- Scammers are taking over bank accounts, often by paying account owners for a one-time pin.
- People who have their bank accounts hijacked are called “money mules”.
- Here we explain why this happens and what needs to be done.
- For more financial news, visit News24 Business.
Judith Hawarden must have been excited when she paid R5.5 million to ENS, the attorneys handling the sale of her new house. Unfortunately, she didn’t realise that the email she had received with the bank account details wasn’t from ENS but from a scammer. The email address ended ensafirca.com, not ensafrica.com, and, quite understandably, she didn’t notice this.
Before any of the parties involved in the sale realised what had happened, the money was transferred out of the bogus account and was gone.
For the next half-decade, Hawarden and ENS fought each other in court, each blaming the other for the loss. Hawarden won in the Gauteng High Court. But ENS prevailed at the Supreme Court of Appeal.
When we read about the case, we wondered: Where was the bank in all this? Why didn’t it manage to recover the money and reverse the transaction to the fraudulent account? Surely, the bank knew who the fraudulent account belonged to? Why does the Financial Intelligence Centre Act (FICA) verification not prevent this from happening?
In 2023, The Big Issue, the non-profit magazine sold by homeless people, almost went bankrupt after paying R600 000 to a scammer instead of its printers. Again, the money couldn’t be recovered. GroundUp published an editorial calling on the bank involved to reimburse The Big Issue. “If FICA cannot prevent this kind of fraud, then its use is questionable,” we wrote.
It turns out that, despite FICA, it’s still possible for the illicit recipient of money to evade identification by banks through what’s known as a money mule – a person who opens a bank account, goes through the FICA process, but then, either deliberately for a fee or without realising it, gives control of their account to fraudsters.
In other words, the mule has passed FICA verification, but their account is used by someone else. It’s like a teenager asking an adult to buy them alcohol they are underage; the only requirement is that the liquor store checks if the purchaser is an adult, not who consumes the alcohol.
Mule recruitment happens in plain sight. On Facebook, fraudsters openly buy bank accounts on Marketplace and in various groups. They target students and the unemployed. They offer a commission in exchange for your banking login details and the one-time pin (OTP) sent to you by your bank. The OTP enables them to commit fraud using your bank account, with transactions approved by you directly.
The fraudsters then trick someone, like Hawarden or The Big Issue, into paying money into the mule’s account. The crooks then swiftly transfer money from the mule account, typically into a crypto wallet or gambling account. At this point, it becomes very hard, if not impossible, to recover the money. The bank knows who owns the account, but its owner – the mule – is uninvolved in the transaction.
We sent questions about mule accounts to the large banks. Absa, FNB, Standard Bank, Discovery Bank and Capitec were very helpful. So was the Southern African Fraud Prevention Service (SAFPS), a non-profit organisation that works with the banks. SAFPS maintains a fraud database that financial institutions can access. The answers to the questions in this article are based on the replies we received from these institutions.
How big a problem is mule fraud?
One banker estimated that mule fraud amounts to hundreds of millions of rands annually. Another told us fraud statistics are significantly under-reported. This is in part because victims often don’t report the problem. Mule fraud is a growing problem, according to the National Financial Ombud Scheme and SAFPS.
But there is a lack of concrete data. As one banker explained to us, there has until now been no consistent definition of fraud categories across the financial sector. “When one bank reports digital malware as fraud, another institution may say they don’t see that as fraud.”
He explained that the Financial Sector Conduct Authority and the Prudential Authority have sat down with the industry to hammer out definitions and reporting standards. He expected that within a year, banks would be required to report monthly on fraud against them or their customers. “But whether [that data will be made] public or just [go] to the regulator, I don’t know.”
Why is it hard for banks to prevent mule fraud?
There is a concerted effort to reduce bank fraud through mules, but it isn’t easy. Banks cannot delay every electronic payment while verification is conducted with both payer and payee; that would make banking impossibly slow.
