Who sank R30-m heist
A tale of beers, braais and cyber secrets
THE syndicate that pulled off one of South Africa’s biggest cyberheists ever banked on a young call centre agent to help them.
Boy Meshack Thekiso, 28, had a good job at the Postbank in Bloemfontein, Free State, when a trip to the tavern in June last year changed his life.
It was there that a former colleague and three others asked for his help to infiltrate the bank. Later, when he accompanied the group to a braai, he was given beer and a small amount in cash.
Within months he became the gang’s inside man, tasked with installing spyware on Postbank computers, obtaining unsuspecting colleagues’ passwords and increasing clients’ daily withdrawal limits to a staggering R500 000.
With Thekiso’s help, the syndicate pulled off their elaborate heist, withdrawing more than R30-million cash from ATMs in different provinces.
Now serving an effective 10year sentence after entering into a plea deal with the state, Thekiso’s confession, made in February after his arrest, details months of planning the heist. It also reveals how the tech-savvy criminals sought “protection” from a sangoma in the days after the robbery.
It was while drinking at the tavern, Thekiso said, that he was approached by a former colleague and three others, including one Moorosi Motsoane, also known as “Jimmy ”.
Motsoane invited Thekiso outside where his former colleague, who cannot yet be named, put pressure on him to work for them. The gang members also intimated that they knew where he lived and said the deal could earn him a lot of money.
Motsoane implied that other Postbank staff were living the good life since helping the gang.
Thekiso said he was not convinced, but later accompanied the group to a braai where Motsoane bought him a six-pack of Hansa beer and gave him R300.
The next day Thekiso again saw Motsoane, who wanted to know if he had considered the proposal. When Thekiso said he wanted no part of it, he was threatened. “Jimmy (Motsoane) again stressed the fact that they knew everything about me,” he said in his sworn statement.
Later that day Thekiso agreed to identify Postbank clients with large sums of money in their accounts, thinking this would be his only role. He was paid R8 000 and bought a new BlackBerry
Kekana showed him how to put a keyboard cable into the password reader and install a key logger in the machine
cellphone. Over the next few months he started feeding the syndicate details of bank accounts. But the gang wanted more from him and in November Motsoane invited him to a meeting at a Bloemfontein pub. There he met Kabelo Kekana, who was introduced to him as “KB”.
Kekana has since been named as the alleged mastermind behind the heist.
“He (Kekana) was in possession of a laptop, a computer case with a password reader and a network modem . . . The computer looked exactly the same as the boxes used by us at the Postbank call centre,” said Thekiso.
Kekana showed him how to put a keyboard cable into the password reader and install a key logger in the machine. He was warned by the others not to “screw up” the project, he said.
On December 21, just days before the gang pulled off the heist, Thekiso was given the same network modem and password reader to install on the computer of a colleague who was on leave. Once connected to the Postbank system, Kekana told Thekiso, he would “clone the system” to allow remote access.
Two days after Christmas Thekiso increased the daily withdrawal limits on 103 accounts to R500 000 a day.
“KB made it clear that I should not be involved at the withdrawals at the ATMs,” he said.
Instead, he would get his reward five days after a string of runners withdrew millions from ATMs across five provinces over a 72-hour period.
On January 5, Thekiso was called to meet with Motsoane and another syndicate member, Teboho Masoleng, in Bloemfontein. Thekiso was given R60 000, after which he drove to Welkom where he bought himself an “old” Toyota Conquest.
In a bid to thwart the police, Thekiso, Motsoane and Masoleng visited a traditional healer. “I was told that the aim and purpose of the ritual was to stop the investigations and to make it difficult for authorities to track and trace perpetrators,” he said.
“I was also informed that if I divulged information I will go insane, or the traditional healer will direct his spirits to kill me.”
Two more visits to the “healer” followed. “The traditional healer indicated there was a problem and he needed to tighten his things. He performed more rituals using a razor; the healer’s wife did the razor cuts on me,” said Thekiso.
Chillingly, Thekiso also reveals that he was told by another syndicate member there had been plans to kill him on February 4. But, as luck would have it, the police nabbed him on February 2.
Thekiso ’ s evidence has so far led to the arrest of Motsoane and Masoleng, who were each sentenced to 15 years. Like Thekiso, they pleaded guilty and turned state witness.
’
“
—
’ was a vegetable hawker from 1996 to 2002, where I first worked on my own, and later employed several people.”
He said he then became a taxi operator and ran a butchery in Atteridgeville as well as a petrol station. But after he sold off these businesses, his known sources of income ended.
“I am presently between jobs and
“
”