Capitec is deliberately keeping open bank accounts it has identified as being used by fraud syndicates, so that criminals can spend weeks working a victim only to find the stolen money held by the bank when it finally arrives.
The tactic, which Capitec calls the “ghost stop”, was described by group CIO Andrew Baker in a piece supplied to TechCentral on Monday.
A second measure, the “landmine selfie”, springs a surprise biometric check on anyone trying to move money out of an account and holds the funds until the person who opened it verifies their identity again.
Both are part of what the bank calls “scammernomics” – an attempt to make fraud unprofitable rather than merely harder to commit.
Blocking accounts on its own does little to change a syndicate’s sums, Baker argued. A mule account – a bank account used to receive and move the proceeds of fraud – is cheap to replace. Syndicates can pay a recruited account holder less than R500 to hand over their banking credentials, he wrote, so having 300 empty accounts blocked would cost a syndicate R150 000, affordable for an operation turning over far more, he argued.
Rather than visibly blocking a detected mule account, Capitec can leave it looking active and hold incoming funds “so they can be recovered and returned to the client”, Baker wrote. Because the account still appears to work, the syndicate keeps investing in the scam.
Disrupting the syndicates
“When the money arrives and cannot be moved onwards, the criminals discover that their investment has failed after they have already incurred the cost,” he wrote.
It also leaves syndicates unsure which of their accounts can be trusted. A payment that won’t move could be a bank countermeasure, theft within their own operation or a bad account. “That uncertainty makes it harder to plan the next operation or trust the people supplying accounts,” Baker wrote.
Capitec checks new clients’ facial or fingerprint biometrics against department of home affairs records when they open an account, and periodically asks clients to re-verify with a selfie in its app. Baker said scammers may learn when those checks are due and acquire an account once they have been cleared.
The landmine selfie is an infrequent extra check triggered at the moment someone tries to move money out of an account. The funds stay put until the person who opened the account completes the selfie, so a criminal holding the credentials must get that person to take part again.
Baker acknowledged its limits. An account holder who has been deceived – for example, someone who believes they are being paid to run an “invoicing service” – may complete the check and keep forwarding money. Biometric checks have to work alongside transaction monitoring, he wrote.
“The number of scams blocked remains an important measure of fraud prevention, but it tells only part of the story when criminals can cheaply replace accounts and start again.”
Rising losses
Capitec, South Africa’s largest bank by client numbers with 26.6 million active clients, is pitching the approach as losses climb. Digital banking crime cost South Africans R2.41-billion in reported client claims in 2025, up 29.2% on 2024, according to the South African Banking Risk Information Centre. Reported incidents rose 12.8% to 110 074. Banking apps accounted for most of those cases, TechCentral reported when the figures were released, though Sabric said this was not evidence that bank systems had been breached.
Capitec has not said when it began using either tactic, how many mule accounts it has caught or how much money it has held and returned. TechCentral has asked the bank for those figures, and how victims are told when their payments have been held. – © 2026 NewsCentral Media
