Debit Orders: Who Gets to Take Money From Your Account, What You Can Do About It, and What Your Bank Can and Cannot Do

Debit orders are pull payments where a company collects money from your account using permission you gave, or that they claim you gave. Your bank cannot simply cancel a "valid" mandate for you, but you can dispute unauthorised debits, request a stop, and ask for reversals within the allowed period. But can you stop money coming off your account?

I should apologise up front for the length of this article. Every section answers a question real people are asking, and the length is a fair reflection of how much clients are expected to work out on their own, usually just after money has left their account. You don’t need to read all of it. Start with the checklist in section 1, then jump to whatever matches your situation:

• Something has left my account and I don’t know what it is
• It might be a card subscription, not a debit order
• I never agreed to this, I was tricked, or I want to cancel
• The company or my bank won’t help
• How to set things up so this doesn’t happen again
• Frequently asked questions

An unfamiliar debit can be genuinely upsetting, and it is natural to assume the bank was breached or that someone stole your details. On its own, though, an unfamiliar debit doesn’t mean either of those things happened. A debit order is a pull payment: a company asks the banking system to collect money from your account based on permission you gave them, or permission they claim you gave them, sometimes obtained by deception. Whichever it is, you have more options than it may feel like right now, and your bank can help you use them.

1. Start here if an unfamiliar payment has left your account

Before you call anyone, take a few minutes to gather what you can see in your banking app or on your statement: the name the debit order appears under, the date, the amount, any reference shown next to it, and whether your bank has sent you any message about this company, such as a request to approve a debit order or a notice that one was registered. If anyone else in your household was hit by the same name, write that down too. Then work through these steps, ideally on the same day.

1. Check whether it is a debit order or a card payment. If it shows on your statement as a card transaction under a merchant’s name, it is probably a card subscription, which has different rules and deadlines, so go to section 2 instead. If you aren’t sure, ask your bank; everything below is about debit orders.
2. Find out whether the payment can be disputed and reversed. Ask your bank what type of debit order it is and whether it qualifies for a reversal. You have 60 days from the day after the collection to dispute it, so do it now rather than waiting to see whether it happens again.
3. Deal with the agreement itself. The agreement is between you and the company, and ending it is the only thing that reliably stops the collections, so contact the company in writing, either to cancel or to say clearly that you never agreed to anything, and keep a copy of what you send and anything you get back. If it is a DebiCheck or registered mandate, your bank holds the company’s details and can tell you who they are. If it is an EFT debit order, simply finding the company can be the hardest part, because the name on your statement may tell you very little (section 10 explains why), so ask your bank to help you trace it.
4. Ask your bank to stop further collections. Your bank can suspend a DebiCheck or registered mandate and put a stop on EFT collections from the same company, so ask for both in the same conversation. It is worth doing, because it blocks the channel the company is using and creates a record. Just be aware that a company determined to keep collecting may try another channel or change its details (section 10 explains how), so keep an eye on your statement and dispute anything that gets through.

If you are not sure what to say when you get through to your bank, this one sentence covers everything you need at the start:

“Please identify this debit order, tell me what type it is, exactly how and when it was authorised, explain my options for disputing it, and tell me how to stop any future collections from this company.”

The “how and when it was authorised” part is more useful than it looks. For a DebiCheck debit order, your bank can tell you the date and the method used to approve it, such as your banking app or a card and PIN on a payment device, and that often explains a mandate you have no memory of approving. For a registered mandate or an EFT debit order, the honest answer will be that it was never authorised with your bank at all, which is worth knowing, because it means the company is relying on paperwork that only it holds.

By the end of the conversation you should have a reference number, a clear answer on whether the money can come back and roughly when, and confirmation of exactly what any stop covers: which company names and references, whether it applies to both DebiCheck and EFT collections, and how long it lasts, since some stops expire after a set period. Ask straight out whether another collection could still get through and what you should do if it does, and if nobody mentions timeframes, ask about those too, because they differ between banks and between types of debit order. If your bank will not help, or you are unhappy with how your request was handled, use its internal complaints process first, and if that does not sort it out you can take the matter to the National Financial Ombud Scheme, which handles banking complaints for free (section 8 has the details).

2. Is it a debit order or a card subscription?

A surprising number of “debit order” complaints turn out not to be debit orders at all, but recurring card payments, usually called card subscriptions. The two work in completely different ways and are fixed in completely different ways, so it really helps to work out which one you are dealing with before you do anything else.

A debit order is collected against your account number. The company submits it through the debit order system, it shows up on your statement as a debit order (often under a short, abbreviated company name), and it is governed by the debit order rules this post describes. Your card has nothing to do with it.

A card subscription is charged to your card number. At some point you, or someone using your card, saved it with a merchant such as a streaming service, a music or app store, a software company, an online shop or a gym’s website, and gave that merchant permission to charge it every month or every year. It shows up on your statement as a card transaction under the merchant’s name, and it is governed by the card scheme rules rather than the debit order rules.

