32 Scams That Target Website Owners in South Africa

Owning a website makes you a target, and not for technical reasons. A business website publishes almost everything a scammer needs: working email addresses, the name of the business, a phone number, a contact form, a Google listing, a Facebook page and, if you sell online, a checkout. Most owners also cannot say, off the top of their head, who hosts the website, who registered the domain or which emails from those companies are real. That gap is what every scam in this guide is built on.

The short answer: almost every scam aimed at website owners does one of four things. It impersonates a supplier or an authority to steal a login, it frightens or tempts you into clicking, downloading or calling, it fakes a payment or an order, or it sells you something that is free or worthless. One rule defeats nearly all of them: never act on the link, file, phone number, QR code or one-time code inside the message. Go to the service yourself, by typing the address or opening the app, and check there.

The stakes are not abstract. SABRIC’s 2025 crime statistics, released in August 2026, recorded 110,074 digital banking crime incidents and losses of about R2.4 billion, up 29.2% on 2024. Most of those losses run through banking apps rather than websites, but the playbook is the same one used against website owners: impersonation, urgency and a stolen code. And one recent change matters more than any other: scammers increasingly send their messages through genuine platforms, including Google’s AppSheet, Google’s own notification systems and Meta’s facebookmail.com domain. A legitimate-looking sender address no longer proves anything.

This guide covers 32 scams in six groups: attacks on your website, hosting and domain; scams that arrive in your inbox; attacks on your social, Google and advertising accounts; scams aimed at your money and orders; scams by SMS, phone and WhatsApp; and attacks that turn your website against other people. Each has the giveaway and the right response.

Scams Aimed at Your Website, Hosting and Domain

1. “Your hosting account will be suspended” and fake SSL expiry

These emails claim your mailbox is full, your hosting account is about to be suspended or your SSL certificate expires in 24 hours. They are made to look as if they come from your own domain or your host, and the button leads to a convincing copy of a cPanel or Roundcube webmail login. cPanel’s own support documentation describes the mailbox quota version as a fake phishing email not sent by cPanel on your server. A variant circulating in October 2026 uses the subject “Roundcube Mailbox Storage Alert” and warns that new messages may be rejected.

South African hosts are impersonated by name. In 2023, Cofense documented a multi-stage campaign against xneelo customers that started with a fake bill threatening suspension, even though the amount due was R0.00, and went on to collect the customer’s login, card details, the live SMS verification code and their webmail password. xneelo’s guidance is plain: it will not ask you to sign in through a link in an email. Afrihost customers received fake domain expiry notices in early 2025 asking for billing details.

The giveaway: a deadline measured in hours, a login button inside the email, and any “SSL renewal” that asks for your email password. No certificate renewal ever requires your email password. What to do: log in to your host’s client area yourself and look for the notice there. If you already entered a password, change it immediately, along with anywhere you reused it.

2. The fake WordPress or WooCommerce security patch

In December 2023, WordPress.org published an alert about emails impersonating its security team. They described a WordPress vulnerability that did not exist, labelled “CVE-2023-45124”, and asked administrators to download a patch plugin. According to Patchstack and Wordfence, the plugin installed a backdoor and created a hidden administrator account named wpsecuritypatch. WordPress.org’s response was unambiguous: its security team will never email you asking you to install a plugin or theme, and will never ask for an administrator username and password.

The template keeps returning. In April 2025, Patchstack documented a version aimed at WooCommerce stores, pointing to a download on a lookalike domain that used a dotted “ė” in place of the “e”. The fake patch set up a task that tried every minute to create a hidden administrator account, and installed several web shells. In January 2026, a fake WordPress domain renewal campaign led to a counterfeit checkout that harvested card details and 3-D Secure codes, rejecting every code as “verification failed” so victims kept entering new ones. Sucuri has also reported fake browser update alerts that only appear to logged-in WordPress administrators, so ordinary visitors never see anything wrong.

The giveaway: any email asking you to download and install a file to fix a security issue. Legitimate updates arrive through your WordPress dashboard. What to do: delete the email. If someone installed the file, treat the website as compromised: look for unknown administrator users and new files, and get it cleaned properly rather than just removing the plugin.

3. Nulled plugins and plugins that change hands

Not every malicious plugin arrives by email. Some you install yourself. “Nulled” copies of premium plugins and themes, cracked to bypass licensing and given away on download websites, are a classic route to a backdoor: Sucuri documented pirated plugins that dropped code into WordPress’s must-use plugins folder and granted attackers administrator access, a backdoor that survives deleting the plugin itself. In 2025, Infosecurity Magazine reported on a fake plugin posing as part of WordPress core that skimmed card details from WooCommerce checkouts.

