The National Prosecuting Authority’s Asset Forfeiture Unit (AFU) has secured an urgent High Court order freezing more than R21.5 million linked to an alleged online banking scam that targeted a Middelburg business, marking one of the most significant recent interventions against cyber-enabled financial crime in South Africa.
The preservation order, granted by the High Court in Mpumalanga on June 12, prevents the movement of funds believed to be connected to a sophisticated fraud operation that allegedly relied on fake bank communications, social engineering tactics and the rapid transfer of money through multiple accounts.
Authorities say approximately R21.55 million was fraudulently transferred from accounts linked to Middelburg-based company Jormid. Following a financial investigation, officials managed to secure R21,654,539.97 across several accounts, preventing the suspected proceeds from being dissipated while legal proceedings continue.
A fake fraud alert that turned into a multimillion-rand loss
The alleged scam began on May 21 when Jormid’s financial manager received WhatsApp messages appearing to come from Absa Bank. The messages warned of suspicious activity on the company’s account and requested confirmation regarding several transactions.
After indicating that the transactions had not been authorised, she reportedly received a call from an individual claiming to be from the bank’s fraud division. The conversation lasted for nearly four hours, from around 12:45pm until 4:30pm.
During the call, the financial manager was allegedly instructed to approve several electronic links sent to her cellphone. She was also told not to log into any of the company’s online banking profiles because doing so would supposedly interfere with the bank’s efforts to stop the suspicious activity.
While she remained on the call, unauthorised transfers were allegedly processed from the company’s accounts. A colleague later alerted her that large amounts of money had already been moved.
How the money was traced through multiple accounts
Investigators say part of the stolen funds was transferred into an Absa account linked to the financial manager’s family guesthouse before being distributed across several other accounts.
After ending the call and reviewing the guesthouse account, she reportedly discovered that approximately R16 million had already been transferred into other bank accounts.
She immediately contacted Absa’s fraud department and opened a criminal case with the South African Police Service in Middelburg.
The financial manager also reportedly discovered that her cellphone number had been redirected, preventing her from receiving incoming calls. While investigations remain ongoing, the alleged phone diversion has become an important element of the case because it may have helped fraudsters maintain control during the transfer process.
AFU and Financial Intelligence Centre move quickly
The matter was referred to the Asset Forfeiture Unit on May 29. Investigators immediately sought assistance from the Financial Intelligence Centre (FIC), requesting that possible recipients of the funds be identified and any remaining balances be frozen.
Using transactional banking data, the FIC traced the movement of the money and compiled a flow chart showing how the funds moved through the banking system. The investigation reportedly identified eight recipient company accounts in addition to the guesthouse account.
Based on the findings, the FIC issued directives freezing available funds across the identified accounts. The AFU then approached the High Court on an urgent ex parte basis and obtained a preservation order covering the accounts linked to the investigation.
The Financial Intelligence Centre plays a central role in South Africa’s efforts to detect suspicious financial activity and support investigations involving fraud and money laundering.
Why this preservation order is significant
In many online banking fraud cases, stolen funds are moved repeatedly within hours, making recovery extremely difficult. The ability to trace and freeze more than R21.5 million before it disappeared further into the financial system represents a major achievement for investigators.
A preservation order does not automatically transfer ownership of the money to the state. Instead, it ensures that the funds remain frozen while forfeiture proceedings and criminal investigations continue.
The order also gives authorities time to pursue additional evidence and identify individuals who may have received or benefited from the funds.
A growing warning for businesses facing social engineering attacks
Unlike traditional cyberattacks that focus on breaking technical security systems, social engineering scams exploit trust and human behaviour. Fraudsters impersonate trusted organisations, create a sense of urgency and persuade victims to authorise actions that appear legitimate.
The methods described in the Middelburg case reflect a growing trend in financial crime where criminals combine messaging apps, voice calls and account manipulation to bypass normal verification procedures.
The incident comes as financial institutions continue warning customers about increasingly sophisticated impersonation schemes. Recent concerns around phishing and tax-related fraud have also emerged, including SARS scam warnings issued ahead of South Africa’s 2026 tax season, where criminals attempted to exploit trusted brands and government-related communications.
Read More
What happens next
The preservation order remains in force while the NPA pursues forfeiture proceedings. Individuals wishing to challenge the order reportedly have 14 calendar days from the date of service to enter a notice of appearance.
Investigations are continuing, and authorities have indicated that arrests and criminal charges related to fraud, theft and money laundering are expected.
The case serves as a reminder that online banking scams are becoming increasingly sophisticated. It also highlights how coordinated action between banks, financial intelligence specialists and prosecutors can play a critical role in tracing and securing suspected criminal proceeds before they vanish from the financial system.
Make Swikblog your go-to source on Google for reliable updates, smart insights, and daily trends.
