Scam messages are no longer full of spelling mistakes. Many look like they come from your bank, a courier or SARS. The aim is always the same: get you to click a link, share a code or send money before you stop to think.
A few habits stop most of them.
How scammers pressure you
- Urgency: “Your account will be closed in 24 hours.”
- Fear: A blocked card, an unpaid fine or a suspicious login.
- Reward: A refund, a prize or a parcel waiting for you.
Real organisations rarely demand that you act within minutes.
Warning signs
- The sender address does not match the organisation, or is a slight misspelling of it.
- The greeting is generic, such as “Dear customer”.
- A link shows one address but leads somewhere else. On a computer, hover over it to see the real address. On a phone, press and hold.
- You are asked for a PIN, a password or a one-time PIN (OTP).
- An unexpected attachment, especially a ZIP file or a document that asks you to enable macros.
- A request to pay a small fee to release a parcel or a refund.
What to do instead of clicking
- Do not click the link or open the attachment.
- Open the organisation’s website or app yourself, by typing the address or using your saved app.
- If you need to phone, use the number printed on your bank card or on the official website, not the one in the message.
- Never share an OTP, PIN or password with anyone. Your bank will never ask for it, not even from a “fraud department”.
If you already clicked
Do not panic, but act quickly.
- If you entered banking details or shared an OTP, call your bank immediately on the number on your card.
- Change the password for any account you typed in, and for any other account that uses the same password.
- Switch on two-step verification wherever it is offered.
- Run a full malware scan. If you downloaded anything, treat the computer as infected.
We can check the computer, remove anything that should not be there and help you lock down your accounts. See our anti-malware services or computer support.
For businesses
The same tricks target staff. Fake invoices and requests that appear to come from a director are common. Criminals can also send mail that looks like it came from your own domain. Our Mail Sentry service helps companies stop that.