The more unsettling version involves genuine plugins. In 2025, a portfolio of more than 30 established WordPress plugins was sold through the Flippa marketplace, and a backdoor was added in an update months after the sale. It sat dormant, then in April 2026 began serving spam that only Googlebot could see, and WordPress.org permanently closed the plugins. WordPress.com alone reported more than 2,200 websites on its platform running the affected plugins. What to do: never install nulled software, buy premium plugins from the developer, remove plugins you do not use, and pay attention when a plugin changes ownership. Knowing who applies your updates, and what they are applying, is the quiet value of a maintained website.

4. “We hacked your website” extortion and fake security alerts

A long-running scam arrives through your own contact form: a message claiming your website has been hacked and its database copied, and that the data will be leaked and the website blacklisted unless you pay in Bitcoin within 72 hours. BleepingComputer documented a US$2,500 demand of this kind in 2022 and noted that the emails are mass-sent, and WP Tavern, covering an earlier wave delivered through contact forms, found that the targeted websites showed no evidence of tampering. A related trick imitates genuine security alerts: KnowBe4 reported in 2023 on fake Wordfence login notifications that led administrators to a malicious domain. What to do: do not reply and never pay. Check the website’s real status yourself, through Search Console’s Security Issues report, your host and your security plugin’s own dashboard.

5. Domain renewal invoices, slamming and the foreign brand scare

Fake renewal notices use the expiry details visible in domain records to send convincing invoices at plausible times. A cousin of the scam, known as domain slamming, dresses a transfer authorisation up as a renewal, so approving it moves your domain to a registrar you never chose. Another variant warns that a company abroad is about to register your brand under foreign extensions and offers to secure them first. As one domain protection company put it, there is no such entity. Only your registrar, or the hosting company or agency that manages the domain on your behalf, can renew it, so treat a renewal demand from anyone else as fraudulent. Turn on two-factor authentication for your registrar account and, where your registrar offers it, a transfer lock, and confirm who your registrar is before you ever need to know. Our guide to choosing between .co.za and .com covers the registration side.

6. The buyer who wants your domain appraised first

An unsolicited offer arrives to buy your domain, often for far more than it is worth. There is one condition: the domain must first be valued by a particular appraisal or certification service, at your expense. Pay the fee and the buyer disappears. Namecheap has noted that the person making the offer can turn out to own the appraisal service, and DigiCert points out that genuine buyers do not insist on a particular appraisal service. What to do: ask the buyer to commission and pay for any appraisal, and handle a real sale only through a reputable escrow service.

7. The “critical errors on your website” email

Unsolicited audits arrive weekly: your website has bugs, is not ranking, or can be placed on page one. Some are lazy sales pitches; some are fishing for access or a deposit. Google’s own guidance addresses this directly: no one can guarantee a number one ranking, you should be wary of SEO firms that email you out of the blue, and buying links for ranking purposes violates Google’s spam policies. Treat any offer to sell you guest posts or link placements as a liability, not a favour.

8. The directory listing that is really a contract

This one has run in South Africa for years. A form arrives, often styled to resemble a well-known directory, asking you to confirm or update your business listing. The small print is a contract. In a case TimesLIVE reported in 2017, the form committed the business to R299 a month for 24 months, and the Advertising Standards Authority ruled that the approach created a misleading impression. Telkom told MyBroadband in 2019 that businesses giving the impression they act on its behalf could potentially be viewed as fraud. What to do: read anything you are asked to sign or “confirm”, and if you did not knowingly agree to a contract, do not pay.

9. Paid prestige: fake press features, Wikipedia pages and blue ticks

Business owners are also sold prestige that does not exist. Press Gazette reported in 2026 on fake websites posing as regional editions of Forbes, which Forbes confirmed were not its own, in a market of paid offers promising guaranteed coverage. Wikipedia’s 2015 Orangemoody investigation uncovered paid editors who created articles about businesses and then demanded money to publish and protect them, leading to 381 blocked accounts. And Bitdefender reported in 2025 on fake Meta Verified offers delivered as a browser extension that stole Facebook business account sessions; Meta does not issue blue ticks through browser extensions. What to do: genuine coverage is earned or clearly labelled as advertising, and genuine verification is bought inside the platform itself.