Once you know that difference, a lot of things that seem baffling start to make sense:

• Cancelling or replacing your card does nothing to a debit order. The debit order was never attached to your card in the first place; it is attached to your account, so if debit orders keep arriving after you have changed your card, that is exactly what you would expect.
• Replacing your card doesn’t always stop a card subscription either. The card schemes run services that pass your new card details on to merchants you have recurring payments with, so that the subscriptions you want keep working after a card expires or is replaced, and cards saved in a digital wallet or stored by a merchant in tokenised form can also carry on working. That is handy for the subscriptions you want and maddening for the ones you don’t.
• Locking online or international transactions affects card subscriptions, not debit orders. The card controls in your banking app can block online, international or recurring card payments, which will stop a lot of subscriptions, but they have no effect at all on debit orders, because debit orders never touch your card.
• Emptying the account doesn’t end either one. A debit order or card charge that fails because there is no money is usually just tried again, and the contract or subscription is still sitting there, and depending on your account the failed attempts may cost you fees as well, so starving the account is often the most expensive way to tackle the problem.

To stop a card subscription you need to cancel it with the merchant. For app store, music, software and streaming subscriptions, that usually means going into the subscription settings of the account you signed up with, and you won’t need your old card number to do it. People are sometimes upset that their bank won’t give them the full number of an old card, even their own, but no bank will do that, because a full card number is exactly what a fraudster is after. If you can’t get into the merchant account, contact the merchant’s support team and ask them to cancel it for you. Then ask your bank to block that merchant on your card if it can, and to dispute any charges you didn’t authorise. Card disputes follow the card scheme’s rules and deadlines, which are not the same as the 60 day debit order window, so raise them quickly.

Be especially wary of apps and websites that push subscriptions on you. Accidental sign ups are one of the most common card complaints around: a free trial that quietly rolls into a paid plan, a membership that was already ticked at checkout, or a “join and save” button sitting exactly where the normal checkout button would be. Getting out can be just as hard, with the cancel option hidden several screens deep. This isn’t just a local problem, either. In the United States, the Federal Trade Commission, 21 states and the District of Columbia have alleged in an amended complaint that one large ride hailing and delivery app signed people up to its paid membership without their knowledge or consent, and that cancelling could take as many as 23 screens and 32 separate actions; those are allegations rather than findings, but they give you a sense of the problem. Users in Canada have reported similar surprise membership charges, and a proposed class action has been filed there. The lesson is to read every checkout screen before you tap confirm, make a note of when any free trial ends, and look through the subscription settings in your apps every so often.

The simplest protection against all of this is a virtual card. Many banks let you create virtual cards in their app, which are card numbers that exist only digitally, that you can use for online shopping and subscriptions, and that you can freeze or delete in seconds without touching your physical card. If you use a separate virtual card for subscriptions, or even one per subscription, then when a merchant won’t let you cancel, or you discover you were signed up by accident, you can delete that card, and in most cases new charges to it will then fail, without you having to replace the card you use every day. How this works can vary between banks and wallets, so check how your bank handles payments to a deleted or paused virtual card. Deleting the card doesn’t cancel the subscription agreement, so you still need to cancel with the merchant, but it does stop them charging you while you sort it out. Section 14 describes a simple setup with two virtual cards, one for the payments you rely on and one for everything else.

From here on, the post is about debit orders.

3. How to tell which type of debit order you have

Start with your banking app. Many banking apps let you see your DebiCheck mandates and registered mandates, including the company, the contract reference, the amount, the collection day and, for DebiCheck, details of when and how the mandate was approved, and if your app doesn’t show this, your bank can tell you. When a debit order puzzles you, this list is the first thing to check, because it often answers “when did I agree to this?” in a few seconds and gives you the company’s contact details at the same time. If the debit order you are worried about isn’t on the list, it is most likely an EFT debit order, which your bank never holds a mandate for.

Much of what you can do depends on which of the three types you are dealing with, and your statement won’t always make that obvious, which is why asking your bank is the quickest and most reliable route and why it is built into the sentence in section 1. If you would rather work it out yourself, think back over the messages your bank has sent you. If you were asked to approve the debit order in your banking app, by USSD or SMS, at an ATM, or by putting your card into a device and entering your PIN, it is almost certainly a DebiCheck debit order, and some banks also show a small DebiCheck fee next to each collection. If your bank told you that a mandate had been registered against your account without asking you to approve it, it is probably a Registered Mandate (RM). If neither of those happened, and the first you knew about it was the money leaving your account, it is most likely an EFT debit order.

4. The three types at a glance

It helps to pull apart three things that tend to get blurred together. The service contract is the agreement you made, or supposedly made, with the company, such as the funeral policy, the gym membership or the loan. The permission to collect, called a mandate, is your authority for the company to take payments from your account under that contract. The bank instruction is the actual collection request that lands at your bank on a particular day. Your bank only controls the last of these: it can refuse to pay instructions, and for DebiCheck it holds a verified record of the mandate, but it isn’t a party to your contract and can’t end it for you. Cancelling a contract you did make, or challenging one you never made, happens with the company, or through an ombud, regulator or court if the company won’t cooperate. Here is how the three types compare.

If you only remember one row, make it the last one. Every stop, suspension or reversal at the bank deals with payments, not with the contract, and a company that still thinks it is owed money may keep trying through another channel. If you genuinely owe the money, the company can still come after you for it, and if you don’t, you still need to deal with the company, or get an ombud or regulator to deal with them, so that the problem doesn’t keep coming back.

5. Common situations and what to do in each

“I never agreed to this.” If you have never heard of the company and never approved anything, dispute every collection within the 60 day window and ask your bank to stop further collections. For EFT and RM debit orders the reversal is automatic within that window, and it is then up to the company to prove that you gave them a valid mandate. If your bank’s records show that a DebiCheck mandate was approved and you are sure it wasn’t you, say so clearly, ask how and when the approval happened, and ask the bank to investigate, because that is potentially fraud and should be treated as such. You don’t need the company’s permission to stop paying for something you never agreed to, but it is still worth writing to them to say you never entered into any agreement, so that your position is on record.

