South Africa Cybercrime Case Returns US$1.32 Million to Middelburg Firm
SOUTH AFRICA · FRAUD AND RECOVERY
Key Facts
- —What happened Thieves posing as Absa bank staff moved 21.55 million rand (about US$1.32 million) out of Jormid Electrical.
- —How it worked A fake WhatsApp alert was followed by a call from a fake bank fraud officer.
- —The trace The Financial Intelligence Centre followed the money into nine bank accounts, which Absa then froze.
- —The court Middelburg’s High Court preserved the funds on 12 June and forfeited them on 15 and 21 September.
- —The outcome The National Prosecuting Authority says the full amount went back and the firm lost nothing.
- —The catch Nobody has been charged yet, and the company waited four months for its money.
Prosecutors traced the stolen money into nine bank accounts and the High Court ordered it forfeited. The company got all of it back.
A South Africa cybercrime case has ended with 21.55 million rand (about US$1.32 million) back in a company account. The money was stolen in one afternoon and returned four months later.
How the scam actually worked
The company was Jormid Electrical (Pty) Ltd of Middelburg, in Mpumalanga province. The loss happened on Thursday 21 May 2026.
Its financial manager received WhatsApp messages that appeared to come from Absa, the company’s bank. They warned of suspicious transactions on the business account.
When she said she did not recognise them, a caller rang claiming to be from Absa’s fraud division. He said he was helping her cancel the fraudulent payments.
He asked her to approve electronic links sent to her phone, and she did. While she was still on the call, a colleague told her large payments had already gone out.
The payments left the account because the manager was talked into approving them herself. That makes this a social engineering case rather than a hacking case.
What the company and the bank did next
Jormid reported the theft to Absa’s fraud department straight away. It also opened a criminal case with the South African Police Service in Middelburg.
The case went to the Asset Forfeiture Unit of the National Prosecuting Authority (NPA). That unit asked the Financial Intelligence Centre for help.
The Centre analysed the transactions and directed Absa to freeze funds in nine bank accounts. Those accounts were suspected of receiving the stolen money.
The nine accounts were held at Absa. The bank was directed to freeze the funds sitting in them while the trace continued.
A Centre freeze is only a short hold on a transaction. Prosecutors still had to go to court to keep the money in place.
How the courts locked the money down
The Mpumalanga High Court in Middelburg granted an urgent preservation order on 12 June 2026. That order stopped anyone from moving the frozen funds.
That first order came just over three weeks after the theft. The final orders came four months after it.
Final forfeiture orders followed on 15 and 21 September 2026 in the same court. The NPA said three orders were granted across those two days.
The NPA regional spokesperson, Monica Nyuswa, said the full amount was recovered and returned. The company therefore suffered no financial loss from the scam.
Forfeiture of this kind is a civil process in South Africa. Prosecutors do not have to wait for a criminal conviction before acting on the money.
What This South Africa Cybercrime Case Means for Business
Rand figures here use 16.36 rand to the US dollar, the rate on 24 September 2026. That puts the loss at about US$1.32 million.
For firms trading in or with South Africa, the practical lesson is about the first hours. The money was traceable because the theft was reported the same day.
The sum is large for a regional contractor. One sequence of approvals on a phone moved the equivalent of US$1.32 million out of the business.
The rest of the timeline was slow. The company was without US$1.32 million for four months while the case moved through court.
The NPA presented the result as an example of what banks, investigators and prosecutors can do together. It did not describe the outcome as routine.
What to do in the first hours after a transfer
The advice published alongside this case is simple. If a caller says they are from your bank and asks you to approve a link, end the call.
Then ring the bank back on the number printed on your card or your statement. Do not use a number or link from the message you received.
Check any message about your account using contact details you already hold. Details supplied inside an unexpected message or call cannot be trusted.
If money has already gone, do what Jormid did within hours. Report it to the bank’s fraud department and open a police case.
Those two steps are what gave the Financial Intelligence Centre something to trace and freeze. Prosecutors can only preserve money that is still sitting in an account.
What is still not known
No arrests have been announced. The NPA said in June that its investigation continued, and that fraud, theft and money laundering charges were expected.
The people behind the nine bank accounts have not been named publicly. It is also not known how the callers chose this company and this manager.
Absa has not said publicly what its own checks caught or missed that day. The bank froze the nine accounts after the Centre directed it to.
The money is back and the criminal side of the case is still open. Businesses in the region will learn more if charges are brought in the coming months.
Frequently Asked Questions
How much was stolen, and how much came back?
Thieves took 21.55 million rand (about US$1.32 million) on 21 May 2026. The National Prosecuting Authority says all of it was returned to the company.
Was this a hacked email account or a SIM swap?
It was neither. The financial manager was tricked by a fake WhatsApp alert and a call from a fake bank fraud officer into approving the payments.
What should a company do first if money is taken?
Tell the bank’s fraud department immediately and open a police case. Fast reporting is what allowed the receiving accounts in this case to be frozen.
Sources: Reported from statements by the National Prosecuting Authority and the Financial Intelligence Centre, with coverage by SAnews, TimesLive, IOL, The Citizen and MyBroadband; conversion at open.er-api.com rates.
This article was produced by The Rio Times’ automated newsroom system. How we use AI · Report an error
Read More from The Rio Times