Scams That Arrive in Your Inbox

10. The fake RFQ with a ZIP file or a “project portal”

Of every scam on this list, the fake request for quotation is the one most precisely aimed at businesses with a website, because the sales and info addresses on your contact page are exactly where genuine buyers are supposed to write. The email looks like a routine enquiry: a company you have not heard of asks you to quote, and the details are in an attached ZIP or RAR file, or behind a link to a project portal or secure file transfer. Fortra reported in October 2026 that malicious emails using RFQ lures had grown twelvefold over the previous year, and that nearly 73% of them led to phishing pages asking for business logins, such as copies of Microsoft 365 or Google Workspace sign-in pages.

Others deliver malware. AhnLab documented RFQ-themed emails in September 2026 that hid a script inside a RAR archive, which went on to install the Remcos remote access tool. Kaspersky has reported that password-protected archives remain a popular way to deliver malware, because a filter cannot look inside an archive it cannot open, and Microsoft has noted ZIP files being used to slip past the protections Windows applies to downloaded files.

Some attackers are patient. In a campaign Check Point named ZipLine, reported in 2025, attackers filled in companies’ own Contact Us forms and corresponded for weeks to build trust. Some victims were asked to sign a non-disclosure agreement, and a ZIP file followed that installed a backdoor. The targets were mainly American manufacturers, but the method suits any business that answers its contact form.

The giveaway: no RFQ number or genuine project scope, a sender company that does not match the email domain, a reply-to address that differs from the sender, an archive with a password, or any request to sign in to view documents. What to do: look the company up independently and phone its switchboard before opening anything. Never sign in to view a quote package, and ask whoever manages your email to block archive types you never use. If the RFQ claims to be from government, see scam 24.

11. Fake invoices, payment receipts and remittance advice

Close relatives of the RFQ arrive dressed as money: a remittance advice, a proof of payment, an invoice or a statement. Palo Alto Networks’ Unit 42 documented a 2025 campaign in which an email claiming a payment had been made asked the recipient to review an attached order, a compressed file that installed the Agent Tesla and XLoader information stealers. Seqrite found a 2025 “payment receipt” archive whose file name ended in .pdf.z, hiding a program behind a PDF-style name, and Barracuda reported in June 2026 on a link presented as a document called Invoice.pdf that actually downloaded a malicious script. Microsoft’s own data shows HTML files were the most common malicious attachment type in every month of the second quarter of 2026; opened, they show a fake login page in your browser. The giveaway: a payment you were not expecting, an attachment that is an archive or an HTML file rather than a plain PDF, or a document that asks you to sign in. What to do: confirm payments in your banking app, never in an attachment.

12. “A document has been shared with you” and the Microsoft 365 takeover

A notification says someone has shared a document through DocuSign, SharePoint, OneDrive or Adobe. The link leads to a convincing copy of the Microsoft 365 login, and this is where ordinary two-factor authentication stops being enough. Kits such as Tycoon 2FA sit between you and the real Microsoft page, pass your password and your code through, and capture the session cookie the real website issues afterwards, which lets the attacker into your mailbox without needing your code again. Microsoft reported that by mid-2025 Tycoon 2FA accounted for about 62% of the phishing attempts it blocked, before Microsoft and Europol disrupted it in March 2026 by seizing 330 domains. Volumes fell sharply, but Okta observed operators rebuilding within days, and some shifting to device-code phishing, which tricks you into approving the attacker’s device on your account.

What happens next is the expensive part. Microsoft has documented attackers creating inbox rules that silently move incoming mail out of sight and mark it as read, then using the mailbox to send thousands of further phishing emails. Arctic Wolf reported in 2026 on a campaign that used compromised Microsoft 365 accounts to harvest invoice, payroll and banking correspondence. That is the raw material for scam 25. Microsoft is explicit that resetting the password alone is not an effective fix: sessions must be revoked, and unknown sign-in methods, forwarding and inbox rules removed.

The fix is phishing-resistant sign-in. Passkeys and security keys are tied to the genuine website, so a proxy page cannot replay them, which is why Microsoft and the US cybersecurity agency CISA recommend them over codes sent by SMS or typed from an app.

13. QR codes in emails and PDFs

A QR code hides a link from both you and your email filter. Microsoft reported that QR-code phishing rose 146% in the first quarter of 2026, from 7.6 million messages in January to 18.7 million in March, mostly inside PDF attachments, and Kaspersky has documented lures such as fake HR policy documents and new voicemail notices. Scanning with your phone also moves the attack to a device that may lack the protection your computer has, as Sophos found in one 2024 case. What to do: treat a QR code in an unexpected email exactly like a link, and reach the service by typing its address.

