“Scammers can empty a victim’s bank account within seconds after the victim presses 1 during a phone call from someone claiming to be the victim’s mobile network operator.”

Fraudsters use call spoofing, a technique where they falsify the information transmitted to a caller ID display to disguise their identity. The phone number then appears to be the bank name and the phone number associated with the bank where a business maintains an account. Once those credentials are received, the fraudster attempts to reset the customer’s password to gain access to the account to initiate funds transfers.

According to the indictment and information presented to the court, victims received a pop‑up message on their computers directing them to call a number to resolve a security issue. When the victims called, they were instructed to allow the fraudsters to access their computers remotely and then were tricked into believing they had been refunded too much money. The fraudsters then convinced victims to send funds, often by wire transfer or by purchasing gift cards. In some cases, victims were called back repeatedly and pressured into sending additional payments.

The SAPS has issued public warnings about scams targeting consumers, including fraudulent calls and attempts to obtain personal or banking information. This official warning supports the existence of scam calls in general, but it does not document a 'press 1' mobile-network-operator scam that can drain a bank account within seconds.

FNB explains that SIM swap fraud is dangerous because criminals can intercept one-time passwords and other verification messages after taking over a number. The bank’s guidance centers on monitoring for loss of network connectivity and contacting the bank quickly; it does not support the specific claim that pressing 1 during a call from a mobile operator can empty an account in seconds.

Scammers may call you using caller ID that looks like it’s your bank. An automated message might ask you to ‘press 1’ to speak to the fraud department about suspicious activity on your account. Once you respond, the scammer will try to get your online banking credentials or one‑time passcodes. With this information, they can access your account and make transfers or send peer‑to‑peer payments in your name. These transfers can happen in real time, and people have reported that their accounts were emptied before they could contact their bank.

Mirage Security researchers describe a vishing-as-a-service platform called P1 that automates “press 1” scams. Fraudsters spoof trusted institutions and play messages claiming a victim’s bank account has been compromised, instructing the victim to press 1 "if they want to resolve the issue." Those who do are then connected to a scammer posing as an employee, who continues the scam using AI-generated voice prompts. The article makes clear that pressing 1 connects the victim to scammers and allows interaction; it does not state that the single keypress itself gives technical access to the bank account or instantly empties it.

The article gives an example of a phone call claiming a fraudulent charge and instructing the recipient to "press 1". It explains that "that is how the scammer baits the hook to get you to press 1 so the fake representative can pump you for personal information needed to steal your identity." It further notes that the scammer then asks for account numbers and other details to move money. The discussion does not assert that pressing 1 alone instantly empties a bank account, but that it leads to a conversation where the victim may reveal information that allows theft.

In common mobile-network and bank impersonation scams, pressing 1 is typically used to connect the victim to a live scammer or to confirm an active phone number. The actual financial loss usually occurs later, after the victim is tricked into revealing one-time passwords, approving a transfer, or sharing login credentials. I am not aware of a reputable primary source showing that pressing 1 alone empties a bank account within seconds.