AI Voice Clones and Deepfakes: The New Face of Impersonation Scams

Artificial intelligence has fundamentally changed what is possible in scam execution. Tools that once required expensive studios and skilled technicians can now clone a voice from three seconds of audio, generate a convincing video of any public figure, and produce personalised phishing emails at scale — all in minutes, for free or near-free. Scammers are using these capabilities aggressively, and South Africa is not immune.

AI-powered scams are not a distant future threat. South Africans have already been targeted by fake celebrity investment endorsements using deepfake video, virtual kidnapping calls using cloned family member voices, and AI-generated WhatsApp messages impersonating bank fraud departments. The technology lowers the skill barrier for scammers while raising the difficulty of detection for victims.

How AI is being used in scams

Voice cloning — the virtual kidnap call

Voice cloning requires only a few seconds of a person's voice — easily harvested from a social media video, voicemail greeting, or TikTok clip. Scammers use this clone to place calls impersonating a family member in distress: "Mom, I've been arrested and need bail money urgently," or "Dad, I've been in an accident — please send money to this number."

The voice sounds right. The emotional urgency is overwhelming. Victims often comply before stopping to think, because the combination of a familiar voice and a crisis bypasses rational evaluation.

Deepfake investment endorsements

Fabricated videos showing Patrice Motsepe, Elon Musk, and various South African politicians and celebrities endorsing investment platforms or crypto schemes have circulated widely on Facebook, YouTube, and WhatsApp. These videos are generated using AI and have no connection to the real individuals — who have no knowledge of or involvement in the schemes.

These endorsements lend false credibility to platforms that are entirely fraudulent, drawing in victims who trust the perceived authority of the endorser.

AI-generated phishing and smishing

Large language models can now produce grammatically perfect, contextually convincing phishing emails and SMSes that mimic your bank, SARS, a courier company, or your employer. Earlier phishing was relatively easy to identify through poor grammar and generic greetings. AI-generated phishing is personalised, well-written, and harder to dismiss.

Deepfake video calls

Some more sophisticated scams involve live or near-live deepfake video calls from "bank officials" or "government representatives." These use real-time face-swapping technology over video calls, making it appear that the caller is a real, legitimate person.

Common AI scam scenarios in South Africa

• A WhatsApp audio message from what sounds exactly like your spouse or child, asking you to send money urgently.
• A Facebook or YouTube ad featuring a well-known South African businessperson endorsing a "guaranteed" investment opportunity.
• A video call from a "Standard Bank fraud department" using a deepfake avatar.
• A perfectly written email from "SARS" about an overdue payment, with your correct name and tax number.
• A voice call from your "manager" asking you to process an urgent payment — the voice is cloned from a company video.

How to spot AI-generated content

For voice calls

• Urgency + money = automatic verification required. No real family emergency, bank call, or legal situation requires you to send money in the next 10 minutes. Genuine crises allow time for you to hang up and call back.
• Ask a question only the real person would know. A voice clone cannot answer questions about personal history, shared memories, or specific details it hasn't been trained on.
• Call back immediately on a saved number. Do not use any callback number the caller provides.

For videos

• Unnatural blinking or eye movement — deepfakes often struggle with realistic eye behaviour.
• Lighting inconsistencies — the face and background may not share the same light source.
• Audio that doesn't quite match the mouth movement, particularly on vowel sounds.
• The person only speaks directly to camera and doesn't interact naturally with the environment.
• The video appears only as an ad and cannot be found on the person's verified social media accounts.

For written messages

• Check sender email or number against known official contacts.
• Hover over links to see the actual destination URL before clicking.
• Be suspicious of urgency — AI-generated phishing still relies on urgency as its conversion mechanism.

How to protect yourself

Set up a family safe word

Agree on a word or phrase with immediate family that a caller must provide to confirm their identity in an emergency. Keep this private — it should never appear in writing or on social media.

Limit public audio and video of yourself

Scammers need source material to clone a voice or face. Limiting the amount of audio and video of yourself and family members on public social media reduces the available material, though even a brief clip can be sufficient for modern cloning tools.

Treat all investment endorsements with scepticism

Legitimate investment opportunities are not marketed through celebrity video endorsements on Facebook. Any such endorsement, regardless of who it appears to show, should be treated as a scam until independently verified through the FSCA register and direct contact with the company.

Report deepfakes

Report deepfake investment ads to the platform (Facebook, YouTube, TikTok) and to the FSCA. Report virtual kidnapping attempts to SAPS. These reports contribute to faster takedowns and law enforcement intelligence.

Frequently asked questions

Can I tell if a voice is AI-generated?

Sometimes, but not reliably. Current voice cloning tools produce output that most people cannot distinguish from the real person, especially under emotional stress. The most reliable protection is not trying to detect the fake, but applying the rule of always verifying financial requests through a known, separate channel before acting.

Is it illegal to create a deepfake in South Africa?

Using a deepfake to defraud someone is fraud, which is a criminal offence in South Africa. The Cybercrimes Act 4 of 2020 also covers certain forms of digital impersonation and data manipulation. However, law enforcement capacity to prosecute AI-facilitated fraud is still developing.

What should I do if I receive a virtual kidnapping call?

Stay calm. Ask the "victim" a question only they would know. Say you need to hang up to call them on their regular number before you do anything. Do not send money under any circumstances until you have confirmed the person is genuinely in danger by reaching them directly. Call the person's regular number immediately after hanging up.