Are USSD Codes Safe

Quick Answer

Yes, USSD codes are generally safe when you use an official code from the correct provider. They become risky when a code is sent by a stranger, fake support agent, social media post, SMS, WhatsApp message, or caller who pressures you to act quickly.

Last checked: 26 June 2026.

USSD is used by South African banks and mobile providers for everyday tasks such as checking balances, buying airtime, accessing cellphone banking, and managing prepaid services. For example, Nedbank describes its cellphone banking as a way to bank from a phone with no app, no data, and no smartphone, while Absa and Capitec publish their own official cellphone-banking USSD routes on their websites. (Nedbank)

The safety rule is simple: dial only codes you have verified on the official provider’s website, app, branch material, ATM screen, or verified support channel. Banking Association South Africa advises users to dial USSD codes only from trusted official sources, never share OTPs or PINs over USSD or during a phone call, and report suspicious codes to the bank or mobile provider immediately. (The Banking Association South Africa)

There is no single universal “safe USSD code” that can confirm whether all other USSD codes are safe. You must verify each code with the provider it claims to belong to.

Step-by-Step Instructions

1. Check where the code came from

Before dialling any USSD code, ask yourself: where did I get this code?

A USSD code is more trustworthy when it comes from:

• the official bank website;
• the official mobile network website;
• the provider’s official app or self-service portal;
• a branch, ATM, SIM pack, or printed provider document;
• a verified provider support page.

A USSD code is risky when it comes from:

• an unsolicited SMS;
• a WhatsApp broadcast;
• a social media comment or advert;
• a caller claiming to be from the bank or network;
• a stranger offering free data, refunds, rewards, loans, SASSA help, or account protection;
• a website that uses a provider’s logo but is not the official provider website.

SABRIC warns that criminals use tactics such as phishing, malware, and fraudulent SIM swaps to access confidential information and intercept OTPs sent by banks. (sabric.co.za)

2. Confirm the provider and task

Do not assume that one USSD code works for every network, bank, or service. A code for cellphone banking is different from a code for airtime, SIM services, subscription cancellation, or prepaid support.

Before using a code, confirm:

• which provider owns the code;
• whether it is for a bank, mobile network, government service, or another company;
• whether it applies to prepaid, contract, personal, business, or banking users;
• whether there are fees, limits, eligibility rules, or expiry conditions;
• whether the provider has changed the menu or replaced the code.

For broader navigation, use USSD codes South Africa. For bank-specific routes, use banking USSD codes South Africa.

3. Dial the code yourself

A safer USSD session is one that you start yourself after checking the code. Be careful when someone else tells you to dial a code while they stay on the phone.

Stop immediately if a caller says:

• “Dial this code to stop fraud.”
• “Read me the number on your screen.”
• “Give me the OTP so I can cancel the SIM swap.”
• “Press 1 to reverse the transaction.”
• “Enter your banking PIN to secure your account.”
• “Do not hang up or your account will be blocked.”

Real support teams should not need your OTP, card PIN, banking password, or app password. Banking Association South Africa specifically warns users not to share OTPs or PINs over USSD or during a phone call. (The Banking Association South Africa)

4. Read every screen before you press Send

USSD sessions often move quickly, but do not rush. Read each screen carefully before selecting an option.

The menu should match the task you intended to perform. For example, if you wanted to check a balance, the menu should not unexpectedly ask you to approve a payment, reset a profile, add a beneficiary, confirm a SIM swap, or change account access.

Exit the session if:

• the provider name looks wrong;
• the menu does not match the task;
• the wording is urgent or threatening;
• the screen asks for sensitive information unrelated to the task;
• you are asked to approve something you did not request;
• you do not understand what an option will do.

5. Keep a record if something goes wrong

If a USSD code fails, deducts airtime, triggers a suspicious alert, or leads to an unexpected menu, write down:

• the code dialled;
• the date and time;
• the provider name;
• the message shown on screen;
• any reference number;
• what action you selected;
• whether money, airtime, data, or account access was affected.

Do not share screenshots that show OTPs, PINs, ID numbers, full card details, or banking references with unofficial support accounts.

Important Notes Before You Use the Code

Warning signs

Treat a USSD code as suspicious if it is connected to fear, urgency, prizes, refunds, account blocking, or pressure.

Vodacom advises users to watch their phone connectivity and contact Vodacom immediately if they suddenly cannot make calls or receive messages, because this could indicate a SIM swap on the number. Vodacom also says users should never ignore a SIM-swap SMS alert. (VodacomNow)

What not to share

Never share these details with a caller, WhatsApp contact, SMS sender, social media account, or unofficial support page:

• OTP;
• banking PIN;
• app PIN;
• card PIN;
• online banking password;
• full card number;
• CVV;
• profile reset code;
• SIM-swap approval code;
• authentication code;
• full ID number unless you are inside a verified official provider process.

Even if the code itself is official, the situation may still be unsafe if someone else is guiding you through the menu.

