Digital banking crime cost South Africa R2.41 billion in reported client claims in 2025, an increase of 29.2% from 2024, according to the South African Banking Risk Information Centre (SABRIC) Annual Crime Statistics Report. Reported incidents rose by 12.8% to 110,074, with an average loss of R21,865 per incident.
Stronger authentication, better detection and blocking suspicious accounts remain essential, but rising losses show why the industry must also address the economics that keep fraud syndicates in business.
We have traditionally approached fraud as a security problem, concentrating on making it harder for criminals to reach clients and their money. Fraud syndicates, however, also operate as businesses, with recruitment costs, people to manage and a return on investment that must justify the effort. Understanding those costs gives banks another way to disrupt fraud by making the business behind it less profitable.
This approach, which we call “scammernomics”, asks how we can make the criminal business model unprofitable by increasing the cost and uncertainty of each operation.
The unit economics of a mule account
A mule account is a bank account used to receive and move the proceeds of fraud, making it a critical part of the syndicate’s business model. Once a victim has been persuaded to send money into it, the account holder may knowingly help criminals move the funds, surrender control of the account or unwittingly forward the money under their instructions.
Capitec uses the strongest form of identity verification in its FICA process, with either facial or fingerprint biometrics checked against Department of Home Affairs (DHA) records. We periodically revalidate the client’s biometric identity through selfies in the Capitec app, extending those checks beyond the point at which the account is opened.
An account can therefore be used to move the proceeds of fraud even when its owner’s identity has been verified. The client may believe they are working for a legitimate company providing an ‘invoicing service’, receiving payments into their own account and earning a fee for forwarding the money as instructed. In this scenario, criminals exploit a verified person’s trust by misleading them about the purpose of the payments, rather than exploiting a gap in the bank’s identity checks.
Where a syndicate buys access to an account, it can pay less than R500 for a recruited account holder to hand over their credentials. Even at R500 per account, blocking 300 empty accounts would cost the syndicate R150,000, which may remain an affordable expense for an operation turning over considerably more than that.
Persuading a victim to part with their money can require a much greater investment, particularly in scams that involve weeks of building trust, preparing fabricated documents and maintaining a convincing story. Throughout that period, the syndicate commits time and resources without knowing whether the operation will produce a return. Disrupting the payment after that work has been done can therefore impose a greater cost than simply forcing the criminal to replace an empty account.
The ghost stop: turning the mule account into a trap
The ghost stop applies this principle by delaying the visible block on a detected mule account while holding incoming funds so they can be recovered and returned to the client. Because the account appears operational, the syndicate may continue investing time in building a victim’s trust, preparing documents and persuading them to make a payment. When the money arrives and cannot be moved onwards, the criminals discover that their investment has failed after they have already incurred the cost.
This also creates uncertainty across the syndicate’s pool of accounts, because an account that appears usable may still prevent them from moving the proceeds of a scam. When a payment cannot be moved, they may struggle to determine whether the cause is a bank countermeasure, theft within their operation or a problem with the account they acquired. That uncertainty makes it harder to plan the next operation or trust the people supplying accounts.
The landmine selfie
A scammer may learn when Capitec is likely to request selfie verification and try to acquire an account after those expected checks have been completed, believing it is now ready to make the payments they want. The landmine selfie introduces an infrequent additional check at the moment a criminal is trying to move money through a Capitec account. When this check is triggered, the funds remain trapped in the account until the original person who opened it completes the required selfie verification in the app. The criminal must therefore get that person to participate again before the money can be moved, even if they already hold the account credentials and believed all the necessary checks had been cleared.
Although a selfie revalidates identity, a client who has been deceived about the purpose of a payment may complete the check themselves and continue forwarding money. The supposed ‘invoicing service’ illustrates why biometric verification must work alongside transaction monitoring and measures that prevent criminals from moving the proceeds of fraud.
The future of fraud prevention
The number of scams blocked remains an important measure of fraud prevention, but it tells only part of the story when criminals can cheaply replace accounts and start again. We should also assess whether our interventions increase their costs, reduce their returns and make it harder to repeat the same operation at scale.
- Andrew Baker, Group CIO at Capitec
