PROJECT: THE MATRIC LEAK SCAM
PLEASE SHARE THIS PUBLIC DOCUMENT
WHEN EXAMINATION ANXIETY BECOMES A CRIMINAL OPPORTUNITY
As South Africa’s 2026 National Senior Certificate examinations begin, learners and parents must remain alert to scams involving purported leaked examination papers. The Department of Basic Education has warned that social-media claims
about leaked 2026 examination papers are fake or misleading and may cause unnecessary confusion and panic.
The department has also urged learners to report suspected examination misconduct rather than circulate unverified material.
With 962,832 full-time and part-time candidates registered for the 2026 examinations, the potential reach
of examination-related misinformation is substantial. Criminals can exploit the pressure associated with matric results
by advertising confidential papers, demanding payment for supposed access or using the promise
of an academic advantage to obtain personal and financial information.
The public should understand the distinction between a verified examination breach and a fraudulent claim designed
to exploit learners. Both require attention, but they must be addressed through appropriate reporting and investigation.
Learners and parents should not only protect themselves from fraudulent sellers but also recognise that attempting
to obtain an unfair academic advantage through confidential examination papers is unethical.
Paying someone for supposed leaked papers supports a market built on dishonesty and may expose the buyer
to examination-related disciplinary action or further investigation, depending on the circumstances.
The responsible choice is to reject these offers, prepare through legitimate educational resources
and report suspicious activity to the relevant authorities.
HOW THE MATRIC LEAK SCAM OPERATES:
A common scam involves an individual or online account claiming to possess question papers before the scheduled examination. The material may be advertised through WhatsApp groups, Telegram channels, Facebook pages or other social-media platforms, with prospective buyers instructed to make payment before receiving access. The seller may provide screenshots, photographs of documents or previous examination papers to create the impression that the offer is genuine. In other cases, the individual may claim to have an insider within an examination authority, school or printing facility.
These claims should not be accepted without verification. A document that resembles an examination paper is not proof that it is authentic, and a person who claims to have confidential access may simply be attempting to obtain money or information from unsuspecting buyers. Once payment has been made, the seller may disappear, block the purchaser or provide material that has no connection to the forthcoming examination.
THE FINANCIAL AND DIGITAL RISKS:
The immediate financial loss is only one possible consequence of these scams. Criminals may also use the transaction to collect personal information that can support further fraud.
A prospective buyer may be asked to supply a full name, identity number, telephone number, banking details or proof of payment. The information may then be used for impersonation, phishing attempts or fraudulent transactions. Requests to install unfamiliar applications, open suspicious links or provide passwords and verification codes create additional risks.
Parents are also potential targets. A parent who is worried about a child’s examination performance may be more willing to pay for a supposed advantage, particularly when the seller claims that the opportunity is limited or that other learners have already purchased the material.
Pressure to act immediately is a warning sign, not evidence that the offer is genuine.
WHEN A CLAIM OF A LEAK IS NOT A SCAM BUT A SECURITY BREACH:
Although fake leak claims can be used to defraud the public, genuine examination-security breaches remain a separate concern.
In January 2026, the Department of Basic Education published interim findings concerning the 2025 National Senior Certificate examination breach. The investigation identified seven compromised papers across English Home Language, Mathematics and Physical Sciences, with the material circulated through a combination of electronic and physical methods. The department reported that the breach was localised and that further investigative and disciplinary processes were continuing.
This case demonstrated how confidential examination material can move beyond its source and reach learners through multiple channels. It also showed why a suspicious document should not automatically be dismissed as fake simply because scams are common. The correct response is to report the information so that the relevant authorities can establish whether a genuine breach has occurred. Members of the public should not attempt to verify the material by distributing it more widely.
WHY FORWARDING SUSPECTED PAPERS CAN MAKE MATTERS WORSE:
When a supposed leaked paper appears in a messaging group, recipients may forward it to friends, classmates or other groups in the belief that they are helping others prepare. This can increase the circulation of false information and, if the material is genuine, further compromise examination security. Learners should not download, purchase, distribute or use confidential examination material offered through unofficial channels. If suspicious content has already been received, the recipient should avoid forwarding it and report the matter to a teacher, school principal or the appropriate examination authority. Publicly posting the material in an attempt to expose the seller can also spread the document further and make it more difficult for investigators to contain the incident.
THE CONSEQUENCES OF BUYING OR USING LEAKED PAPERS:
Learners should not assume that purchasing a purported examination paper is a harmless transaction. Depending on the circumstances, knowingly obtaining or using confidential examination material may trigger an examination-irregularity investigation. Conduct involving theft, unauthorised access, fraud or the unlawful distribution of protected information may also require investigation under applicable law.
The consequences will depend on the facts and the individual's involvement. Receiving a suspicious message, purchasing a paper and knowingly participating in the unauthorised distribution of genuine examination material are not necessarily the same conduct and should not be treated as interchangeable.
