It’s sad to say, but fraud is an everyday occurrence in South Africa. Recent reports on the matter indicated that 66% of local businesses experience year-on-year increases in fraud losses. Unsurprisingly, 77% of businesses expect more attacks to come. But fraud attacks don’t just take the shape of an email from some fictitious Nigerian prince or the bank demanding you immediately log in on their one-time link to change your passwords. Sometimes, it’s hidden in your own business.
“For a small business, one fraudulent payment can do more than create a financial loss. It can take away money set aside for stock, salaries or a supplier, and the resulting disruption can be difficult to absorb,” says Rendani Singo, Managing Director of MK Fraud Insights.
In this article, he highlights the importance of small businesses understanding their digital fraud exposure and how to reduce their risks.
The Importance of Fraud Risk For Small Businesses
“A growing business may rely on a small number of people who are expected to move quickly and make decisions across several functions, without the layers of review available in a larger organisation,” he notes. “South Africa’s digital fraud exposure makes those decisions particularly important.
“SABRIC’s 2025 Annual Crime Statistics records approximately R2,4 billion in client claims relating to digital banking crime across banking apps, Internet banking and mobile banking channels. These are figures reported by participating banks, not a measure of SME losses or a complete national total. They nevertheless show the scale of fraud affecting financial channels that businesses use every day.”
Singo reminds entrepreneurs that fraud does not necessarily start with a sophisticated technical attack. It may begin with a credible e-mail, a WhatsApp instruction or a false payment confirmation. “In my view, growth deserves particular attention: once the founder is no longer personally checking every payment, customer adjustment or supplier instruction, verification needs to develop alongside delegated authority,” he warns.
Fraud Readiness for SMEs
Fraud readiness is an organisation’s ability to understand where fraud could affect it, determine whether its controls cover those risks, recognise suspicious activity and respond before an incident becomes a larger business problem. “Awareness helps people recognise a threat. Readiness connects that recognition to a decision, a responsible person and a workable response,” he explains.
Singo uses the following example:
Consider a customer who sends a payment confirmation and then urgently requests a refund. Staff may know that false confirmations exist, but the business still needs a clear rule about verifying cleared funds, authority to pause the refund and evidence that the check happened. “Assessing that control is one part of readiness; management also needs to know who acts if money has already left the account,” Singo states.
“An investigation seeks to establish what happened in a suspected incident. Readiness concerns how the business prepares to prevent, detect and handle such incidents. It does not mean fraud is impossible. It means leadership has a defensible view of its exposure, the controls it depends on, the people responsible and the gaps that deserve attention.”
Fraud Readiness Is A Management Decision
When actively implementing fraud readiness measures, Singo encourages management to start with one transaction that matters to the business, not with an extensive policy exercise. The goal is to put protocols in place to ensure the right steps are taken when suspicious activity arises.
“Take a payment to an established supplier. The invoice is genuine, the goods were received, and then an e-mail arrives saying the supplier’s account details have changed,” he mentions another example. “Management should establish who may change those details, how the change is checked through a trusted channel, whether the same person can update the record and release a payment, and who can authorise an exception.”
The next step is to decide what needs to change and how management will know it has changed. “That could mean a callback using a number already held on file, a separate review of the change and a record of the verification. Allocate an owner and a completion date, then review a sample of subsequent changes to see whether the process is being followed. Where a separate reviewer is unavailable, decide which payments must wait for independent confirmation rather than allowing urgency to become the approval rule.”
Singo says that the aim is to prioritise the exposures that could most disrupt the business, then work through them. “Fraud readiness becomes a management discipline when risks lead to specific decisions, owners and checks.”
Four Points of Entry for Fraud in a Business
According to Singo, there are four points of entry for fraud in a business. These are the areas that need to be examined, but they shouldn’t be seen as the only areas to focus on. Instead, it should be used as a framework that provides a starting point.
1. The Supplier and Contractor Relationship
This includes fabricated invoices, impersonation, collusion and fraudulent changes to payment details.
2. Customer-facing Activity
This includes elements such as false proof of payment, abusive refunds or returns, and orders released before funds have cleared.
3. The Movement of Money and Assets within the Business
This includes placing transactions under the microscope, including payroll, cash, stock and adjustments made without proper authority.
4. People and Digital Access
This is who can act for the business, change records, use an account or override a control, and whether that authority can be stolen or misused. No one should be the only person with access.
Singo notes that these areas overlap. “A compromised employee mailbox can lend credibility to a false instruction, while someone with legitimate authority may approve the resulting transaction. The practical value of the framework is in tracing how a request becomes an authorised action and identifying where verification or accountability can fail,” he explains.
Misconceptions about Fraud in a Business
“One misconception about fraud is that it is only a concern for large organisations or businesses holding substantial amounts of cash,” he says. “Another is that good relationships with employees and suppliers remove the need for checks. Trust matters, but an honest employee can be deceived, and a trusted insider can deliberately misuse authority. Verification protects the business and gives employees a clear basis for challenging an unusual request.”
Singo notes that a particularly costly misconception is that a secure bank account or accounting platform means the business is protected. “The technology can perform as designed while someone uses genuine authority to approve a payment based on a false instruction. An annual audit, a fraud policy or a once-off training session is also no substitute for checking whether important controls operate in daily work.”
The ACFE’s Occupational Fraud 2026: A Report to the Nations identifies absent or overridden controls as recurring weaknesses in investigated cases. “That is global research about occupational fraud, committed against an organisation by someone working for it, not an estimate of South African SME’s losses.
“Fraud is also too easily assigned entirely to finance or IT. Procurement, sales, human resources and operations all make decisions that can create exposure. Management has to understand how those decisions connect.
Steps To Reduce Fraud Risks
For a microbusiness, Singo recommends a few non-negotiable practices. “Verify changed banking details using contact information already known to be genuine, use unique passwords and multifactor authentication on e-mail, banking and other important accounts, confirm that funds have cleared before releasing goods against a payment or issuing a refund, and reconcile transactions regularly,” he explains. “An owner who delegates payments should review them against supporting records. Where the owner does everything, a periodic review by an external accountant, where affordable, can help; meanwhile, transaction alerts, bank limits and a deliberate verification step before unusual payments provide practical safeguards.”
Looking at larger businesses like a small enterprise, the next priority is clarity about who can make and approve changes. “Separate supplier maintenance from payment approval where possible, set limits for refunds and adjustments, review unusual transactions, and restrict access to what each role needs,” Singo says. “Remove access promptly when someone leaves. Staff need a clear route for escalating suspicious instructions and management support when a necessary check delays a transaction.”
Singo says a medium-sized enterprise should map its significant exposure across customer, supplier, payment and internal processes. “Management should identify the controls it relies on, test whether they operate, assign responsibility and deadlines for weaknesses, and review exceptions as the business changes. If full separation of duties remains impractical, document who independently reviews the higher-risk activity and how often.”
Every business also needs a short response plan: who can stop a payment, contact the bank immediately, secure a compromised account and preserve the relevant records. “Readiness includes limiting further loss when prevention fails.”
Singo remarks that the scale of the response should reflect the nature and consequences of the risk. “Owners who want a structured starting point can use MK Fraud Insights’ free Fraud Readiness Assessment. It tailors questions to the organisation and provides a private Snapshot based on the answers submitted. It helps management identify where further attention may be needed; it does not test evidence, verify controls or provide an audit or assurance opinion. Detailed paid reports and separately scoped advisory support are available for businesses that need to take the work further,” he concludes.
It’s sad to say, but fraud is an everyday occurrence in South Africa. Recent reports on the matter indicated that 66% of local businesses experience… Read More
