Banking safely online
Most South African banking fraud does not defeat the bank’s security — it persuades the customer to hand over the keys. The defences that matter are therefore mostly about how you respond to being contacted.
Your bank will never ask for your PIN, password or a full OTP. Nobody legitimate needs them, and any request for them is fraud regardless of how convincing the caller is.
Read what an OTP message actually says before entering it. Fraudsters rely on people entering codes reflexively — the message usually states plainly what is being authorised, and that sentence is your last line of defence.
If contacted about a problem, end the call and phone the bank on the number from your card or from an app you opened yourself. A caller who resists this is telling you what they are.
Use the bank’s own app rather than links in messages, keep it updated, and enable transaction notifications so an unauthorised payment is visible immediately rather than at month end.
Related
Sources and last checked
This page explains how ZarCash works rather than citing external material.
Page last checked 10 August 2026. Statutory caps and lender terms change — confirm anything you intend to rely on with the provider or the National Credit Regulator. Found something wrong? Tell us and we will correct it.