When the Bank Calls It a Goodwill Gesture
A retired teacher lost R1 276 100 to a phishing scam. Nine months later, Nedbank's full and final offer was R20 000, while its own collections division pursued her for arrears on the accounts the fraudsters had drained.
On 30 September 2025, a caller identifying herself only as "Rose" reached Luisa Elisabetta Westphal, 63, a retired schoolteacher from Dowerglen, on WhatsApp. The caller already had Westphal's name, ID number, and flight history, and claimed to represent SAA, offering a seniors' discount through a link styled to look like the official SAA app. Westphal clicked it.
Within twenty minutes, fraudsters had moved R994 300 out of her Nedbank home loan access bond, an account with no withdrawal activity since 2023, and a further R82 800 from her Nedbank credit card. Her husband's Standard Bank account was hit separately for R199 000 in the same window.
Total loss: R1 276 100.
Westphal called Nedbank's fraud line five times in the first thirty minutes after the breach. The bank opened a case on 2 October. An investigator made one round of contact six days later. Then silence, for four months.
On 2 February 2026, Nedbank closed the file. The offer, in writing: R20 000, framed as a goodwill gesture for a long-standing client, not an admission of guilt, and presented as full and final settlement.
While that letter was being prepared, Nedbank's collections division was separately chasing Westphal for arrears on the same credit card the fraudsters had emptied, and the same home loan, where the instalment had since climbed from a stable few hundred rand a month to over R13 000, a direct consequence of the fraud itself drawing the bond down. She has had no access to her own accounts since the day after the theft.
The bank's written position:
"Nedbank is not liable in any way."
That is the institution's own characterization of an account, untouched for over two years, emptied within twenty minutes of a single phone call, with no verification contact from the bank before, during, or after the transaction cleared.
This is not an isolated complaint. IOL has reported at least three comparable disputes against Nedbank and Standard Bank since May 2026 alone, including a couple with 37 years of loyalty to Nedbank offered R1 300 after a fraud loss, and a separate Harrismith case where a R60 000 loss drew a R16 000 offer the client refused.
The shape of the complaint repeats:
An anomalous transaction clears without verification, the bank's own investigation timeline runs long, and the eventual settlement recovers a small fraction of what was taken.
The open question, framed the same way by IOL's own reporting, is whether a bank's duty of care should extend to flagging transactions that depart sharply from an account's established pattern, independent of how the login credentials were obtained. A two-year-dormant access bond moving close to a million rand in one sitting is not a subtle anomaly.
Whether South African law currently requires a bank to catch it is unresolved, and now sits with the Ombudsman for Banking Services and Westphal's attorneys. Nedbank's only on-record comment was that the matter is now a formal dispute handled through Westphal's legal representatives, and that it continues investing in security and client awareness.
Discovery Bank, where the funds were ultimately traced, said it could not discuss account specifics under POPIA, and pointed to its own real-time monitoring and FICA reporting obligations.
Questions on the record, for Nedbank to answer if it chooses to:
What anomaly-detection threshold, if any, applies to access bond accounts with two or more years of zero withdrawal history.
Why a R994 300 movement on such an account did not trigger a verification call before the funds cleared.
Why collections proceeded on accounts the bank's own fraud division had already logged as compromised, while the claim was still open.
What an offer covering roughly one and a half percent of a documented loss is meant to communicate to the client who absorbed the rest.
Sourced from IOL News, reporting by Karabo Ngoepe and Wendy Dondolo, on documents including Westphal's sworn complaint and Nedbank's own correspondence.
#OnyxAudit
About the Author: ●onyxdigitalintelligence85@protonmail.com ●@BaximusCyber85 on X ●Baximus855.github.io
Adjacent to truth ≠ Truth.
Love Everyone But Never Sell Your Sword.