Your phone beeps. Someone you’ve never heard of has taken R99 out of your account. You phone your bank. They tell you that you can dispute it, for a price. Then you say, “How can you just give my money away like this? Prove that I agreed to this deduction!”

And the bank replies, “Not our problem. It’s between you and your service provider.”

You probably shout, “What service provider? I don’t know these people! Show me where I signed!”

And the bank says, “It’s not our responsibility to verify mandates.”

You are furious, and maybe you pay the dispute fee. And then it happens again next month.

But why, you wonder, do the custodians of your money have so little interest in protecting it for you? It becomes blisteringly clear when one follows the money.

“After a huge Twitter outcry in December 2017, FNB and Standard Bank “generously” decided to waive fees for disputed debit orders in February 2018” In FNB’s case, only for amounts under R200. And if the “service provider” does end up having a “mandate”, FNB will bill you R130 for a wrongful dispute. EDIT: A Standard Bank client on Twitter pointed out that Standard Bank has never charged for debit order disputes within the 40-day window. This appears to be true from this article, for amounts under R200. Outside of the 40-day window, they charge R290 if the mandate is valid.

Capitec still charged R20.18 to reverse with their app, but dropped it to R5.00 by January 2019. Nedbank now charges R5.00, and Absa has been free through their online portal since 2015. EDIT: An Absa client on Twitter states that Absa told him recently that the online dispute functionality is new. S/he says that the functionality is not available on the app, and that s/he recently disputed 8 rogues amounting to R780 in-branch, and was charged R310.64 in combined fees.

In the previous paragraph, the banks’ names link to the fee structures for a cheap account, which I used to compare them. I averaged the various fees across all five banks for the calculations below,  since they all ended up very close to the averages. A spreadsheet of my calculation and sources is available here.

More expensive account bundles tend to include a number of free transactions, and their value has improved steadily since about 2015. Back then everyone still charged R10 – R15 for an external debit order, and now no-one is above R6. Might it have something to do with the exponential increase in rogue debit orders?

The Payments Association of South Africa (PASA) said in September 2017 that there had been about 13.248 million NAEDO disputes and 4.777 million ordinary debit order disputes in 2017. The rest of the figures in the presentation don’t quite gel with the graphs in their Annual Report, probably because the presentation was before the end of the financial year.

Of the disputes, 2 971 were judged to have flawed or missing mandates, and the companies who presented the debit orders were fined R1 000 per debit order. So PASA, or someone, got a cool R2.971 million rand, for finding wrong-doing in 0.017% of the cases.

PASA says that it is impossible to tell how many debit orders are disputed for cash flow reasons.

For example, you fell behind last month, and your car financing company “helpfully” pays a few extra rand to spy on your bank account for up to 32 days so that they can pounce as soon as there’s any money in there. But you were planning to settle some, or all, of the arrears, early next month, after the rest of the bills are squared. Except you can’t, because of NAEDO. So you dispute the extra payment which came through before the agreed date. That is naughty of you. But I believe NAEDO is much, much naughtier.

PASA received R61m in member contributions in 2017, up from R30m in 2016. Probably to cover the 55% increase in employee costs. Did we mention the members are all banks? Well, yes.

So how did the other 18 022 575 disputes work out for everyone else?

When dealing with a rogue debit order, your options are:

1. You dispute it and it gets reversed

The Fraudster pays a payment gateway company like these guys a fee to process your debit order for R99.00. (R6.45 success fee + R2.75 tracking fee = R9.20 excluding VAT).

You pay between R3.73 and R5.55 for the debit order. You pay another 40c up to R1.11 for the SMS notification.

You phone up your bank to argue. Heaven knows how much the airtime costs you. The bank charges you between 0 and R5.00 to reverse the debit order. You get your R99 back.

The Gateway charges the Fraudster R10.25 for the dispute.

Who wins?

Fraudster:  – R22.37. Gateway: R22.37 Bank: 17.75 You:  –  R17.75

More, if your bank also charges you for the SMS confirming that the debit has been reversed.

But nobody does anything and the Fraudster can try again next month, or next week.

If you try to block it, it’ll cost you between R5.35 and R60.00. But, next time, the Fraudster presents it with a slightly different description and a slightly different value, which renders the block useless and you end up paying the R17.75 anyway. All the banks promise that these fees will be reversed if the debit order is proven to be a rogue, but a conviction rate of 2 971 out of 18 million probably means that no-one is following up.