The Department of Basic Education has reiterated its zero-tolerance approach to examination irregularities and has urged learners to report suspected wrongdoing. Candidates should seek academic assistance through their teachers and recognised educational resources rather than risk their qualifications through unofficial offers.
RED FLAGS FOR LEARNERS AND PARENTS:
The following warning signs should prompt caution:
A person offers a question paper before the scheduled examination.
Payment is demanded for access to confidential examination material.
The seller insists on secrecy or pressures the buyer to act immediately.
Screenshots or testimonials are presented as the only proof of authenticity.
The seller claims to have an unnamed insider or guaranteed access to official papers.
Personal information, banking details, passwords or verification codes are requested.
The seller directs the buyer to unfamiliar websites, payment channels or applications.
None of these signs alone establishes that a criminal offence has occurred, but they justify refusing the offer and reporting suspicious conduct.
WHAT TO DO IF YOU ENCOUNTER A SUSPECTED MATRIC LEAK:
Learners and parents should not pay for or circulate the material. Where possible, retain relevant information about the account, messages, payment request and contact details without opening suspicious links or putting personal information at risk.
Report the incident to the school principal or relevant provincial examination authority. Suspected criminal conduct should also be reported to the South African Police Service. The Department of Basic Education has confirmed that a 24-hour examination hotline is available for reports of suspicious activity; the current contact details should be obtained from an official departmental communication.
If money has already been transferred, contact the bank or payment provider immediately, explain that the transaction may involve fraud and request assistance in securing the account and tracing or disputing the payment where possible. Change compromised passwords and never disclose one-time PINs or verification codes to a seller.
Do not publicly identify or accuse a person based solely on a social-media post. Preserve relevant information and allow the appropriate authorities to establish the facts.
The matric leak scam exploits examination pressure for financial gain and may expose learners and parents to fraud,
identity theft and examination-related consequences. At the same time, genuine security breaches must be reported and investigated without spreading the material further or making unsupported accusations.
Learners should concentrate on legitimate preparation, while parents should treat offers of confidential examination papers
with caution. Where suspected criminal activity requires further investigation, SSS specialist investigators under the direction of Mr. Mike Bolhuis can assist with the assessment of relevant information and investigative support.
Specialised Security Services invites the public to the Mike Bolhuis Daily Projects WhatsApp Channel.
This channel is important in delivering insights into the latest crime trends, awareness, warnings and the exposure of criminals.
How to Join the WhatsApp Channel:
1. Make sure you have the latest version of WhatsApp on your device.
2. Click on the link below to join the Mike Bolhuis Daily Projects WhatsApp Channel:
3. Follow the prompts to join the channel.
4. Make sure you click on "Follow", then click on the "bell"-icon (🔔)
CONTACT MR MIKE BOLHUIS FOR SAFETY AND SECURITY MEASURES, PROTECTION, OR AN INVESTIGATION IF NEEDED.
ALL INFORMATION RECEIVED WILL BE TREATED IN THE STRICTEST CONFIDENTIALITY AND EVERY IDENTITY WILL BE PROTECTED.
Regards,
Mike Bolhuis
Specialist Investigators into
Serious Violent, Serious Economic Crimes & Serious Cybercrimes
PSIRA Reg. 1590364/421949
Mobile: +27 82 447 6116
E-mail: mike@mikebolhuis.co.za
Fax: 086 585 4924
Follow us on Facebook to view our projects -
EXTREMELY IMPORTANT: All potential clients need to be aware that owing to the nature of our work as specialist investigators there are people who have been caught on the wrong side of the law - who are trying to discredit me - Mike Bolhuis and my organisation Specialised Security Services - to get themselves off the hook. This retaliation happens on social media and creates doubt about our integrity and ability. Doubt created on social media platforms is both unwarranted and untrue. We strongly recommend that you make up your minds concerning me and our organisation only after considering all the factual information - to the exclusion of hearsay and assumptions. Furthermore, you are welcome to address your concerns directly with me should you still be unsatisfied with your conclusions. While the internet provides a lot of valuable information, it is also a platform that distributes a lot of false information. The distribution of false information, fake news, slander and hate speech constitutes a crime that can be prosecuted by law. Your own research discretion and discernment are imperative when choosing what and what not to believe.
STANDARD RULES APPLY: Upon appointment, we require a formal mandate with detailed instructions. Please take note that should you not make use of our services – you may not under any circumstance use my name or the name of my organisation as a means to achieve whatever end.
POPI ACT 4 of 2013 South Africa: Mike Bolhuis' "Specialised Security Services" falls under Section 6 of the act. Read more here: https://mikebh.link/fntdpv
SSS TASK TEAM:
Copyright © 2015- PRESENT | Mike Bolhuis Specialised Security Services | All rights reserved.
Our mailing address is:
Mike Bolhuis Specialised Security Services
PO Box 15075 Lynn East
Pretoria, Gauteng 0039
South Africa
Add us to your address book
THIS PUBLIC DOCUMENT WAS INTENDED TO BE SHARED, PLEASE DO SO.
