AFU Steps In To Recover Majority Of Funds After Sophisticated WhatsApp Scam At TFG

On Tuesday, 3 February 2025, Johanna Rademan received a WhatsApp message appearing to come from TFG’s chief financial officer, Ralph Buddle. Believing the communication was legitimate, she transferred over R22m into accounts controlled by the fraudsters.

Thanks to swift action by the AFU, led by Senior State Advocate Nomasomi Nodada-Gantolo, the majority of the funds were recovered, averting a potentially catastrophic financial loss for the retail giant. The case highlights both the risks of digital fraud and the power of rapid legal intervention.

The WhatsApp message advised Rademan that, following a board meeting, there were several key points that would impact TFG’s operations. The message further informed Rademan that she would have to sign a Non-Disclosure Agreement (NDA) so that Buddle could provide her with all the relevant details.

Red flags raised

On the same day, Rademan received a WhatsApp call from a person who introduced himself as Gerald du Plessis, a lawyer who assisted Buddle with the proposed acquisition. Du Plessis emailed the NDA to Rademan, and she signed it.

Du Plessis called Rademan again and discussed the process to follow regarding tranche payments that were required to be made, and that the instruction would come from the chief financial officer, Buddle.

Rademan received a WhatsApp instruction from Buddle that he had sent an email requesting two payments via the encrypted chat and that Rademan must please execute them as soon as possible, as it was quite urgent.

She received payment instructions from Buddle requesting payments to two separate bank accounts for the same company, ICUBED Distribution (Pty) Ltd, and the amounts were R11,785m and R11m, respectively.

Rademan sent an email instruction to Je-Anne Wagner, who is responsible for loading online banking payments, to execute the two payments. Rademan testified that something did not feel right later that evening after checking the telephone numbers on Truecaller. The individuals who contacted her did not correspond with the names on Truecaller.

She contacted the Group Financial Controller and raised her concerns. The Group Financial Controller confirmed that it was most probably fraud as Buddle would not contact a person via WhatsApp.

Funds swiftly recovered

Buddle and the Group Financial Controller contacted TFG relationship managers at the two banks where the millions of rands were deposited, and both banks confirmed putting a temporary block on the bank accounts.

On further investigation, it was established that Buddle was not aware of dealings with ICUBED Distribution, and he had not contacted Rademan in relation to payments. His cellphone number was different from the one that Rademan contacted.

One bank paid the R11,785m back to TFG, while Adv Nodada Gantolo engaged in an unrelenting fight to ensure that the criminals did not get away with the millions of rands. She obtained a preservation order for the R11m on 06 August 2025, and a forfeiture order on Tuesday, 3 February 2026.

Western Cape Director of Public Prosecutions, Adv Nicolette Bell, applauded the NPA’s Asset Forfeiture Unit (AFU) for its continued efforts to continue following monies stolen by suspected criminals and reclaim the monies.

The Asset Forfeiture Unit (AFU) will ramp up its efforts to deal with high-profile suspects, specifically using its novel (Chapter 6) civil forfeiture powers to claim back the stolen money, she said.