Whether or not their deposit taking controls are effective, there's also an external factor that makes it difficult, which is not only faced by Capitec. I've heard of many cases where transactional accounts are "sold" (either through incentive or intimidation) to fraud syndicates. So, here you have a 100% FICA-compliant account from an everyday citizen, which is being used for fraudulent/criminal purposes. How does a banking institution prevent this from happening?
I'm not sure how a Bank can just accept anyone? In order to issue an account, you need a licence, which is issued by the FIC. They (the FIC) will evaluate the controls that the institution has implemented around issuing accounts and deposit taking as well as perform audits to determine compliance. Any contravention and the institution faces fines and could ultimately lose their licence and even further repercussions from SARB. So, I don't think they'll just accept anyone. Once again, whether their controls are effective enough, is a different question.
Getting back to the News24 story, I can only suspect a phishing attack. The perps/fraudsters had to have been in possession of the token generator or fed the token because, if memory serves correct, it expires after 60 (or 120) seconds.