Four minutes. Two cash withdrawals. R5,000 gone.

Nhlanhla Mbatha was inside a Capitec branch trying to resolve a problem with his banking app when money was withdrawn elsewhere.

According to Sowetan’s January 2024 report, he had checked his balance at an ATM before approaching a teller because he could not access the app. While he was seeking help, two cash-send withdrawals were made at another shopping centre.

Capitec confirmed the incident and attributed it to banking-app activation fraud—a scam associated with people posing as retail employees offering free airtime or shopping vouchers. The bank said his PIN had been compromised. The report did not independently establish exactly how the criminals obtained it.

His case does not prove that money can disappear without any security information or approval being compromised.

It does reveal something unsettling: the place where you discover the theft may be nowhere near the place where it began.

The voucher is bait. Your banking access is the prize.

Capitec’s current warning describes fake promoters approaching people at malls, taxi ranks and near ATMs.

They may have branded shirts, clipboards and a convincing sales pitch. The request sounds ordinary: register for a reward, verify your identity, activate a voucher.

The bank describes two routes.

In one, the scammer persuades you to open your banking app on your own phone. They obscure the screen or rush you through instructions while transactions or approvals take place.

In the other, they request identity details and a selfie, then persuade you to approve a request supposedly connected to the voucher. What you are actually approving is banking access on their device.

You think you are accepting a benefit. They are obtaining access.

This does not mean a stranger can empty your account simply by photographing your face. Capitec’s explanation includes the manipulation of a banking approval.

If a promoter asks you to open your banking app, provide identity verification or approve access to receive a reward, stop and verify the offer directly with the retailer.

“I never shared my PIN” is not the end of the investigation

A card PIN, a banking login and an app approval do different jobs.

Keeping your ATM PIN secret matters. But it does not explain every possible route through which a payment can happen.

For example, Standard Bank’s guidance explains that criminals can use stolen card details for remote purchases without possessing the physical card. Online transactions may use additional checks such as a one-time password or app approval rather than your card PIN.

And an approval can be genuine while the explanation attached to it is false.

That distinction is central to the voucher scam. The customer sees a request on a familiar banking app, but the stranger supplies a misleading reason to approve it.

The app is asking one question. The scammer is persuading you that you are answering another.

Sometimes the “fraud alert” is where the fraud starts

On 19 October 2026, Capitec published a warning about fake SMS fraud alerts.

A message claims that money has been spent and provides a number to call if the transaction was not yours. You call because you want to protect your account.

But the number belongs to the criminals.

Capitec explains that the supposed transaction may not exist at all. The message creates panic so that you will disclose information or approve a request you otherwise would not.

Read that again: your account may be untouched until you follow the instructions to “protect” it.

The same tactic appears in calls about suspicious activity or unauthorised debit orders. Capitec warns that criminals may ask customers to send cash, buy vouchers, approve payments or move funds into a supposed safe account.

The practical response is simple: end the interaction and contact the bank through a channel you independently know is genuine.

Do not let the person reporting an emergency also choose the only route through which you are allowed to verify it.

Not every voucher scam involves taking over your account

“Voucher scam” can describe several different incidents.

The scam

What is being targeted

A fake free-voucher promotion

Banking access or transaction approvals disguised as registration.

Someone watching a cash-send transaction

The reference and secret code needed to collect the money.

A fake bank official requesting vouchers or cash send

An outgoing transaction disguised as a fraud-prevention step.

A message from an impersonated friend requesting emergency cash

Your trust in the person you believe is asking.

In September 2025, Capitec told Daily Investor that criminals were observing cash-send voucher numbers and PINs, then redeeming the money quickly. That is theft of collection details, rather than necessarily a takeover of the sender’s banking profile.

SAPS warned in April 2026 that criminals were also gaining access to phone numbers and messaging platforms, impersonating their owners and asking contacts for cash sends. In those cases, the compromised account may be the messaging account—not the bank account of the person sending money.

An urgent message from a familiar name still deserves an independent check.

Real losses deserve answers—not guesses about “hacking”

Another case shows why the details matter.

