MATERIAL OBSERVATIONS · 11 AUGUST 2026
Practical answer
Stop before logging in or paying. Copy the hostname, preserve the message or advert that led there, and compare the legal entity, licence, province and domain with current NGB and provincial records. Contact the genuine operator through a separately verified route. If credentials or money were exposed, contact the bank immediately.
| Signal | Why it matters | Verification step | Do not do |
|---|---|---|---|
| Lookalike hostname | One character can route to another owner | Compare the full hostname with primary records | Do not trust the logo |
| Copied licence badge | Images can be reused | Match number, entity, province and domain | Do not search the number only |
| Message-only support | Impersonators control the conversation | Reach support from the typed official domain | Do not share PINs |
| New beneficiary | Money may leave the expected route | Check recipient in the banking app and terms | Do not send a test amount |
| Urgent unlock fee | Pressure suppresses verification | Confirm against authenticated terms and bank guidance | Do not pay another transfer |
Freeze the route before it disappears
Copy the full URL, including subdomain and path, and note the source that delivered it. Preserve the advert, SMS, WhatsApp message, email headers or social profile. Do not continue clicking around merely to collect more screenshots; every login or download can increase exposure. A browser capture should show date and address where possible, while sensitive fields remain hidden.
Use another device or clean browser session to type the known brand address and locate legal terms. Compare company names, licence wording and contact details. A clone may reproduce every visible word, so independent records and a separately reached support channel carry more weight than design.
Match identity through official records
The NGB verified-operator portal rechecked on 11 August 2026 is the national starting point. Search the trading and legal names, then compare the exact hostname and province. The NGB FAQs, accessed 9 August 2026, explain the provincial licensing structure, so the issuing board should resolve any uncertain domain or licence reference.
A missing match is a reason to pause, not proof of fraud. A conflicting entity or copied number is an observation to report. Preserve both the suspect claim and the official record used for comparison, including their access dates.
Recognise the payment and support pattern
The FSCA payment-scam warning, accessed 9 August 2026, describes advance-fee and bank-transfer scam patterns. An unsolicited contact demanding another payment before winnings or a withdrawal can be released should trigger a stop and independent verification.
Nedbank’s deposit and refund scam guidance, inspected 11 August 2026, adds context around fake proof of payment and refund pressure. Do not rely on an image of a banking confirmation; verify movement in the actual account.
Respond according to the harm
If credentials were entered, change the password from the genuine service and anywhere it was reused. If bank credentials, card details or an OTP were exposed, call the bank’s verified fraud channel. If money moved, give the bank the beneficiary, reference, amount and timestamp immediately. Do not delay bank action while waiting for an operator reply.
Report the suspect route factually to the genuine operator and appropriate authority. State the exact URL, how it arrived, what it displayed and what was sent. Avoid publishing identity documents or claiming a named person committed fraud without an official finding. A careful incident record is more actionable than a broad accusation.
| If exposure occurred | First recipient | Evidence to keep | Privacy rule |
|---|---|---|---|
| Password entered | Genuine operator and reused-password services | Hostname, time and security alerts | Never forward the password |
| Bank credentials entered | Bank fraud channel | Session time, URL and transaction alerts | Keep PIN and OTP secret |
| Transfer sent | Bank immediately | Beneficiary, reference, amount and confirmation | Share redacted copies publicly |
| Identity document uploaded | Operator, bank and relevant reporting route | Document type, upload address and time | Watch for later impersonation |
| Clone still live | Operator and appropriate authority | URL, advert source and dated capture | State observations, not accusations |
Close a clone incident without destroying evidence
Create a read-only copy of the original chat, email or advert and record the suspect hostname as plain text. Note which device was used, what information was entered and whether the browser downloaded anything. Do not circulate a live phishing link to friends for confirmation. A redacted image or safely written hostname is enough for most initial reports.
Track every containment action: password changed, sessions ended, bank called, card blocked, operator notified and authority report submitted. Record reference numbers and advice received. If no money moved, say so. If the genuine operator confirms that the route is not theirs, preserve that response as an operator statement and still let the competent authority decide any formal finding.
A clone report should never expose the victim twice. Remove identity numbers, full bank details, passwords, one-time PINs and unrelated messages from working copies. Keep originals private for the bank or investigator. Update the record if the domain disappears or an authority publishes a notice, but retain the first dated observation.
Recheck the suspect address only through safe institutional processes; a punter does not need to revisit it to prove that it once existed. If an archive or authority later preserves the domain, record that source and date separately. Disappearance may follow many causes and is not, on its own, proof that a scam finding was made.
Review method and evidence limits
The clone checklist combines NGB primary records, NGB jurisdiction guidance, an FSCA official warning and first-party bank fraud guidance recorded between 9 and 11 August 2026. It describes observable patterns and response actions without identifying any unproven perpetrator.
Questions South African punters ask
Can a fake betting site use a real licence number?
It can display copied text or an image. Verify the number together with the entity, exact domain, province and product scope.
Is HTTPS proof that a betting site is genuine?
No. Encryption protects a connection to a hostname; it does not establish who operates that hostname.
What should I do after entering my bank login?
Contact the bank through a verified channel immediately, change exposed credentials and keep the suspect URL and timestamps.
Should I pay a small fee to test a withdrawal?
No. Stop and verify any extra payment demand against authenticated terms and official scam guidance.
Does a domain mismatch prove fraud?
Not by itself. It is a serious hold point that requires operator and regulator confirmation.
Source docket
- ZA-S01 · National Gambling Board: recorded source. Primary portal; rechecked 11 August 2026.
- ZA-S02 · National Gambling Board: recorded source. Primary jurisdiction guidance; accessed 9 August 2026.
- ZA-S08 · Financial Sector Conduct Authority: recorded source. Official scam warning; accessed 9 August 2026.
- ZA-S25 · Nedbank: recorded source. First-party bank fraud guidance; inspected 11 August 2026.
Continue with the scam-warning hub, the fake-support response guide or the full review method.