We asked the banks why they cannot detect when an unusually large amount goes into an account and then delay the transaction while it is confirmed to be legitimate.
One bank explained that while “unusual or out-of-pattern transactions” are often suspicious, there are legitimate scenarios in which such transactions are valid. Blanket delays based only on transaction size “could result in unnecessary friction”, the bank said.
Also, mule fraud has become more sophisticated.
“It is no longer limited to newly opened or obviously suspicious accounts,” a bank told us. “In many instances, mule accounts belong to longstanding, legitimate clients, which makes detection far more complex.”
What more could the banks do?
The banks that responded all said they have software that attempts to detect and stop suspicious transactions.
They also cooperate to identify mules. And they have access to a database of fraudulent activities maintained by the SAFPS.
But the volume of transactions is huge, and the banks have a competing interest in making paying and being paid as frictionless as possible.
In a Daily Maverick video, journalist Rebecca Davis suggests two measures that could reduce fraud:
- Banks should, by default, have to reimburse clients for fraud up to a certain amount (so that there’s a strong incentive for them to prevent it); and
- The name of the payee that the payer specifies should be verified against the payee’s account name.
The banks, perhaps unsurprisingly, expressed scepticism about the first suggestion. One bank employee said his bank does reimburse some victims of fraud, but in mule fraud cases, the victims authorise the payments, so it’s not really the bank’s fault.
One bank said reimbursement could have “unintended consequences”, causing a “shift in customer behaviour, where individuals and businesses may take greater risks, knowing that losses could be refunded”.
Another bank pointed out that banks already invest significantly in fraud prevention.
On the second suggestion, it was pointed out that some banks already offer an account verification option when making a payment. But it costs the customer money. Presumably, few people use it, but that might change if the service were free.
Account name matching would certainly help, but it would not eliminate mule fraud entirely, as many mule accounts use the intended payee’s name but are not controlled by that payee.
Neither one of these measures would prevent scams that use money mule accounts, which often take the form of:
- Romance fraud, where a person pays a large amount of money into the account of someone they believe is in love with them;
- Marketplace fraud, where people are sold products from dodgy online sites at prices that are too good to be true; and
- Investment fraud, where people are conned into investing money by paying into accounts from which the money is simply stolen.
At least one bank, Capitec, makes you take a selfie before processing some payments. This makes it harder for the person who has hijacked a mule account to transfer the money they have been fraudulently paid into an onward account. Sometimes Capitec clients complain about this feature on social media, but it does protect them from fraud.
What more can the state do?
One bank pointed out that the Protection of Personal Information Act, which came into effect in 2020, while an important protector of privacy, also slows information sharing between banks, making it harder to trace fraudulent transfers. This is something legislators could try to address.
Also, while none of the banks said this, it’s quite clear that the police have very limited capacity to catch fraudsters.
Another institution involved in eliminating fraud is the South African Banking Risk Information Centre. It works with the banks and the Hawks. The organisation claims that it has helped strengthen the police service’s “digital forensic analysis capacity and its ability to investigate and prosecute complex financial crimes”, and that this “was necessary for South Africa to be removed from the Financial Action Task Force grey list of countries that have weaknesses in their capacity to fight financial crime”. South Africa was removed from this list in 2025.
Also, since much mule fraud involves transferring money to crypto or gambling site accounts, stronger regulation of these online sites might help.
What can you do to avoid being scammed?
When making large payments, it is best practice to verify the payee’s banking details telephonically. You can also use account validation services offered by your bank, even though they do cost money (and should be free).
One of the bankers emphasised that romance scams, investment scams, and online product sales that are clearly “too cheap to be true” are key red flags to watch out for.
“Always consult friends and financial advisors,” he said. “Slow down” before making a payment.
He also advised that if you get a call saying that your money is about to be compromised, drop the call and call your bank’s fraud hotline to report it. Such calls are probably an attempt to get you to transfer your money into a mule account.
First published on GroundUp.
