Will my bank refund me automatically?

No. South Africa has no mandatory reimbursement scheme of the kind introduced in some other countries. Whether the bank bears the loss depends on the facts, including whether it carried out reasonable verification and what you were shown and told. That is argued from evidence, which is why capturing the page matters more here than it would elsewhere.

What is the CAS number and why does everyone ask for it?

It is the reference for the criminal case opened when you lay a charge at a SAPS station. Banks, the National Financial Ombud and any civil claim will ask for it, and it also fixes the date on which you reported. Get it on the same day if you possibly can.

The website is already offline. Is there any point?

Yes, though less than there would have been. Capture whatever still exists: the payment confirmation, the emails, the SMS messages, the profile if it is still up, any archived copy of the page. Capture it today, because the remaining traces disappear too, and say plainly what you were able to preserve and when.

Does this apply to investment and crypto scams?

Yes, and the pattern is the same. The promise, the projected returns, the fake dashboard showing your balance and the account that made the pitch are all web pages, and they are all removed once the money stops arriving. Capture the dashboard as well as the pitch, because the fake balance is often what shows the deception.

What about a scam on a marketplace or social platform?

Report it to the platform, but capture the listing, the seller profile and the full message thread first. Platform removal is the outcome you want and it is also the moment the record stops existing, exactly as it is with a takedown in any other context.

SAPS, your bank and the National Financial Ombud

No automatic refund. Your file is the whole case.

South Africa has no scheme that reimburses you automatically when you are defrauded. Banking fraud losses ran to billions of rand in 2025 and digital banking fraud incidents rose sharply. What decides whether you see the money again is how fast you report it and how well you can show what you were shown: the fake store, the cloned bank page, the investment promise, the profile that is already being deleted.

Capture the evidence now How it works

Works on Chrome and Edge. From $4.99 (about R83) as a one-off, or a 7-day trial that requires a credit card.

There is no mandatory reimbursement scheme in South Africa, which makes the sequence in the first hour more important here than in jurisdictions that have one. Phone your bank’s fraud line immediately so the account and the beneficiary can be frozen, then lay a charge at any SAPS station and get the CAS number, because every later step will ask for it. If the bank rejects your claim, the complaint goes free of charge to the National Financial Ombud. That process runs on documents, and the documents are the pages that persuaded you: the store that took payment and never shipped, the page that imitated your bank, the profile that promised returns, the SIM swap notification you were sent. All of them come down within days. Under section 15 of the Electronic Communications and Transactions Act 25 of 2002 a data message is admissible and its weight turns on how reliably it was generated and stored, how its integrity was maintained and how its originator was identified. ProofSnap captures each page as a package with the full page, the saved source, the URL, the capture time in UTC, a SHA-256 hash of every file and an RSA-4096 signature. From $4.99 (about R83) as a one-off.

By Radim Motycka, Founder and Lead Engineer, ProofSnap · Last updated: 31 July 2026 · Independently verifiable via Trust Verifier

Why claims get refused

The site is gone before the bank asks to see it

Fraud infrastructure is disposable. By the time anyone investigates, the thing that convinced you has usually been taken down.

Fake stores and clone pages are short lived

A fraudulent store or a page imitating a bank exists for days, sometimes hours. Once the domain is dead, the page you paid on cannot be produced by you, by the bank or by the police.

The profile deletes itself

Investment scams, romance scams and marketplace scams run through accounts that are deactivated the moment the money moves. The conversation, the promises and the account details go with them.

The bank decides on what you can show

A bank assessing whether it should bear the loss looks at what you were shown and what warnings you were given. If you cannot produce the page, the assessment is made without it, and the escalation to the Ombud starts from the same gap.

The order of operations, and why it is this order

Each step depends on the one before it. Doing them out of order costs you either the money or the evidence.

Phone the bank first

Every bank runs a 24 hour fraud line. The only realistic chance of recovering funds is freezing the beneficiary account before the money is moved on, and that is measured in minutes rather than days. Do this before anything else.

Lay a charge and get the CAS number

Report at any SAPS station and keep the CAS number. Banks, the Ombud and any civil claim will ask for it, and a report made the same day is treated very differently from one made three weeks later.

Capture what you were shown

Before the site disappears, capture the store, the payment page, the clone, the profile and the message thread. This is the part nobody tells you to do and it is the part that cannot be recovered afterwards.