14. Copyright notices that carry malware, or demand a link

A message arrives by email or through your own contact form, claiming that an image on your website infringes someone’s copyright and demanding removal within 24 hours. The “evidence” is a download. Cisco Talos tracked a campaign from at least July 2024 that impersonated companies’ legal departments and delivered information-stealing malware such as Lumma, disguised as a PDF inside a password-protected archive. That campaign targeted business Facebook users in Taiwan, but the template works anywhere. Lumma is not a minor nuisance: Microsoft reported finding it on more than 394,000 Windows computers between March and May 2025, harvesting saved passwords, card details and bank logins.

A second version wants something different. Fake law firms, complete with AI-generated lawyer headshots, send copyright demands that can be settled by adding a clickable link to a particular website. Engadget reported one such operation in 2024. It is an SEO scheme dressed as a legal threat. Genuine rights holders usually ask you to remove the image or pay a licence fee; they do not send an unverifiable firm’s demand that you link to an unrelated website. What to do: never open the attached or linked “evidence”, check whether the firm exists independently, and if you genuinely cannot show a licence for an image, replace it.

15. The job applicant whose CV is malware

Recruitment is a reliable way in, because opening attachments from strangers is part of the job. Arctic Wolf reported in 2025 on a group emailing recruiters links to a supposed CV. After a CAPTCHA screened out security scanners, the download was a ZIP file containing a shortcut that installed the More_eggs backdoor. What to do: if you advertise vacancies on your website, take applications through a form or a job platform, never open shortcut or script files, and be wary of any CV delivered as a download link or an archive.

16. Callback scams and fake Microsoft support

Some scams want a phone call, not a click. An email arrives with an invoice for an antivirus renewal or a PayPal charge you never made, often inside a PDF, which hides the wording from filters that only read the email text, and a support number to dispute it. Cisco Talos found NortonLifeLock, PayPal and Geek Squad among the brands most often impersonated this way in mid-2025. The person who answers walks you into installing remote access software such as AnyDesk. Browser pop-ups that freeze the screen and display a support number work the same way. Microsoft’s position is clear: it does not make unsolicited calls or send unsolicited emails to fix your computer, and its genuine error messages never include a phone number. What to do: never call the number in the message, and never let anyone who contacted you take control of your computer.

Scams Aimed at Your Social, Google and Advertising Accounts

17. “Your Facebook page will be disabled”

Business pages and ad accounts are worth money to criminals, and the lures are relentless. In May 2026, Guardio reported a campaign that hacked roughly 30,000 Facebook accounts using fake Meta Support appeal and deletion notices, relayed through Google’s genuine AppSheet service so the emails passed spam filters. In late 2025, Check Point documented around 40,000 phishing emails sent to more than 5,000 businesses from Meta’s real facebookmail.com domain by abusing a business invitation feature. Other variants claim a copyright strike over music, or file false takedowns through Meta’s own copyright tools and then demand money to withdraw them. MyBroadband described the local fallout in 2024 as South Africa’s Facebook “hackdemic”, with one business owner still missing page features 22 months after his account was hijacked.

What to do: never sign in or enter a verification code on a page you reached from a message. Look for the notice inside Facebook or Meta Business Suite itself, by opening the app or typing the address. If there is no matching notice there, treat the message as fake. Turn on two-factor authentication for every administrator, and keep at least two trusted administrators on each page so one compromised account does not lock the business out.

18. Google Ads account takeovers

An advertising account is valuable because criminals can run their own ads on your card. In January 2025, Malwarebytes reported criminals buying sponsored Google search results for Google Ads itself, leading advertisers to fake login pages that captured their login details; the attackers then added their own administrator, and Malwarebytes believed many accounts were resold. Similar campaigns have targeted Microsoft Advertising and Semrush users, and since late 2025 agencies have reported fake account-access invitations aimed at their manager accounts. Google states that it will never send an unsolicited message asking for your password, and in 2026 it began requiring passkeys from some advertisers for sensitive actions such as changing user access. What to do: type ads.google.com yourself rather than clicking a search result, use a passkey, review the account’s users regularly, and never accept an access invitation from a company you do not know.

