Online: Grand Theft Auto… But Make It Social Grants

Title: Grand Theft Auto… But Make It Social Grants

After turning 18, I discovered that someone had used my identity to claim South Africa’s Social Relief of Distress grant. What began as a personal case of identity fraud led me to uncover something far bigger. A small API weakness in the public application portal allowed me to test national ID numbers, revealing evidence that fraudulent grant applications were being submitted at a widespread and systematic scale.

This talk follows how I turned one suspicious application into a national investigation, validated the pattern, responsibly disclosed the findings and ultimately presented the evidence before South Africa’s Parliament. I will break down the missing rate limits, weak identity verification and failures that left victims with almost no way to recover. It is the story of how one overlooked API exposed serious weaknesses in a welfare system relied upon by millions of South Africas Poorest Individuals, all for a R350 welfare grant for unemployed people.

•⁠ ⁠Background on the SRD grant ecosystem and its scale (18M+ users)
•⁠ ⁠How my personal identity theft revealed a broader systemic issue
•⁠ ⁠Breakdown of the unauthenticated API and data-model inconsistencies
•⁠ ⁠Using SA ID numbers and StatsSA data to detect demographic anomalies
•⁠ ⁠Fraud chain: leaked data → SIM swaps → bank KYC failures → grant extraction
•⁠ ⁠Why facial verification struggles in South Africa
-- Hardware constraints
-- Demographic bias
-- Environmental/lighting issues
-- False accept vs false reject rates
Demo: comparing DHA ID photos to user-submitted selfies
•⁠ ⁠Technical considerations when designing verification for millions
•⁠ ⁠Latency, device diversity, offline identity, rural access
•⁠ ⁠Why “add biometrics” doesn’t solve fraud at population scale
•⁠ ⁠Government response, parliamentary engagement, next steps for national digital identity

Facilitator: Veer Gosai

Veer Gosai is a South African cybersecurity researcher working across dark-web intelligence, vulnerability research, threat hunting, digital forensics and incident response. He currently leads The Nascent Group’s Security Research Unit and is the founder of Threat Dynamics, a specialist South African cybersecurity company.
He also works on the development of DarkNotify, a dark-web monitoring service, and DarkRisk, a third-party risk management platform. His work includes building custom monitoring capabilities to identify exposed identities, compromised corporate information and external risk signals affecting organisations.
Veer has also reported vulnerabilities to South African and international government bodies, public and private companies and is currently studying his undergraduate in a Bachelors of GeoInformatics (Computer Science) at Stellenbosch University in Cape Town

If you are new to the group, read our monthly meeting FAQ to answer some common questions (https://www.meetup.com/DeveloperUG/pages/Monthly_Meetings/).