South Africa Cybercrime Case Returns US$1.32 Million to Middelburg Firm
SOUTH AFRICA · FRAUD AND RECOVERY
Key Facts
- Who and where Jormid Electrical is a firm in Middelburg, an industrial town in Mpumalanga province, and it banks with Absa.
- What happened Thieves posing as Absa bank staff moved 21.55 million rand (about US$1.32 million) out of the company in one afternoon.
- How it worked A fake WhatsApp alert was followed by a call from a fake bank fraud officer, who talked the manager into approving payments.
- The scale South Africans lost about 2.4 billion rand (about US$147 million) to digital banking crime in 2025, across 110,074 incidents.
- The mechanism Middelburg’s High Court preserved the funds in June, then forfeited them in September under the Prevention of Organised Crime Act.
- Why it matters Forfeiture is civil, so no conviction was needed — the full amount came back before anyone was charged.
Prosecutors traced the stolen money into nine bank accounts and the High Court ordered it forfeited. The company got all of it back.
A South Africa cybercrime case has ended with 21.55 million rand (about US$1.32 million) back in a company account. The money was stolen in one afternoon and returned four months later.
How the scam actually worked
The company was Jormid Electrical (Pty) Ltd of Middelburg, in Mpumalanga province. The loss happened on Thursday 21 May 2026.
Middelburg is an industrial town in Mpumalanga, the province east of Johannesburg. It is a mining and manufacturing area, not a financial centre.
Absa is one of South Africa’s big four banks. Absa Group reported 13.1 million customers and 2.2 trillion rand (about US$134 billion) in assets for 2025.
Its financial manager received WhatsApp messages that appeared to come from Absa, the company’s bank. They warned of suspicious transactions on the business account.
When she said she did not recognise them, a caller rang claiming to be from Absa’s fraud division. He said he was helping her cancel the fraudulent payments.
He asked her to approve electronic links sent to her phone, and she did. While she was still on the call, a colleague told her large payments had already gone out.
The payments left the account because the manager was talked into approving them herself. That makes this a social engineering case rather than a hacking case.
What the company and the bank did next
Jormid reported the theft to Absa’s fraud department straight away. It also opened a criminal case with the South African Police Service in Middelburg.
The case went to the Asset Forfeiture Unit of the National Prosecuting Authority (NPA). That unit asked the Financial Intelligence Centre for help.
The National Prosecuting Authority is the state body that prosecutes crime in South Africa. Its Asset Forfeiture Unit goes after the money rather than the people.
The Financial Intelligence Centre is South Africa’s financial intelligence unit. Its mandate is identifying the proceeds of crime and combating money laundering.
The Centre analysed the transactions and directed Absa to freeze funds in nine bank accounts. Those accounts were suspected of receiving the stolen money.
The nine accounts were held at Absa. The bank was directed to freeze the funds sitting in them while the trace continued.
A Centre freeze is only a short hold on a transaction. Prosecutors still had to go to court to keep the money in place.
How the courts locked the money down
The Mpumalanga High Court in Middelburg granted an urgent preservation order on 12 June 2026. That order stopped anyone from moving the frozen funds.
That first order came just over three weeks after the theft. The final orders came four months after it.
Final forfeiture orders followed on 15 and 21 September 2026 in the same court. The NPA said three orders were granted across those two days.
The NPA regional spokesperson, Monica Nyuswa, said the full amount was recovered and returned. The company therefore suffered no financial loss from the scam.
Forfeiture of this kind is a civil process in South Africa. Prosecutors do not have to wait for a criminal conviction before acting on the money.
The law used is the Prevention of Organised Crime Act of 1998, known as POCA. Its Chapter 6 lets the state act against property linked to crime.
It works in two steps. A preservation order locks the money where it sits, and a forfeiture order then takes it out of the account for good.
The NPA states that preservation and forfeiture orders do not depend on a prosecution. The test is the balance of probabilities, not proof beyond reasonable doubt.
That is why the money is back while nobody has been charged. The case runs against the funds themselves, not against a named defendant.
What This South Africa Cybercrime Case Means for Business
Rand figures here use 16.36 rand to the US dollar, the rate on 24 September 2026. That puts the loss at about US$1.32 million.
For firms trading in or with South Africa, the practical lesson is about the first hours. The money was traceable because the theft was reported the same day.
The sum is large for a regional contractor. One sequence of approvals on a phone moved the equivalent of US$1.32 million out of the business.
Set against the national picture, the theft is an outlier. The banking industry body SABRIC counted 110,074 digital banking crime incidents in 2025.
Those cases cost about 2.4 billion rand (about US$147 million) in client claims. That averages roughly 21,800 rand (about US$1,330) per incident.
Jormid lost close to a thousand times that average in a single afternoon. SABRIC attributes the bulk of the loss to social engineering rather than attacks on bank systems.
The rest of the timeline was slow. The company was without US$1.32 million for four months while the case moved through court.
The NPA presented the result as an example of what banks, investigators and prosecutors can do together. It did not describe the outcome as routine.
No published South African figure shows how often stolen money finds its way back. SABRIC’s annual report counts losses, not recoveries.
What the case does show is that full recovery is possible. It needed same-day reporting, funds still sitting in accounts, and a civil court route.
The method itself is portable. A messaging app alert, a voice call and a few approvals require no hacking, and work wherever banking is done by phone.
What to do in the first hours after a transfer
The advice published alongside this case is simple. If a caller says they are from your bank and asks you to approve a link, end the call.
Then ring the bank back on the number printed on your card or your statement. Do not use a number or link from the message you received.
Check any message about your account using contact details you already hold. Details supplied inside an unexpected message or call cannot be trusted.
If money has already gone, do what Jormid did within hours. Report it to the bank’s fraud department and open a police case.
Those two steps are what gave the Financial Intelligence Centre something to trace and freeze. Prosecutors can only preserve money that is still sitting in an account.
What is still not known
No arrests have been announced. The NPA said in June that its investigation continued, and that fraud, theft and money laundering charges were expected.
The people behind the nine bank accounts have not been named publicly. It is also not known how the callers chose this company and this manager.
Absa has not said publicly what its own checks caught or missed that day. The bank froze the nine accounts after the Centre directed it to.
The money is back and the criminal side of the case is still open. Businesses in the region will learn more if charges are brought in the coming months.
More: South Africa news in English, every day from The Rio Times.
Frequently Asked Questions
How much was stolen, and how much came back?
Thieves took 21.55 million rand (about US$1.32 million) on 21 May 2026. The National Prosecuting Authority says all of it was returned to the company.
Was this a hacked email account or a SIM swap?
It was neither. A fake WhatsApp alert and a call from a bogus bank fraud officer led the financial manager to approve the payments.
What should a company do first if money is taken?
Tell the bank’s fraud department immediately and open a police case. Fast reporting is what allowed the receiving accounts in this case to be frozen.
Sources: Reported from statements by the National Prosecuting Authority and the Financial Intelligence Centre, with coverage by SAnews, TimesLive, IOL, The Citizen and MyBroadband; conversion at open.er-api.com rates. Scale and mechanism figures from the SABRIC Annual Crime Statistics Report 2025, the NPA Asset Forfeiture Unit’s published guidance on the Prevention of Organised Crime Act, the Financial Intelligence Centre, and Absa Group’s full-year 2025 results.
This article was produced by The Rio Times’ automated AI newsroom. Editorial responsibility: Matthias Camenzind, Publisher and Editor-in-Chief. The Rio Times also runs Ask Rio Times, which answers from 100,000+ of our own articles, the daily Latin America Power Map, and prediction-market odds on elections and markets.. How we use AI · Report an error