Card Cloned or Used Without You? Your Rights and the Process
Unauthorised transactions are one of the few money problems where speed genuinely changes the outcome. Report within the hour and you are usually made whole. Report a fortnight later, after the statement arrives, and you are arguing.
The first hour
Block the card. Every major South African banking app does this instantly, and it does not require a phone call or a branch. Do it before anything else — before working out what happened, before calling anyone.
Get a reference number. Whether you block in the app or by phone, record the date, the time and the reference. This becomes the evidence of when you reported, and the timing is what most disputes turn on.
Do not move money around first. People often transfer their balance to another account before blocking the card. Block first; the account is what is exposed.
Change your banking password and check your registered details — cellphone number, email, delivery address. Fraud often begins with a change to your contact details so you do not receive the one-time PINs.
Open a police case. You will need the case number for the bank's investigation.
Then dispute it formally
Blocking the card stops future transactions. It does not reverse the ones already made. That is a separate step, and it must be in writing.
Your bank will ask for a signed dispute form or affidavit listing each transaction — date, amount, merchant. Be precise, and list every one, including small amounts. Fraudsters commonly test with a small transaction before a large one, and a R20 test charge you ignore is often the first entry in the sequence.
The bank must investigate and give you a decision. Timeframes vary, and card-scheme rules govern how long a merchant has to respond to a chargeback, so a few weeks is normal.
The question the whole dispute turns on
Almost every card fraud dispute in South Africa comes down to one thing: was your PIN or one-time PIN used?
Card-not-present transactions — online, telephonic, in-app — are where the bank's position is weakest. The merchant took a risk accepting a card without the physical card and a PIN, and liability commonly sits with the merchant or the acquiring bank rather than with you.
Chip-and-PIN transactions are where it gets difficult. If the correct PIN was entered, the bank's starting position is that only you knew it, and therefore either you made the transaction or you disclosed the PIN. That is not the end of the argument, but it is the argument.
Genuine cloning of a chip card is hard. What is far more common, and what actually happens:
- Card swapping. Someone distracts you at a point of sale or ATM and returns a different card. You walk away with a stranger's card while they hold yours — and they watched you enter the PIN.
- Shoulder surfing plus theft. The PIN is observed, then the card is taken.
- Magnetic stripe skimming on older devices or overseas terminals that still fall back to the stripe.
- Phishing for the OTP. Someone calls claiming to be the bank's fraud department, says a fraudulent transaction is in progress, and asks you to "confirm" the OTP to stop it. The OTP authorises the fraud.
That last one is now the most common route by a wide margin, and it is the one banks are least sympathetic about — because you passed on the code.
Your bank will never ask you for an OTP, a PIN or a password. Not to verify you, not to cancel a transaction, not ever. Anyone who does is committing the fraud.
SIM swap fraud
If your phone loses signal for no reason and stays dead, treat it as an emergency rather than a network problem.
A SIM swap moves your number to a fraudster's SIM, so every OTP goes to them. It is usually the second step of an attack that began with your personal details being obtained elsewhere. Contact your mobile operator immediately and your bank straight after.
If the bank says no
A rejection is not the end. The bank must give reasons.
- Ask for the reasons in writing, and for the evidence they relied on — whether the PIN was used, the terminal location, the transaction type.
- Check that evidence against your own facts. A transaction in a city you were not in, at a time you can account for, is a strong position. Cellphone location data and till slips help.
- Escalate internally through the bank's formal complaints process, in writing.
- Take it to the National Financial Ombud. It handles banking complaints, it is free to consumers, and it can make findings against the bank. Give it your reference numbers, the police case number and the correspondence.
The single strongest fact in your favour is almost always how quickly you reported it. That is why the first hour matters more than anything you do afterwards.
What the bank must do, and what it may ask of you
The bank is not free to simply decline. It must investigate, keep you informed, and give reasons for its decision.
It may ask you to complete an affidavit, provide the police case number, and answer questions about where the card was and who had access to it. Answer them fully and in writing, and keep copies. Vague or shifting answers are the fastest way to lose a dispute that had merit.
What it may not do is close the matter because you did not phone back, or leave you without a decision indefinitely. If a dispute goes quiet, write and ask for a status update with a reference number. A paper trail is what makes an ombud complaint work later.
You are also entitled to the transaction detail. Ask for the merchant name, the terminal ID, the location, and whether the transaction was chip-and-PIN, contactless or card-not-present. That detail is what lets you show a transaction happened somewhere you were not.
The account behind the card
One point people miss in the panic: a cloned card is a symptom, and the account is the thing to secure.
Check whether any beneficiaries were added, whether limits were changed, and whether a new device was linked to your profile. Fraud that begins with a card often continues through the banking app if the attacker has enough of your details. Reviewing your registered devices and removing anything you do not recognise takes two minutes and closes the route that matters most.
Also look at your debit orders while you are there. A fraudster who obtains enough personal information sometimes sets up a collection rather than making card purchases, because a debit order attracts far less attention than an unfamiliar retailer. Our guide to disputing and stopping a debit order covers the 40-day reversal window.
Finally, if you suspect the compromise went beyond the card, what to do if you suspect fraud on your bank account covers the wider account response.
Reducing the exposure before it happens
- Turn on transaction notifications for every amount, not just above a threshold. The R20 test charge is the warning.
- Set a low daily online limit and raise it in the app only when you need it. This is the single most effective control most people never use.
- Use a separate card or a virtual card for online shopping, so your main account is not exposed to every merchant you have ever bought from.
- Never let a card leave your sight in a restaurant or shop.
- Cover the keypad. It defeats both cameras and shoulder surfing.
- Check statements monthly, properly. Fraud that runs for months is fraud nobody was checking for.
A credit card is generally the safer instrument for online purchases than a debit card, because the money is the bank's until you settle, and a disputed transaction does not leave your own account empty while it is investigated. If you carry one, it is worth understanding how credit card fraud works in South Africa so the safety does not come with surprises.
Frequently asked questions
Am I liable if my PIN was used?
Not automatically, but it shifts the burden. The bank's position will be that only you knew it. You need to be able to account for how it could have been observed or obtained.
How long do I have to report?
Immediately. There is no useful grace period — the strength of your position falls with every day between the transaction and the report.
Will the bank refund me while it investigates?
Sometimes, as a provisional credit that can be reversed if the dispute fails. Do not spend a provisional credit until the outcome is confirmed.
