The short version
- A voice note or a video call is no longer proof of who is speaking. Cheap tools can copy a voice or a face from a short public recording.
- South Africa records the highest share of deepfake-driven identity fraud in Africa, according to Smile ID's 2026 fraud report.
- Staff cannot be trained to spot a good fake. They can be trained to verify every payment request through a second channel.
- Three rules stop most attempts: call back on a number you already hold, put two people on every payment, and never change bank details on the strength of a message.
What is a deepfake scam?
A deepfake scam is a fraud in which criminals use AI to copy a real person's voice or face, then use that copy to ask for money, access or information. In a business the target is usually someone who can release a payment, and the person being copied is usually their boss.
The best-known case is the engineering firm Arup. Hong Kong police said in February 2024 that a finance employee had joined a video call with people he believed were the chief financial officer and several colleagues. Every one of them was a deepfake. He made 15 transfers worth HK$200 million, about US$25.6 million, before he checked with head office. Arup later confirmed to CNN that fake voices and images were used. Nothing was hacked and no system was breached. A person was convinced.
How common are deepfake scams in South Africa?
South Africa records the highest share of deepfake-driven identity fraud in Africa, with 22% of cases involving AI-generated impersonation, according to WeeTracker's report on Smile ID's 2026 Digital Identity Fraud report. The report draws on more than 200 million identity checks run in 2025 across more than 35 countries, and found that nearly nine in ten rejected verification attempts in Southern Africa were linked to AI-assisted impersonation and spoofing. Those numbers come from a verification company's own data, so read them as a direction of travel and not as a census.
The local examples are easier to picture than the percentages:
- Fake endorsements. In June 2025 the Financial Sector Conduct Authority warned about deepfake videos of President Cyril Ramaphosa, Deputy President Paul Mashatile and Patrice Motsepe promoting an investment platform that promised R13,000 to R17,000 a day on a R4,500 deposit, as TimesLIVE reported.
- Executives copied on WhatsApp. The same WeeTracker report describes fraudsters impersonating Momentum Group's financial director, Risto Ketola, in an invite-only WhatsApp group in June 2025, using a photo taken from LinkedIn.
- Voice notes from "the FD". Richard Ford of the security firm Integrity360 told WeeTracker that finance staff are receiving WhatsApp voice notes that imitate their financial directors and ask for urgent payments.
Staff know they are exposed. In KnowBe4 research reported by Business Report in July 2026, 63% of South African employees said they would be unlikely to recognise a deepfake attack at work.
How does a deepfake payment scam work, step by step?
A deepfake payment scam follows five steps: research, cloning, a believable story, pressure, and a payment that is moved on within hours. None of the steps needs access to your systems, which is why antivirus and firewalls do not see it coming.
- Research. The criminals read your website and LinkedIn to learn who approves payments, who reports to whom and which suppliers you use.
- Cloning. A director's voice is copied from a webinar, a podcast, a conference talk or a voicemail greeting. A face is copied from video in the same way.
- The story. The request arrives with a reason that fits your business: a supplier has changed banks, a deal is closing today, an audit needs a deposit paid back.
- Pressure. Three levers are pulled together: authority ("this is the CEO"), secrecy ("keep this between us") and a deadline ("before the bank cuts off at three").
- The payment. The money lands in an account opened for the purpose and is split and moved on quickly, which is why the first hour matters more than the first week.
Can staff be trained to spot a deepfake?
Not reliably, and it is the wrong goal. The old giveaways, such as odd blinking, flat tone or a slight delay, are disappearing as the tools improve, and a compressed WhatsApp voice note hides most of what is left. A person who believes they can spot a fake is more dangerous than one who assumes they cannot.
Train the process instead. The question is never "does this sound like her?" The question is "has this request been confirmed on a channel the requester did not choose?" That is the same habit that defeats ordinary phishing, and it works whether the fake is good or bad.
Which controls actually stop deepfake fraud?
Deepfake fraud is stopped by payment controls that do not depend on recognising anyone: a call-back on a known number, two approvers on every payment and a fixed procedure for changing bank details. The table matches each common attack to the control that breaks it.
| Situation | What the attacker is counting on | The control |
|---|---|---|
| An urgent payment request by voice note or phone call | Authority and time pressure | Hang up and call back on the number already saved in your phone or payroll system, never the number that contacted you |
| A supplier says their banking details have changed | Finance updating the record without checking | Confirm by phone using the contact on the original contract, and use your bank's account verification before the first payment |
| A video call with several "executives" | Seeing is believing | Two-person approval inside the banking platform above a set amount. Nothing is approved on a call |
| An instruction to keep the request confidential | Isolation from colleagues who would question it | A standing rule that a request for secrecy is itself a reason to escalate |
| "IT" asks for a one-time PIN, a password reset or remote access | Helpfulness | IT never asks for codes. Staff phone the helpdesk number they already have |
Two supporting measures make the controls stick. Agree a family-style code word among directors and the finance team for genuine emergencies, and switch on multi-factor authentication everywhere so that a cloned voice cannot be used to talk someone into a password reset that actually works.
What should a business do if it has already paid?
Phone your bank's fraud line immediately and ask for the payment to be recalled or the receiving account frozen, because speed is the only thing that recovers money. Then work through the rest in order.
- Call the bank first. Do it before you investigate, before you tell the board and before you email anyone.
- Keep the evidence. Save the voice notes, numbers, emails and screenshots. Do not delete the chat or block the number yet.
- Report it to the police. Cyber fraud is a crime under the Cybercrimes Act. Open a case and keep the case number, because your bank and your insurer will ask for it.
- Check for a data breach. If personal information was exposed along the way, POPIA requires you to notify the Information Regulator and the people affected as soon as reasonably possible. The POPIA checklist covers what a notification needs.
- Tell your staff what happened, without blame. The person who paid followed an instruction that looked real. People who are punished for reporting stop reporting.
How can AMEA help protect a business from deepfake fraud?
AMEA Technologies puts in place the three layers that make these scams fail: multi-factor authentication on every account, staff security awareness training and a written incident response plan. The plan matters because the first hour decides whether money comes back. AMEA's cybersecurity service covers all three for businesses and nonprofits across South Africa, and the free IT health check scores where you stand in twelve questions.
What are the sources for this article?
- CNN, 16 May 2024: Arup confirmed as the victim of the Hong Kong deepfake video call fraud.
- WeeTracker, 19 March 2026: Smile ID's 2026 Digital Identity Fraud report and South African examples.
- TimesLIVE, 13 June 2025: the FSCA's warning about deepfake investment videos.
- Business Report, July 2026: KnowBe4 research on South African employees and deepfakes.