The email arrives with all the hallmarks of legitimacy. The WesBank logo sits confidently at the top, the language is polished, and the tone carries just enough urgency to make you sit up straighter in your chair. It feels official. It feels familiar. It feels safe enough to act on quickly. And that is exactly where the danger begins.
In late 2024, nearly 70% of South Africans were targeted by fraud, with victims losing an average of more than R12,500. At the same time, digital banking fraud surged by 86%, resulting in losses of approximately R1.888 billion across the financial sector. Within this escalating threat landscape, WesBank is raising the alarm over a particularly deceptive trend: letterhead-based scams that convincingly impersonate official communication.
These scams are not clumsy attempts thrown together in haste. They are carefully engineered forgeries designed to mirror legitimate bank correspondence in tone, formatting, and branding. Fraudsters study customer behaviour and financial cycles, often targeting individuals with existing or previous vehicle finance agreements. The timing is deliberate, striking when customers are most likely to expect communication, such as after vehicle purchases, settlements, public holidays, or during periods of financial pressure.
The tactics used are varied but consistently manipulative. Some victims receive proof of payment scams where fake confirmations are sent to sellers, prompting them to release vehicles before funds are actually transferred. Others encounter change of banking details requests, where scammers impersonate WesBank officials and instruct customers to redirect payments into fraudulent accounts. Refund or overpayment scams create false narratives that money is owed back to the customer, requiring sensitive banking information to “process” the refund.
More aggressive schemes include fake vehicle finance arrears notices that claim accounts are overdue and demand immediate payment, often followed by fabricated legal action or repossession threats designed to provoke panic. In other cases, car sales scams circulate fraudulent financing approval letters to private sellers, while account verification scams pressure customers into sharing sensitive information under the guise of routine security checks. There are also fake insurance or warranty add-ons, where criminals attempt to sell non-existent products through convincing but entirely fraudulent communication.
“These letterhead scams are becoming increasingly sophisticated, making it difficult for even vigilant consumers to distinguish between genuine and fraudulent communication,” says Lebogang Gaoaketse, Head of Marketing and Communication at WesBank. “Fraudsters invest considerable effort in replicating our branding, tone, and document formats to create convincing forgeries.”
Despite their sophistication, these scams often leave subtle clues. Fraudulent emails frequently originate from addresses that mimic official WesBank domains but contain slight alterations such as extra characters or unfamiliar extensions. Spelling and grammatical inconsistencies can also appear in otherwise professional-looking messages. Another common indicator is tone, as scam communications tend to rely on pressure, urgency, or threats that push recipients toward immediate action without time for verification. Requests for passwords, PINs, one-time passwords, or full banking details are also major red flags, as legitimate institutions never ask for such information via email or SMS. Similarly, instructions to make payments into new or unfamiliar accounts outside established channels should always be treated with suspicion.
Gaoaketse stresses that verification remains the strongest defence. Customers are encouraged to pause before responding to any communication involving payments, personal data, or urgent instructions. “We encourage all customers to pause before acting on any communication that requests payment, personal information or urgent action,” he explains. “Contact WesBank directly through our official channels to verify any communication you receive. Taking a few minutes to confirm authenticity could save you from significant financial loss and identity theft.”
The advice is simple but critical. Suspicious messages should not be clicked, downloaded, or engaged with in any way. Instead, customers should independently verify all communication through official WesBank contact details available on their website, or by reaching out directly to customer service. Any suspicious activity should be reported immediately, and payment instructions should always be confirmed through trusted channels before action is taken.
In a digital environment where deception is becoming increasingly polished, caution is no longer optional. It is essential. When something feels rushed, overly urgent, or just slightly off, it deserves a second look. Because in the world of financial fraud, the smallest pause can be the difference between safety and significant loss. For more guidance, WesBank continues to make its ScamProof resources available via its official website.
