South Africa SIU unearths ghost‑worker fraud

South Africa’s Special Investigating Unit, or SIU, has spent the past two years tracing how COVID-19 wage-support money was diverted through fake employee lists, stolen identities and company accounts that should never have qualified for relief. The cases sit inside the Unemployment Insurance Fund’s Temporary Employer/Employee Relief Scheme, known as TERS, which was created to help workers and employers during lockdowns. Investigators say some claims used real people’s identity details without their knowledge, while others relied on “ghost workers” who did not exist at all. The result was the same: public money meant for wage support was paid out on the basis of fabricated payrolls. ### How did the fraud work in practice? TERS was designed to pay support to workers whose employers were affected by COVID-19 restrictions. That meant the system depended heavily on employer-submitted payroll data, identity details and banking information. SIU case updates show a recurring pattern: companies or individuals allegedly created false employee records, attached identity numbers to those records, and then routed approved payments into accounts that did not reach legitimate workers. In one April 2026 case involving Lubelo Hlomuka Holdings, trading as SA Scrum Assembly, the SIU said about R16.36 million was unlawfully received through ghost employees and then diverted through other accounts in what it said appeared to be a money-laundering pattern. ### Which recent case best shows the scale? Mpumalanga police and labour authorities announced on May 18 that three suspects had been arrested over an alleged R27 million TERS fraud involving more than 700 ghost employees. The Department of Employment and Labour said the arrests were carried out by the Hawks and formed part of a broader effort to protect UIF funds. (sanews.gov.za) Reporting carried by SA News and other local outlets said the suspects included a construction company director, his wife and his brother-in-law. Authorities allege the group submitted claims for workers who did not exist in order to obtain COVID-19 relief payments. ### Where does identity theft enter the picture? A March 2023 SIU-backed prosecution showed that the fraud was not limited to invented names. (labour.gov.za) In that case, a man was convicted after stealing the identity of a South African National Defence Force member and using it in TERS-related fraud, according to SA News. That earlier conviction helps explain why investigators describe these matters as more than payroll manipulation. (msn.com) Some cases involve identities of real people being inserted into false claims, making it harder for investigators to separate genuine high-volume pandemic claims from opportunistic fraud. That reading is supported by the mix of ghost-worker and identity-theft cases disclosed by the SIU and labour authorities. (sanews.gov.za) ### What other cases show the same pattern? The SIU said in August 2025 that Ntsebeng Marygold Moji and her company, Aqua Land and Swimming Services, were sentenced in the Free State over COVID-19 TERS fraud tied to ghost workers. The agency said the court found Moji guilty of fraud and money laundering. Another April 2026 matter involved Nako Mang Trading Enterprise CC, where the SIU said the company submitted about R19 million in fraudulent TERS claims and later faced preservation orders over its assets. (sanews.gov.za) In both the Nako Mang and SA Scrum matters, the SIU framed the alleged conduct as money being diverted away from workers the scheme was created to support. ### Why are asset freezes and tribunal orders featuring so often? (siu.org.za) The SIU has paired criminal investigations with civil recovery steps. In the SA Scrum case, it said the Special Tribunal froze a director’s assets worth more than R16 million. In the Nako Mang matter, the agency said it secured preservation orders over assets linked to allegedly fraudulent TERS claims. (sanews.gov.za) Those orders matter because they target the proceeds of the alleged fraud before money or property can be dissipated. The SIU, the Hawks, the UIF and the National Prosecuting Authority’s Asset Forfeiture Unit have all appeared in recent TERS announcements, showing how the cases are moving on both criminal and civil tracks. ### What happens next in this investigation stream? (siu.org.za) The SIU’s next steps are likely to remain visible through court appearances, Special Tribunal applications and agency statements tied to UIF TERS matters. The three Mpumalanga suspects arrested on May 18 are part of that pipeline, while older cases continue to move through sentencing, forfeiture and recovery stages. (witness.co.za) April and May 2026 updates show the agencies are still pursuing both fresh arrests and asset-preservation orders, suggesting the TERS cleanup is continuing well after the pandemic-era payouts ended. (sanews.gov.za) (labour.gov.za)