“I was tricked into approving it.” This is what the “you’ve won a competition” scam in section 7 leaves behind, and it is the hardest situation of all, because your bank’s records show a mandate approved with your own card and PIN or your own app. A DebiCheck collection that matches the approved amount and date can’t be reversed through the normal dispute process, but that doesn’t mean you are out of options. Ask your bank to suspend the mandate straight away and to stop EFT collections from the same company, and dispute any EFT collection that still gets through. Tell the bank that you were deceived and ask for that to be recorded and assessed; a report that you were tricked should be looked into, not answered with “but you approved it”. Then complain to the company in writing, say that you were misled, and ask for the agreement to be cancelled and your money refunded. The Consumer Protection Act prohibits false, misleading or deceptive representations when goods and services are marketed (section 41), and under South African common law a person who was induced into a contract by a material misrepresentation can have it set aside and get back what they paid, which can cover several months of payments rather than just the latest one. If the company ignores you or refuses, escalate using the contacts in section 8, and since most of these scams involve funeral or insurance products, that usually means the National Financial Ombud Scheme.

“I signed up, but I want to cancel.” If you did agree to the contract and simply don’t want it any more, cancel with the company in writing and keep proof that you did. Ask your bank to stop future collections once the cancellation is confirmed, or if the company carries on collecting after you have cancelled. Disputing collections on a contract you validly agreed to won’t end the contract, and the company can chase you for the arrears.

“I stopped it, and it came back.” This happens a lot, and it doesn’t mean your bank ignored you. If collections reappear after you have placed a stop, look closely at the name and the reference, because the company may have switched from DebiCheck to EFT, or changed the reference so that your stop no longer matches. Dispute the new collection straight away, tell your bank you already have a stop in place and that the company seems to be getting around it, and ask for the stop to be widened to cover the new name or reference. Section 10 explains both tricks.

6. What your bank can do, and where its limits are

Your bank can do more than many people realise, although stopping a determined company is not one of its strengths. It can suspend a DebiCheck or registered mandate at your request, which stops future collections through that channel and tells the company. It can put a stop on EFT collections from a named company, which returns any collection that matches the details on the stop. It can reverse EFT and RM collections that you dispute within 60 days, as well as DebiCheck collections that didn’t match the mandate. It can look into a company whose collections look like abuse of the payment system, pass the pattern on to its fraud teams and to the industry bodies that share fraud information, and report the company, and the bank that sponsors it into the payment system, to the Payments Association of South Africa (PASA), which can act against participants that abuse the system and, for repeated violations, can take away a company’s ability to collect at all. And when you report that you were deceived, that report should be recorded and properly assessed, because the Financial Sector Conduct Authority’s conduct standards require banks to handle complaints fairly.

The limits are real too, and I would rather you heard them now than discovered them later. Your bank can’t guarantee that a company will stop collecting from you, because it can only close one channel at a time (section 10 explains how abusive collectors exploit this). It can’t cancel a validly authenticated DebiCheck mandate on its own, so if you were tricked into approving one, the bank can suspend it while the mandate is cancelled with the company’s cooperation or set aside by an order, and you should dispute anything that gets through in the meantime. It can’t reverse a DebiCheck collection that matched the mandate just because you no longer want the product, although it can stop further collections while you chase a refund from the company using the routes in section 8. It can’t decide whether your contract with the company is fair or valid, but it can record your complaint and point you to the ombud or regulator who can. It can’t accept disputes after the 60 day window has closed, which is why acting quickly matters so much. And it can’t see EFT mandates in advance, which is why checking your statement every month, using your 60 day dispute right and choosing the right kind of account for your money are your best defences against EFT abuse.

7. Tapping your card and the “you’ve won a competition” scam

The scam that catches the most people tends to play out the same way every time. Someone approaches you at a mall, a taxi rank or outside a shop, or phones you and arranges to meet, and tells you that you have won a competition, a voucher, a cash prize or a free phone. To “claim your prize” or “verify your identity”, they ask you to tap or insert your bank card on a small portable device and enter your PIN. What you have actually done is approve a DebiCheck debit order, usually for a funeral policy, an insurance product or a subscription you never wanted. Because the approval used your own card and PIN, your bank’s records show a properly approved mandate, and as far as the payment system is concerned, the collections that follow are exactly what you agreed to.

The rule that protects you is simple, and it is worth repeating to everyone in your family: your card and PIN on someone else’s device is your signature. No genuine prize, competition or verification process needs you to authenticate with your bank card in order to receive money, and you never need a PIN to be paid. If anyone asks you to tap your card to claim something, walk away. If it has already happened to you, follow the “I was tricked into approving it” route in section 5.

8. Where to escalate if the company or your bank will not help

Always start with the company, or with your bank if your complaint is about the bank, because every ombud expects you to have tried that first and given them a reasonable chance to put things right. If that doesn’t work, who you go to next depends on the kind of company you are dealing with.

