A boer maak ’n plan, and so does a fraudster.
Only this kind of farming has nothing to do with crops, and everything to do with cultivating digital assets for exploitation. Fraud is a never-ending headache and solving the issue is as long as a piece of string, especially in the financial sector. In the last couple of years we’re seeing new, complex threats emerge that are uniquely tied to South Africa’s push for financial inclusion.
Access to credit and the need to onboard customers digitally is accelerating, and because of this, fraudsters are adapting fast. That’s exactly why account farming and identity farming are on the rise. These tactics allow fraudsters to game systems at scale, and they’re becoming a major problem for businesses across the country. 45% of all reported fraud in South Africa happens in the financial sector, and a significant chunk of that can be traced back to these two tactics.
So what exactly are account farming and identity farming? How do they work? And what can be done to stop them in their tracks?
Let’s break it down.
What is account farming?
It’s the buzzword showing up on every tech blog and fraud forum – and while most people get the concept in theory, the real question is: how is account farming actually affecting businesses, and how are fraudsters getting away with it?
If we look at what account farming is at its core, it’s the mass creation or takeover of fake, duplicate, or stolen accounts to exploit digital systems. These accounts are designed to look like real users, often slipping past basic verification checks. Whether it’s for referral abuse, fake loan applications, promo stacking or money laundering, the goal is always the same: extract as much value as possible.
Fraudsters typically start with stolen or synthetic identity data (often bought on the dark web), then automate the account creation process using bots, scripts, or even low-cost human labour. The accounts are “warmed up” with light activity to appear genuine, by logging in, browsing, or even completing low-risk actions, before being activated for fraud. Once they’ve served their purpose, they’re either recycled, resold, or discarded.
Who’s most affected by account farming?
- Telecom: Fake SIM registrations can be used to claim free airtime/data, then resold or used for scams.
- Banking: Multiple fake accounts opened to abuse referrals or move money between mule accounts.
- Fintech/Lending: Bots mass-create accounts to exploit sign-up offers or test lending limits.
- Retail/E-commerce: Fake accounts used for discount abuse and fake product reviews.
- Government: Fraudulent accounts used to apply for duplicate grants, pensions, or tax refunds. This is a big issue in the South African landscape.
The biggest risks of account farming for businesses
- Financial losses: South African businesses can lose billions, with promo abuse, refund fraud and loan defaults.
- Poor experience for real users: spam, fake reviews, and trust-eroding interactions.
- Compliance risk: fake accounts often rely on stolen data, increasing exposure to data breaches and regulatory fines.
🛡️ How can businesses protect themselves?
Business need layered defences that kick in at every stage of the user journey. That means combining strong identity checks with continuous monitoring, device insights, and behavioural signals.
What solutions will people need to
Strengthen identity verification
Using tools like Gathr to collect ID information from HANIS and confirm their identity, cross-check third-party data, and flag inconsistencies in real-time, all before an account is even created.
Verify bank & contact details
Confirm account ownership and retrieve accurate contact details via Gathr to prevent the use of fake or recycled information.
Monitor continuously after onboarding
Spot farmed accounts early by analysing how users interact with your platform. By building a behavioural profile for each user, making it easier to detect bots or patterns that are not human-like.
👤 What is identity farming?
Identity farming is a more sophisticated type of fraud, and it’s the backbone of many modern scams. It’s when fraudsters collect and build up fake or manipulated identities using large volumes of real personal information. Sometimes they create entirely synthetic profiles; other times, they tweak just enough detail on a real person to avoid detection.
This information, names, ID numbers, addresses, selfies, and financial data, is usually harvested through: phishing scams, data breaches, malware, and selling stolen identity kits
Once a fraudster has a “farm” of ready-to-use identities, they can use them to open accounts, apply for credit, collect payouts, or move money, all while appearing completely legitimate.
And because these identities often pass initial verification, they slip into systems quietly, exposing businesses to long-tail fraud, losses, and compliance risk.
Who’s most affected by identity farming?
- Lending: Fraudsters use synthetic or stolen identities to apply for credit or BNPL, with no intention of repaying.
- Financial services: Fake identities are used to open bank accounts or apply for high-risk products like loans, cards, or overdrafts.
- Cross-border remittance: Farmed identities help bypass AML and FICA checks, used to move money internationally under false pretences.
- Retail (store accounts): Stolen or fake IDs are used to open store credit accounts, rack up purchases, and walk away with no trace.
- Employment platforms: False CVs, fake names, and identity documents are submitted to secure job placements or shift-based payments.
- Gyms and access-controlled facilities: Fraudsters use false identities or someone else’s membership details to gain access without being flagged.
- Funeral insurance: Payouts are claimed using fake beneficiaries or stolen identity data, often slipping through without proper checks.
The biggest risks of identity farming for businesses
- Fraudulent onboarding: Fake or stolen identities can slip through your onboarding process, opening accounts that will later be used for fraud, defaults, or money laundering.
- Reputational damage: If customers or regulators discover your platform is enabling fraud, even unknowingly, it can seriously harm your brand’s credibility.
- Regulatory penalties: Failure to detect and prevent identity farming can lead to breaches of KYC, AML, or POPIA requirements, exposing your business to fines and sanctions.
- Financial loss: Lenders, insurers, and telecoms face real monetary losses when services are extended to synthetic or fake profiles that never pay.
- Skewed data and poor decisions: Fake accounts distort analytics, making it harder to understand customer behaviour, assess risk accurately, or measure campaign effectiveness.
🛡️ How can businesses protect themselves?
Build rich user profiles
Don’t rely on one-time checks. Use multiple data points, like ID checks, location history, behavioural patterns, and biometrics, to build a unique, evolving profile for each user.
Monitor behaviour over time
Real users act like humans. Bots and fake accounts don’t. Watch for identical click patterns, rapid form submissions, or logins from shared IPs to flag suspicious activity.
Cross-reference data sources
Validate customer info across banks, bureaus, and telcos. If the phone number, bank account, and ID don’t align, you’ve likely got a synthetic identity on your hands.
Detect device and environment anomalies
Use device intelligence to block emulators, spoofing tools, and multiple accounts from the same hardware or IP range.
Stay ahead with feedback loops
Feed confirmed fraud cases back into your system to flag similar future attempts faster and more accurately.
Where does this leave you?
Account and identity farming aren’t fringe issues, they’re scaling fast and hitting industries across South Africa hard. Whether you’re in retail, financial services or lending, these fraud models are designed to slip past outdated defences.
The good news? You don’t need to fight this blind. By combining identity verification tools with behavioural analytics, device intelligence, and ongoing monitoring, you can stop ID or account fraud before the real damage happens.
