BLOG: DON'T GO PHISHING
5 RED FLAGS THAT COULD HELP SOUTH AFRICAN BUSINESSES PREVENT FINANCIAL FRAUD
Don't Take the Bait: One Click Can Cost You Everything
It's 16:45 on a Friday afternoon. You're clearing your inbox before the weekend. An email lands from "your bank": Your account has been suspended. Verify now to avoid permanent closure.
You're tired. You're busy. You click.
That's exactly what the sender is counting on.
Phishing is the fishing trip nobody asked for – and you're the fish. Across South Africa, from Pretoria and Johannesburg to Cape Town and Durban, criminals send these emails, SMSes and WhatsApp messages by the thousand. They don't need to fool everyone. They only need one person on a busy afternoon.
The good news is that phishing can be beaten. Once you know what the bait looks like, it becomes much easier to recognise and avoid. Here's what to look out for.
Why Phishing Is a Financial Fraud Problem, Not Just an IT Problem
Many business owners think of phishing as an IT issue. It isn't. It's one of the most common entry points for financial fraud.
A single successful phishing attempt can lead to:
Stolen banking credentials and drained accounts.
Fake invoices paid into a criminal's account.
Hijacked email accounts used to deceive clients and suppliers.
Ransomware that locks your systems until you pay.
POPIA compliance issues if customer information is exposed.
Phishing affects finance teams, compliance officers, HR departments and directors alike. Anyone with access to money, data or authority can become a target – including people who work in fraud prevention themselves.
The 5 Lures: Know the Bait Before You Bite
Think of each warning sign as a lure. Here's what each one looks like in real life.
Lure 1: Urgent or Threatening Language
Scammers want you to panic because people who panic don't think rationally.
What it looks like:
"FINAL NOTICE: Your SARS refund will be cancelled in 24 hours unless you confirm your details."
The tell:
Legitimate organisations generally communicate through official channels. Pressure and urgency are common tactics used by scammers to manipulate recipients into acting without thinking. If a message makes your heart race, slow down. That reaction is precisely what the sender is counting on.
Lure 2: A Sender Address That Doesn't Quite Match
The display name says "Standard Bank". The actual email address says something else entirely.
What it looks like:
From: Accounts Team accounts@stand4rdbank-secure.co
The tell:
Look beyond the sender's display name and check the actual email address and domain. Watch for swapped letters, additional words, unusual domain endings or a "director" contacting you from an unfamiliar personal email account, such as Gmail.
Criminals may also impersonate your boss or a senior executive and send urgent payment requests. This is known as business email compromise (BEC), and it can result in significant financial losses. Always verify unusual requests through a separate, trusted communication channel.
Lure 3: The Unexpected Attachment
An invoice you didn't ask for. A "delivery slip" for a parcel you didn't order. A "voice note" in an email.
What it looks like:
Subject: Outstanding Invoice #48291
Attachment: Invoice_Payment.zip or Remittance.html
The tell:
If you weren't expecting an attachment, don't open it without verifying its legitimacy. Compressed files, HTML attachments and documents prompting you to enable macros can be used to deliver malicious software or direct you to fraudulent websites.
If in doubt, contact the sender using a telephone number you already trust rather than replying to the suspicious email.
Lure 4: Requests for Passwords or Payments
Legitimate organisations will not ask you to disclose your password, PIN or OTP through email, SMS or WhatsApp.
What it looks like:
"We've detected unusual activity. Reply with your one-time PIN to secure your account."
"Hi, I'm in a meeting. Please urgently pay this supplier and send proof. Keep it confidential."
The tell:
Any message requesting login credentials, changes to banking details or an urgent payment deserves a second pair of eyes. Criminals often use impersonation, authority and confidentiality to bypass normal approval procedures.
Always verify banking-detail changes by contacting the supplier on a telephone number obtained from your own records. Never rely solely on the contact details provided in the message requesting the change.
Lure 5: Links That Don't Go Where They Claim
The button says "Log in to your account". The link takes you somewhere very different.
What it looks like:
Button text: Sign in to Microsoft 365.
Example destination: http://secure-login.microsoft-verify.xyz/auth
The tell:
On a computer, hover over the link without clicking to see the destination address; on a mobile device, press and hold. If it looks strange, don't tap. Be cautious of unfamiliar domains, misspellings and web addresses that don't match the organisation's official website. Rather open the organisation's official website directly through your browser or use a saved bookmark. When in doubt, don't click.
