Avoiding crypto scams in South Africa

This guide describes the South African position: the patterns repeat in every market, but the registers and regulators you check here are South African.

Crypto scams in South Africa have cost ordinary people very large sums, and the post-mortems read remarkably alike. The schemes that did the most damage were not technically sophisticated. They were built on ordinary human incentives: a return that sounded plausible rather than absurd, a person who seemed credible, a withdrawal that worked the first time, and social proof from someone the victim already trusted.

What follows describes patterns, not people. We make no allegations about any named individual or company; where a matter is before a court or a regulator, that is where it belongs. The value of the patterns is that they are predictive: if a proposition in front of you has three of these features, the specific names involved barely matter.

The patterns behind the biggest failures

1. A return that is described as certain

The common thread in the largest South African crypto collapses was a stated or implied rate of return — often modest enough to sound professional rather than greedy — presented as reliable because of some proprietary edge: an algorithm, a bot, a trading team, arbitrage between venues. Real trading produces variable results, and any operation that smooths those results into a consistent monthly figure is either subsidising bad months from new deposits or lying about the returns.

2. Recruitment as the actual product

Where a scheme rewards you for introducing others — multi-level referral tiers, commission on a downline, ranks and bonuses — the returns are increasingly funded by new entrants rather than by any external activity. That structure fails arithmetically, without any dishonesty being required at the point where it is sold to you by a friend.

3. Withdrawals that work, until they do not

Early small withdrawals almost always succeed. They are the marketing. The failure mode is familiar: a maintenance notice, a migration to a new platform, a regulatory pretext, a request for a fee or a tax payment before the withdrawal can be released. The moment a payment is required in order to receive your own money, the money is gone.

4. A structure designed to be unreachable

Offshore entities, changing corporate names, no verifiable South African registration, no physical address you can visit, no licence, and a director profile that cannot be confirmed anywhere. This is not administrative sloppiness. It is the part of the design that determines what happens to you if the scheme fails.

5. Custody without any reason for it

If someone needs to hold your assets — deposit into our wallet, we will manage it — ask what that custody is for. An exchange service does not require it: value moves once in each direction against an agreed rate. Discretionary management is a separately licensed activity in South Africa under Category II, and most operators making these offers hold no licence at all.

The specific red flags

How to verify an FSCA licence, step by step

1. Get the details in writing. The exact registered company name, the CIPC registration number and the FSP number. A refusal or a delay at this step is the answer.
2. Go to the FSCA website yourself. Type the address into the browser. Do not use a link, a QR code or a screenshot supplied by the person you are checking.
3. Search the register by FSP number, then by name. Both should return the same entity. A trading name that differs from the registered name is normal; a licensed entity that does not exist is not.
4. Check the status and the date. The licence must be active, not lapsed, suspended or withdrawn.
5. Check the authorised categories and products. The licence must cover crypto assets. An FSP authorised only for long-term insurance is not authorised for this.
6. Check who is authorised to act. Key individuals and representatives are recorded. The person messaging you should be connected to the licensed entity.
7. Search FSCA press releases and public warnings for the name and for any similar names.
8. Phone the FSCA on a number you found yourself if anything is ambiguous. The regulator would rather answer a question than open a file.

How to check a company at CIPC

1. Ask for the registration number in the standard format and the exact registered name.
2. Use the CIPC enquiry service to confirm the entity exists and that the name matches the number.
3. Check the company status. Deregistered, in business rescue or in liquidation are all material facts that a website will not mention.
4. Check the registration date against the story you are being told. A company incorporated last quarter is not a firm with a decade of history.
5. Compare the registered address with the address advertised. A mismatch is not proof of anything on its own, but it is a question worth asking out loud.
6. Remember what a CIPC registration is: proof that a company exists. It is not a licence, not an endorsement, and not a statement that the company is solvent or honest. Registration numbers are quoted by scams precisely because they look official.

Under section 32(4) of the Companies Act, a company must state its registered name and registration number on its electronic publications, including its website. A South African operator that publishes neither is not merely being casual.

What a legitimate desk will never ask you to do

• Never ask for your seed phrase, recovery words, private key or wallet password.
• Never ask you to install remote-access or screen-sharing software.
• Never ask you to pay a fee, a tax or a release charge before you can receive your own funds.
• Never ask you to receive or send money on behalf of somebody else, or to accept a payment from an account that is not yours.
• Never ask you to skip identity verification, or offer to do a trade without it.
• Never promise a return, a yield, a profit or a guaranteed outcome, or tell you a rate will expire in the next five minutes.
• Never ask you to send crypto to an address supplied only in a chat message without confirming it on a channel you have independently verified.
• Never object to you meeting them at a registered address, or to your accountant or attorney being copied on the correspondence.

There is a mirror image of this list. A compliant desk will insist on things a scam avoids: full FICA onboarding under section 21 of the FIC Act, source-of-funds questions, settlement to a bank account in your own name, and a written confirmation of every trade. Friction is not the opposite of good service here. Its absence is the warning.

Impersonation, which is now the common attack

A rising share of losses involves someone impersonating a real, legitimate business. The pattern is a near-identical social media handle, a cloned website on a lookalike domain, and a helpful person who moves the conversation to a private channel quickly. Two habits defeat it almost entirely: type the website address yourself rather than following a link, and confirm any wallet address by a second channel — a phone call to a number you already had, or in person — before sending anything. Our official channels are listed on this page for exactly this reason.

If you have already sent money

Act quickly, and stop paying. The most common secondary loss is the recovery scam: someone who contacts you claiming to be able to retrieve your funds for a fee. They cannot.

1. Preserve everything: chat logs, screenshots, transaction hashes, addresses, bank references, the website, the names used.
2. Report it to the South African Police Service and obtain a case number.
3. Tell your bank immediately if any rand leg is involved. Speed occasionally matters.
4. Report the conduct to the FSCA, particularly if regulated financial services were being offered.
5. If the operator claims to be a registered financial services provider, a complaint to the FAIS Ombud may be available.
6. Take legal advice from an admitted attorney before signing anything, including any settlement or recovery agreement.