South Africans received an estimated 17.47 billion spam calls in the first half of 2026 — about 96 million a day — according to data presented at the Truecaller Critical Thinking Forum in Johannesburg.
The volume was 25.2% higher than in the same period last year and placed South Africa among the world’s 10 most spam-targeted markets. It has also contributed to a wider breakdown in trust: many people no longer answer unknown numbers, legitimate businesses struggle to reach customers and criminals use the noise created by unsolicited communication to disguise scams.
Hosted by Truecaller in partnership with the Mail & Guardian and the Gordon Institute of Business Science (GIBS), the forum examined how technology, regulation and cooperation between industries could offer South Africans stronger protection.
The panel brought together Truecaller director of market development for South Africa Mmathebe Zvobwo, Acting National Consumer Commissioner Hardin Ratshisusu, Communications Risk Information Centre chief executive Thokozani Mvelase and Internet Service Providers’ Association chair Sasha Booth-Beharilal. Broadcaster Joanne Joseph moderated the discussion.
Presenting Truecaller’s data, Zvobwo said the company had also identified an estimated 3.71 billion spam messages during the first six months of 2026, a year-on-year increase of 58.9%.
The South African figures were extrapolated from Truecaller’s platform data to the country’s wider mobile subscriber base. Its data showed that close to three in every 10 unknown calls in South Africa were spam.
There was some evidence that people were becoming more alert to the threat. The proportion of spam calls answered fell from 10.2% in the first half of 2025 to 7.8% in the corresponding period this year. But people ignoring calls is not, on its own, a solution. It also prevents legitimate communication and leaves businesses searching for other ways to establish their identity.
How spam gives scammers cover
Booth-Beharilal said it was important to distinguish between spam and scams. Spam is generally unwanted or unsolicited communication and often raises questions about consent. A scam is a deliberate attempt to deceive someone into handing over money, information or access.
The link between them is that criminals can imitate the messages consumers already receive from legitimate businesses.
“A very smart scammer will use spam,” Booth-Beharilal said.
A fraudulent bank notification, traffic fine or delivery message is more difficult to spot when it appears among dozens of similar communications. The link in the message may lead to a fake website designed to collect banking or personal information.
The financial losses are significant. Figures presented from the Global Anti-Scam Alliance’s 2026 South African study estimated that eight million adults lost a combined R59.7 billion to scams over 12 months.
The study, based on a survey of 1,280 adults conducted between March and April 2026, estimated an average loss of R7,442 and a median loss of R1,368. More than half of those who lost money had been victimised more than once, while only one in four victims who reported a loss recovered anything.
Mvelase warned that smaller individual losses should not be read as evidence that the threat was receding. Criminals could remain below the radar by stealing modest amounts from a larger number of people.
“There are people who are in the business of committing crime. We are in the business of defending against it,” he said.
The economics often favour the criminals. Artificial intelligence, automated dialling and voice-over-internet protocol services allow thousands of people to be targeted at little additional cost. Network defence and criminal investigations, by comparison, require sustained investment and specialised skills.
Criminals also exploit human behaviour. Social engineering relies on urgency, fear, financial pressure or trust in a familiar institution to persuade a person to act before checking whether a communication is genuine.
Caller-ID spoofing can make a fraudulent call appear to come from a recognisable number, while AI-generated voices make impersonation more convincing.
“Seeing is no longer believing,” Zvobwo said. “Just because you see it, it doesn’t mean it’s real. Just because you hear it, it doesn’t mean it’s real.”
Technology identifies the networks behind the calls
Truecaller said it uses artificial intelligence, network signals and reports from its users to identify suspicious activity and links between fraudulent calls. Shared devices, scripts and patterns across groups of numbers can expose a wider network rather than only one offending number.
Its AI Call Scanner is designed to detect AI-generated voices during calls. Other protections include caller identification, fraud-network detection, impersonation protection, family protection and tools that check suspicious messages, links and telephone numbers.
