In Gqeberha, a nurse received an SMS saying SARS had auto-assessed her and a R9,840 refund was due to her. She had been waiting to fix her car to help travel for night shift.

R31,600 left her bank account later that day and real refund had never been released. Lindiwe was not chasing free money. She had worked overtime in April and May, her car had started making a grinding sound, and her unemployed boyfriend had already asked for help with money for a deal he was working on.

When the SMS arrived, the timing felt almost merciful. It used the language we all recognise around tax filing season; auto-assessment, refund, verification, banking details etc. That is why the message did not feel like a scam. It felt like admin finally moving.

In Bellville, a woman listed a couch on Facebook Marketplace for R4,500. A buyer contacted her and sounded normal, sent proof of payment, and said the money was “held” until she verified her bank account.

By 21:14, R42,870 was gone from her bank accounts. The bank said it was authenticated and they could not help her.

A Thread Nomsa was not trying to get rich from the couch. She was clearing space in a small flat before month-end, hoping the sale would help with school transport and groceries.

The buyer asked normal questions, negotiated like every other Marketplace buyer, used a local profile with family photos, and moved the conversation to WhatsApp in the same casual way many South Africans now do when a sale starts on a platform and becomes personal.

In Midrand, Thabo Mokoena had just been paid R7,184,230.55 by Eskom…
48 hours later, he was kidnapped and forced to transfer every cent out of his account. What happened next is not how these stories usually end, thanks to his bank.

A Case Study. At 36, Thabo ran a small electrical subcontracting firm operating between Midrand and Witbank, the kind of business that survives on relationships, relentless follow-ups, and just enough cash flow to stay one step ahead of supplier pressure, payroll anxiety, and the constant risk of a single delayed payment collapsing everything.

In Centurion, 36-year-old Lerato Khumalo had just received R1,892,440.60 from selling her late father’s house.

By 14:26 that afternoon, she was seconds away from transferring the full amount to a fraudster… and the only reason she didn’t was something she had almost deleted two weeks earlier.

A Case Study Lerato worked in HR at a mid-sized engineering firm, earning just over R42k a month, and had spent months managing the estate process after her father passed, dealing with paperwork, agents, and family expectations.

In Waterfall, Midrand, Karabo Mokoena was earning just over R3.8 million a year as a senior executive, and by the time she approved a R352,840,000 contract renewal, her children’s R750,820 school fees and part of her R14.2 million bond had already been quietly settled through structures she had never questioned.

A Case Study. Karabo had built her reputation the slow way, coming through the graduate programme and earning credibility over years of delivering in environments where most people relied on theory, which made her one of the few executives trusted to make decisions that carried operational consequences beyond spreadsheets.

In Rosebank, Andile Ncube, a 32-year-old customer service team leader earning R54k a month, quietly processed refunds into his own accounts for 7 months… while being praised for “excellent customer resolution times.”

By the time anyone noticed, R11.4m was gone.

A Thread. Andile worked on the 3rd floor of a busy e-commerce office just behind The Zone. His team handled complaints, failed deliveries, duplicate charges, and angry customers who threatened to go straight to Twitter if things weren’t fixed quickly.

Speed mattered more than anything.

At a conference in Sandton, Tondani’s iPhone was dying, so he leaned over and asked Kolobe if he could charge it on his laptop while they listened to the speaker. Kolobe said yes without thinking much of it. Six weeks later, Kolobe’s company lost R25,184,600.

A thread. It was one of those polished corporate conferences at the Sandton Convention Centre where everyone wore lanyards, spoke about resilience and digital transformation, and posted blurry stage photos on LinkedIn before lunch. Kolobe worked for a mid-sized industrial supplies business based in Jet Park. He had come to network, collect CPD points, and get out of the office for a day.

In February 2024, a chrome mining project was approved near Zeerust in the North West. The numbers made sense, shallow deposits, low stripping ratio, and a projected R120 million initial capital injection with break-even expected within 14 months.

A Thread The investors were a mix of local businesspeople and a mid-tier mining fund based in Johannesburg, and from their perspective, the biggest risks were geological uncertainty and commodity price fluctuations.

Somewhere in Parklands, Cape Town, there is a university that has quietly overtaken UCT, Wits and UP as the most productive engineering school in the country.

Except this one specialises in Social Engineering and the graduates don’t build bridges, they build fraud schemes.

A Thread. The campus is not what you would expect from a leading institution. There are no lecture halls or laboratories, only apartments where laptops, headsets and multiple WhatsApp accounts sit open on every screen. Yet the programme is extremely competitive because the skills taught here can move more money in a week than many legitimate careers pay in a year.