19. Fake notices from Google, Shopify and your payment gateway

Any platform your website depends on can be imitated: Search Console, Merchant Center, Shopify, your payment provider. Two recent findings show why checking the sender is no longer enough. Kaspersky documented a 2025 attack in which a fake legal alert arrived from Google’s genuine no-reply address, correctly signed, by replaying a legitimately signed Google message. And Ironscales reported in May 2026 that Search Console’s own notification system had been abused to send phishing that passed SPF, DKIM and DMARC. Merchant Center logins have also been imitated through malicious search ads. South African payment providers are clear about their limits: PayFast says it never asks for sensitive financial information, such as card numbers or banking details, by email, and Yoco says it will never request your password or PIN by email, SMS or phone. What to do: reach every dashboard by typing its address, every time.

20. Google Business Profile: calls, extortion and hijacked listings

The phone version is old and still works: a caller says your Google listing will be removed, or offers to guarantee you a top position, for a fee. Google’s own help pages state that it will never ask for payment information over the phone or guarantee a special spot, will never try to convince you to pay to maintain your Business Profile, and will never ask for a one-time PIN. Business Profiles are free.

Review extortion is newer and nastier. A business suddenly receives a run of one-star reviews, followed by a message, often on WhatsApp, demanding payment to stop. Google launched a dedicated reporting form for this in late 2025 and advises businesses never to engage with or pay the extortionists, because paying invites more attacks. The quietest risk is the suggested edit. Anyone can propose a change to your listing, including your phone number, and a 2024 test by Near Media saw a listing’s number changed almost instantly without alerting the listing’s primary owner. Google now gives owners four days to accept or reject a suggested edit once notified, after which it may publish changes supported by public sources. What to do: hang up on “Google” sales calls, report extortion through Google’s form with screenshots, and check your listing weekly.

21. Review removal services

Where there are bad reviews, there are people selling their removal. MarTech described an industry built around the fictitious service of guaranteed Google review removal, and noted that a fake negative review is often followed quickly by an offer to remove it for a fee. Google’s contribution policy prohibits offering incentives such as payment, discounts or free goods for a review, or for changing or removing a negative one. What to do: the legitimate route is free. Flag reviews that break Google’s policies through your Business Profile, and respond calmly and factually to the rest.

Scams Aimed at Your Money and Your Orders

22. Fake proof of payment and the buyer with a “courier agent”

For South African online stores accepting EFT, the doctored proof of payment is a constant. An order is placed, a convincing payment confirmation is emailed or sent on WhatsApp, and the buyer pushes for fast dispatch. The overpayment variant “accidentally” pays too much and asks for the difference back. Standard Bank’s business guidance is to be suspicious of any request to refund an overpayment, and to confirm with your bank that the money has actually arrived before you refund anything. In August 2026, police in Tshwane warned sellers not to rely on screenshots or electronic proof of payment, because they can be manipulated. A proof of payment is a picture, not money.

Businesses that sell through online marketplaces or WhatsApp face a variant: an interested buyer insists on using a courier company to arrange payment and collection, and the seller then receives a link by email, SMS or instant message designed to capture their details and move money out of their account. Fastway warns about this exact scam and states that it does not facilitate or arrange payments between buyers and sellers. What to do: release goods only once the money reflects in your own account, remembering that payments between banks can take time to clear.

23. Card testing on your checkout

Card testing is the automated version. Criminals use your checkout to test stolen card numbers with small purchases. WooCommerce’s documentation identifies a sudden increase in failed orders as the common sign, and recommends a CAPTCHA or Cloudflare Turnstile on checkout, anti-fraud tools, removing products with no minimum price and asking your payment provider to tighten its fraud rules. Left alone, card testing can damage your standing with your payment gateway.

24. The fake government order

Suppliers registered on National Treasury’s Central Supplier Database receive what look like official requests for quotation from government departments. The order is large and urgent, and the item is described so precisely that only one supplier appears to stock it. That supplier is the scammer. Pay it, and both the supplier and the “department” disappear. In a scheme reported by the Independent on Saturday in January 2025, fraudsters sent fake RFQs in the name of the national departments of Health and Defence. A private investigator quoted in the report put victims’ losses at between R600,000 and R2 million, and the Department of Health said it received such reports every month. Eskom, Transnet, the City of Cape Town and several national departments have issued similar warnings over the years.

National Treasury advises suppliers to verify an RFQ directly with the institution that supposedly issued it, and the Central Supplier Database states that it will never request your banking details by post, email or SMS. The giveaway: an urgent order for goods you do not normally supply, a single supplier who seems to be the only source, a free email address or a lookalike domain instead of the department’s official one, and any upfront fee, deposit or commission. What to do: verify on a number taken from the department’s official website, never from the email, and never pay a supplier deposit on the strength of a purchase order alone.

