Guide
How to spot phishing emails and SMS scams in South Africa
Most break-ins don't start with clever hacking. They start with a convincing message that gets someone to click, log in or share a one-time PIN. Here's how to recognise them.
The scams we see most
- "SARS refund" emails asking you to log in or "verify your banking details" to receive money.
- Bank messages warning of a blocked account or suspicious transaction, with a link or a request for your OTP.
- Courier and parcel SMSes asking for a small "customs" or "delivery" fee.
- Fake invoices to businesses with "updated banking details" for a supplier you really use.
- Account warnings from Microsoft 365, Google or social networks saying your mailbox is full or your password expires today.
Seven warning signs
- Urgency or fear: "within 24 hours", "account suspended", "legal action".
- A request for a password, OTP or PIN. No legitimate organisation needs your OTP.
- A sender address that doesn't match the organisation, or a slightly misspelled domain.
- Links that go somewhere else. On a computer, hover over the link and read the real address before clicking.
- Unexpected attachments, especially compressed files, documents asking you to "enable content", or files ending in .exe, .js or .html.
- Changed banking details on an invoice. Always confirm by phoning a number you already have, never one in the email.
- Too good to be true: prizes, refunds or job offers you didn't apply for.
If you clicked
- Entered a password? Change it now from a trusted device, and anywhere else you use the same password. Turn on multi-factor authentication.
- Shared banking details or an OTP? Call your bank's fraud line immediately using the number on your card.
- Opened an attachment or installed something? Disconnect from the internet and run a full scan. See how to remove a virus from Windows.
- At work? Tell your IT team straight away. Speed matters more than embarrassment.
Protect yourself before it happens
- Turn on multi-factor authentication for email, banking and social media.
- Use a password manager so every site has a different password.
- Keep SmartScreen and real-time protection on in Windows. CitadelLite checks this for you.
- For businesses: agree that payment detail changes are always confirmed by phone.
Frequently asked questions
Will my bank ever ask for my OTP?
No. South African banks do not ask for your one-time PIN, password or card PIN by phone, email or SMS. Anyone asking for it is a scammer.
I clicked a phishing link. What now?
If you entered a password, change it immediately from a trusted device and turn on multi-factor authentication. If you entered banking details, call your bank's fraud line straight away. Run a full anti-virus scan if you downloaded anything.
How do I report a phishing message?
Report it to the organisation it pretends to be from, using contact details from their official website, then delete it. Most South African banks and SARS publish how to report phishing on their websites.
Help shape CitadelGate before launch
We are looking for a small number of South African MSPs and IT teams to pilot AI-assisted ticket remediation on test devices first. No cost, no commitment.