Capitec Secure Safe and Why a Duress PIN Makes You Less Safe, Not More

Capitec's Secure Safe removes accounts from the digital attack surface entirely. Once placed in the safe, an account has no digital footprint inside the banking app, cannot be transferred from the phone, and cannot be reached through normal digital banking channels. To access the money, the client must visit a branch in person.

1. The problem we are actually solving

South Africa’s crime problem has quietly become a banking problem. Criminals no longer need to hack a banking app, they force victims to unlock it themselves. The industry calls this transfer mugging, and it is growing fast. Express kidnappings, where a victim is grabbed and forced to open their banking app on the spot, rose seventy three percent in the first half of 2025, cellphone theft in South Africa averages one hundred and eighty nine phones a day, and banking fraud losses reached R3.9 billion last year.

That fear carries a real cost. A comparable pattern in United States banking research found that forty two percent of people who avoid banking apps cite security distrust as the reason, and it would not surprise me if South African clients feel that pressure even more sharply given what they are actually facing here. Some clients uninstall their banking app before they leave home, which is not irrational, it is a sensible response to a genuine threat with the only tool available to them. But it should not be necessary, and it is a sign the industry has been solving the wrong layer of the problem. This is not really a fear about software at all. It is the fear of a hand on your shoulder in a parking lot, or a voice behind you telling you to unlock your phone, and the safest digital account is the one that simply does not exist digitally.

2. Why the clever tricks do not work

A comment on one of my earlier posts asked a fair question. Why not build something like the duress password found in GrapheneOS, where entering a special password secretly wipes the device if someone forces you to unlock it. It is a sensible idea for protecting a phone. Banking under physical duress is a different problem entirely, because the thing you are protecting is not the device. It is the client standing in front of an armed criminal.

The trouble with any clever secret is that it stops being a secret the moment a bank markets it. Criminals read the same press releases, the same app store update notes, and the same breathless coverage of new security features that everyone else does. A special password that quietly shows a fake balance sounds ingenious right up until the marketing team announces it exists, at which point every criminal in the country knows it exists too.

Picture what that actually means for the person standing there with a gun pointed at them. They enter what they believe is a safe number, and now they have to plead with an armed attacker that the low balance on the screen is genuine and that they did not just use the special pin. The criminal has read the same comms you have, so they know the feature exists, and they are going to apply enormous pressure before they believe anyone. You have not removed the danger. You have added an entire negotiation to it, one where the victim carries the burden of proof. Perversely, a client would have been safer without the feature at all, because there would be nothing to be accused of hiding in the first place. That same flaw hides inside every version of this idea, whether it is renaming the app, changing its icon, burying it in a folder, running a decoy account, or setting a secondary password that quietly triggers a hidden state. Each depends entirely on the criminal not knowing about it, and secrecy of that kind never survives contact with a large enough population of criminals for long, especially once the bank itself has told everyone the trick exists. Under real coercion, a renamed app is recognised by its layout, a fake balance is cross checked against a second device, a hidden account is found by anyone patient enough to swipe through folders, and a secondary password is simply beaten out of someone once its existence is suspected. None of these were designed to remove the account from the attacker’s reach. They were only designed to make it slightly harder to find, and slightly harder is not the same as unreachable.

The strongest version of this idea, a duress PIN that looks identical to a normal PIN but silently flags the transaction for fraud monitoring rather than showing a fake balance, has the same flaw one layer deeper. Capitec, like every bank, sometimes delays a payment for entirely ordinary reasons that have nothing to do with duress, and a criminal who knows a silent flag exists will treat any delay as proof one was used. The client signalled nothing, the payment was simply slow, and they carry the risk of retribution for something they never triggered. A feature that can be blamed on the victim even when they did nothing has just moved the danger to a moment the bank cannot control.

