Capitec is deliberately keeping open bank accounts it has identified as being used by fraud syndicates, so that criminals find the stolen money held when it finally arrives. The approach, described by group chief information officer Andrew Baker, is called the “ghost stop”.
A mule account is a bank account used to receive and move the proceeds of fraud. Under the ghost stop, Capitec leaves such an account looking active but blocks any outgoing transfers, allowing the funds to be recovered and returned to the client. A second measure, the “landmine selfie”, triggers an unexpected biometric check, a facial or fingerprint verification, when someone tries to move money out of the account. The funds remain frozen until the original account holder completes the selfie.
Baker argues that simply blocking accounts does little to hurt a syndicate because a mule account is cheap to replace. He estimates a syndicate can pay a recruited holder less than R500 for credentials, so blocking 300 accounts would cost about R150 000, affordable for an operation that moves far larger sums. By keeping the account open and then stopping the money, the bank forces the criminals to discover their investment has failed after they have already spent the cost of the account.
The landmine selfie adds another hurdle. If the person who opened the account has been deceived, for example, believing they are running an invoicing service, they may comply with the selfie request and allow the fraud to continue. Baker notes that biometric checks must work alongside transaction monitoring to be effective.
Digital banking crime cost South Africans R2.41 billion in reported client claims in 2025, up 29.2% on 2024, according to the South African Banking Risk Information Centre. Reported incidents rose 12.8% to 110 074. While Capitec has not disclosed how many mule accounts it has caught or how much money it has held and returned, the bank is pitching the tactics as a way to curb rising losses.
For more on technology and telecom developments, see the Tech & Telco section.
Capitec labels the combined tactics “scammernomics”, a strategy aimed at making fraud unprofitable rather than merely harder to execute. The bank’s description highlights that keeping a mule account appearing active forces criminals to waste time and resources on a dead-end transaction, a psychological pressure point that differs from outright blocking. By allowing the account to receive funds and then halting any outbound movement, the bank creates a scenario where the fraudster’s investment is sunk before they can reap any benefit, increasing the operational risk for the syndicate.
When a new client opens an account, Capitec cross-checks facial or fingerprint biometrics against Department of Home Affairs records, a step that establishes a baseline identity verification. The bank then prompts periodic selfie re-verification within its app, a routine that keeps the biometric profile current. The “landmine selfie” is an extra, unscheduled check that activates only at the moment a transfer is attempted, ensuring that the original account holder must confirm their identity again before any funds can move.
Capitec, with 26.6 million active clients, has positioned the approach as a response to the surge in digital banking crime, which the South African Banking Risk Information Centre quantified at R2.41 billion in client claims for 2025. While the bank has not disclosed specific figures for mule accounts intercepted, the emphasis on returning recovered funds to victims aligns with its broader effort to mitigate the rising loss figures that have climbed 29.2 percent year-on-year.
