Quick answer: find the right contact route
A phone number is only one kind of contact detail, and it is not the one that costs South Africans the most money. Banking details on an invoice are. Each type of detail has its own verification test, and they are not interchangeable: an email address is checked against the domain, a WhatsApp number against whether the organisation runs one at all, and bank details against a phone call to a number you sourced yourself. Verified 18 August 2026.
Main contact categories
| Detail type | How to verify it | The failure it prevents |
|---|---|---|
| Phone number | Published on the organisation’s own site, reached by typing the domain | Calling a fraudster’s help desk |
| Email address | The part after the @ matches the organisation’s real domain exactly | Replying to a lookalike domain |
| Website | Domain typed by hand and read character by character | Entering credentials on a cloned site |
| WhatsApp number | Confirm the organisation publishes a WhatsApp channel at all | Trusting a business profile as proof of identity |
| Banking details | Phone the supplier on a number you sourced yourself, never one on the invoice | Paying an intercepted or altered invoice |
| Physical address | Published on the official site before you travel or deliver | Handing over documents or goods at a false address |
Verifying an email address or domain
Only the text immediately before the first slash matters, and only the part after the final @ in an address. Everything else can be set to whatever the sender likes, including the display name. A message showing “Standard Bank” as the sender tells you nothing at all.
- Read the domain right to left. A South African organisation usually ends in co.za, gov.za for government, or org.za for many non-profits.
- Watch for inserted words and hyphens, which is the most common trick because it still reads correctly at a glance.
- Watch for substituted characters, such as a digit standing in for a letter it resembles.
- Treat free email providers as disqualifying for an organisation’s official support address.
- Never verify a domain by clicking it. Type it into a fresh tab instead.
Verifying banking details before you pay
This is the highest-value check on the page. In an invoice interception, a genuine invoice from a supplier you really do owe is altered so the account number is the fraudster’s. Everything else about the document is correct, which is why it works on people who are paying attention.
- Phone the supplier on a number you already had, from a previous invoice, a signed contract or their website. Never the number printed on the invoice you are questioning.
- Read the account number to them rather than asking them to confirm it. Reading it out means a fraudster cannot simply agree.
- Treat any notice of changed banking details as suspect until confirmed by voice. This is the single most common wording in the fraud.
- Make a small test payment first on large amounts, and confirm receipt before sending the balance.
How to choose the correct department or provider
- Financial services and investments: check the provider against the FSCA’s FSP Search on fsca.co.za, which confirms whether it is an authorised Financial Services Provider.
- Telecoms and fibre: the provider’s own domain, with ICASA on 012 568 3000 or [email protected] as the regulator.
- Banking: the number on the back of your card, which no listing can alter.
- Government and grants: gov.za domains only.
- Identity and fraud filings: SAFPS on 011 867 2234 or [email protected].
Complaint and escalation routes
If money has already gone to details that turned out to be false, phone your bank immediately on the number on your card, because a recall only succeeds while the funds remain in the receiving account. Open a case with SAPS on 10111 or at a station and keep the case number, then lodge a written dispute with your bank quoting it.
Where the bank does not resolve the matter, the National Financial Ombud handles unresolved banking disputes once the bank’s own process is exhausted. For a licensed telecoms provider, ICASA is the route after the provider has had a fair opportunity. Confirm jurisdiction with either body before lodging, and expect to show that the provider was approached first. If your ID details were shared, apply for Protective Registration through SAFPS, which is free.
Related contact pages
- How To Check If A Phone Number Is Official: the method applied specifically to phone numbers.
- Change Of Banking Details Scam: the invoice interception fraud in detail.
- Check If Online Store Is Legit South Africa: verifying a retailer before you buy.
- Company Impersonation Scam South Africa: how an impersonation is put together.
- Report A Scam South Africa: where to report each kind of loss.
Frequently asked questions
What is the best way to verify contact details?
Match the check to the detail. Numbers and email addresses are verified against the organisation’s own website, reached by typing the domain. Banking details are verified by voice, on a number you sourced independently of the document asking for payment.
What information should I prepare?
Your account, policy or invoice number, the details you are checking copied exactly, where they came from, and the relevant dates. Never prepare to share an OTP, PIN, card CVV, banking login or remote access to your device.
What should I do if I cannot get help?
Lodge a written complaint with the organisation and keep the reference, then escalate to the National Financial Ombud, ICASA or the relevant regulator depending on the sector, after confirming your matter falls within its mandate. Report criminal loss to SAPS separately.
Does a verified badge prove a WhatsApp number is genuine?
No. A business profile, logo and badge are account settings. The real question is whether the organisation publishes a WhatsApp channel at all, and many South African organisations do not, which makes any such number a warning sign rather than a convenience.
Last verified 18 August 2026. Routes confirmed on saps.gov.za, safps.org.za, icasa.org.za and fsca.co.za.