Beware Instant EFT payments in South Africa

The South African Reserve Bank (SARB) and the Financial Sector Conduct Authority (FSCA), in consultation with the Payments Association of South Africa (PASA), has issued a warning to consumers regarding the risks of using instant electronic funds transfer (EFT) services.

Instant EFT has raised concerns as it relies on providing your online banking credentials to a third party.

These third party providers employ screen scraping to perform an EFT on your behalf, and then validate that the payment has gone through.

Several ecommerce stores in South Africa have taken to offering Instant EFT as an alternative to card-based payments.

The regulators provided the following illustration as an example of how Instant EFT works.

Consider the following scenario: Sidney wants to order a pair of sneakers for his son's birthday. He searches for an online clothing store and finds the perfect pair. He selects the size and colour, and clicks on "Buy Now". Sidney proceeds to the delivery details and payment page. Here, he is asked how he will make the payment, and selects the "InstantEFT" option. Sidney is given a list of banks and is prompted to select the bank he uses. Immediately, he is redirected to a page with his bank's logo, and is required to enter his online banking details. He inputs his online banking username and password, and clicks on "Submit". Once he inputs the username and password, he is required to select the account from which he wishes to make the payment, and is then required to authenticate the payment via his mobile phone. The webpage then moves to the payment confirmation page to inform Sidney that his payment was successful. Finally, he receives an SMS message from his bank alerting him that a payment has been made. InstantEFT benefits Sidney in that he can make purchases quickly and easily from anyonline store.

What are the risks to consumers?

The SARB, the FSCA, and the payments industry stated that they do not support the use of screen scraping to effect payments, given that it exposes consumers to several risks. These risks include:

  • Potential loss of data privacy
  • Fraud
  • Breach of contractual agreements with bank / terms and conditions
  • Financial loss

South Africa’s financial regulators warned that when you give your online banking credentials to an Instant EFT provider, you have no control over what personal data they can read from your account.

“Account numbers and account statements can be stored and utilised without the consumer’s knowledge or consent,” the regulators stated.

They also warned that there is a risk that fraudsters might pose as an instant EFT service or ecommerce site and trick people into providing their online banking username, account number, password, and/or PIN.

Another important consideration is that by providing your Internet banking login credentials to any third party, including Instant EFT services, you may be in breach of your banks’ terms and conditions.

“As a result, knowingly or unknowingly, consumers might be giving up their rights of recourse and any legal protection in the event of suffering fraud and/or subsequent loss,” they warned.

The final warning from the regulators was that EFT payments are final and irrevocable in nature. You are unable to lodge a dispute or reverse a transaction in the event of an online store not honouring their agreement (e.g. not delivering the goods or delivering counterfeit goods).

Security advice

“As the global economy experiences an increase in the use of electronic payments and online shopping, and considering the growing role of financial technology in payments, online crimes are increasing,” said PASA, the FSCA, and the SARB.

“It is becoming even more important for consumers to educate themselves on the risks and benefits of using online means to make payments or order goods and services. It is also becoming exceptionally difficult for regulators and the financial industry alike to keep up with such crimes before a loss is experienced by either party.”

For these reasons, the regulators encouraged the following practices:

  • Be extra vigilant. As a consumer, you need to double- and triple-check the trustworthiness of a service asking for your money, including contacting your bank for advice before going ahead with something marketed and disguised under the premise of convenience.
  • Use industry-supported solutions, like paying by debit or credit card.
  • Do not share your Internet banking login credentials with any third party.

Now read: Beware these Black Friday scams

Latest news

Partner Content

Show comments

Recommended

Share this article
Beware Instant EFT payments in South Africa