October 30, 12:51TechCentral

How to Protect Business from Fraud and Attacks in Digital Banking

As businesses grow and the volume of digital transactions increases, not only do opportunities grow, but so do risks. Fraudsters use sophisticated methods, making the security of digital banking critically important for protecting cash flows, reputation, and company development. The Standard Bank Business Digital Security Center helps enterprises understand these threats and strengthen their protective mechanisms.

Main Types of Fraud

Many deception schemes are based on social engineering rather than technical hacking. Phishing emails and SMS messages, calls using vishing (voice phishing), and OTP fraud can impersonate a trusted organization, create a sense of urgency, or direct the user to a link to request a PIN, password, or OTP.

Fraud involving fake accounts and payments can utilize altered accounts or false requests to change a supplier's bank details, while transactional fraud can exploit compromised credentials to authorize payments. Furthermore, remote access fraud allows criminals to gain control over a device and disclose digital banking information.

Basic Protection Rules

The most reliable protection starts with simple and consistent security rules: never disclose your PIN, password, or OTP. Standard Bank will never ask for this information over the phone, email, or via a link.

Any changes to payments must be independently verified. If a supplier reports a change in their bank details, you should contact them using a previously known trusted number before making the payment.

If you receive an unexpected message supposedly from Standard Bank or a trusted supplier, especially if you are pressured to act urgently, you must cease interaction and verify the information yourself using known and reliable contact details. It is also important to protect devices: never install third-party applications or grant remote access to a computer or mobile device during an unsolicited or unverified support call.

Fraud prevention is a shared responsibility, especially for employees involved in payments, supplier management, and online banking.

The Standard Bank Business Digital Security Center provides companies with access to security guides, educational materials, anti-fraud checklists, and information on scam schemes to enhance their protection. Protecting people, systems, and payments that ensure your business functions is part of the 'Where Real Growth Begins' principle.

For practical security resources, visit the Standard Bank Business Digital Security Center. Save the 24/7 Standard Bank fraud reporting number: 0800 222 050, to respond promptly in case of suspected fraud.

Similar stories

iol.co.zaOctober 28, 06:55

Signs of fraud in online investments: what to check before transferring funds

As South Africans continue to feel financial pressure, many may consider online investment opportunities. However, citizens are strongly advised to verify the credentials of financial service providers and be cautious about promises of unrealistic returns, as international investigations continue to uncover fraudulent investment schemes targeting depositors.

In its latest update on Operation 'Serengeti III', published on October 22, Interpol reported that authorities in 21 countries arrested 1,462 suspects, disrupted 10,909 malicious networks, and recovered over $105 million USD in illicit funds.

The operation ran from June 29 to August 31, 2026, and targeted various forms of cybercrime, including online fraud, cyber fraud, ransomware, and digital extortion.

Authorities identified 65,929 victims targeted by cybercriminal networks, while financial investigations linked this criminal activity to losses exceeding $385 million USD. These figures cover the entire operation and are not limited only to investment fraud.

One case identified in Uganda involved two transnational fraud groups linked to online investment and pension scams targeting victims across Asia. Interpol stated that 365 foreign nationals were arrested in connection with these schemes.

Investigators discovered a rotating call center model that used communication scripts, fake trading platforms, and fraudulent websites to convince pensioners to invest in non-existent opportunities. This case highlights how professionally presented online platforms and direct communication from alleged investment representatives can be used to create the appearance of legitimate business.

What are the signs of investment fraud?

The Financial Sector Conduct Authority (FSCA) has warned the public about individuals and organizations that may offer financial services without the necessary authorization. In a warning issued in June 2025, the regulator highlighted several red flags for consumers to watch out for.

Unrealistic returns

Caution should be exercised regarding offers promising unusually high or guaranteed profits.

Pressure to make a quick decision

Demands to invest immediately should be considered a warning sign.

Vague investment details

It is necessary to scrutinize offers that provide vague information about the product or the company behind it.

Lack of verifiable authorization

One should not rely solely on a website, logo, or claimed license number.

Requests for additional payments

Be wary if you are asked to pay more money to gain access to investments or to recover already deposited funds.

The FSCA also cautioned that fraudulent operations can disguise themselves as legitimate businesses, making independent verification extremely important before any transfer of money.

How to check an investment platform?

The regulator advises consumers to ensure that the individual or company is licensed to provide the relevant financial services. Investors can use the FSCA's search for authorized financial service providers to check the name or Financial Services Provider (FSP) number of the provider. The details must match the company or person offering the investment. Consumers must also verify whether the provider is authorized to offer the specific promoted service.

An online presence, a professionally designed website, reviews, or a displayed account balance should not be taken as proof of investment authenticity. The FSCA specifically warned consumers against accepting financial advice or investment proposals from individuals who cannot demonstrate the required authorization.

What to do if you suspect fraud?

Do not send any more money or share bank details, passwords, or one-time PINs with the suspected scammer. Keep records of communications, payment confirmations, and platform details, and contact your bank immediately if you have transferred money. Suspicions of investment fraud can also be reported to relevant authorities, including the FSCA and the South African Police.

tecnoblog.netOctober 21, 13:07

Vulnerability in digital certificates causes alarm among cybersecurity specialists

The discovery of eight compromised digital certificates from the eMudhra Certificate Authority has put companies and security researchers on high alert. The private keys were so weak that they could be recovered and used to issue fake certificates capable of imitating legitimate websites and services.

Six affected intermediate certificates were used for TLS, the technology underlying HTTPS connections, while two others were intended for code signing. Mozilla, Google, Apple, and Microsoft received notification on Saturday (the 17th), after which manufacturers began blocking the compromised certificates shortly thereafter.

HTTPS uses digital certificates to confirm that a user is actually connected to the desired website. These certificates function as a form of identity recognized by the browser and help prevent the substitution of the original server with another.

With access to the private keys, an attacker could create fraudulent certificates for websites and services that would be accepted as legitimate by vulnerable systems. A researcher named Wayne demonstrated access to these eight keys, using them to digitally sign a message sent to the companies responsible for major browsers and systems. According to Mozilla, their engineers were able to recover the same keys shortly after the issue was discovered, confirming the flaw.

However, this does not mean that a hacker can intercept any internet connection. As Ars Technica reports, exploiting these certificates in an attack would still require intercepting traffic between the victim and the service.

Mozilla stated that it completed the blocking of certificates in Firefox in less than three hours after receiving the warning. The company also released Firefox version 158.0.1 to enhance user protection. Chrome and other browsers also began rejecting the compromised certificates.

At the time of publication, there was an exception: Microsoft Edge on Windows 10 could still establish connections with some vulnerable servers. Microsoft was questioned about this but did not specify when the block would be applied in that system.

As of now, there are no public reports of fraudulent certificates being used in attacks. Similar measures have been taken in other cases; for example, Chrome stopped trusting Entrust certificates after Google pointed out issues with the Certificate Authority's operation.

The main problem is currently outside of browsers. Linux distributions, applications, and connected devices may continue to trust the compromised credentials until they receive updates. Cryptography engineer Filippo Valsorda told Ars Technica that the cleanup effort could be larger than that caused by Heartbleed, a critical vulnerability discovered in 2014, due to the variety of systems requiring updates.

For ordinary users, the main recommendation is to keep their browser, operating system, and applications up to date. Services like Signal and WhatsApp do not rely on TLS to protect message content and are therefore not affected to the same extent.