25. Fake banking details on your invoices

Business email compromise does not target your website directly, but your domain and your inbox are the delivery mechanism. A criminal intercepts or imitates an invoice you send and changes the banking details, and your customer pays the wrong account. SABRIC’s 2025 report names supplier mandate fraud and business email compromise as material risks.

South African courts have been clear about who carries that loss, and it is uncomfortable reading for both sides. In Hawarden, the Supreme Court of Appeal held in 2024 that a buyer who lost R5.5 million after paying into a fraudster’s account, on instructions sent from a lookalike of her conveyancer’s email domain, had to take responsibility for failing to protect herself against a known risk. In 2025, closer to home, the SCA ordered a Louis Trichardt dealership that had paid R290,000 into a fraudster’s account, after invoices from Northcliff Nissan were intercepted, to pay Northcliff Nissan in full, because it is the debtor’s duty to seek out its creditor. A business that ignores its own verification procedures can end up carrying the loss itself: in Gerber v PSG, the Johannesburg High Court ordered PSG to pay a client R811,488.98 after it paid out his funds on a fraudster’s emailed instructions, overriding its own bank account verification check.

The law may protect you, but your customer relationship may not survive it. Publish a clear statement on your website and invoices that your banking details will never change by email, and ask customers to confirm any change by phone on a number they already have. Configure SPF, DKIM and DMARC on your domain, with DMARC set to an enforcing policy, so criminals cannot easily send mail from your exact address. It will not stop lookalike domains or a hacked mailbox, which is why the verification notice matters.

Scams by SMS, Phone and WhatsApp

26. “Your parcel is waiting”

An SMS or email says a parcel is waiting and a small delivery or customs fee, often R20 to R30, must be paid first. The link leads to a card form that asks for the card number, expiry date and CVV, and then for a one-time PIN. As FNB explained to MyBroadband, the CVV and OTP are exactly what is needed to register a card in a digital wallet, so that OTP is not approving a R25 payment: it is adding your card to the criminal’s phone. Discovery Bank and Visa’s SpendTrend26 research, reported in April 2026, found that courier and delivery fraud was the most common type of fraud in South Africa, with 46% of the 1,000 people surveyed saying they had experienced it in the previous year.

Couriers are clear about how they really operate. The South African Post Office said in 2022 that it never requests an EFT or online payment before a parcel is collected. Fastway says the sender pays delivery fees and that it never asks recipients for money. SARS Customs warned in 2025 about fraudsters posing as its officials to demand payment for detained parcels. DHL does collect import duties electronically, but says it never sends email from free addresses such as Gmail and never links to websites other than its own. What to do: check delivery status only through the retailer or the courier’s own website or app. If you entered card details, call your bank immediately and have the card stopped. If you run an online store, assume your customers receive these messages too, and tell them how you genuinely communicate about deliveries.

27. SARS impersonation

SARS impersonation peaks around filing season and has become more polished. SARS logs each scam it identifies, and its list had reached its 400th entry, a fake High Court summons, by September 2026; earlier entries include fake settlement notices, a fake employer statement of account and refund-under-audit messages. In July 2026, SARS warned that scammers were using AI to produce professional-looking refund emails, spoofed to appear to come from addresses such as refunds@sars.co.za; SARS’s real domain is sars.gov.za. SARS states that it will never request passwords, OTPs, banking PINs or eFiling login details, will never ask for your banking details by post, email or SMS, will not send you links to other websites, and does not send HTML attachments. What to do: log in to eFiling yourself to see genuine correspondence, never pay into an account given in a message, and forward suspicious emails to phishing@sars.gov.za.

28. CIPC deregistration threats, and paying for compliance that is free

Companies receive emails or calls claiming they are about to be deregistered, followed by an offer to fix it for a substantial fee. This works precisely because CIPC genuinely does deregister non-compliant companies and does notify them by email. CIPC has warned that it will never call customers asking them to download an app, upload details, provide banking details or share a one-time PIN. A related risk is outright company hijacking: in June 2026, Ford Southern Africa said a director appointment recorded against it on the CIPC register was entirely false. What to do: check your company’s status and director records yourself through CIPC’s own platforms, not through anyone who contacted you.

