As cybercrime escalates in scale and sophistication, South African businesses and individuals face an increasingly complex digital threat landscape. From ransomware and data breaches to phishing and identity theft, cybercriminals are exploiting vulnerabilities that threaten financial stability, sensitive information and business continuity.
As Cybersecurity Awareness Month comes to an end, it is important to highlight that cybersecurity is about creating everyday habits that make it difficult for cybercriminals.
"Fraud and scams are two of the biggest challenges South Africans face when interacting online," says Manie van Schalkwyk, CEO of the Southern African Fraud Prevention Service (SAFPS).
"As the world becomes increasingly digitised, these threats will continue to grow. South Africans must understand the risks they face and the measures available to protect themselves."
Cybercriminals are increasingly exploiting trust and human vulnerabilities
Cybercrime increasingly relies on deception, with scammers exploiting trust through emails, phone calls, fake websites, social media and messaging platforms. Their evolving tactics make fraud increasingly difficult to recognise.
Phishing (fraudulent emails) continues to rise, while telephone-based scams, known as vishing, remain particularly damaging.
“Fraudsters impersonate bank representatives or reputable organisations, warning victims about suspicious transactions before directing them to transfer money, share One-Time PINs or click malicious links,” explains Van Schalkwyk.
Scammers also pose as bank fraud departments, offering assistance with account verification or branch appointment bookings. Their objective is to obtain sensitive information or gain access to victims’ devices and accounts.
Online shopping scams are another growing concern. Fraudsters advertise unbelievable deals, create convincing websites with fake reviews and payment portals, then deliver counterfeit goods or nothing. Stolen personal and card details may facilitate further fraud.
Investment scams similarly promise exceptional returns, using fabricated opportunities, financial jargon and false urgency to appear credible. Once victims invest, scammers demand additional payments or disappear.
Malware also threatens consumers by allowing criminals to access devices and sensitive information.
“These tactics exploit trust and create urgency, leaving victims little time to question what they're being told. Always stop, think and verify,” urges Van Schalkwyk.
Financial losses highlight the serious threat to businesses
Cybercrime presents substantial financial risks to businesses. Fraudsters target employees by impersonating a trusted supplier, contractor, or senior employees via a manipulated email or message.
These incidents frequently involve intercepted communications or manipulated payment instructions that redirect legitimate business payments into fraudulent accounts.
This reinforces the importance of always verifying payment instructions, implementing and strengthening financial controls, and continuously educating employees about increasingly convincing fraudulent communications.
"The ongoing threat for individuals and businesses alike highlights the importance of improved reporting, stronger fraud intelligence and continuous public education," adds Van Schalkwyk.
Leading the future
As technology becomes increasingly embedded in business and everyday life, technology-enabled fraud presents a growing challenge. Addressing this requires stronger digital skills and greater cybersecurity awareness across South Africa.
The Mancosa School of Information and Digital Technology (SIDT) believes tertiary education providers have an important role in developing these capabilities.
Sithandwayinkosi Hlongwane, an Academic at Mancosa SIDT, explains that cybersecurity education should extend across technology programmes rather than remain confined to specialist courses.
Students need competencies in secure software design, cloud and network security, identity management, responsible data handling, risk assessment and incident reporting.
Education must also address the human dimension of cybercrime, including how criminals exploit trust, urgency and routine behaviour.
A practical approach could involve introducing cybersecurity awareness into institutional learning management system inductions, including MANCOSA Connect, ensuring students encounter essential security principles early.
"Graduates also need practical knowledge of the Protection of Personal Information Act (POPIA) and the Cybercrimes Act," says Hlongwane.
"They must understand legal and ethical boundaries, particularly concerning personal information, unlawful access and interference. These competencies should be integrated into core courses rather than confined to optional specialist modules."
Targeted education
As technology-enabled crime evolves, tertiary institutions must prioritise practical cybersecurity education that prepares graduates for real-world threats.
"Students should learn to investigate incidents across devices, accounts and platforms," explains Hlongwane. "An impersonation attempt might begin on WhatsApp, progress to a fraudulent email and ultimately compromise a mobile banking account. Students should learn to construct timelines, examine messages and login records, preserve evidence and distinguish verified facts from assumptions."
Hlongwane emphasises that investigations must follow authorised procedures and respect privacy requirements under POPIA and the Cybercrimes Act.
Practical training is equally important. Controlled laboratories and cyber ranges allow students to practise detecting, containing and recovering from attacks in safe environments.
Tabletop exercises, simulated incidents and sanitised case studies also develop decision-making, teamwork and communication skills.
"Assessment should consider analysis, evidence handling, reporting and corrective actions, rather than simply whether a tool produces an output," says Hlongwane. "Hands-on learning develops capabilities that lectures alone cannot, particularly applying knowledge under pressure and coordinating effective responses."
However, cybersecurity education cannot remain static. "Technology professionals need continuous learning because tools, vulnerabilities and criminal methods change faster than qualification cycles," Hlongwane explains. "Artificial intelligence is enabling increasingly convincing phishing, voice and video impersonation, and automated attacks. Professionals must follow credible security advisories, undertake professional development, practise in safe environments and learn from incidents."
Hlongwane adds that institutions should regularly refresh practical examples while developing graduates' ability to assess emerging threats critically rather than memorise short-lived technologies.
Habits that will keep you safe
Van Schalkwyk notes that the cyber landscape may seem daunting. However, there are steps you can take to empower yourself to fight back against scams:
- Limit what you share online: Be aware of what information you share online, especially in the public domain. Insights into your life gives scammers information about you that could be used to scam you.
- Be sceptical: Be sceptical and verify any unexpected emails, phone calls, messages, friend, follow, or messaging requests.
Just say goodbye. If you did not expect this call and you do not recognise the number or person, just say goodbye. Do not press any buttons, share One-Time-PINs, or respond to pop-ups. Just say goodbye and end the call.
- Do not share information: Do not share personal or confidential information with someone you do not know, especially via messaging platforms.
Implement robust cybersecurity practices: Use strong and unique passwords, do not use public Wi-Fi when banking or working with confidential information, and implement multi-factor authentication where possible.
- Verify and do your own research: Before you take any action, contact the company or organisation via their formal channels to confirm any offers or deals are in fact legitimate before engaging.
- Add a layer of protection to your identity: You can apply for an SAFPS Protective Registration which alerts SAFPS Members to take extra care when handling your information. Find out more on www.safps.org.za.
- Report it: If you have been scammed, please report it immediately to the relevant organisation and/ or authorities, as well as the Yima reporting function or scams hotline via www.yima.org.za.
Building cyber resilience through education and awareness
South Africa's ability to protect its digital future depends on more than technological safeguards. Cybersecurity Awareness Month reinforces the importance of collective responsibility and continuous education.
Through the fraud prevention efforts of the Southern African Fraud Prevention Service and practical cybersecurity education championed by Mancosa, the country can strengthen its digital defences.
Combining fraud intelligence, targeted skills development and sustained public awareness will help businesses and individuals recognise emerging threats, respond effectively and build lasting cyber resilience.
