Think HTTPS Means Safe? Think Again — Inside South Africa’s Online Scam Trap

May 12
4 min read

In today’s digital world, most South Africans use the internet daily for banking, shopping, social media, and business. While the internet has made life easier, it has also created new opportunities for scammers. Cybercriminals increasingly use fake websites, payment pages, and phishing links to steal money and personal information. A large portion of these scams involves something people see every day but rarely question — HTTP and HTTPS.

Understanding how these web protocols work can help you better protect yourself against online fraud.

WHAT ARE HTTP AND HTTPS?

When you open a website, your browser communicates with it using a specific protocol.

- HTTP stands for Hypertext Transfer Protocol. (It allows information to move between your browser and the website’s server.)

- HTTPS stands for Hypertext Transfer Protocol Secure. (It performs the same function as HTTP, but with added encryption to protect the information being transmitted.)

The difference is simple:

HTTP = not secure
HTTPS = encrypted (but not necessarily trustworthy)

You can usually identify HTTPS by:

A padlock icon (🔒) in the browser or;
The website address starting with “ https:// ”

Many people assume that if a site uses HTTPS, it must be safe. Unfortunately, scammers understand this and actively exploit that trust.

How Scammers Use HTTPS to Look Legitimate

Years ago, fake scam websites often used plain HTTP because obtaining security certificates was difficult. Today, scammers can get free SSL certificates within minutes.

This means fake websites can now also display:

The padlock icon
HTTPS in the address bar
Professional-looking pages

Because of this, many victims wrongly believe:

“If the website has a lock icon, it must be real.”

Scammers use HTTPS to make fake websites look trustworthy enough to trick people into entering:

Banking details
Credit card information
OTP codes
Login credentials
Personal identity numbers

The lock only means the connection is encrypted — it does not mean the website itself is honest or trustworthy.

COMMON SCAM METHODS IN SOUTH AFRICA

South Africa has seen a significant rise in online scams that rely heavily on fake secure websites.

1. BANKING PHISHING SCAMS

Victims receive SMS or email messages impersonating banks such as:

· FNB

· Standard Bank

· Absa

· Nedbank

· Capitec

The message often says:

· “Your account has been suspended”

· “Unusual login detected”

· “Verify your banking details urgently”

The link leads to a fake HTTPS website that looks almost identical to the real bank website.

Because victims see HTTPS, they often trust it.

Once login details are entered, scammers take ownership of the account.

2. FAKE MARKETPLACE PAYMENTS

South Africans using platforms like:

· Facebook Marketplace

· Gumtree

· WhatsApp selling groups

· Telegram “investment/crypto” groups

are often targeted by payment scams.

The scammer sends a fake payment confirmation link that leads to a fake secure payment page.

Victims may be asked to:

· Confirm banking details

· Enter card information

· Pay a “release fee”

The page often uses HTTPS to appear genuine.

3. COURIER DELIVERY SCAMS

Victims receive messages claiming:

· “Your parcel is waiting”

· “Pay customs fee”

· “Delivery failed”

These messages contain links to fake courier sites using HTTPS.

Because the page looks professional and secure, people pay small amounts that lead to stolen card details.

WHY HTTPS ALONE IS NOT ENOUGH

Many South Africans believe:

Padlock = safe

This is one of the biggest misunderstandings scammers exploit.

HTTPS only means:

Your data is encrypted while traveling
Other people cannot easily intercept it

It does NOT mean:

The website is real
The business is legitimate
The person behind the site can be trusted

A scam website can still have full HTTPS protection.

That means criminals can protect the stolen data from you to them.

HOW SCAMMERS BENEFIT FROM HTTPS

Scammers gain several advantages by using HTTPS.

Increased Trust

Victims feel safer when they see:

The lock icon
Green or secure indicators
Professional branding

Better Email Delivery

Some spam filters trust HTTPS links more than plain HTTP links.

Harder to Detect

Victims may ignore warning signs because the site appears secure.

Improved Mobile Scams

On smartphones, people often only see part of the URL, making HTTPS scams more effective.

This is especially dangerous in South Africa where many people rely mainly on mobile banking.

WHY SOUTH AFRICANS ARE BEING TARGETED

South Africa has become a major target for online fraud because of:

High smartphone usage
Increased digital banking
Growing online shopping
Social media marketplace sales
Limited cybersecurity awareness

Scammers know that many users do not understand the difference between a SECURE CONNECTION and a TRUSTED WEBSITE

This creates an opportunity for social engineering.

WARNING SIGNS TO WATCH FOR

Even if a site uses HTTPS, look for red flags:

1. SUSPICIOUS DOMAIN NAMES

Example:

real bank: standardbank.co.za
fake site: standard-bank-secure.co.za

2. URGENT MESSAGES

Scammers create panic:

“Act now”
“Account locked”
“Payment failed”

3. POOR SPELLING

Many scam pages contain:

grammar mistakes
odd wording
strange layouts

4. REQUESTS FOR SENSITIVE DETAILS

Banks rarely ask for your PIN, OTP or full card details by email link

HOW TO PROTECT YOURSELF

South Africans can reduce risk by following simple habits.

1. ALWAYS CHECK THE FULL WEBSITE ADDRESS

Do not only look for HTTPS.

Check:

spelling
domain ending
unusual extra words

2. TYPE THE WEBSITE MANUALLY

Instead of clicking links in:

Go directly to the official site.

3. VERIFY THROUGH OFFICIAL CHANNELS

Call the bank or company directly before responding.

4. USE BANKING APP ALERTS

Enable:

login alerts
payment notifications
fraud warnings

5. EDUCATE FAMILY MEMBERS

Older people are often targeted because they trust secure-looking sites.

FINAL THOUGHTS

HTTP and HTTPS were created to help websites communicate securely, but scammers have learned how to abuse that trust.

In South Africa, cybercriminals are increasingly using HTTPS to make fake websites appear professional and believable. The presence of a padlock no longer guarantees safety. It only means your connection is encrypted — even if you are sending your information directly to a criminal.

The most important lesson is simple:

A SECURE WEBSITE IS NOT ALWAYS A SAFE WEBSITE.