People who worked between 1990 and 2019 "have a right to withdraw R30,000" from South Africa's government, claims a message widely shared on social networks.
On WhatsApp, the message tells the recipient to click a link to check if they are eligible for the money. It includes a screenshot of what seems to be a department of labour webpage headed "gov: Funds Available".
The link leads to a survey. Once this is completed, the user is told to share the message with five other WhatsApp groups or contacts in order to go to "the mlss page to receive the benefit".
But there isn't a benefit. It just redirects to another page with lots of pop-up advertising.
'The message is a scam'
The message is well travelled. In 2018 a Business Insider article reported a similar scam. This one promised R33,000 in "benefits" from the labour department. The link also led down a dead end.
The message "is a scam", Teboho Thejane, a department spokesperson, told Africa Check. He directed us to a media statement on the real website.
The November 2018 statement warns the public about a fake website promising unemployment insurance fund (UIF) benefits.
"The department of labour manages the UIF benefits, and has never published any list of people to withdraw any benefits. The claim is a blatant fake." There wasn't any list of workers due to get benefits, it added.
Webpage previews on social networks
Despite these red flags, whenever the message is shared on WhatsApp it shows a thumbnail that looks a lot like a link to the genuine labour department website.
How does this work? When a link is shared on social networking sites like Facebook, LinkedIn and WhatsApp, software sends a request (a so-called HTTP GET) to the website being shared to fetch a preview of its content.
The targeted website then complies, and the software generates a preview of the webpage by selecting some of the content found there - a thumbnail image, text from the page or something similar.
Threat of malware
Scammers are able to "confuse" the app "simply by making an image, either from a screenshot or with any image processing software, and to put that image on the webpage, and to 'hitchhike' along with the regular algorithm of the tool that generates previews", Keet told Africa Check.
She added that she was concerned there were other processes running on the page, because of its behaviour when one tried to close it.
"My suspicion is that it's not only a scam to get data, but that it also may try to install malware such as viruses, worms or trojans."
In a black Friday spam message that went viral on WhatsApp in 2018, recipients were promised shopping vouchers from Spar worth more than R3,000 if they followed similar steps to those in the benefits scam.
The retail store refuted the claims. - Naphtali Khumalo (16/05/19)