Beware Instant EFT payments in South Africa

The South African Reserve Bank (SARB) and the Financial Sector Conduct Authority (FSCA), in consultation with the Payments Association of South Africa (PASA), has issued a warning to consumers regarding the risks of using instant electronic funds transfer (EFT) services.

Instant EFT has raised concerns as it relies on providing your online banking credentials to a third party.

These third party providers employ screen scraping to perform an EFT on your behalf, and then validate that the payment has gone through.

Several ecommerce stores in South Africa have taken to offering Instant EFT as an alternative to card-based payments.

The regulators provided the following illustration as an example of how Instant EFT works.

What are the risks to consumers?

The SARB, the FSCA, and the payments industry stated that they do not support the use of screen scraping to effect payments, given that it exposes consumers to several risks. These risks include:

Potential loss of data privacy
Fraud
Breach of contractual agreements with bank / terms and conditions
Financial loss

South Africa’s financial regulators warned that when you give your online banking credentials to an Instant EFT provider, you have no control over what personal data they can read from your account.

“Account numbers and account statements can be stored and utilised without the consumer’s knowledge or consent,” the regulators stated.

They also warned that there is a risk that fraudsters might pose as an instant EFT service or ecommerce site and trick people into providing their online banking username, account number, password, and/or PIN.

Another important consideration is that by providing your Internet banking login credentials to any third party, including Instant EFT services, you may be in breach of your banks’ terms and conditions.

“As a result, knowingly or unknowingly, consumers might be giving up their rights of recourse and any legal protection in the event of suffering fraud and/or subsequent loss,” they warned.

The final warning from the regulators was that EFT payments are final and irrevocable in nature. You are unable to lodge a dispute or reverse a transaction in the event of an online store not honouring their agreement (e.g. not delivering the goods or delivering counterfeit goods).

Security advice

“As the global economy experiences an increase in the use of electronic payments and online shopping, and considering the growing role of financial technology in payments, online crimes are increasing,” said PASA, the FSCA, and the SARB.

“It is becoming even more important for consumers to educate themselves on the risks and benefits of using online means to make payments or order goods and services. It is also becoming exceptionally difficult for regulators and the financial industry alike to keep up with such crimes before a loss is experienced by either party.”

For these reasons, the regulators encouraged the following practices:

Be extra vigilant. As a consumer, you need to double- and triple-check the trustworthiness of a service asking for your money, including contacting your bank for advice before going ahead with something marketed and disguised under the premise of convenience.
Use industry-supported solutions, like paying by debit or credit card.
Do not share your Internet banking login credentials with any third party.