Dealing with a vishing scam
Vishing (voice phishing) is when you receive a phone call from a criminal who tries to trick you into sharing information that can be used for their personal gain. The criminal typically impersonates someone from a legitimate organisation and is often well-practised at convincing people they are genuine.
Vishing scams are designed to create fear and urgency. Some happen over a very short period and aim to obtain your card details, passwords or security information. Others are more sophisticated and may continue over days or weeks, convincing you to transfer large amounts of money or install software that gives criminals access to your device.
In South Africa, callers may pretend to be from your bank, SARS, SAPS, a mobile network, a courier company, an insurer, a government department or a fraud investigation team.
We want to better understand the impact of you experiencing this issue, can you share your experience by filling in this online form? This will help us better protect future victims.
How to spot a vishing call (telephone scam)
You receive an unexpected phone call - Banks and other legitimate organisations may contact you about suspicious activity, but they should never ask you to:
Share your password.
Share your full PIN.
Share a one-time PIN (OTP) or verification code.
Approve a login or payment request in your banking app.
Share your card PIN, CVV or online banking password.
Give them remote access to your device.
Do not assume a call is legitimate simply because the caller ID looks correct.
Criminals can spoof phone numbers so that they appear to come from your bank or another trusted organisation.
If you have any doubts, hang up and call the organisation back using a trusted number that you have obtained independently. Never rely on contact details provided by the caller.
If you are unsure, end the call and contact the organisation yourself using the number on its official website, banking app, bank card or statement.
The caller creates a sense of urgency - The caller may claim:
Your bank account has been compromised.
Fraud has been detected.
A family member urgently needs money.
You must act immediately to avoid losing your money.
Their goal is to pressure you into acting before you have time to think.
Never use any phone number or contact details provided during the call. Instead, contact the organisation using details you already know are genuine.
Something doesn’t feel right - Trust your instincts. If something feels unusual or suspicious, end the call and verify the situation independently.
What to do if you have fallen for a vishing scam
It is very easy to fall for a vishing scam—even cybersecurity professionals can be deceived. Do not feel embarrassed. The most important thing is to act quickly.
Contact the organization that was impersonated - Report the scam to the organisation the caller claimed to represent.
If financial information was shared, contact your bank's fraud department immediately. They may recommend:
Blocking your account.
Cancelling your bank card.
Issuing replacement cards.
Monitoring your accounts for suspicious activity.
Follow any additional security advice they provide.
Change any information you shared - If you disclosed passwords, PINs or other security information, change them immediately.
Where possible:
Change passwords from a trusted device.
Use strong, unique passwords.
Enable multi-factor authentication (MFA) if it is available
Watch out for warning signs of identity theft - If you shared your South African ID number, banking information, payslips or other personal information:
Monitor your bank accounts and credit card statements carefully.
Watch for transactions you do not recognise.
Ask your bank whether additional fraud monitoring is available.
Consider contacting the Southern African Fraud Prevention Service (SAFPS) for advice on fraud prevention and protective registration.
If you let someone remotely connect to your device - Some scammers pretend to be technical support staff and persuade victims to install remote access software.
If you installed software such as AnyDesk, TeamViewer, Quick Assist or RustDesk, disconnect the device from the internet as soon as possible.
For guidance on checking and securing a potentially compromised device, refer to The Cyber Helpline's Compromised Device Guide. The guide provides steps for dealing with a potentially compromised device, including disconnecting from the internet, checking for suspicious software, running security scans, changing passwords and seeking expert technical help where necessary.
The Cyber Helpline responders will not access, control or attempt to remediate your device. Their role is to explain the available guidance and signpost you to appropriate support.
Report the crime
If you are in South Africa:
Report fraud or cybercrime to SAPS by opening a case at your nearest police station.
You can also report crime through SAPS Crime Stop on 08600 10111, where appropriate.
If money or banking access was involved, contact your bank's fraud department immediately before or alongside reporting to SAPS.
If your identity information was exposed, consider contacting SAFPS for advice on fraud prevention and protective registration.
If the scam involved an investment, insurance product, financial adviser, broker, trading platform or someone claiming to be regulated, check whether they are authorised and consider reporting the matter to the Financial Sector Conduct Authority (FSCA).
How to avoid falling for a telephone call scam
Register on the National Opt-Out Registry - Consider registering on the National Consumer Commission's Opt-Out Registry to reduce unwanted direct marketing calls, SMSs and emails.
This may reduce legitimate marketing communications, but it will not stop criminals from contacting you.
Always treat unexpected calls requesting money, personal information, OTPs or remote access as suspicious.
Be cautious with unexpected calls - Unexpected calls are not always scams, but they should be treated with caution.
If someone unexpectedly asks you to:
Share personal information.
Share an OTP or verification code.
Approve a banking app notification.
Install remote access software.
Transfer money.
Move money to a "safe account".
End the call immediately and contact the organisation using contact details from its official website, banking app, bank card or previous correspondence.
Never do the following during an unexpected phone call-
Share a one-time PIN (OTP) or verification code.
Approve a login or payment request in your banking app.
Share your card PIN, CVV or online banking password.
Install remote access software such as AnyDesk, TeamViewer, Quick Assist or RustDesk.
Transfer money because someone claims your account is "at risk" or needs to be moved to a "safe account."
Use a caller ID app - Caller ID apps can help identify known spam callers and block many nuisance calls.
However, they are not foolproof. Criminals can spoof legitimate phone numbers, so always verify unexpected calls independently before sharing any information.
Contact your bank directly - If someone claims to be calling from your bank:
End the call.
Wait a few moments if necessary.
Contact your bank using the number in your banking app, on the back of your bank card, on your bank statement or on the bank's official website.
Do not rely on caller ID alone, and do not call back using any number provided during the suspicious call.
Stay informed - Keep up to date with common scams by using trusted South African fraud awareness resources, including those provided by:
Your bank.
The Southern African Fraud Prevention Service (SAFPS).
The Financial Sector Conduct Authority (FSCA).
Consumer protection organisations.
Learning about new scam techniques is one of the most effective ways to reduce your risk of becoming a victim.
Donate
Your generosity makes our free support possible. Please consider giving today.
Without donations, we cannot keep our service free or provide help to the most vulnerable victims of cybercrime when they need it most. As a not-for-profit organisation, every donation goes directly towards keeping The Cyber Helpline up and running. Donate now and help us support victims of cybercrime.