Cybercrime & Identity Theft: How to Report and Protect Yourself

What is Cybercrime?

Cybercrime refers to illegal activities carried out using computer systems, networks, or the internet. In South Africa, cybercrime is governed by the Cybercrimes Act 19 of 2020, which came into effect on 1 December 2021.

Common Types of Cybercrime

Identity Theft: Stealing someone's personal information (ID number, banking details) to impersonate them.
Phishing: Fraudulent emails or messages that trick you into revealing passwords or financial information.
Smishing: SMS phishing (fake text messages with links).
SIM Swap Fraud: Criminals port your phone number to a new SIM card to access your accounts.
Malware: Viruses, ransomware, or spyware that infect your device.
Online Banking Fraud: Unauthorized access to your bank account.
Cyberstalking and Harassment: Using technology to harass, threaten, or intimidate someone.
Data Breaches: Unauthorized access to personal or corporate databases.

The Scale of the Problem in South Africa

In 2024, South Africa experienced:

A 400% surge in identity theft between April 2023 and April 2024.
An 86% increase in digital banking fraud, with losses reaching R1.888 billion.
68% of South Africans were targeted by fraud (email, phone, or SMS).
Banking apps accounted for 65% of digital fraud cases.

The Cybercrimes Act Explained

The Cybercrimes Act criminalizes various offenses and provides a legal framework for combating cyber threats.

Key Offenses Under the Act

Unlawful Access: Hacking into computer systems without authorization (up to 5 years in prison).
Unlawful Interception of Data: Intercepting emails, messages, or data transmissions (up to 5 years).
Cyber Fraud: Using technology to commit theft or fraud (up to 15 years).
Cyber Extortion: Demanding money or benefits through threats via electronic means (up to 15 years).
Identity Theft: Stealing or using someone's personal information for fraudulent purposes (up to 10 years).
Distribution of Harmful Messages: Sending threats, intimidation, or harmful content (up to 3 years).

Penalties

Depending on the severity, penalties range from fines to imprisonment of up to 15 years.

Extraterritorial Jurisdiction

South African courts can prosecute cybercrimes committed outside the country if they affect a South African person or business.

How to Report Cybercrime to SAPS

Step 1: Gather Evidence

Before going to the police, collect all available evidence:

Screenshots of suspicious messages, emails, or websites.
Bank statements showing unauthorized transactions.
Proof of identity theft (fraudulent accounts opened in your name).
Phone records (for SIM swap fraud).
Any correspondence with the fraudster.

Step 2: Visit Your Nearest Police Station

Go to any SAPS station and request to open a case for cybercrime.

Step 3: Draft an Affidavit

You will be asked to make a statement (affidavit) detailing:

What happened (dates, times, amounts).
How you discovered the crime.
Any evidence you have.
Financial losses incurred.

Step 4: Get a Case Number (CAS Number)

SAPS will issue a case number. Keep this number—you'll need it for insurance claims, bank disputes, and credit bureau notifications.

Step 5: Request Referral to Cybercrime Unit

Ask the investigating officer to refer your case to the SAPS Cybercrime Division for specialized investigation. Not all police stations have cybercrime expertise, so this is important.

Alternative: Report Online

Some cybercrimes can be reported online, though the process is still developing. Check the SAPS website for updates.

What to Do If You're a Victim of Identity Theft

1. Report to SAPS

Open a case immediately and get a case number.

2. Notify Your Bank

If your banking details were compromised:

Call your bank's fraud hotline immediately.
Freeze or close affected accounts.
Request new cards and change all PINs and passwords.
Dispute unauthorized transactions.

3. Contact Credit Bureaus

Place a fraud alert on your credit profile with all major bureaus:

TransUnion: 0861 886 466
Experian: 0861 105 665
Compuscan: 0861 514 131

Request a copy of your credit report to check for fraudulent accounts.

4. Report to Your Mobile Network (SIM Swap Fraud)

If your SIM was swapped:

Contact your network provider immediately (Vodacom, MTN, Cell C, Telkom).
Request an affidavit reversal to get your number back.
File a complaint and block the fraudulent SIM.

