South Africa’s Digital Bank Fraud Hit R2.4B, Up 29% in 2025

South Africans lost R2.4 billion to digital banking crime in 2025. That is up 29.2% on 2024 and more than double the R1.09 billion lost in 2023.

Nigeria’s fraud losses fell in 2025, and Kenya’s hit a record. South Africa’s tell a third story: the old crimes are fading while the new one grows. This report reads the 2025 figures from the South African Banking Risk Information Centre (SABRIC) and sets them beside earlier data. Four findings stand out. First, banking apps now carry almost 89% of all digital cases and about 70% of the money lost. Second, the biggest losses per case sit in internet banking, where one case costs about four times an app case. Third, the physical crimes that once made headlines have collapsed, and they were always small beside the digital losses. Fourth, the crime starts outside the bank, in a phone call or a message, so the app is where the loss shows up, not where the break-in happens.

Start with the three-year picture. SABRIC counts client claims in digital banking crime, and the 2025 data covers 110,074 cases.

The average loss per case rose too, from R19,095 in 2024 to R21,865 in 2025. By our sums, that is a rise of about 14.5%. Cases rose more slowly than money. Earlier SABRIC reporting put 2024 at 97,975 cases, so by our sums cases grew about 12% in 2025 while losses grew 29%. Criminals are not just hitting more people. They are taking more from each one.

A note on the 2024 base. SABRIC’s own 2024 release gave a lower digital figure, about 64,000 incidents and R1.4 billion, while other coverage of the same report gave 97,975 incidents and R1.9 billion. The 2025 comparison uses R1.86 billion for 2024, which matches the higher series. Treat early 2024 numbers with care, because the counts appear to use different scopes.

Now the channels, which carry the main story.

The mobile line is our sum, found by taking the app and internet cases from the 110,074 total. Apps are the busiest channel by far, but internet banking is the costliest per case. Using the reported shares, an app case averages about R17,400, while an internet banking case averages about R73,600. That is about 4.2 times as much. This fits a pattern seen in Nigeria, where internet banking was 7% of cases but 52% of losses. Where a customer logs in on a computer, the sums moved tend to be bigger. Mobile banking, including USSD, is now a small slice of value. SABRIC says it still shows the most SIM-swap signs, but that SIM-swap activity was less common than in earlier years.

Why do apps dominate? SABRIC’s view is that “the fraud began outside the banking platform.” A typical case starts with a call or message from someone posing as the bank or the police. The caller says the account is at risk and tells the customer to move money to a “safe account”, often while staying on the line. The customer then approves the transfer in the app, with their own phone and their own biometrics. A fraud analyst at the security firm Entersekt, Nishan Maharaj, makes the same point: the app is where a transfer is approved after the deception, not where the breach happens. This matters because the bank’s systems see a real customer making a real payment. In its 2024 report, SABRIC said every reported digital case came from social engineering. It named phishing, voice scams, text scams and malicious QR codes. It also said AI helps criminals write clean messages and clone voices. The 2025 release carries no AI-specific figures, so the size of that effect is not yet known.

Cards tell a different story.

Card-not-present fraud, which means a stolen card number used online, remains the largest card loss category. SABRIC’s release calls it “one of the most significant fraud types affecting consumers.” One detail is useful: card-not-present losses fell for both credit and debit cards, yet total card losses still rose. Card losses and digital banking losses are separate series in SABRIC’s data, so we do not add them together.

Now the crimes that used to dominate the news. Cash-based crime is falling fast.

The 2024 rows for ATM attacks and cash lost are worked back from the reported falls of 46% and 63%, so treat them as approximate. Together, the physical losses named in SABRIC’s data add up to about R19 million in 2025 by our sums. That is under 1% of the R2.4 billion lost digitally. Banks have spent years hardening machines and branches, and it shows. The one place where physical crime is rising is the street. Robberies linked to ATM use rose 43%, from 414 to 592, and robberies after a withdrawal rose from 154 to 257. Money bomb incidents, where dye or explosives hit cash, doubled from 64 to 132. So the threat has not vanished. It has moved to people on the pavement, and to people on their phones.

The lending side adds a warning. Fraud at the point of applying for credit grew sharply in some products.

SABRIC left out actual vehicle finance losses because investigations are open. The R28.3 billion is value that banks caught and declined, not money lost. SABRIC says AI-generated supporting documents are one reason fake applications are harder to spot at onboarding.

What happens when a customer disputes a payment? Here the picture is bleak, though the data is thin. A June 2026 article in Personal Finance cited industry figures on the National Financial Ombud Scheme. Its banking division received more than 15,000 complaints, the highest on record. Nearly 80% of cases were decided in favour of the banks. The article did not say which year those figures cover or how many were fraud cases. It quoted Pieter de Swardt of Entersekt, who called the dispute process “cumbersome and largely analogue.” He argued that banks should use the same device and location data they use to approve payments. They should use it to judge disputes and to update customers. A study he cited, by researchers at Notre Dame and Carnegie Mellon, found something telling. Victims were more likely to leave a bank over poor handling of the dispute than over the fraud itself.

One caution on all of these figures. SABRIC’s data comes from participating institutions and is not a national census. The digital data covers nine banks. Fraud that victims never report, or that happens on mobile money and non-bank wallets, is not in it. So the true cost to South Africans is probably higher than R2.4 billion.

Why it matters: South Africa shows where fraud goes once the doors and machines are locked. It goes to the phone. About seven in every ten rand lost in digital banking now sits behind an app that the customer opened and approved. That changes the advice. Strong passwords and biometrics do not help when the customer is tricked into using them. For customers, the rule is to end any call that asks you to move money, and to call the number on your card. No real bank or police officer asks you to move funds to a safe account. Report a loss at once. For banks, the lesson is to slow down risky first-time transfers. Warn customers in the app at the moment of payment. And treat disputes with the same data used to approve payments. For regulators, it is to publish clearer data and to settle who bears the loss when a customer is tricked. With dispute outcomes tilted toward the banks, this remains an open question.

What to watch next: the next SABRIC report, to see whether losses keep rising at about 29% a year. Watch whether app-based cases and value shift when banks add more payment warnings and delays. Watch the dispute figures at the Ombud, and whether anyone publishes fraud complaints and outcomes by bank. Watch whether physical crime keeps falling while street robberies after ATM use keep rising. Watch for AI-specific fraud data, which SABRIC has not yet published. And watch whether South Africa sets clear rules on refunds for tricked customers, as Kenya has promised to do.

Sources: SABRIC on the 2025 Annual Banking Crime Statistics Report; TechCentral on bank robberies and ATM bombings collapsing as criminals go digital; BusinessTech on R2.4 billion stolen from South Africans; TechCentral on AI-led digital banking fraud in 2024; SABRIC on its 2024 annual crime statistics; Personal Finance on bank fraud dispute processes.

A note for startup founders: Don’t practice on investors. Practice on AI first. RaiseReady by Index Prima is an AI fundraising simulator for African founders: upload your pitch deck, get a readiness score and face a tough AI investor before the real meeting. Find this post, and every post we publish, at raiseready.indexprima.com.