Quick answer: use this route first
A company impersonation copies everything visible about a real business: its name, logo, staff names, invoice layout, licence number and tone of voice. What cannot be copied is control of the official domain and the bank account in the company’s registered name. Every reliable check exploits that gap. Reach the real company through its own website, typed in yourself, and confirm banking details by voice on a number you sourced independently. Verified 18 August 2026.
What gets copied, and what it costs to copy
| Element | Effort to fake | What it proves |
|---|---|---|
| Logo, colours, website design | Minutes | Nothing |
| Company name and staff names | Minutes, both are public | Nothing |
| Invoice and quotation templates | One genuine invoice to copy | Nothing |
| Registration or licence number | Copied from the real company | Nothing on its own |
| Email address on a lookalike domain | Cost of a domain | Nothing |
| Control of the real domain | Not available to them | Decisive |
| Bank account in the registered name | Not available to them | Decisive |
Reading down that table is the whole method. Everything a fraudster can produce cheaply is worthless as evidence, and the two things they cannot produce are precisely the two things worth checking.
The borrowed licence number
The most effective version of this fraud does not invent credentials, it borrows real ones. A quoted company registration number or Financial Services Provider number will check out as genuine, because it belongs to a real, legitimate business. The mismatch only appears if you check which name holds that number.
- Search the number, then the name, separately. Company registrations can be checked through the Companies and Intellectual Property Commission on cipc.co.za, and authorised financial services providers through the FSCA’s Entity and Persons Search on fsca.co.za.
- Compare the registered name against the bank account you are being asked to pay. A registered business banks in its registered name.
- Treat a match on the number alone as no evidence at all. Verifying that a number is real is not the same as verifying who is using it.
Reading a lookalike domain
- Read right to left, up to the first single slash. That final part identifies the site. Everything before it can be set to anything, including the real company’s name.
- Watch for inserted words and hyphens, which still read correctly at a glance and are the most common variation.
- Watch for a changed ending, where a co.za business appears on a different suffix entirely.
- Ignore the padlock. It confirms encryption, not honesty, and lookalike domains obtain certificates routinely.
Where it hurts most: the intercepted invoice
The costliest form of company impersonation is not a fake company at all. It is a genuine invoice from a supplier you really do owe, altered so the banking details are the fraudster’s, sent from an address one character different from the real one. Everything else on the document is correct, which is why it works on people paying close attention.
- Phone the supplier on a number you already had, from an earlier invoice or their website. Never the number on the invoice you are questioning.
- Read the account number to them rather than asking them to confirm it, so that agreeing is not enough.
- Treat every notice of changed banking details as fraudulent until confirmed by voice. That phrase is the signature of this fraud.
- Send a small test payment first on large amounts and confirm receipt before the balance.
Where to check and report
| Route | Detail | Use it for |
|---|---|---|
| Your bank | The number on the back of your card | Stopping or disputing a payment, first priority |
| CIPC | cipc.co.za | Checking a registered company name and number |
| FSCA | fsca.co.za, 0800 203 722 | Checking an authorised financial services provider |
| SAPS | 10111, or any station | The criminal case and case number |
| SAFPS | 011 867 2234 | Protective Registration if ID details were shared |
| The impersonated company | Its own verified route | Warning others and pursuing a takedown |
Tell the real company even if you lost nothing. It has standing to demand a takedown of a lookalike domain or social account, and you usually do not.
What to prepare
- The exact domain, email address or number used, copied character by character.
- The document you received, kept in its original form with email headers where possible.
- The bank account details you were asked to pay, with the beneficiary name.
- Proof of payment, with amounts, dates and times.
- The genuine company’s details as you previously held them, which show what changed.
What not to share
- One-time passwords or banking login details, to anyone resolving an account or invoice query.
- Remote access to your device to correct a payment.
- Payment to an account in an individual’s name for a company invoice.
- Company documents or ID copies to an address on a domain you have not checked.
If the issue is not resolved
Lodge a written dispute with your bank quoting your SAPS case number and attaching the altered document and your record of the genuine details. If the bank’s own process does not resolve it, the National Financial Ombud on 0860 800 900 handles unresolved banking disputes once that process is exhausted, subject to jurisdiction. Where the impersonated party is a financial services provider, report the conduct to the FSCA so it can issue a public warning. The underlying debt to your real supplier usually remains owing, which is worth resolving with them in writing early rather than late.
Related contact pages
- Change Of Banking Details Scam: the intercepted invoice in full detail.
- Verify Financial Services Provider South Africa: matching an FSP number to a name.
- Check If Online Store Is Legit South Africa: the retail version of the same checks.
- Verify Contact Details South Africa: verifying domains, emails and banking details.
- Report A Scam South Africa: which body handles which loss.
Frequently asked questions
They gave a registration number that checks out. Is the company genuine?
Not necessarily. Borrowed numbers belong to real companies, which is why they check out. Search the number and confirm which registered name holds it, then compare that name to the bank account you are being asked to pay.
The email came from the company’s own address. Could it still be fake?
Check the domain character by character, since a single inserted letter or hyphen is easy to miss. Where an account has genuinely been compromised, the address will be correct, which is why banking details are confirmed by voice rather than by reply.
What information should I prepare?
The exact domain, address or number used, the original document with headers, the beneficiary account details, proof of payment, and the genuine company details you held previously.
What should I do if I cannot get help?
Escalate the bank dispute in writing with your SAPS case number, then approach the National Financial Ombud after the bank’s process is exhausted. Report the impersonation to the real company and, where a financial provider is involved, to the FSCA.
Last verified 18 August 2026 against cipc.co.za, fsca.co.za, saps.gov.za, safps.org.za and nfosa.co.za.