A more elaborate version of the same idea runs into the same wall from a different angle. One suggestion is to have the duress PIN appear to process the transfer normally while silently placing it into a pending state, paired with a rule that any attempt to raise a transfer or withdrawal limit under suspicious circumstances needs a second trusted person, a spouse or a banker, to approve the change. Picture what that second step actually asks of someone in the moment. A phone call to a spouse, made in front of the person holding a gun to them, to get that spouse to approve a change they have no idea is even happening. That is not a safeguard, it is a second life put at risk inside the same crime. And underneath all of it sits the exact problem already described above. Capitec already delays or holds high risk payments for entirely ordinary reasons that have nothing to do with duress. The moment a duress PIN exists as a known feature, every one of those routine delays becomes something a criminal can point to and ask about. Why has this payment stopped, did you enter a duress PIN. That question does not need the feature to have ever been used. It only needs the criminal to know it exists, and Capitec makes exactly this kind of decision on entirely ordinary transactions every day.

Every version of this idea shares one flaw that matters more than any technical detail underneath it. It gives the client something to do, and anything a client can do during a crime is something a criminal can force them to prove they did or did not do. The principle Capitec actually works from is the opposite of that. During duress, a client should have no control and no influence over what happens to their money at all, because control is precisely what a gun is being used to extract, and a client who cannot act cannot be blamed for whatever happens next. That has to be true for the criminal just as much as it is true for the client. A criminal who understands that a vaulted account cannot be moved, delayed, flagged, or negotiated with by anyone standing in that room has no reason to keep applying pressure once that fact is established, because there is genuinely nothing left to gain. A criminal who instead suspects the client might still have some hidden lever to pull, a special PIN, a delay they can trigger, a call they can make, has every reason to keep pushing until they are satisfied that lever does not exist. Removing the client’s control is not a limitation of Secure Safe. It is the entire reason it makes anyone safer.

3. The real issue is digital visibility

Once you strip away the disguises, the underlying problem is unchanged, because the account still exists digitally. If it lives on the phone it can be found, if it appears anywhere in a support system it can be queried, and if it is something that can be demanded under duress at all then it remains part of the attack surface no matter how well it is disguised. That is the insight that matters here, and it is the one that most of the industry’s thinking about this problem has missed.

Most banking security asks a narrow question. How do we better protect digital access. It is the right question for almost every threat a bank faces, from phishing to sim swaps to card skimming, and it is the wrong question for a coercive crime happening in person, because a criminal standing next to the victim is not trying to defeat your authentication. They already have it, because the victim is unlocking it for them. The question that actually matters for this threat is not how you protect digital access more cleverly. It is whether digital access needs to exist at all.

Once you frame it that way, the design principle almost writes itself.

Every improvement to a duress password, a hidden folder, or a fake balance is still an improvement to something that exists.

And something that exists can eventually be found, demanded, or beaten out of someone. The only category of solution that actually changes the outcome for the client is one that removes the thing itself, so that there is nothing left for the criminal to find no matter how much time or violence they are willing to use.

4. Removing the attack surface instead of disguising it

The obvious response to that insight is not to disguise an account more cleverly but to remove it from the attack surface entirely, and that is the philosophy behind the feature we have just shipped at Capitec, which we are calling Secure Safe. The goal was never to make an account hard to find. The goal was to make it digitally unreachable.

Think about the difference between cash sitting in your wallet and cash sitting inside a physical vault at a bank branch. A criminal can empty your wallet in seconds, but nobody can stand on the pavement outside and force that vault open, because the vault still exists, it is simply not reachable from where the criminal is standing. Secure Safe brings that same physical logic into a digital world. Once an account is placed into the safe it has no digital footprint inside the banking app at all, it cannot be transferred from the phone, and it cannot be reached through any of the normal digital banking channels, and even our own staff cannot simply browse and discover it. The account also disappears from the list of accounts you can transfer to from within the app, so you cannot move money into it the way you would with any other account you hold. Instead you get money in the way you would send it to anyone else, as a normal beneficiary payment, which means the vault can keep receiving deposits without ever reappearing as a destination a criminal could point to and demand. The only way to reveal that a hidden account exists is for the client to explicitly authorise a query using their own fingerprint, and without that deliberate action the vault effectively does not exist and the digital duress vector disappears completely. To actually reach the money you need to walk into a branch, exactly the way you would with a physical vault.

It helps to compare the two attack paths side by side. In a traditional savings account, the path from client to bank runs through a single link, the phone, and anyone holding the phone unlocked in the client’s hand holds the account. In Secure Safe, that same path now runs through the branch, the vault record, the client’s own fingerprint, and the bank’s internal process for releasing an account from the safe. An attacker does not just need the phone anymore. They need the client to physically walk into a branch, they need the fingerprint of a living person who is willing to authorise the release, and they need to get past a process that was never designed to be rushed. That is not a harder version of the same attack. It is an entirely different attack surface, and one that a mugging on the street cannot reach no matter how much pressure is applied.

