PROJECT: UNDERSTANDING THE "JUMPED" SCAM IN SOUTH AFRICA

YOU MAY SHARE THIS PUBLIC DOCUMENT

A NEW THREAT IN MOBILE BANKING FRAUD

With mobile money transactions surging across the continent, scammers are evolving tactics,

making public awareness and education more critical than ever.

BACKGROUND AND CONTEXT:

The "Jumped" scam is a new and increasingly sophisticated fraud technique targeting mobile money users in South Africa.
It typically starts with a scammer sending a small, real deposit - ranging from R200.00 to R300.00 - into a victim's mobile wallet.
This tactic is part of a broader wave of social engineering attacks capitalising on the continent's rapid growth in digital banking.
According to the Global Systems for Mobile Communications Association (GSMA), Africa's mobile money sector processed $832 billion in transactions in 2022.
In South Africa alone, digital banking fraud losses surged from R440 million in 2021 to R740.8 million in 2022 - a staggering 68% increase (Sabric).

THE MECHANICS OF THE "JUMPED" SCAM:

The scam works through a series of calculated social engineering steps:
- INITIAL DEPOSIT: Scammers send a legitimate, small deposit to a target's mobile wallet to establish trust and prompt curiosity.
- SOCIAL ENGINEERING: This is followed by a call (vishing) or message (smishing), often posing as a bank official claiming the deposit was made in error.
- TRIGGERING PIN ENTRY: Victims are manipulated into checking their balance or "verifying" the deposit, leading them to unknowingly enter their PIN.
- This PIN may sometimes be intercepted or used to authorise a linked withdrawal.
This method reflects a more sophisticated variant of the "deposit and refund" scam, adapted for mobile money platforms widely used in South Africa like Capitec Pay, FNB eWallet, and MTN Mobile Money.

EXECUTION:

Fraudsters often acquire victim data through leaks or black-market sources, such as compromised public or financial institution databases.
Once the victim is identified, scammers exploit mobile banking systems to send real deposits and quickly follow up with fake but convincing communication.
The effectiveness of this scam lies in blending a genuine transaction with manipulative interaction, creating a false sense of legitimacy. Operation Red Card (Nov 2024 – Feb 2025) highlights the scale of this threat, with over 300 arrests across Africa related to mobile banking fraud (Interpol).

DANGER LEVEL FOR CITIZENS:

The risk to South Africans is high. With over 763 million active mobile money accounts in Sub-Saharan Africa and an annual growth rate of 17%, the attack surface is enormous.
Victims have reported losses ranging from thousands to millions of rand. In one case, a South African lost R6 million to an AI-driven banking scam, and another lost R100,000 (MyBroadband).
Elderly individuals, often less tech-savvy, are particularly vulnerable to vishing and smishing attacks, making education and prevention all the more critical.

PRECAUTIONARY MEASURES:

NEVER SHARE PINS OR OTPs:
- Even with someone claiming to be from your bank.
VERIFY DEPOSITS THROUGH OFFICIAL CHANNELS:
- Do not rely on phone numbers or links in unsolicited messages.
USE MULTI-FACTOR AUTHENTICATION (MFA):
- Prefer app-based or biometric authentication over SMS-based codes.
DELAY CHECKING UNEXPECTED DEPOSITS:
- If suspicious, wait before checking your balance, or enter an incorrect PIN as a precaution.
REPORT SUSPICIOUS ACTIVITY:
- Contact your bank immediately and freeze your account if needed..
- Leading banks like Capitec and Nedbank have issued similar advisories, urging customers to avoid reacting impulsively to unknown deposits or messages (Capitec, Nedbank).

COMPARATIVE ANALYSIS OF SCAM TACTICS:

The table below outlines how the "Jumped" scam compares to other common mobile fraud tactics in South Africa:

This comparison shows that the "Jumped" scam is a unique and dangerous adaptation of traditional tactics, using real transactions to bypass scepticism and lure users into compromising actions. — **This comparison shows that the "Jumped" scam is a unique and dangerous adaptation of traditional tactics, using** ***real*** **transactions to bypass scepticism and lure users into compromising actions.**

The "Jumped" scam is a prime example of how fraudsters are adapting to South Africa's growing mobile banking ecosystem. It exploits trust, curiosity, and urgency - key levers in social engineering - to defraud victims using legitimate-looking transactions. With digital fraud on the rise, public awareness, secure banking practices,

and swift reporting are essential to curb this growing threat.

KEY CITATIONS:

Specialised Security Services invites the public to the Mike Bolhuis Daily Projects WhatsApp Channel.

This channel is important in delivering insights into the latest crime trends, awareness, warnings and the exposure of criminals.

How to Join the WhatsApp Channel:

1. Make sure you have the latest version of WhatsApp on your device.

2. Click on the link below to join the Mike Bolhuis Daily Projects WhatsApp Channel:

- https://whatsapp.com/channel/0029VarjftF8PgsI4pODE929

3. Follow the prompts to join the channel.

4. Make sure you click on "Follow", then click on the "bell"-icon (🔔)

CONTACT MR MIKE BOLHUIS FOR SAFETY AND SECURITY MEASURES, PROTECTION, OR AN INVESTIGATION IF NEEDED.

ALL INFORMATION RECEIVED WILL BE TREATED IN THE STRICTEST CONFIDENTIALITY AND EVERY IDENTITY WILL BE PROTECTED.

Regards,

Mike Bolhuis

Specialist Investigators into

Serious Violent, Serious Economic Crimes & Serious Cybercrimes

PSIRA Reg. 1590364/421949

Mobile: +27 82 447 6116

E-mail: mike@mikebolhuis.co.za

Fax: 086 585 4924

Follow us on Facebook to view our projects -

https://www.facebook.com/MikeBolhuisOfficial

EXTREMELY IMPORTANT: All potential clients need to be aware that owing to the nature of our work as specialist investigators there are people who have been caught on the wrong side of the law - who are trying to discredit me - Mike Bolhuis and my organisation Specialised Security Services - to get themselves off the hook. This retaliation happens on social media and creates doubt about our integrity and ability. Doubt created on social media platforms is both unwarranted and untrue. We strongly recommend that you make up your minds concerning me and our organisation only after considering all the factual information - to the exclusion of hearsay and assumptions. Furthermore, you are welcome to address your concerns directly with me should you still be unsatisfied with your conclusions. While the internet provides a lot of valuable information, it is also a platform that distributes a lot of false information. The distribution of false information, fake news, slander and hate speech constitutes a crime that can be prosecuted by law. Your own research discretion and discernment are imperative when choosing what and what not to believe.

STANDARD RULES APPLY: Upon appointment, we require a formal mandate with detailed instructions. Please take note that should you not make use of our services – you may not under any circumstance use my name or the name of my organisation as a means to achieve whatever end.

POPI ACT 4 of 2013 South Africa: Mike Bolhuis' "Specialised Security Services" falls under Section 6 of the act. Read more here: https://mikebh.link/fntdpv