• Banks, insurers (including funeral and life policies) and credit providers: the National Financial Ombud Scheme (NFO), which since March 2024 has brought together the former banking, credit, long term insurance and short term insurance ombuds, and which is free to use.
• Financial advisers and intermediaries, such as the agent who sold you a policy: the FAIS Ombud.
• Market conduct by financial services providers more broadly: the Financial Sector Conduct Authority (FSCA).
• Registered credit providers and credit agreements: the National Credit Regulator (NCR).
• Gyms, subscriptions and other general goods and services: the Consumer Goods and Services Ombud (CGSO) and the National Consumer Commission (NCC).
• Claims of up to R20,000 against a company that won’t refund you: the Small Claims Court, where you don’t need a lawyer.

A clear, written complaint with your evidence attached, including dates, amounts, your written cancellation or objection to the company and any reference numbers from your bank, will usually get an unresponsive company moving far faster than calling its call centre again and again.

9. How the system works, for those who want the detail

You don’t need this section to protect yourself, but if you have ever wondered why the three types of debit order behave so differently, this is the explanation.

DebiCheck, formally known as Authenticated Collections, was introduced at the direction of the South African Reserve Bank and rolled out through PASA to deal with the flood of unauthorised debit orders in the late 2010s, including the R99 scam, where fraudsters kept amounts small enough to slip under notification thresholds. When you sign up with a company, it sends the mandate to your bank, and your bank asks you to approve it before any money can be collected. The mandate shows the company’s name, the contract reference, the amount, the collection date and frequency, and any terms that allow the amount to change, so read all of it before you approve: check that the name matches the business you actually dealt with, that the amount and date are what you agreed, and that any maximum amount or yearly increase is something you can live with, because that is exactly what you are allowing the company to collect for as long as the contract runs. Once you approve it, the mandate is stored in a central register and every later collection is checked against it, so anything with a different amount or date is rejected. The approval can happen in three ways. A TT1 request is sent in real time to your banking app, USSD, SMS or a similar channel while you are dealing with the company, and for the immediate version you have about 120 seconds to respond before it expires. A TT2 request is sent overnight in a batch, which gives you longer to respond. A TT3 request is approved on a payment terminal with your card and PIN, which is useful for a gym or a car dealer that wants to finish the paperwork before you leave, and which is also the mechanism the competition scam abuses. If you ignore a DebiCheck request it simply expires, and if you reject it the debit order won’t be processed as DebiCheck, but neither of those cancels the contract, and the company may still try to collect through one of the other two systems.

Registered Mandates replaced the old Registered Mandate Service on 12 May 2025. An RM is registered with your bank, and your bank tells you the company’s abbreviated name, the contract reference and contact details, but you aren’t asked to approve it. A company can also, if it has asked for this, have a DebiCheck mandate that you didn’t approve registered as an RM instead. RMs also cover business accounts and accounts that need two signatories, which DebiCheck excludes. If you get an RM notification from a company you don’t recognise, treat it as an early warning and act on it the same day.

EFT debit orders: your bank does not verify the permission. EFT is the oldest kind of debit order and is still very widely used. The company is supposed to hold a mandate from you, which might be written, recorded on a phone call or captured online, but that mandate is never registered with or checked by your bank. When the company submits a collection through its own bank, your bank processes it with nothing to compare it against. Your protection all comes afterwards: the right to dispute the collection and get it reversed, notifications that help you spot strange debits quickly, stop payments, and the ability of sponsoring banks and PASA to act against companies that abuse the system. PASA itself acknowledges that because EFT mandates are neither verified nor registered with banks, they are more prone to disputes and unauthorised debits than DebiCheck and RM. The three systems also run at different times of day, with DebiCheck in the earliest morning window and EFT in a late evening window after RM collections, which is why debits tend to arrive in a particular order on payday.

The 60 day dispute window. From 13 April 2026, PASA standardised the dispute window across all three types: you have 60 calendar days, counted from the day after a successful collection, and disputes after that are generally no longer accepted. This replaced the old arrangement, where EFT disputes within 40 days were reversed immediately and older ones, up to 365 days, went to an investigation. For EFT and RM debit orders, a dispute within 60 days is reversed without the company getting a chance to block it first, and a company that believes the collection was valid then has to produce the mandate and pursue you. DebiCheck works differently on purpose: a collection that matches the approved amount and date can’t be reversed through the dispute process at any point in the window. That trade was deliberate, because DebiCheck protects you from collections you didn’t approve, and in return it protects companies from people reversing collections they did approve because money is tight at the end of the month. It is also why, if you were tricked into approving a mandate, your route to a refund runs through the company and the ombuds rather than through a reversal at your bank.

10. How bad actors try to get around your bank’s blocks

There are two tricks behind many of the cases where people feel their bank failed to stop a debit order, and a third weakness in EFT that makes both of them harder to fight.

The first is the switch to EFT. When you suspend or reject a DebiCheck or registered mandate, some companies simply resubmit the collection as an EFT debit order, which needs no prior approval and isn’t blocked by the suspension. It is common enough with abusive collectors that you should watch for it rather than assume the suspension has ended the matter. Sometimes the company genuinely holds a separate written or recorded EFT mandate from when you signed up, and collecting under a mandate that was properly obtained isn’t unlawful in itself. The abuse is in using EFT specifically to get around a suspension that reflects your live dispute, which is collecting in bad faith. An EFT stop placed alongside the suspension might catch the first resubmission, but you shouldn’t rely on it, for the reason described next. What does work is disputing, because any EFT collection you didn’t authorise can be disputed within 60 days and reversed automatically, and every reversal costs the company that collection. The industry knows that having DebiCheck and EFT side by side creates this gap, and work has been going on to let a DebiCheck suspension carry across every debit order system for the same company and client, but that isn’t a binding rule yet. Until it is, the honest position is that your bank can’t stop a determined company from presenting EFT collections, but it can reverse the ones you dispute and act against the company if the pattern keeps repeating. So if a company keeps doing this, tell your bank, because a pattern across many clients is what lets a bank escalate the company to PASA.

