Freeze, block, reset

The one idea

Blocking the card that was used is the visible move. But a fraudster who had your credentials may have planted things that survive the block: a new beneficiary waiting quietly, a raised daily limit, a changed contact number so future alerts go to them, your password reused on your email. The freeze-block-reset sweep clears all of it.

Compare:

Card blocked, new card issued, victim relaxes. Three weeks later a "saved beneficiary" receives a large EFT — set up during the original breach.

versus

Card blocked — then beneficiaries reviewed (one unknown, deleted), limits checked (raised to R100k, reset), contact details verified (unchanged), passwords rotated everywhere they were reused. Nothing left to detonate.

The sweep, in order

1. Cards and profile — freeze/block (you did this in the first ten minutes).
2. Beneficiaries — delete any you did not create. Note their details first: they are evidence.
3. Limits — check daily payment and transfer limits; reset anything raised.
4. Contact details — confirm the phone number and email on the account are still yours.
5. Devices — review registered/trusted devices in the app; remove strangers.
6. Passwords — a phished password is burned EVERYWHERE it was reused. Change banking first, then email (email resets everything else), then any account sharing that password.

Each unknown thing you find — beneficiary, device, limit change — write it down with its details before removing it. Your future dispute needs the list.

Try it now

Open your banking app and do steps 2 to 5 right now as a drill: view your beneficiary list, your limits, your contact details, your registered devices. Knowing where these live is 80% of doing this at speed.

Your win today

You sweep the whole account, not just the card — and everything planted becomes evidence instead of a time bomb.