Except in the cases where the Fraudster gets fined that R1 000, which then goes to PASA and sits in the liabilities section of their balance sheet. Who knows to whom it’s owed.

The Fraudster only goes on the naughty list for three months, during which he only debits those of us who haven’t disputed yet. Money for jam.

2. You don’t notice it or don’t dispute it

The Fraudster gets R99.00, and pays the Gateway R10.58. Your bank charges you the debit order fee and the notification fee.

Fraudster:  R88.42 Gateway: R10.58 Bank:  R5.19 You:  –  R106.80

3. You don’t have money and it bounces

The Fraudster pays the Gateway around R3.10 as a declined fee and the R2.75 tracking fee. R6.73 including VAT.

Your bank charges you the debit order fee, the notification fee, and between R5.55 and R26.00 because the debit order bounced.

Fraudster:  –  R6.73 Gateway:  R6.73 Bank:  R16.47 You:  –  R16.47

So how much is all this costing South Africans?

That takes some detective work, and requires statistics from here (pages 8 and 33), and here (graph at the bottom). They’re not all based on the same time periods, but they’re close enough to each other to give a good estimate.

The short, and very conservative answer looks like this. The amounts are in millions (Rm’s).

Assumptions:

  1. 1 in 20 bounced (unsuccessful) debit orders are fraudulent.
  2. Half of disputed debit orders are fraudulent.
  3. 1 in 200 successful debit orders are fraudulent.
  4. All fraudulent debit orders are for R99.

This is the best case scenario, in which fraudsters break even if they have to give back all the money for disputed debit orders. That’s how the number for successful fraudulent debit orders was calculated.

Everybody wins, except the customer. Even SARS gets its pound of flesh. Why on earth would they want to stop such a lucrative cottage industry?

In October, one company presented 400 000 debit orders of R99. One bank smelled a rat and reversed 150 000 of these automatically. Capitec later reversed 25 000 and the bank charges associated with them, but it may not necessarily be from the same batch.

Think of it. Four hundred thousand of us are on a single list for fraudulent debit orders. According to PASA, there are 4 600 user companies in the debit order payment system. Do you think there is only one list?

DebiCheck will make all of this so much better, PASA promises. Except that DebiCheck only replaces NAEDO transactions, and it’s voluntary. The fraudsters won’t be able to NAEDO us any more, but hey, putting through a fraudulent EFT debit order is cheaper for them, so they’ll make more money.

All this regulation to police legitimate service providers, at a cost of only R4 billion, from an industry whose five biggest players declared R71 billion in fee income for 2017 alone. But, meh.

So what can I do?

  1. Put down the phone immediately if somebody phones you up and tells you your full ID number and bank details. Start following up how those details leaked, and be extra careful in future.
  2. Put down the phone if anyone tries to sell you vouchers or holiday clubs or whatever, if they talk really fast or try to confuse you or won’t take a polite ‘no’ for an answer. Shout “No, I don’t!” repeatedly, if you must.
  3. Practise saying “I understand,” instead of “Yes,” or “Ja,” or “Ee”, when you’re listening to a sales pitch.
  4. Go through your bank statements. Every month. It’s scary to realize how much you spend on take-aways, or bank charges, or Uber, but do it anyway. You won’t find the Fraudsters otherwise. (You also won’t realize that the cellular network is still charging you for a device that you paid off last year, because you didn’t take the ‘upgrade’ and went into an ‘evergreen’ contract.)
  5. Phone your bank and get the Fraudster’s telephone number and “Abbreviated Short Name”. Shout if you have to.
  6. If your bank says it’s the same company every time, but the descriptions and amounts vary, make a note.
  7. Log a dispute with your bank, if you can afford to.
  8. Phone the “service provider”. If they answer, insist on a copy of their mandate. Shout if you must.
  9. Read or listen to the “mandate”. It might not be your signature, or your handwriting. This lady received a voice recording of a complete stranger rattling off her personal details.
  10. Put all your notes, abbreviated short names, and any discrepancies from month to month, on an e-mail to DOA@pasa.org.za (Debit Order Abuse). They say you should exhaust bank and “service provider” channels first. That sounds like R2.97 million, for no work, to me.
  11. If you want, send me a copy of your info: Radical[at]Radical.org.za. I am going to start collecting the names of the fraudsters.
  12. A company who harasses you via phone or SMS for a debt you don’t remember, or are sure you paid off, is a debt farmer who is trying to bully you into acknowledging a debt that probably doesn’t exist or has prescribed. Do not agree to pay anyone called “XYZ Attorneys on behalf of Vodacom / Truworths / Woolworths / TV Licences” anything, no matter what. They buy written-off debts for a few cents in the rand, and are trying to recover them for their gain. I have proof that the providers who sell debts often use older balances, so even if you did clear the debt, the debt farmer doesn’t know that.