The second is changing the reference to dodge a stop payment. Because your bank never holds an EFT mandate, a stop on an EFT debit order has to match the details carried on each incoming collection, usually the company name as it appears and the reference attached to the debit. Some bad actors know this and change those details on purpose between submissions: a contract number becomes a new contract number, a date or sequence number is added to the reference, characters are added to or removed from the company name, or the collection arrives under a different trading name or collection agent. To a stop that matches the original details, it looks like a different debit order, and it goes through, which is something bankers have been warning people about for years. The EFT system was never designed to identify a debit order by anything the company can’t change, so there is no perfect defence, but speed and persistence help a great deal. When you place a stop, give your bank every version of the company name you have seen. Check your statement after every month end, and dispute any new collection from what is obviously the same company straight away, even if the name or reference looks slightly different, mentioning that you already have a stop in place. Every reversal costs the company the collection and adds to the record against them. On the bank’s side, the useful tools are smarter matching that sees through cosmetic changes to the company behind them, linking repeat disputes about the same collector, and treating a company whose collections keep popping up under altered references as a candidate for escalation to its sponsoring bank and PASA. A company that changes its references to get past your instruction isn’t making an admin mistake; it is deliberately getting around a control, and it should be treated that way.

The third problem makes both of the others worse: an EFT debit order often tells you almost nothing about who took your money. With DebiCheck and RM, the mandate your bank holds includes the company’s registered short name, the contract reference and contact details, so your bank can tell you exactly who is collecting and how to reach them. An EFT collection only carries whatever the company chooses to put in a short text field, which is usually an abbreviated name of a few characters that might belong to a collection agent, a payment processor or a trading name rather than the company you think you dealt with, plus a reference that may be a string of numbers that means nothing to you. There is no phone number, no email address and no registered company name. That is a real obstacle, because almost every remedy in this post starts with contacting the company, whether to cancel, to object, or to show an ombud that you tried. A few things help. Search the name exactly as it appears together with the words “debit order”, because other people are often asking the same question online. Ask your bank to help identify the collector, because even though your bank doesn’t hold the mandate, it can see which bank sponsored the collection into the payment system, and that sponsoring bank knows who its client is. And if you still can’t identify the company, don’t let that stop you disputing, because an EFT dispute within 60 days doesn’t require you to have reached the company first, and a collector that can’t be identified or contacted is exactly the kind of pattern your bank should record and escalate.

11. Accounts that refuse debit orders altogether

There is one more protection, and it sits outside the whole stop and dispute process: the kind of account your money is in. Some savings accounts and digital wallets don’t accept debit orders at all, so any collection presented against them simply fails, whether it is DebiCheck, RM or EFT, whether or not the reference has been changed, and whether or not the company claims to hold a mandate. For money held in an account like that there is nothing to stop, suspend or dispute, because no debit order can succeed in the first place, and unlike a stop or a suspension, it isn’t something a company can get around by switching channels or changing a reference.

That is a good thing and a “bad” thing at the same time, because most of us want some debit orders and not others. Your bond, your car finance, your medical aid, your life cover and your school fees are debit orders you want to go through, and an account that refused all of them would leave those payments unpaid, which can mean a lapsed policy, arrears, penalty fees from the company and, for credit agreements, damage to your credit record. An account that rejects every debit order protects you completely from the ones you don’t want only by also blocking the ones you do, and it doesn’t change what you owe either, because a collection that fails for that reason is still a missed payment as far as the company is concerned.

The practical answer is to split your money by purpose. Run the debit orders you want from a transactional account, and keep only enough in it to cover them plus a reasonable buffer. Keep the rest of your money, meaning your savings and anything you haven’t earmarked yet, in an account that refuses debit orders, and move money across when you need it. If a rogue company does get a collection through on the transactional account, the damage is limited to what was sitting there, and the bulk of your money was never within reach of any debit order.

Many people go for a more drastic option and close the account the debit orders are running against, then open a new one, reasoning that a collection presented against a closed account can’t succeed. That does work against collections aimed at the old account number, but it costs more than people expect. When you close an account and open a new one, you may lose what was attached to the old account in your banking app, depending on your bank: your saved beneficiaries, which you then have to load and verify all over again; the tax documents you may need for SARS; and your payment history. That information usually isn’t gone for good, because your bank can generally still provide it, for example at a branch, but it may no longer be in the app where you are used to finding it, and rebuilding your beneficiaries alone can take a while. Closing the account also does nothing to the contracts behind the debit orders, so a company you genuinely owe can still come after you, and every debit order you do want, from your bond to your school fees, has to be moved to the new account before it starts failing. Before you take that step, it is worth asking yourself whether disputing the unauthorised collections and moving your savings into an account that refuses debit orders would give you the same protection with far less upheaval.