5. Change All Passwords

Change passwords for:

Email accounts.
Banking apps.
Social media.
Any accounts linked to your compromised details.

Use strong, unique passwords and enable two-factor authentication (2FA).

6. Monitor Your Accounts

Check bank statements, credit reports, and online accounts regularly for suspicious activity.

How to Protect Yourself from Cybercrime

1. Use Strong Passwords

Use at least 12 characters with a mix of letters, numbers, and symbols.
Never reuse passwords across accounts.
Use a password manager (e.g., Bitwarden, LastPass).

2. Enable Two-Factor Authentication (2FA)

Add an extra layer of security by requiring a code sent to your phone or email.

3. Beware of Phishing Scams

Don't click on links in unsolicited emails or SMS messages.
Verify sender email addresses carefully (look for typos).
Never provide personal information via email or phone unless you initiated contact.

4. Protect Your Personal Information

Don't share your ID number, banking details, or passwords.
Shred documents containing sensitive information.
Be cautious about what you post on social media.

5. Secure Your Devices

Install reputable antivirus software.
Keep your operating system and apps updated.
Use a VPN on public Wi-Fi.
Lock your phone and computer with strong PINs/passwords.

6. Monitor Your Bank Accounts

Set up transaction alerts via SMS or app notifications to catch unauthorized activity immediately.

7. Be Skeptical of "Too Good to Be True" Offers

If an investment, job offer, or prize sounds unrealistic, it probably is a scam.

8. Protect Against SIM Swap Fraud

Request a SIM swap block from your mobile provider.
Never share OTPs (one-time pins) with anyone.
If your phone suddenly loses signal, contact your network immediately.

Frequently Asked Questions

Will SAPS investigate my cybercrime case?

Yes, but capacity is limited. In 2024, over 100,000 banking fraud cases occurred, but SAPS recorded only 544 cybercrime cases. Ensure your case is referred to the Cybercrime Division for better attention.

Can I get my money back if I've been scammed?

It depends. If your bank account was hacked due to the bank's security failure, the bank may refund you. If you willingly shared your PIN or OTP, recovery is unlikely. Always dispute unauthorized transactions immediately.

How long does a cybercrime investigation take?

It varies widely—from a few weeks to several months or longer, depending on complexity and SAPS resources.

Can I sue a company for a data breach?

Yes. If a company's negligence led to your data being stolen, you can claim damages under POPIA (Protection of Personal Information Act).

What if the scammer is based outside South Africa?

The Cybercrimes Act has extraterritorial jurisdiction. If you're a South African victim, SAPS can investigate and cooperate with international law enforcement (Interpol).

How do I check if my personal information has been leaked?

Use services like Have I Been Pwned (haveibeenpwned.com) to check if your email or phone number appears in known data breaches.

Is using public Wi-Fi dangerous?

Yes. Hackers can intercept data on unsecured networks. Always use a VPN when accessing sensitive information on public Wi-Fi.

Can I report cyberbullying to SAPS?

Yes. The Cybercrimes Act criminalizes the distribution of harmful messages and cyberstalking. You can open a case.

What should I do if I accidentally clicked a phishing link?

Do not enter any information.
Close the page immediately.
Run antivirus software.
Change your passwords.
Monitor your accounts for unusual activity.

Are cryptocurrency scams illegal in South Africa?

Yes. Fraud is fraud, regardless of the currency. Report crypto scams to SAPS and the Financial Sector Conduct Authority (FSCA).

Key Takeaways

Cybercrime in South Africa is governed by the Cybercrimes Act, with penalties up to 15 years in prison.
Identity theft surged 400% in 2024, and digital banking fraud reached R1.9 billion in losses.
Report cybercrime to SAPS, get a case number, and request referral to the Cybercrime Division.
If you're a victim of identity theft, notify your bank, credit bureaus, and mobile network immediately.
Protect yourself with strong passwords, 2FA, antivirus software, and vigilance against phishing.
Never share OTPs, PINs, or personal information via email or phone.
Monitor your bank accounts and credit reports regularly.
Act fast—early detection and reporting significantly improve your chances of recovery and preventing further damage.