After turning 18, I discovered that someone had used my identity to claim South Africa’s Social Relief of Distress grant. What began as a personal case of identity fraud led me to uncover something far bigger. A API weakness in the public application portal allowed me to test national ID numbers, revealing that fraudulent grant applications were being submitted at a systematic scale.
This talk follows how I turned one suspicious application into a national investigation, validated the pattern, responsibly disclosed findings and ultimately presented the evidence before South Africa’s Parliament. I will break down missing rate limits, weak identity verification and failures that left victims with no way to recover. This is the story of how one overlooked API exposed serious weaknesses in a welfare system relied upon by millions of South Africa's Poorest Individuals, all for a R350 (21$ / 18Fr.) welfare grant for unemployed people.