Truecaller said it flagged 6.9 billion suspected fraud attempts globally during the first seven months of 2026. Its systems were stopping an estimated 115 million fraudulent calls and messages each week, up from 60 million a week in 2025.
Reports from Truecaller’s users form part of this detection system, giving the company signals that can be compared across numbers, networks and countries. But the panel agreed that the information needed to stop scams remained spread across different parts of the system.
A network operator may notice unusual traffic, a consumer may recognise a suspicious message and a bank may identify an irregular transaction. The problem is that this information is not always shared quickly enough to stop money from being stolen.
Mvelase said telecommunications companies, banks and technology platforms operated under different laws, licence conditions and privacy requirements. These restrictions can delay the exchange of fraud intelligence.
An operator may know that a number has recently undergone a SIM swap, for example, but alerting a bank before a transaction takes place requires an agreed, lawful and secure process.
“Fraudsters don’t need any law to do anything,” Mvelase said. “They operate between the various systems without any safeguards that they need to worry about.”
Prepaid SIM registration is another weakness. Mvelase said the telecommunications industry had adopted a framework that would limit individuals to 10 SIM cards per network operator. There is presently no prescribed limit, he said, making it easier to assemble SIM farms capable of sending large volumes of calls or messages.
He said operators were engaging ICASA, banks and law-enforcement agencies about number allocation and the secure exchange of fraud intelligence.
Blocking suspicious numbers also requires care. Numbers that have been dormant for several months can be recycled and assigned to new customers. If a number has already been marked as spam, its new user may inherit that label. Operators therefore need evidence before disconnecting a number or taking other action against it.
Businesses must communicate more securely
Booth-Beharilal said consumers could report spam through industry bodies such as ISPA and the Wireless Application Service Providers’ Association, use blocking tools built into their devices and report suspected crimes to the police. Those reports help identify patterns that may not be visible from network data alone.
But she said the answer could not be to leave individuals to defend themselves.
“It’s not just about hardening consumers; it’s about empowering,” she said.
Businesses should explain how they contact customers and give them enough information to recognise genuine communication. Industry bodies can also introduce standards without waiting for the slower process of legislative reform.
Truecaller’s data showed that sales and telemarketing calls accounted for 34.6% of identified spam calls in January 2026. By June, the proportion had risen to 61.5%.
Banks moved in the opposite direction. They accounted for 29.1% of identified spam calls in the first half of 2025, but their contribution had fallen to about 3% by June 2026, according to the data presented.
Zvobwo said banks were contributing less to spam calls but remained vulnerable to spoofing and impersonation attacks. This required them to protect their brands and use additional security tools, including secure calling. Consumers also needed to remain alert to scammers attempting to impersonate their banks.
Regulation adds another layer of protection
Ratshisusu outlined the regulatory response. Amendments to the Consumer Protection Regulations provide for a national opt-out registry administered by the National Consumer Commission. Direct marketers will have to register and check their contact lists against consumers’ preferences before contacting them.
“All direct marketers in the country have to register on the opt-out registry,” Ratshisusu said.
Consumers will be able to block particular marketers or opt out of direct marketing more broadly. Ratshisusu said Truecaller’s data could also assist regulators by showing the scale of a problem they could not measure independently.
“We are not able to gather this kind of information on the scale of the problem,” he said. The data could help inform policy, enforcement and the urgency of the response.
The registry will provide another layer of protection, but no single intervention will be enough. Subscriber verification, responsible marketing, consumer reporting, capable law enforcement and secure information sharing all form part of the defence.
Truecaller convened the forum to bring those parts of the system together. Its technology can identify suspicious communication and connections between fraudulent numbers, but banks, operators, regulators and law-enforcement agencies must be able to act on those signals.
“This is a multiplayer conversation,” Zvobwo said. “One of the things we care about is making tomorrow’s communication more efficient, smarter and safer.”
Rebuilding trust will require more than blocking individual numbers. It will depend on whether South Africa can create a communication system in which consumers know who is contacting them, why they are being contacted and what they can do when that trust is abused.