The same pressure is used to sell compliance that costs nothing. The Information Regulator states that registering your Information Officer is free of charge. Exempted micro enterprises, and qualifying small enterprises that are at least 51% black-owned, can prove their B-BBEE status with a sworn affidavit, using a template the dtic provides at no cost, and the B-BBEE Commission has said that certificates issued to these businesses are invalid, with a narrow exception in the transport sector. You may choose to pay an adviser for help, but never for a “registration fee” or a certificate the law does not require.

29. “This is your bank’s fraud department”

The call from your bank’s fraud department is still one of the most effective scams in the country. SABRIC’s 2025 report describes criminals impersonating trusted institutions and coaching victims through transactions during live calls, and its warnings name requests to move money to a so-called safe account and to install remote-access software as red flags. The banks’ rule is absolute: a bank will not ask you to disclose a PIN, password or one-time password, and Absa has warned that your bank will not ask you to move money out of your account because the account is not safe. What to do: hang up and call the number on your card or in your banking app. If your phone suddenly loses signal and OTPs stop arriving, contact your bank and your mobile network immediately, because that is the classic sign of a SIM swap.

30. WhatsApp takeovers and the “new number” message

If your business runs on WhatsApp, its number is an asset worth stealing. The classic version triggers a genuine six-digit registration code to your phone, then a “friend” or “WhatsApp support” asks you to send it on. A 2026 variant asks you to “vote” for someone and links your account to the scammer’s device. WhatsApp’s position is simple: never share your verification code. Turn on two-step verification for the business number today, and because the vote variant abuses WhatsApp’s linked devices feature, check Linked devices in WhatsApp’s settings regularly and log out any device you do not recognise.

A related scam targets your staff rather than your account: a message from a new number claiming to be the owner, a manager or a family member who has lost their phone, followed by an urgent request to pay something. AI-generated voice notes can make this more convincing, although SABRIC said in October 2026 that current evidence does not suggest voice-cloning scams have overtaken conventional social engineering in South Africa. What to do: agree a simple rule that any payment request from a new number is verified by calling the person on the number already saved, and consider a code word for urgent requests.

Scams That Turn Your Website Against Other People

31. The fake CAPTCHA that infects your visitors

Some attacks are not aimed at you at all: they use your website to attack your visitors. Attackers who compromise a WordPress website can inject a fake CAPTCHA or browser check that tells visitors to press a key combination and paste a command into Windows, which installs malware on the visitor’s computer. The Hacker News reported in August 2025 on a campaign called ShadowCaptcha that used more than 100 compromised WordPress websites to deliver information stealers and ransomware, and Trend Micro documented the KongTuke operation using hacked WordPress websites to show fake CAPTCHA pages in 2026. You may never see it, because injected code can be set to show only to some visitors. Google will: deceptive content on your pages can trigger Chrome’s full-page warnings and labels in search results until you clean the website and request a review through Search Console. A genuine CAPTCHA never asks anyone to run a command.

32. Your contact form as a spam cannon

Your contact form can also be turned against your own reputation. Sucuri documented a case in October 2025 in which bots abused a form’s “send a copy to yourself” option to queue about 149,700 emails from a cPanel server, damaging the server’s IP reputation and slowing other websites hosted on it. Mail sent that way leaves under your server’s name, which is how a business ends up on blocklists and with undelivered order confirmations. What to do: remove copy-to-sender options, protect every form with CAPTCHA or Turnstile, and limit how often a form can be submitted.

The Scams at a Glance

The Defence That Beats All of Them

Looking at these scams one at a time is useful, but the defence is structural, and it takes an afternoon. Write a one-page record of your digital assets: who registered the domain, who hosts the website, who maintains it, which platforms you use and which people hold administrator access. Many of these scams work because nobody in the business can answer those questions in thirty seconds. The record also protects you in the situation we cover in your web developer disappeared, which is a scam-adjacent problem in its own right.

Then set five rules and tell your staff. Nobody signs in, downloads a file or scans a QR code from a message they did not expect. Nobody pays a web, domain, hosting, SEO or “compliance” invoice unless it matches a known supplier on the record. Nobody refunds or dispatches against a proof of payment until the bank confirms the money. Nobody calls a number or grants remote access because a message or caller asked. And nobody shares a one-time code with anyone, ever. The banking industry’s own line applies across the board: never share a PIN, password or one-time password with anyone, not even someone claiming to be from your bank, SARS, Google, your host or WordPress.

