SABRIC report shows where the money is being lost
Banking app fraud has become the dominant financial crime facing South Africans, and the industry’s own numbers show how far ahead of every other channel it now sits. Client claims reached R2.4 billion across 110,074 investigations, up 29.2% on 2024’s R1.86 billion and more than double the R1.09 billion recorded in 2023, according to the 2025 Annual Banking Crime Statistics published by the South African Banking Risk Information Centre. TechAfrica News
Banking apps accounted for 97,555 of the 110,074 digital banking investigations, which is 88.6% of cases and 70.5% of claim value. TechAfrica News
SABRIC said digital banking crime remains the biggest threat and that banking app-related crime accounted for more than 70% of reported digital banking losses. Algoa FM
The report also shows criminals abandoning the street. ATM attacks declined by 46% during 2025 while associated cash losses fell by 63%, and bank robberies continued their downward trend with only two incidents reported in 2025, compared with eight in 2024. Taylor & Francis Online
What the average victim loses, and how attackers get in
The per-incident numbers explain who is being targeted for what. Computer-based internet banking produced just 9,354 cases but 28.6% of the value, roughly R73,600 a case against about R17,400 for app incidents, a gap SABRIC ties to large once-off, supplier and business payments. TechAfrica News
In plain terms, app fraud is a high-volume, mid-value crime aimed at ordinary account holders, while internet banking fraud is a lower-volume, high-value crime aimed at businesses.
Importantly, the apps themselves are not being broken into. Attackers go after the phone and the person holding it.
Boris Larin, chief security researcher at Kaspersky, told MyBroadband that attackers target credentials, devices and communications associated with users’ financial accounts in South Africa. “Phishing and social engineering can lead people to fake banking pages, while infostealers and mobile banking trojans are designed to capture credentials or other sensitive information,” Larin said.
He said such malware can collect banking credentials, cookies, card numbers and autofill data, which may support account takeover or direct financial fraud, and that a compromised smartphone can expose far more than one banking login because phones hold personal communications, authentication credentials and access to other accounts.
Kaspersky found that mobile banking attacks grew 1.5 times globally in 2025, and that bank-related phishing accounted for 53.75% of all phishing detections in Africa.
The 2025 banking crime numbers at a glance
| Measure | 2025 figure |
|---|---|
| Digital banking client claims | R2.4 billion |
| Change on 2024 | Up 29.2% from R1.86 billion |
| Total digital banking investigations | 110,074 |
| Banking app investigations | 97,555 |
| Share of cases on apps | 88.6% |
| Share of claim value on apps | 70.5% |
| Internet banking cases | 9,354 |
| Average loss per app incident | About R17,400 |
| Average loss per internet banking incident | About R73,600 |
| Card fraud losses | R1.7 billion, up 18% |
| ATM attacks | Down 46% |
| Bank robberies | 2, down from 8 |
| Fraudulent home and mortgage loan applications | R595.9 million, down 3.4% |
On the arithmetic of the report’s own figures, 70.5% of R2.4 billion works out to roughly R1.7 billion lost through banking apps in a single year. That calculation is Southafriworld’s, based on the published percentage and claim total.
Card fraud also recorded a significant increase, with losses rising by 18% to R1.7 billion, and card-not-present fraud remained one of the most significant forms of fraud affecting consumers. Taylor & Francis Online
The methods have become harder to spot. SABRIC chief executive Andre Wentzel said when the 2024 report was released in August 2025 that criminals are leveraging AI to create scams that appear more legitimate and convincing, from AI-written phishing emails to deepfake voice calls. Facebook
Stolen credentials also circulate long after the initial theft. Kaspersky found credentials linked to more than one million online banking accounts at the world’s 100 largest banks were compromised by information-stealing malware in 2025, and were being traded on the dark web.
What banks and users are being told to do next
Larin’s guidance is unglamorous and specific. He said the easiest starting point is keeping a phone’s operating system and applications up to date, because security patches close the vulnerabilities attackers exploit.
He said banking and other applications should come from official stores or trusted sources, and that users should be wary of installing software through links sent in messages or appearing in unexpected advertisements. “When a message claims to come from a bank, avoid using the link it provides to access your account. Open the banking app independently or use the bank’s known official channel,” Larin said.
Several things are not established in the published material. SABRIC has not released a breakdown of losses by individual bank, no figure has been published for how much of the R2.4 billion was recovered or reimbursed to customers, and the report does not state what proportion of app incidents involved a customer being manipulated into authorising the transaction themselves, which determines whether a bank refunds the loss.
It is also not confirmed whether the 2026 figures are tracking above or below 2025 at the halfway mark.
The next fixed markers are SABRIC’s quarterly industry communications, the Financial Sector Conduct Authority’s reporting on complaints against banks, and the 2026 Annual Banking Crime Statistics, due in the second half of next year.