12. Is the system biased towards the collector?

It is a fair question, and I think the honest answer is yes: the debit order system does have a built in collection bias. That isn’t a conspiracy, it is a consequence of what the system was built to do. Most debit orders are payments that people want to succeed, such as bonds, car finance, insurance, medical aid, school fees and cellphone contracts, and the system is engineered to make those collections reliable. Unfortunately, the same features that make a legitimate collection reliable also help a rogue one, and you can see the bias in several places.

Timing. DebiCheck collections run in the earliest processing window, straight after salaries and other bulk payments land, with RM and then EFT collections later in the day. On payday, that means collectors are paid before you have had any chance to spend your salary or decide what matters most.

Tracking. If there isn’t enough money in your account when a DebiCheck collection is presented, your bank keeps checking for funds for a tracking period of up to 10 days and collects as soon as money arrives. That is why a collection can appear in the middle of the afternoon on the day your salary comes in, rather than just after midnight.

Irreversibility. A DebiCheck collection that matches the approved mandate can’t be reversed through the dispute process. That protects honest collectors from people reversing payments they agreed to, but it also means that someone who was tricked into approving a mandate has to get the money back from the company, which is slower and harder than a reversal.

Channel switching and information. As section 10 explains, a company blocked on one channel can usually move to another, and on the EFT channel it can be hard to even work out who is collecting, because the company holds the mandate and the contact details while you often have nothing but a short name on a statement.

Fees. On some accounts you pay a fee for each collection, and failed collections can carry fees too, so a rogue collector that keeps trying can cost you money even when it fails. It is easy to see why some people conclude that banks profit from the problem. Banks do charge fees for processing payments, but unauthorised debit orders also bring disputes, fraud investigations, complaints and ombud cases, and they cost banks the trust of their clients, so the incentives aren’t as simple as they might look.

The system isn’t tilted entirely one way, though. For EFT and RM debit orders, if you dispute within 60 days you get your money back automatically, without the company being given a chance to defend the collection first, and collectors see that as a bias against them; at least one insurer has gone to court over it. You can also suspend mandates, place stops and keep your savings in an account that refuses debit orders. But on balance, the design assumes a collection is legitimate unless you act, and it puts the burden of noticing, disputing and following up squarely on you, which is the best argument I know for checking your statement and your list of mandates every month.

13. So is it a banking security issue?

For the vast majority of complaints, not in the sense people usually mean. Your bank’s systems weren’t breached and your passwords weren’t stolen. What happened is that someone got permission to collect, either legitimately and then disputed later, or through deception like the competition scam, or, in the EFT case, simply by claiming to hold a mandate that your bank has no way of seeing. The weakness in EFT lies in how the system was designed rather than in a security failure at any one bank: it assumes that whoever submits a collection holds a valid mandate, relies on reversals as the safety net, and carries so little information about the collector that people often can’t even tell who to complain to. The switch to EFT and the reference changing trick are bad actors exploiting exactly those assumptions. DebiCheck closes most of that gap by putting your bank in the loop when you give your consent, but it also shifts responsibility onto you, because once you have approved a mandate with your app or your card and PIN, the payment system treats your consent as real.

None of that means you are powerless. If an unfamiliar debit order appears, act on the same day: dispute what can be disputed within 60 days, deal with the company in writing and escalate to the right ombud if they won’t cooperate, and ask your bank to stop further collections, disputing anything that still gets through. To stay ahead of the problem, read every DebiCheck request before you approve it, never tap or insert your card and enter your PIN on someone else’s device to receive anything, treat RM notifications from companies you don’t know as an early warning, check your statement every month, and keep your savings in an account that doesn’t accept debit orders. Your bank can’t promise that a determined company will never present another collection, and it would be wrong of me to tell you otherwise. What it can do is reverse unauthorised collections you dispute in time, give you somewhere to keep money that no debit order can reach, and act against companies that abuse the system, while the ombuds and regulators deal with the company itself, and between them there is a clear next step in almost every situation.

14. Best practices: a simple setup that keeps you in control

If you only do three things, do these: read every DebiCheck request before you approve it, never put your card and PIN into someone else’s device to receive anything, and look down your statement once a month for anything you don’t recognise. Those three habits prevent or catch most problems.

If you want more control, the arrangements below go further. They are optional, they take a little setting up, and most banks already offer the building blocks in their app.

1. Split your money by purpose. Keep the debit orders you want, such as your bond, car finance, insurance, medical aid and school fees, on one transactional account, with only enough in it to cover them plus a reasonable buffer. Keep your savings and the rest of your money in an account that refuses debit orders (section 11), and move money across when you need it, so that if a rogue collector gets through, the damage is limited to what was in the transactional account.

2. Keep your physical card for in person use. Use your physical card at tills and ATMs, and switch off online and international transactions on it in your app’s card controls unless you need them. That way the card in your wallet is never the one saved with an online merchant, and losing it won’t disrupt any of your subscriptions.

3. Use at least two virtual cards, one for critical payments and one for everything else. Most banks let you create virtual cards in their app. Make one of them your critical card, for the handful of recurring card payments you never want interrupted, such as the cloud storage your photos live in, a streaming service the family uses, or an insurance premium paid by card, and only use it with merchants you know and trust. Make another your general card, for free trials, new apps, one off online purchases and anything you aren’t sure about. Because nothing important depends on the general card, you can pause it, delete it and create a fresh one whenever a merchant won’t let you cancel or you find a subscription you never meant to sign up for, without putting the payments that matter at risk. If you sign up for a lot of trials, you can take it further and use a separate virtual card for each one.

