South African tender fraud — live feed

A fraudster registers a domain that resembles a real department (extra words, hyphens, or a .com instead of .gov.za) and emails an RFQ that looks official.

From: procurement@treasury-gov-za.com — "Kindly quote for the attached tender. Submit to this email only."

• ⚑Domain is not the real .gov.za address
• ⚑Hyphenated or .com version of a known entity
• ⚑Replies routed to a different address than the sender

An "official" creates time pressure ("close of business today") and, once you respond, sends updated banking details for payment or a deposit.

Reply: "Please note our banking details have changed. Use the account on the attached letter for this order."

• ⚑Unusual urgency or same-day deadline
• ⚑Banking details change mid-conversation
• ⚑Pressure to skip your normal verification steps

The message appears to come from a genuine department address but fails authentication (SPF/DKIM/DMARC) — the real domain is impersonated and its officials are the victims.

From: (appears to be) an official department address — but sent from an unauthorised mail server.

• ⚑Display name and address look right but feel off
• ⚑No record of the tender on the official portal
• ⚑Verify via the official switchboard, not the email

You are told you have "won" a tender or must pay a registration or processing fee to be listed as an approved supplier.

"Congratulations, your company has been shortlisted. Pay the supplier registration fee to proceed."

• ⚑Any request for upfront payment to win or keep work
• ⚑Vague reference numbers that do not check out
• ⚑Payment to a personal or unexpected account

A supposed government buyer contacts you from a free webmail account rather than an official domain.

From: a free webmail account posing as a procurement officer — "Find attached the order. Treat as urgent."

• ⚑Government business from a free webmail address
• ⚑Generic greeting, no verifiable official contact
• ⚑An attachment or link you did not expect