Escalate to the National Financial Ombud

If the bank rejects the claim, the complaint goes to the National Financial Ombud free of charge once the bank has had its opportunity to resolve it. The Ombud works from documents, so the strength of the file decides the outcome.

SIM swap cases turn on what the bank did, not only on what you did

In a SIM swap the attacker moves your number to a new card and intercepts the one-time PINs. Whether the loss sits with you or the bank often turns on whether reasonable verification was carried out before the swap and before the transactions. Capture the notifications you received and their timing, the network messages, your banking app alerts and any communication with the bank and the network. That timeline is the case, and it is spread across systems that overwrite it.

How do I capture a scam site before it disappears?

No forensic training required. The proof is in the package, not in your testimony about how careful you were.

Freeze first, then capture

Phone the bank fraud line. Then open the store, the payment page, the profile or the thread in Chrome or Edge and capture each one from the side panel while the money is being stopped.

The package seals itself

Every file is hashed with SHA-256, the manifest is signed with an RSA-4096 key, and the manifest hash is anchored to Bitcoin. The capture time is recorded in UTC, independent of your device clock.

Report and attach the file

Lay the charge and get the CAS number, then submit the packages to the bank with the claim. If it is refused, the same file goes to the National Financial Ombud without you having to rebuild anything.

What is in a fraud evidence package?

Between 11 and 15 files depending on your plan, delivered as one ZIP that anyone can check without installing anything.

Full-page screenshot

The whole page, not just the visible window, stitched and hashed.

Saved page source

The document as rendered at capture time, including the head, meta tags and structured data.

Extracted page text

Searchable plain text, so a quote can be found and cited without retyping.

Technical metadata

URL, page title, HTTP response headers, browser, operating system and the capture time in UTC.

Signed manifest

SHA-256 for every file, signed with an RSA-4096 key whose public key ships in the package.

Blockchain timestamp

The manifest hash anchored to Bitcoin via OpenTimestamps, so the capture time cannot be backdated.

Chain of custody and forensic log

A record of what happened during the capture, in the order it happened.

Evidence report as PDF

A readable summary you can attach to an application, a notice or a report.

Verification instructions

Written steps plus scripts, so the other side can re-check the hashes offline.

Anyone can verify it, including the other side. Drop the ZIP onto the public Trust Verifier and the hashes, the signature and the timestamp are checked in the browser. Nothing is uploaded and nothing depends on ProofSnap still existing.

Three ways to get the evidence

Prices are charged in USD. Approximate rand figures are shown for orientation only, and your card issuer sets the actual rate.

One dispute

$4.99 once

about R83

A SnapPack is a single up-front purchase for a set number of captures. No subscription, no auto-renewal, no trial. Best when you have one problem and you want it documented today.

Get a SnapPack

Ongoing matters

$8.99/month

about R149

For anyone who captures regularly: practitioners, property managers, HR, investigators. The 7-day free trial requires a credit card. Cancel any time during the trial and you are not charged.

Start the 7-day trial

We do it for you

$44.99 per URL

about R747

Send us the link and our team captures the package for you, with nothing to install. Useful when the capture should not come from a party to the dispute.

See the capture service

ProofSnap is not a law firm and does not give legal advice. South Africa has no equivalent of the EU qualified timestamp, so the timestamp here is corroboration rather than a legal presumption. What section 15 of ECTA asks about is reliability, and a hash over every file with a signature and a recorded capture time is what answers it. Optional eIDAS qualified timestamps issued by Disig a.s., a Qualified Trust Service Provider on the EU Trusted List, are available on Enterprise plans for cross-border matters.

Official sources

Every figure and deadline on this page comes from the following primary sources. Check them yourself rather than taking our word for it.

SAPS: fraud and scams the official guidance on reporting and on the common scam patterns.
South African Reserve Bank: fraud and scams the official position on financial fraud and where to report it.
Electronic Communications and Transactions Act 25 of 2002 section 15, admissibility and evidential weight of data messages.

If the fraud happened at work and cost you the job, the CCMA guide covers the 30 day referral clock that starts the same day. ProofSnap does not recover money and it is not a substitute for reporting. What it does is make sure that the page which persuaded you still exists in a checkable form when the bank, the Ombud or the court asks what you were shown.

Questions people actually ask

The site will be gone this week

Freeze the money, capture the page, lay the charge. In that order.

Capture the evidence now ProofSnap in South Africa