secrecy or changes to normal payment details.
What to do
Report the fraud to your bank immediately.
Ask the bank to begin a fraud investigation.
Ask whether the receiving bank can attempt to freeze or recover the funds.
Cooperate fully with the investigation.
Provide all requested evidence, including WhatsApp messages and screenshots.
Banks will investigate the circumstances of the fraud.
If you authorised the payment yourself or shared security information such as OTPs, passwords or banking credentials, this may affect whether the bank reimburses some or all of the loss.
Possible outcomes include:
Full reimbursement.
Partial reimbursement.
No reimbursement.
Recovery depends on factors including:
How quickly the fraud was reported.
Whether the money has already been withdrawn.
The circumstances of the transaction.
The bank's investigation and policies.
If you are dissatisfied with the bank's final decision, first complete the bank's internal complaints process.
If the complaint remains unresolved, you may refer the matter to the National Financial Ombud Scheme South Africa (NFO).
2) Someone Made Payments Using Your Account (Unauthorised Payments)
This occurs when a criminal gains access to your online banking or payment account and makes transactions without your permission.
This commonly happens after criminals:
Obtain banking credentials.
Install malware.
Trick you into giving remote access to your device (for example through AnyDesk or TeamViewer).
It can also occur if a criminal obtains access to an account through phishing or social engineering conducted through WhatsApp.
What to do
Contact your bank immediately.
Ask the bank to secure or freeze your account if necessary.
Report every unauthorised transaction.
Change your online banking password.
Enable MFA where available.
Secure any affected devices.
The bank should investigate the unauthorised transactions.
If the investigation finds that you disclosed passwords, banking credentials or security information through phishing or other means, this may affect the outcome of the claim.
3) Someone Used Your Identity to Obtain Financial Products (Identity Fraud)
A criminal may use your personal information to apply for:
Loans
Credit cards
Store accounts
Mobile phone contracts
Other financial products
This information may have been obtained through phishing, social engineering or messaging scams, including WhatsApp.
What to do
Contact the affected financial institution immediately.
Report the identity fraud to SAPS.
Contact the Southern African Fraud Prevention Service (SAFPS) and request a Protective Registration on your identity profile.
Follow the guidance in The Cyber Helpline Identity Theft guide.
4) You Paid Using a Debit or Credit Card
Banks and card providers may offer dispute processes such as chargebacks or other card scheme protections depending on the circumstances.
Examples include:
Goods or services never received.
Goods significantly different from what was advertised.
Merchant fraud.
Unauthorised card transactions.
Card fraud is commonly divided into:
Unauthorised card transactions (for example where the card details were used without your permission).
Authorised card transactions (where the PIN, OTP or registered device was used).
Whether reimbursement is available depends on the circumstances and the outcome of the bank's investigation.
What to do
Contact your card provider immediately.
Explain why you believe the transaction was fraudulent.
Ask whether a chargeback or dispute process is available.
Provide any supporting evidence requested, including relevant WhatsApp messages where the transaction originated through WhatsApp.
Banks have different processes and timeframes, so act as quickly as possible.
If the complaint cannot be resolved through the bank's complaints process, you may consider referring the matter to the National Financial Ombud Scheme South Africa (NFO).
Donate
Your generosity makes our free support possible. Please consider giving today.
Without donations, we cannot keep our service free or provide help to the most vulnerable victims of cybercrime when they need it most. As a not-for-profit organisation, every donation goes directly towards keeping The Cyber Helpline up and running. Donate now and help us support victims of cybercrime.