Why you are the target
Criminals rarely break through firewalls. It is far easier to trick a person into opening the door. That trick has a name: social engineering — manipulating people into clicking, sharing, logging in or paying.
The numbers
- South Africans lost R2.4 billion to digital banking crime in 2025, up 29% on 2024, across more than 110,000 incidents — an average of almost R22,000 per incident. Banking apps accounted for most cases. The banking risk centre SABRIC names social engineering as the main driver. (SABRIC, BusinessTech)
- Interpol's 2025 African Cyberthreat Assessment found South Africa had the most ransomware detections in Africa in 2024. (Interpol)
- Globally, Verizon's breach research consistently finds a human action involved in around 60% of breaches — a click, a reply, a mistake. (ClearanceJobs summary of the 2025 DBIR)
- It happens fast: once a phishing email lands, the typical person who falls for it clicks within seconds, not minutes. (Ninjio on Verizon DBIR 2026)
How social engineering works
Every scam pulls on the same few emotional levers. Learn to notice the feeling, and you'll catch the scam.
| Lever | What they say | What they want you to feel |
|---|---|---|
| Urgency | "Pay before 3pm or the deal falls through." | No time to think or check. |
| Authority | "This is the CEO / SARS / your bank." | You shouldn't question it. |
| Fear | "Your account has been compromised." | Panic, so you act fast. |
| Reward | "You've won" / "Claim your refund." | Excitement that overrides caution. |
| Helpfulness | "Can you quickly do me a favour?" | You want to be useful. |
| Secrecy | "Keep this between us for now." | Don't ask anyone else. |
The pause rule: When a message makes you feel rushed, scared or excited, that feeling is your cue to stop. Take 30 seconds. Check it another way.
Why you, and not just the IT team?
You have something criminals want: access to email, systems, payments, or customer information. A small business is often an easier target than a bank, and one tricked employee can be enough to start a ransomware attack or redirect a supplier payment. You don't need to be a security expert. You need to be the person who pauses and checks.
Knowledge check
1. What is social engineering?
Think about your answer, then check it.
2. A message makes you feel panicked and rushed. What should that feeling tell you?
Think about your answer, then check it.