The Golden Rule: If It Looks Too Tempting, Don't Bite
A surprise refund. A prize you never entered for. A "CEO" who needs a favour right now. If it feels too good, too urgent or too strange to be true, treat it as bait.
Pause. Verify. Then decide.
Taking sixty seconds to phone someone could save you from a potentially costly mistake. Skipping that step could cost your business a significant amount of money.
"But We're Too Small to Be a Target" (and Other Common Objections)
"We're a small business. Who'd bother with us?"
Criminals target businesses of all sizes. Smaller organisations may have fewer resources dedicated to cybersecurity, but automated scams don't check your company size before hitting send.
"We already have antivirus."
Antivirus helps, but phishing targets people, not just computers. Effective protection combines email filtering, multi-factor authentication, secure backups and regular employee awareness training.
"Security sounds expensive and complicated."
It doesn't have to be. Many of the most effective risk-reduction measures start with simple steps, implemented consistently. Compare the cost of prevention with the potential impact of one fraudulent payment, compromised account or week of operational downtime.
"We don't have time to deal with this."
That's precisely why awareness and prevention need to become part of everyday business practices. Clear procedures, regular training and appropriate security measures can help reduce the risk before an incident occurs.
What to Do If You've Already Taken the Bait
It happens to smart, careful people. What matters is how quickly you respond. Don't panic, and don't hide it. Speed is your best defence.
Disconnect and alert your IT team. If you've opened a suspicious attachment, downloaded a file or suspect malware has been installed, disconnect the affected device from Wi-Fi or the network. Immediately notify your IT or security team and follow your organisation's incident response procedures.
Don't enter anything else. If a suspicious link has taken you to a fake login page, don't enter any further information. Close the page and avoid interacting with it.
Change compromised passwords. If you've disclosed your login details, change the affected passwords using a separate, trusted device. Start with your email and other critical accounts, and enable multi-factor authentication wherever possible.
Contact your bank immediately. If banking details or payment information have been compromised, contact your bank using its official fraud reporting channels. If a fraudulent payment has been made, report it immediately. Quick action may help prevent further losses or assist with the recovery of funds.
Notify your IT or security provider. The sooner they are aware of the incident, the sooner they can investigate potential malware, suspicious email forwarding rules and compromised accounts.
Warn your team and contacts. If your email account has been hijacked, your clients and suppliers may become the next targets. Alert those who may have received suspicious messages from your account.
Report the incident. If you've lost money through fraud, report the matter to the South African Police Service (SAPS). Report SARS-related phishing emails to SARS at phishing@sars.gov.za. If personal information may have been compromised, immediately notify your organisation's Information Officer so that the responsible party can assess its reporting obligations under POPIA.
Keep the evidence. Save the suspicious email, screenshots, relevant correspondence and details of when the incident occurred. Don't delete potentially important evidence.
How to Avoid Getting Hooked in the First Place
You don't need to be a tech expert. You need a few good habits and the right protection behind you.
Pause before you click. Make "stop, look, verify" a team habit.
Use multi-factor authentication. Enable it on email, banking and cloud-based applications wherever possible.
Use a password manager. Avoid reusing passwords across different accounts.
Establish payment verification procedures. Any change to banking details must be independently confirmed by telephone using verified contact information.
Keep systems updated. Regular updates help address known security weaknesses.
Back up your data. Maintain secure backups and regularly test that they can be restored.
Train your people. Short, regular awareness sessions and simulated phishing exercises can help employees recognise suspicious messages and respond appropriately.
Strengthen email security. Appropriate email filtering and security controls can help prevent phishing messages from reaching employees' inboxes.
Don't Take the Bait. Stay Informed. Stay Alert.
Recognising the warning signs is an important first step in preventing phishing and financial fraud. However, building a fraud-aware organisation requires ongoing education, awareness and a commitment to ethical conduct.
Fraud prevention is everyone's responsibility. Whether you're a business owner, employee, manager or fraud examiner, staying informed and recognising potential threats can make a meaningful difference.
Join the Association of Certified Fraud Examiners South Africa (ACFE SA) for our International Fraud Awareness Week events, taking place from 16 – 19 November.
Explore our events and register at acfesa.co.za/events.