4. Pause cards when you aren’t using them. Most banks let you pause, freeze or lock a card instantly in their app and unpause it just as quickly. If you keep your general card paused by default and only unpause it for the few minutes you need it, most attempts to charge it while it is paused will be declined. Check how your own bank treats a paused card, because the details can vary. Just remember that pausing your critical card will interrupt the payments you rely on, which is exactly why it should be a separate card.

5. Treat every free trial as a future charge. Put trials on your general card, note the date each one ends, and cancel in the app’s subscription settings before then if you don’t want to keep it. Read every checkout screen before you confirm, and watch out for memberships or “join and save” options that are already ticked for you (section 2).

6. Review your subscriptions and mandates regularly. Once a month, run your eye down your statement for anything you don’t recognise, and every few months check the subscription settings in the apps you use, the list of DebiCheck and registered mandates in your banking app, and which merchants are charging each of your cards. It only takes a few minutes, and it catches problems while they are still inside the 60 day dispute window.

7. Read every DebiCheck request, and never use your card and PIN on someone else’s device to receive anything. Only approve a DebiCheck mandate when you recognise the company, the amount and the collection day, and reject anything you don’t. And never tap or insert your card and enter your PIN on a stranger’s device to claim a prize, a refund or a gift (section 7).

8. Keep a paper trail. Keep copies of the contracts you sign, the cancellations you send and the confirmations you get back, and jot down the reference number every time you speak to your bank. If you ever need to dispute a collection or take a complaint to an ombud, that record is what makes your case.

15. Frequently asked questions

These are real questions people have asked, lightly reworded.

“When I make a payment I have to approve it with my PIN. Why don’t debit orders need the same?”
DebiCheck is exactly that approval, just done once at the start of the contract rather than every month. If every single collection needed approval, your bond, insurance premium or school fees would fail whenever you missed a notification, changed phones or had no signal, and you would end up with lapsed policies and arrears. If you want payment by payment control over a pool of money, the way to get it is to keep that money in an account that refuses debit orders (section 11) and move money across only when you decide to.

“Money paid to me takes time to clear, but debit orders go off immediately. Why?”
Ordinary payments from other banks are settled between banks in batches, which is why they can take a while to reflect, unless the sender uses an immediate payment. Debit orders also run in batches, but their processing windows are timed to run just after salaries land, and DebiCheck collections are tracked for up to 10 days so that they are collected as soon as money arrives. Section 12 explains why that timing favours the collector.

“I emptied my account (or blocked my card) to stop a company, and now I’m being charged fees and it keeps trying.”
Emptying the account doesn’t end the contract or subscription, so the company keeps presenting the collection, and depending on your account the failed attempts may carry fees. Start by working out whether it is a debit order or a card subscription (section 2). For a card subscription, cancel it with the merchant and ask your bank to block that merchant on your card. For a debit order, follow section 1: dispute what can be disputed, deal with the company, and ask your bank to stop further collections.

“I changed my card twice and the debit orders kept coming.”
Debit orders are collected against your account number, not your card, so changing your card makes no difference to them. If the charges are actually card subscriptions, they can survive a card replacement too, because the card schemes pass your new card details on to merchants you have recurring payments with. Section 2 explains how to tell the two apart and how to stop each one.

“I locked online and international transactions, but debit orders still go off.”
Card controls only apply to card transactions, so they will stop many card subscriptions, but they don’t affect debit orders, which never go through your card.

“I lost the card my music subscription was on, and the bank wouldn’t give me the card number so I could cancel it.”
No bank will give out a full card number, even for your own old card, because a full card number is exactly what a fraudster wants. The good news is that you don’t need it, because subscriptions bought through an app store, music or streaming service are cancelled in the subscription settings of that account, and if you can’t get into the account, the merchant’s support team can cancel it for you. If the lost card has been blocked, charges to it will fail anyway unless the merchant has received your new card details.

“If I had really authorised it, I would recognise the name.”
Not necessarily. The name on your statement is a short name chosen by the collector, and it might belong to a payment processor, a collection agent or a trading name rather than the brand you remember dealing with. Check the list of DebiCheck and registered mandates in your banking app (section 3), which shows the company, the contract reference and, for DebiCheck, when and how the mandate was approved, because that record often settles the question one way or the other.

“Isn’t it just people signing up for things they don’t understand?”
Sometimes it is, and reading every DebiCheck request carefully before approving it saves a lot of grief. But deliberate deception is real too, and the competition scam in section 7 is designed so that people approve a mandate without realising they have done it. Both happen, and the way out is different for each (section 5).

“My son’s first salary was debited twice on payday, and he was told nothing can be done.”
If each collection is followed by a DebiCheck collection fee, the collections were made under DebiCheck mandates that the bank’s records show as approved, which is why they can’t simply be reversed. That doesn’t mean nothing can be done, though. He should check the mandates in his banking app to see when and how they were approved, ask the bank to suspend them and to stop EFT collections from the same companies, and if he was tricked into approving them, follow the “I was tricked into approving it” route in section 5 and escalate to the ombud if the company won’t refund him.

“The branch told me the debit order can’t be reversed and suggested I open a new account. What if it happens again on the new account?”
It can. A new account at any bank can receive DebiCheck, RM and EFT debit orders just like the old one, and a company that holds your contract can ask you for the new details, or collect against them if you hand them out. Closing an account also has real costs (section 11). The more lasting protection is to deal with the company that is collecting, dispute what can be disputed, and keep most of your money in an account that refuses debit orders, with only what your wanted debit orders need in your transactional account.

