{"id":623920,"date":"2026-01-03T12:06:57","date_gmt":"2026-01-03T10:06:57","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=623920"},"modified":"2026-01-03T12:09:37","modified_gmt":"2026-01-03T10:09:37","slug":"eskom-insiders-exploited-prepaid-electricity-system","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/623920-eskom-insiders-exploited-prepaid-electricity-system.html","title":{"rendered":"Eskom insiders exploited prepaid electricity system"},"content":{"rendered":"\n

Several Eskom employees have been implicated in a scheme to create billions of rands of fraudulent prepaid electricity vouchers<\/a>, enriching themselves while the utility received no income for the units.<\/p>\n\n\n\n

Syndicates operating inside Eskom sold large volumes of electricity on the black market<\/a> for as little as 25 cents per unit.<\/p>\n\n\n\n

Based on advertisements placed on social media platforms, \u201cghost vendors\u201d offered 600kWh electricity vouchers for around R150, which translates to a unit price of R0.25\/kWh.<\/p>\n\n\n\n

The state-owned power utility revealed in its annual report, published in September, that it was investigating options to prevent the use of these fraudulently generated 600kWh electricity vouchers.<\/p>\n\n\n\n

The average per-unit price Eskom charged to residential customers in 2023 and 2024 was around R3\/kWh \u2014 twelve times more than what the electricity thieves were charging.<\/p>\n\n\n\n

Larger vouchers were also available, offering even cheaper per-unit prices. However, the 600kWh tokens appeared to be the most popular, which is likely why Eskom highlighted them in its report.<\/p>\n\n\n\n

The scale of the fraud is likely to have impacted Eskom\u2019s financial health, exacerbating its debt problem and resulting in higher tariff increases to compensate for the lost revenue.<\/p>\n\n\n\n

In its latest annual report, Eskom revealed that total losses due to criminal conduct during its 2024\/25 financial year were R7.2 billion, up from R6.7 billion the year before.<\/p>\n\n\n\n

Most of this \u2014 R7.1 billion in 2025 and R6.4 billion in 2024 \u2014 is related to estimated non-technical energy losses arising from electricity theft.<\/p>\n\n\n\n

However, MyBroadband understands that the actual losses are much larger than Eskom\u2019s estimates. Prepaid ghost vending may also have contributed to load-shedding.<\/p>\n\n\n\n

Eskom first disclosed that its online vending system (OVS) for prepaid electricity was breached<\/a> in its previous integrated report, published in December 2024.<\/p>\n\n\n\n

Eskom introduced the OVS in 2008 to combat ghost vending using old offline credit dispensing units (CDUs).<\/p>\n\n\n\n

Corrupt Eskom officials assisted syndicates in obtaining the equipment, technical expertise, and system access needed to generate fake electricity tokens \u2014 first on CDUs and later on the OVS.<\/p>\n\n\n\n

University of Johannesburg research associate and forensic investigator Calvin Rafadi has explained<\/a> that Eskom tried to recall its CDU machines when it launched the online vending system.<\/p>\n\n\n\n

However, Eskom officials stole several of the machines from where they were kept in storage. They also obtained the disks and other equipment necessary to alter the electricity prices on the devices.<\/p>\n\n\n\n

The CDU-based \u201cghost vending\u201d problem persisted long after the online vending system was launched, with law enforcement struggling to dismantle the criminal syndicate behind the theft.<\/p>\n\n\n\n

Prepaid electricity meter security questions<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

MyBroadband also understands that the fraudulent tokens generated by Eskom\u2019s compromised system could have been used on meters linked to municipal distribution networks.<\/p>\n\n\n\n

However, Eskom said that this was not technically possible, as meters configured for use in a municipal supply area could not accept Eskom Direct electricity tokens.<\/p>\n\n\n\n

The City of Tshwane metropolitan municipality also dismissed concerns, suggesting that its system prevents ghost vending from taking place.<\/p>\n\n\n\n

\u201cThe City of Tshwane operates on a real-time vending platform; therefore, there are no reported ghost-vendors in the city\u2019s vending system,\u201d a spokesperson told MyBroadband.<\/p>\n\n\n\n