5. This is a deliberate trade off, not an oversight

I want to be direct about something. This is intentionally inconvenient, and that inconvenience is the entire point. If you are overseas and suddenly need the money, you will not get it. If you are travelling, the funds stay locked away regardless of how urgent the need feels in the moment. The vault behaves like a vault, not like a savings account with better marketing.

That means clients need to think carefully about what belongs in there before they use it. Emergency spending money almost certainly does not belong in Secure Safe. A pension payout, a lifetime of savings, money set aside for retirement or a house deposit, those are a completely different conversation and exactly the kind of balance this feature was built to protect. And to be clear on the practical detail that always comes up, if the account holder passes away, the funds remain part of their deceased estate and are administered through the normal legal process like any other asset.

6. Why doesn’t every bank do this

It’s a fair question, and the honest answer is that most digital banking strategy has spent the last decade optimising in the opposite direction. Every bank wants to boast that you can do anything, anywhere, without ever visiting a branch, and that ambition has driven genuinely good outcomes for most clients most of the time. A feature that deliberately puts money out of reach cuts directly against that narrative, and it requires a bank willing to say, for a specific class of client and a specific class of money, that convenience is not the only thing worth optimising for.

It also requires infrastructure that not every bank has invested in the same way, a branch network that can genuinely absorb the release process, staff trained to treat that release with the seriousness it deserves, and leadership willing to accept that some clients will complain about the friction on the way to a branch and be right to complain, because friction was the entire design goal. None of that shows up in a feature comparison table. It only shows up on the day a criminal cannot open a vault that was never in their reach to begin with.

7. What about hiding money from a spouse

A reasonable objection came up when this feature went live. Doesn’t Secure Safe make it trivial to hide money from a partner inside what is supposed to be a transparent family setup, and doesn’t that undo whatever good it does for genuine duress. It’s a fair question for any privacy feature, and it deserves a straight answer rather than a dismissal.

The honest answer is that Secure Safe is a strange tool to pick for that purpose, because South Africa has dozens of banks, and someone determined to hide money from a spouse already has a far simpler option available. Open an account at a different bank entirely and never install its app on a phone your spouse might see. That account leaves no trace on the device, no entry in any statement your spouse could stumble across, and no relationship at all to the bank they already associate with you. It requires no branch visit to release, no cooperation from your primary bank’s staff, and no fingerprint authorisation flow that draws attention to itself, because nobody at your primary bank would even know to look for it.

Choosing to hide money inside the same bank your spouse already knows you use is not the discreet option it might look like, it is just the vault behaving exactly as a vault should for the threat it was built for. Secure Safe exists to protect a client’s money from an external criminal under duress, not to arbitrate financial transparency inside a marriage, and a spouse who already knows which bank you use, and who could reasonably ask questions about that relationship, was never the audience this feature was designed to defeat.

8. The broader point about security design

Most security features try to make life harder for criminals within the existing rules of the game. The problem is that criminals adapt to those rules faster than most institutions can ship features. The strongest security designs do not try to change a criminal’s decision at the point of a duress attack. They remove the decision from existing at all. Instead of asking how you stop someone being forced to transfer money under coercion, the better question is what happens if there is simply nothing available to transfer in the first place.

Good security does not depend on criminals remaining ignorant. It assumes they are informed, organised, and adaptive, and it is built to survive that assumption rather than hope it never gets tested. The strongest systems remove opportunity instead of hiding it. A vault has worked for centuries because it does not negotiate with an attacker, it simply is not there to negotiate with, and digital banking should learn the same lesson. Secure Safe is our attempt to actually apply that lesson rather than just admire it from a distance.

References

1. National Financial Ombud Scheme digital banking fraud complaints, up 73 percent, BusinessTech
2. SAPS average of 189 cellphones stolen daily in South Africa, Institute for Security Studies
3. SABRIC banking fraud losses reaching R3.9 billion in 2025, EBNewsDaily
4. Forty two percent of non app users citing security distrust, a United States finding rather than a South African one, NerdWallet