No-one cares about your money more than you do. Pay attention to your bank statements, even when they’re scary. Answer phone calls from your creditors, the decent ones are surprisingly helpful and sympathetic.

If a thousand of us, on Twitter, got hit by three debit orders, every two months, for a year, and only disputed half of them, this is who wins. Amounts are in rands.

That’s R1 097 for each of us.

And the fraudsters walk away with R594k if they give back all the disputed money.

The remainder of the article is a mathematical attempt to predict the extent of the crisis. The reality is probably 3-4 times worse for customers.

How a dispute apparently works, according to this and this, is that your bank reverses the transaction immediately if you dispute within 40 days. They say they’ll give back your R17.75, too, if your dispute is valid. But they don’t seem to follow up on mandates unless you dispute after the 40-day window, which costs more.

Your bank then bills the Bank who sponsored the Gateway that processed the Fraudster’s transactions. (Needless layers to provide opportunities for graft, anyone?) The sponsor bank must do what it can to recover the money that your bank refunded to you.

18 million disputes means around that many have been reimbursed to customers by banks. At only R99 each, R1.8b worth of reimbursements (2.5% of the 2017 transaction income for the Big 4 and Capitec) must be recovered by banks from merchants, fraudsters, or payment gateways, or the sponsoring bank must absorb the loss. Reputable merchants should co-operate willingly, since they have valid mandates and will be able to recover the amount later, once they have engaged with their client. If only ten percent of disputes are frivolous and valid mandates can be furnished, R180m should be recoverable from customers. The fact that mandates are not even pursued suggests that PASA and banks are well aware that the proportion of frivolous disputes can be disregarded.

This is how much should be recoverable from customers at a given percentage of valid disputes:

I think it’s safe to say that invalid disputes are less than 10% of total disputes.

Also, given the 400 000 rogues horror story from October, it’s likely that somewhat more than 1 in 200 fraudulent debit orders are honoured.

Given that Standard Bank didn’t answer questions about their Gateway, or volunteer any information about how many of the 400k were reversed, we should worry about the other 225k. That’s more than half. Predicting total fraudulent debit orders at 1 in 50 seems conservative.

Add to that, that only 18m disputes are logged out of 523m (3%), it’s also likely that there is a similar percentage that is not being disputed, despite being fraudulent. Particularly since Capitec seems to think that many are not noticed.

What about fraudulent debit orders that bounce?

EFT debit orders, with a bounce rate of 9.7%, are a fairly accurate indication of how many debit orders bounce when the deduction happens on the expected date, ie the date customers contracted for. Their average amount is more than double the average NAEDO amount, so they are for big expenses. Only 1.3% are disputed.

NAEDO debit order bounces, at 24.5%, are likely spectacularly overstated because they can be repeated twice a day and are sneaked in where they have no contractual right. 9.3% are disputed. If PASA is unable to suggest a proportion of invalid disputes, I propose that the percentage difference between bounced NAEDOs and bounced EFT debit orders be considered fraudulent, or at least premature. I have evidence that service providers are able to process NAEDOs ahead of the contractual due date even when the account is not in arrears.

And when I add all of those into the following result, I’m still saying that every fraudulent debit order is R99. Who knows how many wealthy people don’t query R299 and R699 debit orders. Who knows how many maxed-out customers are afraid to look at their bank statements.

Fraudsters: R633m (if they give back all disputes in return for a slap on the wrist)

Banks: R763m (unless they really are as clueless about finding fraudsters as they say they are when we dispute)

Gateways: R579m

Customers: -R1 618m

SARS: R235m.

Mr Mboweni, we have a problem.

Jo-Anne Stolp is an independent solutions consultant that believes opaque pricing by banks and mobile providers are disproportionately penalizing poor consumers. She feels that “it’s the way it’s always been done” is not an adequate excuse.