Direct answer
What is safe to share depends less on the information than on who started the conversation. When you dial a number you verified yourself, answering identity questions is a normal part of being helped. When someone contacts you, the same questions are the fraud. That single distinction resolves most of the uncertainty on this page, because a genuine agent on a call you placed needs surprisingly little, and a fraudster needs quite a lot. Verified 18 August 2026.
Never share, in any channel
| Detail | Why it is never needed |
|---|---|
| One-time password or verification code | It authorises a transaction. Disclosing it is the transaction, not a step toward one. |
| Card PIN | Known only to you. No system requires you to say it aloud or type it into a page. |
| Card CVV, the digits on the back | Needed only to complete a payment you are making yourself. |
| Banking login password | A bank can see your account without it and never needs yours. |
| Remote access to your device | Hands over your logged-in banking session along with the device. |
| A transfer to a safe account | Banks hold no protective accounts for customers. This request is fraud on its own. |
Each line stands alone. If any one of them is requested, the conversation is over regardless of how plausible everything else has been.
Safe to share on a call you placed
- Your account, policy or reference number. This is what a genuine agent needs to find you.
- Your name and the dates involved.
- A factual summary of the problem, without speculation about causes.
- Answers to identity questions such as your ID number or address, where you dialled a number you verified yourself.
- The last few digits of a card, where the organisation asks you to confirm which card you mean.
That is the whole list. Anything beyond it, on any call, deserves the question of why it is needed.
The details that depend on who called
Some information is genuinely required for support and genuinely useful to a fraudster. The initiation rule decides it.
- Your identity number. Reasonable when you have called your bank or insurer on a verified number. Never reasonable to confirm to someone who rang you, because they are supposed to know who they called.
- Your address or date of birth. Same test. An organisation contacting you should already hold these.
- Copies of your ID or proof of address. Send only through a channel you reached yourself, such as an official portal or a published email address.
- Your full card number. Acceptable when you are entering it on a payment page you navigated to yourself. Never acceptable read aloud or sent in a message.
Inbound callers often invert this, presenting their request for your details as a security check performed for your protection. A genuine organisation verifies that it is speaking to you; it does not ask you to prove your identity to a caller whose identity you have not established.
What a genuine agent will not do
- Object to being called back. A real agent expects you to verify and will give you a reference to quote.
- Insist you stay on the line while a transaction completes.
- Tell you to ignore an incoming SMS. That message is your bank warning you.
- Ask you to move to WhatsApp or a personal number to continue.
- Create a deadline measured in minutes. Urgency is a pressure technique, not a business process.
If you have already disclosed something
- Phone your bank on the number on your card if it involved an OTP, PIN, card details or banking login, and say precisely what was given.
- Change the password wherever it was used, from a device you trust.
- Remove any app you were asked to install, and check your device for others you did not add.
- Open a SAPS case on 10111 or at a station, and keep the case number.
- Apply for Protective Registration through SAFPS on 011 867 2234 if identity documents were shared. It is free.
Official reporting routes
| Body | Contact | What it handles |
|---|---|---|
| Your bank | The number on the back of your card | Securing accounts, attempting a recall |
| SAPS | 10111, or any station | The criminal case and case number |
| SAFPS | 011 867 2234, [email protected] | Protective Registration, free |
| ICASA | 012 568 3000, [email protected] | Licensed telecoms provider conduct |
| National Financial Ombud | 0860 800 900 | Unresolved bank disputes, after the bank’s process |
What to prepare before contacting support
- Your account or reference number, found before you dial.
- The dates of the transaction, fault or previous contact.
- A short factual summary of what happened.
- Any earlier reference number, without which the matter is logged as new.
- Something to write the new reference on, before the call ends.
If the issue is not resolved
Move the matter to writing and keep every reference number, since a documented trail is what every escalation route asks for. Complain to the organisation formally first, because regulators and ombud schemes will expect evidence that it was given a fair opportunity. Then approach the relevant body, confirming that your matter falls within its mandate before lodging.
Related contact pages
- How To Check If A Phone Number Is Official: verifying the number before you dial.
- Fake Bank SMS And Call Scams South Africa: the requests that identify a fraudulent call.
- Phishing Vishing Smishing Scams South Africa: the three delivery routes.
- Banking Scam Prevention South Africa: the settings that cap a loss.
- Report A Scam South Africa: where to report each kind of loss.
Frequently asked questions
My bank asked for my ID number. Is that normal?
It depends on who called. On a number you dialled yourself, identity questions are a normal part of being helped. From a caller who rang you, it is not, because an organisation contacting you already holds those details.
Is it ever safe to give a one-time password?
No. There is no legitimate circumstance in which anyone needs your OTP, including an agent on a call you placed. It exists to authorise a transaction, so disclosing it is the transaction.
What should I prepare before contacting support?
Your account or reference number, the relevant dates, a short factual summary, any earlier reference number, and something to write the new reference on before the call ends.
What should I do if I cannot get help?
Put the complaint in writing, keep the reference, and escalate to the relevant regulator or ombud once the organisation has had a fair opportunity, after confirming your matter falls within its mandate.
Last verified 18 August 2026. Routes confirmed on saps.gov.za, safps.org.za, icasa.org.za and nfosa.co.za.