How the SRD Grant System Has Been Defrauded

Massive numbers of fraudulent applications prevent people who genuinely need the Social Relief of Distress Grant from applying for it.

• We have previously reported that the Social Relief of Distress (SRD) grant system is being defrauded.
• Here we explain how weak computer systems at the South African Social Security Agency (SASSA), Shoprite and TymeBank allowed large numbers of fraudulent grant applications to be made.
• Shoprite and TymeBank have taken measures to reduce the risk of fraud. SASSA says it has also taken steps to reduce fraud. Their responses are at the bottom of this article. But concerns remain.

The SRD grant was introduced during the Covid pandemic to assist people in dire need. About nine-million of these R370 grants are paid out monthly now. It is potentially the basis for a universal basic income grant.

Activist Israel Nkuna has for years been warning of fraudulent applications for the SRD grant, and that these fraudulent applications have been squeezing out legitimate applicants by using their ID numbers without permission. GroundUp too has reported this problem. Then in October we published an article by Stellenbosch University students who discovered a massive number of fraudulent applications for the SRD grant, and evidence that at least some of these fraudulent applications were succeeding.

Since then it has become clearer to us how the SRD grant system has been defrauded at scale. It involves six steps.

• First, obtain ID numbers and their associated names from one of the various large leaks of South African data.
• Second, open improperly verified accounts with Shoprite or TymeBank, or possibly some other banks as well. This could be done on a laptop or phone without leaving one’s home. Shoprite and TymeBank have in recent months tightened up their bank account application processes, so fraudsters can no longer continue to do this.
• Third, obtain improperly verified sim cards. This is easily done by simply going to a local dodgy cellphone shop. But until recently it could even be done entirely online by registering free electronic SIM cards through me&you mobile. This too has since been stopped.
• Fourth, use the ID number, telephone number and bank account obtained in the first three steps to apply for an SRD grant.
• Fifth, wait for the grant to be paid into the account opened in step two. As far as we can tell every month SASSA sends ID numbers of applicants to the banks, SARS and NSFAS to check if applicants pass the means test. If the applicant isn’t paying income tax, doesn’t receive money from NSFAS and has income to their bank account less than R625 per month, the grant is paid.
• Sixth, launder the SRD money by transferring it out of the bank account. There are various ways to do this, which we do not describe here.

Doing the above for one SRD grant is not worth the effort. But a determined fraudster or group of fraudsters could make dozens or even hundreds of applications a day. At one point it was possible to carry out the entire process described above using only a laptop. It would also be possible to write a computer program to automate the process, but such sophistication would be unnecessary: going to a shop to buy sim cards and manually making lots of applications would be very profitable.

As far as we can tell it is no longer possible – or at least no longer easy, to make new fraudulent applications. But it’s likely that many fraudulent applications made for years after the grant was introduced are still passing the monthly means test and receiving SRD grants.

SASSA needs to act

SASSA, together with companies that have received large numbers of SRD grants like TymeBank and Shoprite, can take at least these steps to prevent this fraud:

• Insist banks only accept SRD grants for biometrically verified people who have been validated with a fingerprint or facial scan.
• Remove third-party access to the SASSA grant application system, except to authorised institutions that have a legitimate need to access the system. (SASSA says it has now done so.)
• Limit the number of requests a single computer device can make to the SASSA website so that programs making tens, hundreds or thousands of requests to it per second fail. (SASSA says it has now done so.)
• Audit all current SRD grant applications to identify the scale of the fraud, remove fraudulent applications — identifying these might be difficult — and insist that suspicious applications undergo verification. (SASSA says an audit “would not assist”. But TymeBank says it is “conducting an analysis of transacting behaviour on accounts opened prior to August 2024 that receive grant payments to identify those that are non-legitimate grant beneficiaries”.)

While we do not have enough information to quantify it, we suspect the scale of SRD fraud is very large. Not only does this bleed money from the social grant system, every fraudulent application using someone else’s ID potentially denies a legitimate SRD grant recipient the possibility of getting the grant because their ID number is being used by someone else. At best, someone who is a victim of ID fraud has to navigate their way through a horrible bureaucratic process to undo the fraudulent application.

© 2024 GroundUp. This article is licensed under a Creative Commons Attribution-NoDerivatives 4.0 International License.

You may republish this article, so long as you credit the authors and GroundUp, and do not change the text. Please include a link back to the original article.

We put an invisible pixel in the article so that we can count traffic to republishers. All analytics tools are solely on our servers. We do not give our logs to any third party. Logs are deleted after two weeks. We do not use any IP address identifying information except to count regional traffic. We are solely interested in counting hits, not tracking users. If you republish, please do not delete the invisible pixel.