In February 2026, Sowetan reported that Thabo Khoza had received a R421,000 Road Accident Fund payout in March 2025. He alleged that a cousin who assisted him with banking took money through his app. Three transfers listed in the report totalled R395,000.

His family alleged that facial recognition had been bypassed. Capitec disputed a security failure, saying valid credentials and the customer’s selfie had authenticated the beneficiary. Police confirmed a theft case.

Those are competing accounts. The published evidence does not establish a proven facial-recognition flaw.

Likewise, Sowetan reported in September 2024 that Olivia Mahlare said an unexplained R150,000 arrived in her account before outgoing funds included her own R11,800. Capitec said it was investigating. The report did not establish how access was first obtained.

It would be wrong to fill that gap with a confident story about malware, a SIM swap or a shared PIN.

A missing balance is evidence of a problem. It is not, by itself, a diagnosis of how it happened.

“It disappeared overnight” tells us when someone noticed

A person can discover missing money in the morning without knowing when access was first compromised.

The useful questions are more specific:

-What time did the transactions happen?

-Were they card purchases, transfers, voucher purchases or cash sends?

-Was another device registered?

-Was a new beneficiary added?

-What approval or authentication was recorded?

These questions help separate account access, stolen payment details and payments obtained through deception.

They also help avoid two unfair shortcuts: assuming every loss proves the bank was hacked, or assuming every victim knowingly handed over access.

The cases reviewed here do not establish a single, widespread Capitec system breach. They show different incidents, including documented scams and unresolved disputes.

If money is missing, do this before trying to solve the mystery

Contact Capitec immediately.

Its official personal-banking fraud number is 0860 10 20 43. From outside South Africa, call +27 21 941 1377.

Explain what happened, including any suspicious approvals, device access, lost phone or unexpected transactions. Capitec says it can stop affected accounts, transaction channels or cards and open an investigation. It may request supporting information, including a SAPS affidavit.

Then:

1. Keep the evidence. Save messages, transaction references, statements and a timeline of calls or interactions.

2. Ask what has been secured. Make clear if someone may have access through another device; do not describe everything simply as a lost-card problem.

3. Get the case reference and written findings. If you dispute the explanation, identify what remains unanswered.

4. Report the crime to SAPS. Capitec’s guidance advises doing so, alongside immediately contacting the bank.

Do not wait until you have worked out the method. Reporting quickly gives the bank an opportunity to act; it does not guarantee recovery.

One check Capitec customers should know about

Capitec’s current app includes caller verification.

According to the bank, a green banner identifies a verified Capitec call and displays the consultant’s name. A red banner means the call cannot be verified.

If uncertain, hang up and call through the app yourself. Capitec specifically warns against believing callers who claim the verification banner is broken or the system is down.

That check is useful because confidence, urgency and knowledge of your personal details can make an impostor sound convincing.

You should not need to understand banking systems to recognise the trap

A voucher offer should not leave you wondering who now controls your banking app. A message about fraud should not become the first step in losing your savings.

People need explanations that connect the request on the screen to what it actually authorises.

That is why Zach of All Trades CPT exists: to help people understand technology and make practical, informed decisions about it.

The next time somebody says, “Just approve that quickly,” take the time to find out what “that” actually is.

8. SOURCES

Research checked: 3 November 2026. Incident dates and publication dates are distinguished in the article.

Capitec — When a “free” voucher costs you your savings

Sowetan — Banking App scam: “How I lost R5k in four minutes”

Capitec — How to spot fake SMS fraud alerts

Capitec — Always verify if it’s us

Daily Investor — Capitec ATM fraud warning

SAPS — Verify requests for money sent via cash-send services

Sowetan — Report on Thabo Khoza’s RAF payout

Sowetan — Victim of fraud told, “sorry case is closed”

Standard Bank — Understanding card-not-present fraud

Capitec — Report fraud

Capitec — Frequently asked questions

9. ALTERNATIVE HEADLINES

They Offered a Free Voucher. The Approval Was for Your Banking App.

The Fraud Alert Was Fake. The Money You Sent Was Real.

Money Missing From Your Capitec Account? “Hacked” May Not Explain What Happened.