Picture this. You hop out of an Uber, get home, and only then notice your phone is gone. A Western Cape man lived that nightmare, and it cost him R19,800. The National Financial Ombud Scheme (NFO) has now said Nedbank isn’t to blame, which leaves him carrying most of the loss himself.
The case is a useful warning for anyone who banks on their cellphone. Here’s what happened, what the ombud decided, and what you can do so it doesn’t happen to you.
What happened on 25 January 2026
The man took an Uber trip on 25 January 2026. It ended at around 1.53pm. Within moments he knew his phone was still in the car, but the driver had already pulled away. He says he tried to call the driver straight afterwards and got no reply.
Then things went quiet for a while. The first suspicious transaction only appeared at 5.41pm, nearly four hours later. In the next half hour or so, criminals made six payments from his account, adding up to R23,800. The last one went through at 6.13pm.
A simple breakdown looks like this:
| Type of transaction | Amount |
|---|---|
| Send money (two payments of R2,500) | R5,000 |
| Prepaid vouchers (two purchases of R2,500) | R5,000 |
| Payment to an Access Bank account | R9,800 |
| Payment to another Nedbank account | R4,000 |
| Total | R23,800 |
When the bank was told
The man reported the problem to Nedbank at about 8.47am on 26 January, the next morning. The bank suspended his banking profile after that.
Nedbank says it reached out to Flash and Access Bank to try to claw the money back. It managed to recover R4,000. That’s why his final loss is R19,800 and not the full R23,800.
The man’s questions about bank security
He wasn’t willing to just accept the bank’s explanation. He said he never approved any of those payments, and he wanted to know how someone got into his Nedbank Money App in the first place.
By his account, he’d done the right things. His phone was locked with biometrics, with a PIN as backup. He’d never shared that PIN or written it down. He hadn’t saved his banking passwords on the device. And the app had an extra layer of two factor authentication.
He also asked a fair question about the bank’s own systems. Several payments and voucher purchases in a short window looks odd. Why didn’t alarms go off before the money left?
There was one more detail. Another person had told him about a very similar case, with a phone left in an Uber two days before his own. He wondered if criminals might be targeting passengers. The documents, however, did not show that the two cases were connected.
What Nedbank told the ombud
Nedbank’s position was straightforward. The payments were made through the man’s existing profile and login details, after criminals got hold of his phone.
The bank said it found no sign of a password reset or a SIM swap before the payments. Its records showed the Money App had been set up on a Samsung phone back on 22 April 2025.
The bank also put a once off goodwill payment of R9,700 on the table. The man said no. He felt it came without any admission of fault, and he would have had to sign away his rights in a full and final settlement. Nine thousand seven hundred rand also fell well short of what he’d lost. By the time the ombud made its ruling, that offer had expired.
What the ombud decided
The NFO weighed up both sides. It accepted that, on a balance of probabilities, fraudsters used the stolen phone to get into the app.
It also pointed out that all six payments happened before the man told the bank about the theft. There was no evidence that Nedbank’s systems had been hacked, and nothing to suggest bank staff were involved.
In its assessment dated 24 June 2026, the ombud found no negligence and no maladministration on Nedbank’s part. It agreed the timeline suggested the man’s login details had been compromised. But it said it simply couldn’t work out how, when or where that happened. It added that login details can be stolen days or even weeks before any money moves, so pinning down the exact moment is hard.
Where the stolen money went
The ombud’s assessment also showed how quickly the cash vanished.
The R9,800 landed in the Access Bank account at 6.40pm. Withdrawals started a minute later and carried on until 7.55pm that same evening. The two send money payments, made at 5.41pm and 5.48pm, were already cashed out by 5.53pm and 5.54pm.
So a large part of the money was gone long before Nedbank had any idea something was wrong. That gap is exactly why reporting a stolen phone quickly matters so much.
Why the ombud pointed to the account holder
The ombud described the man as a victim of crime. Because of that, it said his claim for repayment belongs against the person who received the money, not against his bank.
Chasing or prosecuting that person isn’t something the ombud does. Its job is to settle disputes between banks and their customers, nothing more.
Can the man still get his money back?
He might, but it won’t be quick. The ombud said he can take legal action against the owner of the account that received the funds.
Here’s the catch. Banks can’t just hand over another customer’s details, because of banking confidentiality. He’d first need a subpoena under section 205 of the Criminal Procedure Act, which forces the bank to share the account holder’s information.
The ombud also made clear he is not bound by its finding. A court may be a better place to sort out disputed facts, particularly where oral evidence or expert testimony is needed. The matter is closed for now, but the NFO said it would look again if he brings new, relevant and substantial information.
What this means for South African bank customers
This isn’t a one off. Only days earlier, a similar story came out involving another bank and a stolen phone. With so many of us banking from our phones, the lesson is hard to miss. Your phone is basically your wallet.
The good news is that some protection is easy. If your phone goes missing, call your bank immediately and ask them to block your profile and cards. Use someone else’s phone to change your banking passwords. Ask your network provider to block your SIM, and open a police case as soon as you can, because you’ll need it for any dispute.
Keep your own notes too. Write down the times you called, who you spoke to and any reference numbers. If this ever ends up in a dispute, that paper trail makes your story simple to prove.
It also helps to keep your app transaction limits low. It’s a simple habit that can cap the damage if the worst happens. And try not to save PINs or passwords in your notes app or in messages.
If you can’t sort out a problem with your bank, you can approach the National Financial Ombud Scheme through its official site, nfosa.co.za. The service is free, and it’s easy to lodge a complaint. For tips on spotting and avoiding banking fraud, the South African Banking Risk Information Centre has useful advice at sabric.co.za.
Key lessons from the ruling
First, it’s hard to blame a bank when criminals use real login details and there’s no sign of a hack. The ombud works from evidence, and a loss that feels deeply unfair isn’t enough on its own.
Second, minutes matter. The thieves here turned parts of the money into cash within the hour. Every minute you wait after losing a phone helps them.
For now, the man is still out of pocket. His best shot at getting the money back may be a long legal road.
About the Author
