This cyber-fraud story was reported in the local newspapers and it’s a real nail-biter.

A fellow Capetonian sold his business and retired. At 78 years old, after two decades of hard work, he suddenly had R10.6 million on hand and he developed an investment plan with his financial adviser.

However, the businessman’s email account was compromised, payment instructions were changed by the scammers, and he ended up paying his money into fraudsters’ bank accounts rather than the investment institution recommended by his financial adviser.

Here’s a timeline of what happened:

• 22 November 2024: The investor received an email from his financial adviser’s team saying, “The investment institution will debit your account directly for the authorised amount of funds.”
• 26 November 2024: The investor received a second email seemingly from the same email address saying, “The direct debit failed, please pay directly into X account with FNB instead.”
• November 27, 28 and 29: The investor made six payments of R1 million each over three days to the FNB bank account number he had received in the second email.
• 29 November 2024: The investor received a THIRD email saying, “Please deposit the balance into a different account, this time with Capitec.”
• 2 December 2024: The investor made two payments of R2.3 million each to the Capitec bank account number he had received in the second email.
• 9 December 2024: The investor received a phone call from the legitimate investment institution saying, “We debited your account as you were advised we would, but there were insufficient funds.”

At which point the new investor obviously smelled a scary rat, contacted his financial adviser and began scrambling to get his funds returned by the two banks.

Other facts that came to light on further investigation:

😞 The emails he received changing the plan had a subtle spelling difference in the name of the sender (which he overlooked).

❌ A legitimate email sent by the financial advisers on 9 December 2024 advising that the institution would be debiting his account that day for R5.35 million was never received by him: deleted from his inbox by the scammers.

❗️The emails containing the scammer’s instructions to transfer to FNB and Capitec: also deleted from his inbox by the scammers.

This is a clear case of a compromised personal email account.

The scammers had been watching for an opportunity to create a big payday, and they exploited it after the client was advised how the funds would be debited by the investment institution.

These were the immediate red flags:

🚩 1 – The change of plan from direct debit by the institution to (multiple) EFT payments by the investor.

🚩 2 – A subtle spelling error in the email address used to communicate the supposed change of plan.

🚩 3 – It’s not clear from the newspaper accounts whether the multiple payments he made (6 x R1 million, 2 x R2.3 million) were based on his own banking limits or on specific instructions from the scammers. If he was instructed to pay in several smaller tranches, it would also be a red flag, as the most likely reason would be to avoid the banks’ internal systems for flagging suspicious transactions.

Here’s how to avoid experiencing a similar situation:

Email-account specific: practice excellent email “hygiene”

• Change your email account password regularly.
• Use a strong password each time: 12-14 characters, a mix of numbers, letters, upper and lower case and special symbols.
• Have multi-factor authentication on your email account.

Transaction specific: check and check again

• Know your financial adviser and their staff.
• Request an expected timeline and instructions for any transactions to be effected, and confirm the bank account details directly, using the trusted phone number you keep on hand / in your own device.
• Query ANY deviation from the original plan with your financial adviser’s office, directly, by phone, using the trusted phone number you keep on hand / in your own device.