The phone in your pocket has become a small, profitable crime scene. In the first five months of 2026, Truecaller says it identified more than 14.41 billion spam calls aimed at users in South Africa, a 22.9% jump on the same stretch in 2025.

The numbers are large enough to blur into noise, so the more useful detail is this: scammers no longer need much money, much skill, or even a local presence. With VoIP tools, caller ID spoofing, and scripts written to trigger panic, they can make a bank fraud call look routine, then use stolen personal information to sound convincing.

The scam no longer looks like a scam

The old version of a phone scam was clumsy. The caller had a bad line, a strange accent, and a story that fell apart after two questions. That version still exists, but it is no longer the main problem.

Today’s fraud calls can display a bank number on the screen, then open with a warning about an unauthorised payment, an account lock, or a security review. That fake legitimacy is the whole trick. If the number looks right and the caller knows your name, your bank, or even a detail from a recent purchase, the brain gives the call more credit than it deserves.

VoIP makes the scale possible. A criminal can place huge numbers of calls over the internet for very little money, then move on when a line goes cold. Caller ID spoofing does the rest, masking the true source and making the phone behave as if it is receiving a normal customer-service call.

Banks are a favourite disguise because panic is easier to sell when money is involved. The script usually pushes for immediate action, then asks for the one thing a real bank should never need over an unsolicited call: a PIN, password, or one-time password.

Personal data is the fuel

The flood of personal information in circulation has made these calls more dangerous. Scammers do not need to know everything about a person to sound credible. A name, a cellphone number, a bank, an ID number, or a partial account detail is enough to make a cold call feel oddly specific.

That information comes from several places. Data breaches have exposed customer records in the past. Social media leaves behind scraps of employment history, family links, and travel plans. Other details are bought and traded on criminal markets. Put together, they let scammers tailor the pitch instead of spraying the same script at random.

That shift changes the experience for the person answering the phone. A generic robocall is easy to dismiss. A call that mentions the right bank and uses the right tone can create just enough doubt to make someone stay on the line. Once that happens, the scammer only needs a few minutes of pressure and a moment of hesitation.

The damage lands fast

The visible cost is usually money leaving an account. The hidden cost is everything that follows. Victims can lose savings, fall into debt, or spend days trying to undo transfers that moved too quickly for recovery. For households, the blow can hit rent, school fees, transport money, or retirement savings in one call.

Identity theft is the longer problem. Once criminals have enough personal data, they can open accounts, bypass weak checks, or keep targeting the same victim with newer and more precise scams. The damage is not only financial. It also leaves people second-guessing every call from a delivery service, a lender, or their own bank.

Small businesses are exposed too. A staff member who trusts the wrong caller can hand over access details, confirm payment information, or disclose customer data. The result can be lost money, downtime, and damage to a reputation that took years to build.

The first line of defence is boring

There is no clever response here, only disciplined habits.

• Never give out a password, PIN, or one-time password on an incoming call.
• Hang up and call the institution back using the number on its official website, card, or statement.
• Treat urgency as a warning sign, not a reason to hurry.
• Be sceptical if the caller already knows personal details. That can be stolen, bought, or scraped.
• Report the number to your bank, SAPS, and caller-ID tools such as Truecaller.

Reporting helps build blocklists and fraud patterns that other users can see before they answer.

Networks and regulators still have work to do

The burden cannot sit only with the person holding the phone. Vodacom, MTN, Cell C, and Telkom Mobile all have a role in filtering suspicious calling patterns, but spoofed numbers make that harder than it sounds. A call can look local even when it is not, which complicates any network-level defence built only around the displayed number.

Truecaller is useful because it sits on top of that mess and learns from crowd reports. Its latest figures give a sense of the scale, but they also underline a harder truth. If more than 14.41 billion spam calls can touch users in five months, then the problem is not a handful of bad actors. It is a system that lets fraud travel cheaply.

ICASA has a stake in this too. Caller ID verification, consumer protection rules, and tighter cooperation with operators can reduce some of the damage, even if cross-border calling makes enforcement messy. SAPS remains part of the picture as well, especially when fraud moves from nuisance to theft.

The simplest advice is still the best one. If a caller pressures you to confirm account details, stop the conversation. Banks do not need your OTP to prove they are real. Scammers do.