“Should I move to another bank?”
Every South African bank runs on the same debit order system, with the same three types and the same 60 day dispute rules, so moving banks doesn’t take you out of reach of debit orders. People move between banks in every direction over this, and the problem tends to follow them, because it lives in the contract and the collection system rather than in any one bank. What does differ between banks is how easy they make it to see your mandates, suspend them, dispute collections and keep money in accounts that refuse debit orders, so those are the things worth comparing.

“Isn’t this just the bank taking money from its clients?”
No. The money collected by a debit order goes to the company that submitted it, not to your bank. Your bank may charge a fee for processing the collection, which will be in its fee schedule, but the collection itself is paid to the company.

“Isn’t this usually internal fraud at the bank? Shouldn’t I report it to the branch as fraud?”
A debit order is submitted by a company through its own bank rather than created by staff at your bank, so the usual explanation is a collector, honest or otherwise, rather than an insider, and your account number can reach a collector in all sorts of ways, including any contract or form you have ever filled in. If you genuinely suspect someone at your bank was involved, report it to the bank’s fraud team, which is the right place for it. But a fraud report won’t reverse a collection or speed up a refund on its own, so make sure you also dispute what can be disputed and deal with the company in the meantime.

“The debit orders came from a company in a city I’ve never been to. Was my information sold?”
Where the collector is based tells you very little, because a debit order doesn’t depend on you ever having been anywhere; for an EFT debit order, a collector needs little more than your name and account number, and it can submit the collection from anywhere in the country. Your account number isn’t a secret in the way a PIN or password is, since it appears on invoices, payslips, contracts, application forms and the payment details you give to anyone who pays you, so it can reach a collector through many routes, including a data leak at any business you have ever dealt with. That is exactly why DebiCheck exists: under DebiCheck, knowing your account number is no longer enough to collect without your approval. If debt collectors are now chasing you over a contract you never entered into, write to them disputing the debt and asking for a copy of the agreement and proof that you signed it, and don’t acknowledge or pay a debt you don’t recognise. Debt collectors in South Africa must be registered with the Council for Debt Collectors, which takes complaints about their conduct, and if the debt relates to a credit agreement, the National Credit Regulator can help. If you think your identity has been used to open accounts or contracts, check your credit report with the credit bureaus, which you are entitled to do for free once a year, and consider protective registration with the Southern African Fraud Prevention Service, which warns its member organisations that your identity may be being misused.

“My bank stopped the debit order, but the stop only lasts a few months, it fails if the reference changes, and I’m charged every time I reverse a collection.”
All three are common, and it is better to know about them now than to find out the hard way. Many banks only apply stop payments for a limited period, so note when yours expires and ask for it to be renewed if the company is still collecting. An EFT stop matches on details the company controls, so a changed reference can slip past it (section 10). Some banks charge a fee for disputing a debit order, and fee schedules vary, so ask your bank what it charges, whether the fee applies when the collection really was unauthorised, and whether it can be waived. None of this is a reason to stop disputing, because every reversal costs the collector the money and adds to the record against them, but it is the clearest sign that the lasting fix is to deal with the company itself, escalate to the ombud or regulator if they won’t stop (section 8), and keep most of your money in an account that refuses debit orders (section 11).

“The bank refused to refund me because it said it had proof that I agreed, but it wouldn’t show me the proof.”
You are entitled to understand why your dispute was turned down, so ask in writing for the reasons and the evidence relied on. What that evidence looks like depends on the kind of payment. For a DebiCheck debit order, it is the authenticated mandate, meaning the date, the method used to approve it (such as your banking app or a card and PIN on a device) and the terms you approved, and your bank holds that record and can show it to you. For a card subscription, such as an annual domain, hosting or software renewal, the merchant usually responds to the card dispute with its own records: your account with them, the auto renewal terms you accepted, and your history of previous payments. Annual renewals catch a lot of people out, because the charge arrives a year after the last one, often for a bigger amount, and the card it was saved on may have been replaced in the meantime (section 2). If your bank won’t give you the reasons or the evidence, raise it through its internal complaints process, and if that fails, take it to the National Financial Ombud Scheme (section 8). And if it is a renewal you no longer want, switch off auto renewal in your account with the merchant so it doesn’t happen again next year.

“The app won’t let me reverse the debit order and tells me to go to the bank.”
Banking apps handle the straightforward disputes, and some cases get sent to a branch or the call centre instead, such as DebiCheck collections, which can’t be reversed just because you dispute them, or cases that need investigating. Being sent to a branch doesn’t mean the answer is no. Take the details listed in section 1, use the sentence in section 1 to ask what type of debit order it is and how and when it was authorised, and make sure you leave with a reference number. If you have several debit orders from companies you have never heard of, ask about each one separately, because they may be different types with different remedies.

“I want an account where every transaction has to be approved before it touches my money.”
The friction you are asking for already exists, in two forms. An account that refuses debit orders (section 11) means nothing can be pulled from it at all, so money only leaves when you move it. Card controls in your banking app let you lock online, international or recurring card payments and unlock them only when you need them, which gives you approval over card subscriptions. Used together, with only what your wanted debit orders need in your transactional account, they give you most of the control you are describing without breaking the debit orders you rely on.