Finally, use two-factor authentication everywhere it is offered and keep at least two administrators on every critical account, so that one compromised login is an inconvenience rather than an outage. Be realistic about its limits: phishing kits now capture live codes and session cookies as you sign in, as the xneelo, Meta and Microsoft 365 campaigns show. Where a service offers passkeys, especially your email, use them, because a passkey cannot be relayed through a fake page.

If You Have Already Clicked

Speed matters more than embarrassment. Change the affected password from a clean device and sign out of all other sessions. For a Microsoft 365 or Google Workspace mailbox, a password change is not enough on its own: revoke active sessions, remove any sign-in methods, app passwords or devices you do not recognise, and check for forwarding and inbox rules that hide or redirect mail. If you downloaded or opened a file, assume an information stealer may have taken every password saved in your browser and change them all, starting with email, banking and hosting. If you entered card details anywhere, call your bank immediately to stop the card. If money left your account, ask your bank to attempt a recall, then open a case at SAPS and keep the case number. Report the message to the organisation that was impersonated.

If the compromise exposed customer personal information, such as form submissions, order data or an email account full of client correspondence, and there are reasonable grounds to believe an unauthorised person accessed or acquired it, section 22 of POPIA requires the responsible party to notify the Information Regulator and the affected people as soon as reasonably possible. If you process that information on someone else’s behalf, section 21 requires you to tell them immediately. Since April 2025, the Information Regulator has taken these notifications through its eServices portal. Our POPIA website compliance checklist covers what that involves.

Summary

Frequently Asked Questions

How do I know if an email from my hosting company is real?

Do not use the link in the email. Log in to your host’s client area by typing the address yourself and check whether the same notice appears there. South African hosts such as xneelo state that they will not ask you to sign in through an email link, and cPanel confirms that the common mailbox quota warnings are phishing emails it did not send.

What is a fake RFQ email?

It is a request for quotation sent to a business’s sales or info address that carries a malicious ZIP or RAR file, or links to a fake portal that asks you to sign in to view the documents. Fortra found that nearly three-quarters of RFQ lures between October 2025 and September 2026 led to fake sign-in pages, such as copies of Microsoft 365 or Google Workspace logins. Verify the company by phone before opening anything.

Is the “your parcel is waiting” SMS real?

Treat it as fake unless you can confirm the parcel through the retailer or the courier’s own app or website. The fee page usually asks for your card number, CVV and then an OTP, which can be used to add your card to a criminal’s digital wallet. The Post Office said in 2022 that it never requests an EFT or online payment before a parcel is collected, and Fastway says it never asks recipients for money. Some couriers, such as DHL, do collect import duties electronically, so check any fee on the courier’s own website or app.

Can scammers get past two-factor authentication?

Yes. Phishing kits such as Tycoon 2FA relay your password and code to the real website and steal the session that follows. Passkeys and security keys resist this because they only work on the genuine website, so use them on your email and other critical accounts where available.

Does WordPress ever email you to install a security patch?

No. WordPress.org has stated that its security team will never email you asking you to install a plugin or theme, and will never ask for administrator credentials. Legitimate updates appear in your WordPress dashboard. Any email with a downloadable patch is a scam designed to install a backdoor.

Does SARS send links or attachments by email?

SARS states that it will not send hyperlinks to other websites, does not send HTML attachments, and will never ask for passwords, OTPs, banking PINs or eFiling credentials. Log in to eFiling directly to see genuine correspondence and forward suspicious messages to phishing@sars.gov.za.

Does Google charge to keep my Business Profile active?

No. Google Business Profiles are free, and Google states that it will never try to convince you to pay to maintain one, will never ask for payment information over the phone and will never ask for a one-time PIN. Hang up on callers who claim otherwise.

What should I do if someone threatens fake reviews unless I pay?

Do not engage and do not pay. Collect screenshots of the reviews and the demands, then report it using Google’s dedicated review extortion form. Google advises that paying only encourages further attacks.

Is an EFT proof of payment enough to release an order?

No. A proof of payment can be edited or fabricated. Standard Bank advises confirming with your bank that the money has actually arrived, and police in Tshwane have warned against relying on screenshots or electronic proof of payment. Release goods or issue refunds only once the funds reflect in your own account.

Who carries the loss if a customer pays a fraudster because of a fake invoice?

South African courts have generally held that the paying party bears the risk of paying the wrong account, as the Supreme Court of Appeal found in Hawarden in 2024 and in a 2025 matter involving Northcliff Nissan. A business that ignores its own verification procedures can be held liable instead, as PSG was in Gerber v PSG. This is general information, not legal advice.