The verdict in three sentences
In South Africa, payment fraud averages 1 to 3 % of revenue between fake proofs, abusive disputes and SIM swap. The golden rule: never confirm an order from a screenshot, only from a server-confirmed webhook. A well-tuned anti-fraud module pushes losses below 0.5 %, for an ROI often above 5 to 1.
The most common frauds and their counters
Each fraud type has a simple, low-cost counter-measure.
| Fraud type | Vector | Recommended control | Effectiveness |
|---|---|---|---|
| Fake proof | doctored screenshot | server webhook only | ~95 % |
| Friendly chargeback | "never received it" | signed delivery proof | ~80 % |
| SIM swap | number takeover | 2FA + SIM-change alert | ~70 % |
| Stolen card | no 3DS | mandatory 3-D Secure 2 | ~85 % |
| Multi-account/promo | code abuse | velocity checks + caps | ~75 % |
| Abusive refund | fake return | traced return policy | ~60 % |
The most cost-effective measure remains the server-side webhook: near-zero setup, it eliminates proof fraud, the most common kind.
The ROI of an anti-fraud module
2026 order of magnitude for a South African store doing R 3,000,000 revenue/year.
| Item | Without module | With module |
|---|---|---|
| Fraud rate | 2.5 % | 0.4 % |
| Annual loss | R 75,000 | R 12,000 |
| Module cost (setup) | 0 | R 8,000 to R 20,000 |
| Recurring cost | 0 | R 400/month |
| Disputes/month | 8 to 12 | 1 to 3 |
| Net saving year 1 | — | ~R 38,000 |
From year 2, the net saving exceeds R 55,000/year as setup is amortised. The higher the revenue, the better the ratio.
Mini case study
Thabo, who runs an electronics store in Johannesburg, lost ~3 % of his R 2,250,000 revenue, i.e. R 67,500/year, mostly to fake mobile-payment proofs. After enforcing server-webhook validation, adding velocity checks (max 3 orders/hour/number) and a R 15,000 cap, fraud dropped to 0.5 % (R 11,250). Net gain: ~R 56,000/year for a R 15,000 module paid back in under 4 months.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Why not trust payment screenshots?
A screenshot is trivially faked in seconds. Only the operator/PSP webhook (server-side) proves a payment was actually credited. It is the first measure to deploy.
What is a velocity check?
It is a limit on attempt frequency (e.g. 3 orders/hour per number or card). It blocks automated attacks and promo abuse without bothering legitimate customers.
Is 3-D Secure useful?
3DS2 mainly covers cards; it cuts card fraud by ~85 % and shifts liability. For mobile payments, the priority is webhooks and per-account caps.
How much does fraud really cost?
Expect 1 to 3 % of revenue unprotected. On R 3,000,000 that is R 30,000 to R 90,000 lost per year.
What is SIM swap and how do I guard against it?
It is taking over a number to intercept codes. Guard against it with robust 2FA and an alert on the customer's SIM-card change.
Let's talk about your project. We audit your payment flows and deploy an anti-fraud module tuned for mobile and card. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