Official verification steps

Use this process before trusting a USSD code:

1. Search for the provider’s official website yourself.
2. Do not use a link sent by a stranger or caller.
3. Find the provider’s own banking, prepaid, SIM, support, or self-service page.
4. Compare the exact code, including every *, number, and #.
5. Confirm whether the code is for your provider, account type, and task.
6. Check whether the provider mentions costs, access conditions, limits, or registration steps.
7. Use the official app, website, ATM, branch, or verified call centre if anything feels wrong.

For more detail on suspicious or copied codes, read fake USSD codes South Africa.

What to do if affected

If you think a USSD code has exposed your information or triggered an unauthorised action:

1. Exit the USSD session.
2. End the call or chat with the person who gave you the code.
3. Contact your bank or mobile provider using official contact details only.
4. Ask the bank to secure or freeze affected services if needed.
5. Change your banking PIN, app PIN, and passwords from a safe channel.
6. Check recent transactions, beneficiaries, debit orders, airtime purchases, and profile changes.
7. If your phone lost signal, contact your mobile provider urgently and ask whether a SIM swap was requested.
8. Ask for a case or fraud reference number.
9. Report the issue through the correct official fraud, cybercrime, or complaint channel.

The Department of Communications and Digital Technologies says the Cybersecurity Hub is South Africa’s national Computer Security Incident Response Team and works with stakeholders to identify and counter cybersecurity threats. (dcdt.gov.za)

If your complaint is about how a financial services provider handled the matter, the National Financial Ombud Scheme says consumers may approach it for free assistance with complaints against South African financial institutions. (nfosa.co.za)

For SIM-related risks, read SIM swap fraud South Africa.

Related Codes and Alternatives

USSD is useful when you do not have data, do not have a smartphone, or need quick access from a basic phone. But it is not always the best route for high-risk tasks.

Use an alternative to USSD when:

• the transaction is high value;
• you are adding or changing beneficiaries;
• you are resetting a profile;
• you are changing security settings;
• your phone was stolen;
• your SIM recently lost signal;
• someone contacted you first;
• the menu does not match your task;
• you feel rushed, confused, or pressured.

FAQs

Are USSD codes safe?

Yes, USSD codes can be safe when they are official, provider-specific, and used correctly. The main risk is not the USSD format itself, but fake codes, social engineering, SIM-swap fraud, phishing, and people tricking users into entering or sharing sensitive details.

What is the code for are USSD codes safe?

There is no single code that checks whether all USSD codes are safe. To verify a code, check the official provider website, app, ATM, branch material, or verified support page before dialling it.

Are USSD banking codes safe?

USSD banking can be safe when you use the bank’s official code and protect your PIN. South African banks such as Nedbank, Absa, and Capitec publish official cellphone-banking USSD routes and describe their cellphone-banking services on their own websites. (Nedbank)

The risk increases when a code is sent by a stranger, a caller keeps you on the phone, or a menu asks you to share an OTP, PIN, password, or approval code.

Do USSD codes need airtime or data?

USSD generally does not need mobile data. Some providers also state specific access rules for their own services. Nedbank says its cellphone banking works with no app, no data, and no smartphone, Absa says users do not need airtime to bank using Absa Cellphone Banking, and Capitec says its cellphone banking can be used for balances, airtime, and account access at no monthly cost. (Nedbank)

Always confirm the latest cost, airtime, and access rules with the relevant provider before using or publishing a code.

What should I do if a USSD code does not work?

Check that you typed the code exactly, including the star and hash symbols. Then verify the code on the official provider page. If it still does not work, use the official app, website, ATM, branch, or verified support route instead.

Do not keep retrying a code from an unknown SMS, WhatsApp message, or social media post.

Can a USSD code steal money?

A USSD code does not automatically steal money, but a fake or misused USSD process can trick you into approving transactions, exposing your PIN, sharing an OTP, adding a beneficiary, resetting a profile, or helping a criminal take over your number or account.

SABRIC warns that criminals may use phishing, malware, and fraudulent SIM swaps to obtain confidential information and intercept OTPs sent by banks. (sabric.co.za)

What should I do if someone told me to dial a USSD code?

Do not continue if the person is pressuring you, claiming there is urgent fraud, or asking you to read out numbers from your screen. End the call or chat, then contact the bank or provider yourself using official details.

What should I do if I receive an OTP I did not request?

Do not share the OTP with anyone. Contact your bank or provider immediately through official channels. An unexpected OTP can mean someone is trying to access, register, reset, or approve something using your details.

Is USSD safer than a mobile app?

Not always. USSD is helpful because it can work without data and on basic phones. A mobile app may offer clearer screens, notifications, biometric login, and stronger account controls. The safer choice depends on the task and whether you are using the official provider channel.

For sensitive actions, use the route that gives you the clearest confirmation and the easiest way to get official support.

Where can I find related USSD codes?

Start with USSD codes South Africa for the broader directory. For banking routes, use banking USSD codes South Africa. If you are worried about scams, read fake USSD codes South Africa and SIM swap fraud South Africa.