Capitec is keeping some bank accounts open even after it finds that fraud syndicates are using them. The bank then holds the stolen money when it arrives, so it can be returned to the victim.
Group CIO Andrew Baker described the method, which the bank calls the “ghost stop”, in a piece supplied to TechCentral on Monday. He also described a second measure, called the “landmine selfie”.
“When the money arrives and cannot be moved onwards, the criminals discover that their investment has failed after they have already incurred the cost,” Baker wrote.
The bank calls both steps part of “scammernomics”. The goal is to make fraud lose money for criminals, not only to make it harder to do.
A mule account is a bank account used to receive and move money taken in a scam. Baker said simply blocking these accounts does little to hurt a syndicate.
He wrote that syndicates can pay a recruited account holder less than R500 to hand over their banking details. By his sums, losing 300 empty blocked accounts would cost a syndicate about R150 000. He argued that a large operation can easily afford this.
Under the ghost stop, Capitec leaves a detected mule account looking active. It holds incoming funds “so they can be recovered and returned to the client”, Baker wrote. Because the account still seems to work, the criminals keep spending time and money on the scam.
Baker said this also leaves syndicates unsure which accounts they can trust. A payment that will not move could be a bank trap, theft inside their own group or a bad account. “That uncertainty makes it harder to plan the next operation or trust the people supplying accounts,” he wrote.
Capitec checks new clients’ face or fingerprint scans against Department of Home Affairs records when they open an account. It also asks clients from time to time to confirm who they are with a selfie in its app.
Baker said scammers may learn when these checks are due. They can then take over an account once it has been cleared.
The landmine selfie is a rare extra check. It pops up when someone tries to move money out of an account. The money stays where it is until the person who opened the account takes the selfie.
This means a criminal holding someone else’s login details must get that person to take part again. Baker admitted the check has limits. A person who has been fooled, for example into thinking they run an “invoicing service”, may take the selfie and keep sending money on.
He said biometric checks must work together with tracking of payments. “The number of scams blocked remains an important measure of fraud prevention, but it tells only part of the story when criminals can cheaply replace accounts and start again,” Baker wrote.
Capitec is South Africa’s largest bank by client numbers, with 26.6 million active clients. According to the South African Banking Risk Information Centre, digital banking crime cost South Africans R2.41-billion in reported client claims in 2025. That was 29.2% more than in 2024.
Reported incidents rose by 12.8% to 110 074. Banking apps made up most of the cases, but Sabric said this did not show that bank systems had been breached.
Capitec has not said when it started using either method, how many mule accounts it has caught or how much money it has held and returned. TechCentral said it has asked the bank for these figures.
Source: this article is based on reporting by TechCentral. Image: TechCentral. Written with the help of AI and published by the Tzaneen Voice Technology desk. See our Editorial Standards.
Werner Jacobs covers technology for Tzaneen Voice. Werner reports on mobile networks, data prices, internet access, smartphones, apps, AI, cybersecurity and South African tech companies. Each story explains what a new product, price change or policy means for ordinary users in South Africa.