Mediamec A Western Cape man has failed to secure a refund from Nedbank after fraudsters used his stolen cellphone to make R23,800 in unauthorised transactions. With R4,000 recovered, his remaining loss is R19,800.
The National Financial Ombud Scheme South Africa (NFO) found no evidence that negligence or maladministration by the bank had caused the loss. In an assessment dated June 24, 2026, it said the man should pursue repayment from the account holder who received the stolen money.
The incident followed an Uber trip that ended at about 1.53pm on January 25. The man said he realised immediately that he had left his phone in the vehicle, but the driver departed before he could retrieve it. Repeated attempts to contact the driver shortly afterwards went unanswered.
Between 5.41pm and 6.13pm that day, six disputed transactions were made through his banking profile.
These comprised two send-money transfers of R2,500 each, two prepaid voucher purchases of R2,500 each, a R9,800 payment to an Access Bank account and a R4,000 transfer to another Nedbank account.
The man notified Nedbank at about 8.47am on January 26, after which the bank suspended his banking profile. Nedbank said it contacted Flash and Access Bank to try to recover the funds and secured the return of R4,000.
The complainant challenged the bank’s explanation that criminals had accessed his profile using his existing login credentials.
He said his phone required biometric authentication or a backup PIN, which he had neither shared nor written down. He also said he had not saved banking passwords on the device and that his Nedbank Money App had additional two-factor authentication.
In his view, saying his credentials had been compromised did not explain how the security controls were bypassed. He also questioned why several payments and voucher purchases within a short period had not triggered further verification or intervention by the bank.
Nedbank told the ombud that the transactions were made using the complainant’s existing profile and credentials after criminals gained access to his cellphone. It found no indication of a password reset or SIM swap before the payments.
Bank records showed that his Money App profile had been registered on a Samsung device on April 22, 2025.
Nedbank offered a once-off goodwill settlement of R9,700, but the man declined it. He argued that the amount would not cover his outstanding loss and objected to signing a full and final settlement without an admission of liability. The ombud’s assessment recorded that the offer had since expired.
After reviewing both parties’ submissions, the NFO accepted on a balance of probabilities that fraudsters had accessed the Money App through the stolen phone.
It found no evidence that Nedbank’s systems had been hacked or that its employees were involved. Although the events indicated that the man’s credentials had been compromised, the ombud could not establish how or when this happened.
The assessment noted that credentials can be compromised days or weeks before fraudulent transactions occur. It concluded that the available evidence did not establish a basis for holding Nedbank responsible.
The ombud also found that funds had been withdrawn or redeemed before the bank received the fraud report.
Access Bank’s information showed that the R9,800 payment reached the receiving account at 6.40pm on January 25 and was used for withdrawals between 6.41pm and 7.55pm. The two send-money transfers, made at 5.41pm and 5.48pm, were redeemed at 5.53pm and 5.54pm respectively.
The complainant also reported being contacted by someone who described an allegedly similar incident involving a phone left in an Uber two days earlier. He suggested there could be a pattern of criminals targeting passengers, but the documents did not establish a connection between the incidents.
The NFO said investigating or prosecuting the recipient account holder was outside its mandate to resolve disputes between financial institutions and customers.
It advised the man that he could take legal action to recover the money. Because banking confidentiality rules restrict disclosure of account-holder details, the assessment said a subpoena under section 205 of the Criminal Procedure Act would be needed to compel the release of the relevant information.
The complainant is not bound by the ombud’s outcome. The NFO said a court could be better placed to resolve factual disputes requiring oral evidence or expert testimony.
The matter was closed, subject to reconsideration if new, relevant and substantial information emerged that could alter the finding.
