Tech for Humans is our once-a-month email about using technology with less stress: five minutes, a few useful things, no jargon. This is the August issue as it went out to subscribers. This month: the fraud South Africans know better than most, and the five minute defence.
The big one: SIM swap fraud
You can have a strong password and still get cleaned out, because criminals have found a way around the password entirely. They take over your cellphone number.
It works like this: the criminal gathers a few details about you, often from an old data breach or your social media, then convinces your network provider to move your number onto a SIM in their pocket. Your phone drops to "No Service". Theirs starts receiving your calls and SMSes, including the one-time codes that protect your email and your bank account. From there they reset everything attached to your number.
Here is the honest part: you cannot do much about someone sweet-talking a call centre, and South African networks do not offer a lock you can switch on. What you can do, in about five minutes, is make your number worthless to a criminal, so that even a successful SIM swap gets them nothing:
- Move your important logins off SMS codes. Use an authenticator app or a passkey for email, banking and anything with admin rights. The approval happens on your device, not over the network, so your stolen number opens nothing.
- Let your banking app do the approving. Most South African banks can now confirm payments and sign-ins inside their app instead of by SMS. If yours still texts you OTPs, switch the in-app option on in your banking settings.
- Treat a sudden "No Service" as a warning, not a glitch. If your phone goes dead for no reason, phone your bank first, then your network provider.
The direction of travel is clear: SMS codes are on their way out everywhere, and Microsoft has just put a date on it. More on that below.
Online forms and loyalty programmes keep leaking cellphone numbers into breach dumps, which is where SIM swap cons start. A cheap prepaid SIM kept just for sign-ups keeps your real number private. Failing that, simply stop typing your number into forms that do not truly need it.
Worth knowing this month
Microsoft is switching off SMS codes. From 1 September, passkeys become the default way into Microsoft 365, and from 1 February 2027 Microsoft retires SMS and voice codes entirely: anyone still relying on them will have to register a passkey before they can sign in again. We have been quietly ahead of this one for a while, moving client accounts off SMS codes and onto Microsoft Authenticator or better.*
* We do this proactively for managed clients on Microsoft 365 Business Standard and above, as part of our support plans.
Update Chrome today. Google patched a flaw criminals were already using before the fix existed. Fully close and reopen Chrome on every machine; version 149.0.7827.102 or later is the safe one.
Copilot can now work on its own. Microsoft's Copilot can take on multi-step jobs across your apps and hand back a finished result. It is switched off by default and admins can cap spending per person, so it is worth deciding how your team uses it before someone just switches it on. That decision is the kind of thing we help with.
The number: 26%
More than a quarter of sign-ins worldwide now use a passkey instead of a typed password, and 93% of accounts are already eligible for one. No password means nothing to steal, and a stolen phone number does not help either. We wrote a plain-English explainer: what passkeys are, and where a small business starts.
Thanks for reading. See you next month.
Ray