The "we're reversing a fraudulent debit" call, backed by a real-looking SMS.
Home / Scam guides / Banking
The most dangerous bank scam in South Africa isn't a phishing link. It's a phone call backed by a convincing SMS. Here's a real example, why caller-ID apps can't be trusted, and how to check a bank message before you act.
Published 21 May 2026 · Last reviewed 21 May 2026
The hook A call about a 'fraudulent debit' they're reversing, where they just need to 'verify' you
What they want Your card details, OTP, or PIN, handed over by phone
The hard rule Your bank will never ask you to confirm card details, a PIN or an OTP to receive a refund
Why it's hard to catch There's no phishing link to inspect. The danger is the call and the callback number
The most damaging bank scam in South Africa right now usually doesn’t involve a dodgy link at all. It involves a phone call, a calm and professional one, backed up by an SMS that looks just official enough to lower your guard. It’s called vishing, voice phishing, and because there’s no link to inspect, most scam-checking tools are useless against it.
Here’s a real example that happened recently, taken apart piece by piece, plus the one rule that defeats this scam every time and why your phone’s caller ID can’t be trusted to protect you.
The phone rang. The caller ID, via a popular caller-identification app, showed the incoming number as “FNB Fraud Clearance,” complete with a blue verified-style label. That label is the entire reason the call got answered.
The caller explained, politely and plausibly, that a R99 debit order had been running fraudulently against the account for several months, and that a R2,500 reversal was being processed. They just needed to verify the account holder’s identity first, with card details.
The request for card details was refused, and the caller was asked to send written confirmation. They did. Here’s that SMS, reproduced verbatim (with one identifier redacted for privacy):
FNB:5721Dear CUSTOMER NOTE A R99 DEBIT ORDER HAS BEEN CANCELED AND A REVERSAL OF R2500.00 WILL BE PROCESSED WITHIN 2-24 HOURS, WE APOLOGISE FOR ANY INCONVENIENCE.T&C APPLY AUTH FSP/[REDACTED].FOR MORE INFORMATION CALL.0772809000
A few minutes later, the scammers called back to continue. They were told to go away.
On a quick read, that SMS does its job: it’s got the bank’s name, a reference number, an apology, and an official-sounding authorisation string. But every reassuring detail is doing deceptive work.
When this exact message was pasted into Verifyd, it returned a high scam-confidence verdict, flagging the 077 personal-mobile sender posing as a bank, the impersonal “Dear CUSTOMER” greeting, and above all the embedded callback number, which is the genuine attack vector. No phishing link required.
The detail worth dwelling on is the one that nearly worked: the caller-ID label. A trusted app displayed the incoming call as “FNB Fraud Clearance” with a verified-looking badge, and that label was the reason the call was answered at all.
Here’s the problem with that, and it’s an architectural one. Caller-ID and number-reputation apps attach a verdict to a phone number. But a phone number is not a stable identity:
The result is the worst possible outcome for a security tool: it gives a confident, official-looking verdict that is wrong, and that false confidence is exactly what gets you to pick up. A label bound to a number can lie, because the number itself changes hands.
This is the core of why Verifyd takes a different approach. Our verdict is about the message, not the number.
A phone number’s reputation is just one signal among several. Verifyd weighs the actual content of the message, an AI classifier trained on South African scam patterns, an institution whitelist of how the real banks and couriers actually communicate, and, after launch, a community report signal. Those combine into a confidence score with plain-language reasoning.
The practical consequence matters. A number that a scammer used last month and that now legitimately belongs to someone else doesn’t carry a permanent stigma in our system. And a scammer who rotates to a fresh, “clean” number doesn’t get a free pass either, because the message still reads like a scam. The message gets judged on what it actually says and how it behaves, not on a label attached to a number that can change owners.
That’s the difference between a tool that can be fooled by a recycled number and one that reads the scam for what it is.
You don’t need to analyse any of this in the moment. One habit beats the entire attack:
If you get a call about fraud on your account, hang up and call your bank back yourself, on the number printed on the back of your bank card.
Never use a callback number from the SMS. Never use a number the caller gives you. Never continue on the inbound call. If the original contact was genuine, the bank will deal with it when you call the official line. If it wasn’t, you’ve just walked straight out of the scam. No real bank will ever object to you hanging up and calling them back on their published number.
And alongside that, remember the absolute rules a real bank never breaks:
If a call or message asks for any of these, it’s a scam, no matter what your caller ID says.
If you’ve handed over card details, an OTP, or banking information on a call like this, move fast:
Being caught isn’t carelessness. These calls are engineered by people who do this all day, and the caller-ID label is designed to disarm you before they even speak. Fast action is what limits the damage.
The hard truth about this scam is that there’s no link to check and your caller ID is actively working against you. The signals that actually expose it (a personal mobile number posing as a bank, an impersonal greeting, an unsolicited refund, an embedded callback number) are subtle, and they land in a moment designed to make you panic.
That’s what Verifyd reads. Paste the SMS in, and it weighs the sender, the content, and the behaviour of the message against how real South African banks actually communicate, then gives you a clear verdict with the reasoning spelled out, exactly as it flagged the message in the example above. When a call and a text are working together to rush you, a calm second opinion that judges the message itself is the thing that breaks the spell.
01 Will my bank ever ask for my card details, PIN or OTP over the phone? No, and this is the rule that defeats the scam on its own. South African banks never ask you to confirm your card number, PIN, password or one-time PIN (OTP) over the phone, by SMS, or by email, not even when the caller claims to be from the fraud department processing a refund. An OTP is sent to you to authorise your action. If anyone asks you to read one back, they are trying to authorise their own transaction on your account.
02 The SMS said FNB and the call showed as 'FNB Fraud' on my phone. Doesn't that prove it's real? No. Both the sender name on an SMS and the caller-ID label on a call can be misleading. Caller-ID apps attach a reputation to the phone number, and those labels are unreliable: a number once labelled as a bank can keep that label after it's recycled to a new owner, and scammers can exploit category labels too. Never treat a caller-ID label or an SMS sender name as proof. Judge the message and the call by what they actually ask you to do.
03 Why is a bank scam phone call more dangerous than a phishing link? Because there's nothing to inspect. With a phishing link you can at least check the web address. A scam call backed by an SMS has no link, just a friendly 'consultant' walking you through 'securing' your account in real time, applying pressure and urgency. Most scam-checkers are built around links and have nothing to say about this kind of attack, which is exactly why it keeps working.
04 A 'bank consultant' phoned me about fraud on my account. How do I check if it's real? Hang up. Then call your bank back yourself using the number printed on the back of your bank card, never a number the caller gave you, and never a callback number from the SMS. If the original call was genuine, the bank can pick it up when you call the official line. If it wasn't, you've just sidestepped the entire scam. No legitimate bank will object to you calling them back on their official number.
05 What should I do if I gave away my details? Act immediately. Call your bank's fraud line using the number on the back of your card and ask them to freeze your accounts and cards. Change your online banking password. Report the incident to SAPS and keep screenshots and call records as evidence. The faster you move, the better the chance a fraudulent transaction can be stopped or reversed.
##
Got a message like this? Check it first.
Paste the SMS, email or WhatsApp into Verifyd and get a clear
verdict in seconds, with plain-language reasoning for exactly
what we found.
Get the app More scam guides
Other Trending scams in South Africa Courier & delivery Fake courier delivery-fee SMS