R21.55 Million Stolen Over the Phone — How to Protect Your Business
A Middelburg engineering firm picked up the phone, trusted the voice on the other end, and lost R21.55 million. No ransomware, no hacked server, no clever malware — just a phone call and someone who sounded convincing enough to be believed. If you think "that could never happen here," that's exactly the mindset the scammers are counting on.
This kind of fraud is called social engineering, and it doesn't target your firewall — it targets your staff. The good news is that a proper business phone system, used correctly, gives you tools most small businesses don't even know they have.
How these scams actually work
Phone fraud against businesses almost always follows a pattern:
- ▸Impersonation. The caller pretends to be a bank official, a supplier, an auditor, or even your own CEO or CFO, often using spoofed caller ID so the number looks legitimate.
- ▸Urgency. They create pressure — "this payment needs to happen in the next hour or the deal falls through" — so staff don't have time to verify anything.
- ▸Authority. They drop names, reference real invoice numbers, or quote details scraped from a previous data leak or even a prior phone call, which makes the story feel credible.
- ▸Isolation. They ask the employee to keep it confidential, or to deal only with them directly, cutting out the normal checks and balances.
In the Middelburg case, and in many similar incidents reported in South Africa, a single phone call was enough to get a large payment authorised and sent before anyone double-checked. By the time the company realised something was wrong, the money was gone.
Why call recording matters more than people think
Most business owners think of call recording as a "nice to have" for training or dispute resolution. After incidents like this, it becomes something else entirely: a fraud deterrent and an evidence trail.
With call recording built into NexysPBX, every inbound and outbound call can be logged and stored. That means:
- ▸If a scammer phones your finance team pretending to be a supplier, there's a recording of exactly what was said and when.
- ▸Staff know calls are recorded, which on its own makes them more careful about what they agree to over the phone.
- ▸If fraud does happen, you have real evidence to hand to your bank, the South African Police Service, or your insurer — instead of a "he said, she said" account from a shaken employee.
This isn't about spying on your team. It's about giving everyone, especially the people who approve payments, a safety net.
Call screening: catching the red flags before they cost you
Caller ID spoofing is one of the easiest tricks in the scammer's toolkit — it's trivial to make a call look like it's coming from a trusted number. A modern cloud phone system can help close this gap through call screening and routing rules:
- ▸Route calls claiming to be from banks or known suppliers through a verification step rather than straight to whoever picks up.
- ▸Flag or block known spam and scam numbers at the network level before they ever reach a desk.
- ▸Use an auto-attendant to direct "payment" or "urgent finance" requests to a dedicated person or process, rather than whoever answers the main line.
None of this requires your staff to become fraud investigators. It just slows the process down enough for normal checks to happen — which is usually all it takes to stop these scams cold.
Build a simple verification process
Technology helps, but the real defence is a process every staff member follows, no exceptions:
- ▸Never action a payment change on a phone call alone. Any request to change banking details or urgently release funds must be confirmed through a second, independent channel — a callback to a known number, not the one that just called you.
- ▸Treat urgency as a warning sign, not a reason to skip steps. Real suppliers and banks don't usually demand instant, unverifiable action.
- ▸Record and review. Use your call recordings during onboarding and refresher training so staff can hear real examples of how these calls sound.
- ▸Limit who can authorise large payments, and require more than one person to sign off, regardless of how convincing the caller was.
Businesses that have been burned by load shedding disruptions or short-staffed reception desks are often the most vulnerable here too — a rushed, distracted team is an easier target. If your business is still catching up on basic call handling, our guide on missed call recovery covers some of the fundamentals worth getting right first.
Where this fits into broader phone system security
Fraud prevention isn't just about one feature — it's part of running a proper, modern business phone system instead of relying on personal cellphones and ad hoc WhatsApp groups. If you're still weighing up whether a hosted system is worth the move, our piece on cloud phone systems explains what you actually get, including recording, call logs, and routing controls. Law firms, accounting practices, and financial advisors handle this kind of financial risk daily — see how firms in those sectors are addressing it in our guide for SA accounting practices and our overview on POPI compliance for phone systems, since recorded calls also need to be stored and handled correctly under POPI.
Frequently asked questions
Can call recording actually stop a scam in progress?
Not on its own — but knowing calls are recorded makes staff more cautious, and having the recording afterwards gives you evidence for the bank, SAPS, and your insurer. Combined with a verification process, it's one of the strongest practical defences available.
Is it legal to record business calls in South Africa?
Yes, provided you handle it correctly under POPI — generally this means informing callers that calls may be recorded and only using the recordings for legitimate business purposes like fraud prevention, training, or dispute resolution.
What should I do if my business has already been scammed over the phone?
Report it to your bank immediately to attempt a reversal, file a case with SAPS, and pull any available call recordings or logs as evidence. Speed matters — most recoveries only happen in the first few hours.
Does NexysPBX work with our existing bank verification processes?
Yes — NexysPBX call recording and routing rules work alongside whatever internal sign-off process you already use for payments; it strengthens your existing controls rather than replacing them.