Following Eskom and Tshwane\u2019s feedback, MyBroadband spoke to representatives of Landis+Gyr, a prominent electricity meter manufacturer.<\/p>\n\n\n\n

While the company initially stated that it could not answer questions about Eskom ghost vending, as it does not supply the OVS, it was willing to address technical questions about its meters.<\/p>\n\n\n\n

MyBroadband asked whether it was possible to reconfigure a municipality\u2019s prepaid meters to accept Eskom Direct tokens, and vice versa<\/p>\n\n\n\n

\u201cLandis+Gyr manufactures and supplies meters in accordance with customer-approved specifications and requirements,\u201d it said.<\/p>\n\n\n\n

\u201cIn some cases, customers may opt to have their meters configured with a manufacturer\u2019s default Supply Group Code (SGC).\u201d<\/p>\n\n\n\n

Landis+Gyr explained that this configuration allows the utility or municipality to perform a key change from the manufacturer’s default SGC to their own unique SGC.<\/p>\n\n\n\n

\u201cOnly once the key change is performed will the meter then accept prepayment credit tokens from the utility vending system,\u201d it said.<\/p>\n\n\n\n

\u201cWhile the meter contains the manufacturer\u2019s default SGC, it cannot accept prepayment credit tokens until the utility-specific key change is performed.\u201d<\/p>\n\n\n\n

Eskom reports improvements<\/h2>\n\n\n\n
\"\"
Dan Marokane, Eskom CEO<\/figcaption><\/figure>\n\n\n\n

Eskom previously reported that it had reduced fraud linked to its OVS to very low levels by improving physical security, cyber resilience, and operational controls.<\/p>\n\n\n\n

One of its key future interventions is accelerating the development of a new, secure vending system to replace the OVS.<\/p>\n\n\n\n

\u201cExpanded investigative measures, conducted in collaboration with law enforcement, have been concluded for some of the implicated employees, with the internal process resulting in their dismissal,\u201d it added.<\/p>\n\n\n\n

\u201cCertain elements are to be referred to authorities, and the company will cooperate fully.\u201d<\/p>\n\n\n\n

MyBroadband asked Eskom during its results presentation last year what the value was of the fraudulent 600kWh vouchers generated from its OVS.<\/p>\n\n\n\n

Eskom Group CEO Dan Marokane did not answer the question. Instead, he provided additional detail about the power utility\u2019s approach to ghost vending.<\/p>\n\n\n\n

Marokane explained that they were using three-way matching to audit Eskom\u2019s systems to identify and account for fraudulent prepaid electricity tokens.<\/p>\n\n\n\n

This involves comparing the tokens generated by the online vending system, what Eskom is billing customers, and its financial reporting.<\/p>\n\n\n\n

According to Marokane, this showed there had been a significant decrease in electricity theft through ghost vending.<\/p>\n\n\n\n

He acknowledged that the problem is not resolved and that they were constantly discovering new challenges they needed to manage.<\/p>\n\n\n\n

Marokane highlighted \u201cbig ticket tokens\u201d that were generated in the earlier part of their investigation as a particular challenge they were focusing on.<\/p>\n\n\n\n

\u201cWe are focusing on developing a new solution<\/a> that we want to bring on board. That\u2019s what I\u2019ll share at this point in time. It is a matter that is fully on our radar,\u201d Marokane said.<\/p>\n","protected":false},"excerpt":{"rendered":"

A prominent electricity meter manufacturer has answered questions regarding the security features of prepaid meters in South Africa.<\/p>\n","protected":false},"author":15,"featured_media":488107,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27995,27],"tags":[76540,31156,181,93309,97114,102732,97790],"class_list":["post-623920","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-energy","category-security","tag-city-of-tshwane-cot","tag-dan-marokane","tag-eskom","tag-eskom-direct","tag-ghost-vendors","tag-landisgyr","tag-standards-transfer-specifications-sts"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/623920"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=623920"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/623920\/revisions"}],"predecessor-version":[{"id":623921,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/623920\/revisions\/623921"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/488107"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=623920"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=623920"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=623920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}