On a late Friday evening in Sandton, audit senior Ayesha Khan logged into her firm’s internal audit platform to review files from a client engagement she had worked on months earlier. The system rejected her password three times before finally granting access. By Monday morning, thousands of confidential audit documents had been downloaded from her account.

A Thread. Ayesha worked at Harrison & Cole Advisory, the same audit firm that had already been grappling with a series of uncomfortable internal incidents. Billing manipulation, expense fraud, insider trading and confidential document leaks had each revealed how easily professional systems built on trust could become vulnerable.

In Sandton, a major audit firm signed off the financial statements of a construction company for the fourth consecutive year. The books balanced, the documentation was complete and the audit opinion was clean. Months later investigators discovered the company had been inflating project costs and siphoning millions through subcontractors linked to its own executives.

A Thread. The audit had been performed by Harrison & Cole Advisory, the same firm already dealing with questions after the TransFleet fictitious revenue case, the MetroMart procurement fraud and the BlueWave bank confirmation manipulation. Each incident had exposed a different blind spot in the audit process.

At a warehouse in Montague Gardens, Cape Town, a supervisor named Ashley Petersen marked 48 brand-new coffee machines as “damaged stock” in the inventory system. The system removed them from sale immediately. A week later, the same machines began appearing in small appliance stores around Somerset West.

A Thread. The warehouse belonged to Atlantic Retail Group, a national distributor supplying electronics and appliances to major retail chains across South Africa. Every week shipping containers arrived with televisions, coffee machines, microwaves and other appliances destined for stores around the country.

Case Study #144

One Monday morning in Sandton, the fraud team at a large South African bank (MK Bank) began receiving complaints from customers whose accounts had been emptied overnight.

At first the incidents looked unrelated. Different customers, suburbs and devices. But within a few hours investigators realised something far more serious was happening.

A thread. The first victim was Michael Jacobs, a property developer living in Bryanston. When he opened his banking app that morning, nearly R1.8 million had been transferred out of his account through several rapid transactions.

The transfers had all been authenticated using his correct login credentials.

Case Study 122

In Orlando East, Soweto, a small group of mourners stood quietly beside a freshly dug grave at Avalon Cemetery. The priest finished the final prayer while family members wiped tears from their faces. To everyone present, the burial of Patrick Nkosi, a retired security guard who had spent most of his life working night shifts in Johannesburg CBD, looked like a sad but ordinary funeral.

Within weeks of that burial, however, Patrick’s death would trigger payouts from several different funeral policies across multiple insurance companies.

A thread. Patrick had moved in with his niece Zanele Nkosi during the last year of his life. She lived in a modest house in Orlando East and had become the person responsible for looking after him as his health slowly declined. Neighbours often praised her for the care she showed him, especially when he struggled to walk to the local clinic.

Behind the scenes, however, Zanele had been speaking to someone else about Patrick.

Case Study #140

In Soweto, a taxi owner named Sizwe Mthembu was murdered just three months after taking out several life insurance policies. At first it looked like a tragic robbery that had gone wrong on a quiet street in Diepkloof. But when investigators began piecing the story together, they realised the death had not been random at all. It had been carefully planned.

A thread. Sizwe operated two taxis on the busy route between Dobsonville and Johannesburg CBD, waking before sunrise most mornings to check on his drivers before commuters filled the ranks. Life was not luxurious, but it was steady enough for him to support his wife Lerato and their daughter. Friends described him as cautious with money and proud of the small business he had built.

I would never intentionally teach anyone how to commit fraud, but today let’s get operational and unpack how easy it has become to execute a fraud scam.

FaaS (Fraud as a Service) is booming globally and South Africa is in the forefront.

A Thread Most people imagine fraudsters as highly skilled hackers sitting behind laptops writing complex code. That image is outdated. Today a person with almost no technical ability can run a sophisticated fraud operation. They don’t need to build anything themselves anymore. They simply buy the tools, the data, and sometimes even the victims.

Fraud is the most profitable business in South Africa. That’s why our cousins won’t leave. I will share the most profitable fraud schemes/scams by 12:00 tomorrow and you can do what you wish with that information

Okay, this is a teachable moment. Let me out on my professional hat and walk with me and let me teach you how it works

A Thread

https://twitter.com/rendani666/status/2026339504919830829

The “Investec + Hollywoodbets + R2.3m” story is being framed like a gambling scandal. But the more useful lens is this: it’s a case study in how money moves when systems allow it, even briefly.

Most people don’t get scammed by strangers. They get scammed by someone they know.

It usually doesn’t start with panic. It starts with a normal message from someone already in your contacts. “Hey, my banking app is acting weird. I’m trying to pay someone urgently. Can I quickly use your number? I just need to receive something.”

It doesn’t feel suspicious. It’s a friend. A cousin. Someone you trust.

So you say yes.