Scammers talk you into moving your own money. Then banks won't pay.

22%.

That is the share of banking fraud complaints the National Financial Ombud for South Africa settled in the customer's favour in 2025. Banks kept the other 78%.

The word that usually decides which side a case lands on is "authorised". If a scammer moved your money without your say, the bank generally carries the loss. If a scammer talked you into moving it yourself, you generally carry it, even though the scammer already had your name, your bank and your account number before they ever called.

We have written before about how scammers already know your bank details before they phone and about one bank's goodwill offers to OTP fraud victims. This story is about what happens next, the fight to get your money back, and the rule that decides who wins it.

What does the word "authorised" actually do to your case?

The Code of Banking Practice, the industry rulebook every South African bank signs up to, splits fraud into two buckets.

An unauthorised transaction happens when someone else moves your money without your permission, say through a SIM swap or a hacked login. The instruction to pay was never really yours. Banks are generally liable here, unless you were careless with your PIN or password, or sat on a known compromise instead of reporting it straight away.

An authorised push payment works differently. You typed in the amount. You approved the payment yourself, on your own phone or at your own branch, even though a scammer talked you into it with a fake call, a fake invoice or a fake "safe account". Your instruction was legally real. That shields the bank from automatic liability, according to a legal analysis of South African bank liability law by the law firm Caderco.

Read nextScammers already know your account details before they call, and that is what makes them so convincing

The scammer's head start, already knowing your name, your bank and your balance, is what makes the call convincing enough to get you to press "approve" yourself. That one tap is what moves your case from the first bucket into the second, far harder one.

Photo: Blogtrepreneur / Wikimedia Commons, CC BY 2.0

How many complaints actually get your money back?

The table below lays out the full route a fraud complaint takes, with the real numbers behind every stage.

Source: National Financial Ombud 2025 Annual Report, cited by Daily Maverick (8 June 2026) and The Citizen (16 March 2026).

Fraud complaints are not shrinking either. The ombud closed 3,651 fraud-related cases in 2025, almost double the number closed the year before. Digital scams are moving faster than people's guard goes up.

Did the 2024 numbers look any better?

Not much. Our own earlier reporting found the ombud's banking division closed 11,535 cases in 2024, the most recent year it broke results down that way, and customers won 21% of them. Line the two years up and the pattern barely moves. About 1 in 5 complaints succeed, whichever year you pick.

The money moving through the whole system did grow. The ombud's total recovery across every division, not just banking, reached R443 million in 2025, up from R328.5 million in 2024.

R328.502024

R443.002025

2024	R328.50
2025	R443.00

Source: National Financial Ombud 2025 Annual Report, cited by Daily Maverick, 8 June 2026. Banking's own share was R53 million in 2025, about R31.8 million of it fraud-related.

Set against SABRIC's own number, South Africans lost R2.4 billion to digital banking fraud in 2025 alone, as our earlier report laid out. The ombud's entire banking recovery that year, R53 million, works out to less than 3 cents back for every rand SABRIC says was stolen.

Could a court overseas change the rule here?

Maybe, eventually. On 3 June 2026, a court in Antwerp, Belgium ruled that banks must reimburse phishing and impersonation victims unless the bank itself proves the customer was grossly negligent. That flips the usual burden onto the bank instead of the customer. Belgian banking law specialist Geert Lenssens says genuine gross negligence shows up in barely 1% of phishing cases.

Trending nowPetrol broke R30 a litre. We followed the money

South African financial fraud investigator Patrick Le Roux says the tools to do something similar already exist here. He says the regulatory framework "has not been activated for this purpose". Nobody has forced the question in a South African court yet.

Photo: DP Singh Bhullar / Wikimedia Commons, CC BY-SA 4.0

South Africa has no equivalent yet to the UK's "confirmation of payee" check, which matches a payee's name against their account number before a payment clears. The Reserve Bank is still mid-overhaul of the country's payment rulebook, having taken over functions from the Payments Association of South Africa in September 2026, and a mandatory name-check for ordinary consumers is not yet part of it.

What should you actually say to the bank in the first 24 hours?

Call your bank's fraud line before anything else, and use these exact lines.

• "I want this logged as an unauthorised transaction. I did not approve this payment."
• "Please give me a case or reference number in writing, by email, before we hang up."
• "I am formally requesting the OTP and login log for this transaction. I need the time it was sent, the device, and the IP address it was approved from."
• "I have not signed anything yet, and I will not sign anything today."
• "If you make me an offer, send it in writing so I can read every line before I answer."

Keep a plain timeline with exact times, open a police case, and ask your mobile network whether your SIM was swapped or ported before you called. None of that guarantees a refund. It is what the Code of Banking Practice and the ombud both weigh when they decide whose account the loss sits in.

If the bank still turns you down, you can take the case to the NFO for free at nfosa.co.za. Our guide to why a bank account goes negative covers what happens to your account while a dispute like this drags on.

The word "authorised" sat in your bank's contract long before the scammer ever dialled your number. Almost nobody reads that clause until the day they need it, and by then the call has already happened, the money has already moved, and the only question left is which side of that one word your case falls on.