AI-powered scams in South Africa: build verification into everyday business

The recent warning: convincing content does not establish identity

In an opinion article published by SAnews on 12 October 2026, GCIS director Josias Pila highlighted the misuse of AI for voice impersonation, manipulated video and persuasive phishing. His central concern was the need for stronger public understanding and independent verification. This is a recent South African awareness message, not an announcement of a new attack against a particular business.

Eltrovema’s view is that this warning should prompt an operational review. Ask what evidence your organisation requires before someone changes banking details, resets access or sends confidential information. A process that depends on recognising a voice or trusting a professional-looking message leaves too much judgement with the person receiving the request. The useful starting point is the decision being requested, rather than the apparent quality of the communication.

Sources: [1]

Start with three business decisions that deserve a second check

Choose a small number of sensitive workflows and map who requests, verifies and approves each change. For many organisations, supplier bank-detail changes, urgent executive payment instructions and account recovery are sensible starting points. Include the channels actually used by your teams, such as email, phone calls and messaging applications. The objective is to find where a persuasive request can bypass a normal control.

For each workflow, define a pause point. A supplier change could require a call to an existing verified contact, followed by approval from a separate authorised person. An access reset could require the agreed identity-check procedure before any action. These are suggested process designs, not universal requirements: adapt them to your operating model, authority limits and service agreements. Document exceptions rather than allowing urgency to become an informal approval route.

Use a trusted channel that the requester cannot choose for you

The FBI’s guidance on malicious impersonation campaigns recommends confirming identity using independently obtained contact details. It describes a US campaign and should not be read as evidence that the same actors are targeting your organisation. The relevant operational principle is simple: a number or link inside a suspicious request is not an independent way to check that request.

Put that principle into a usable staff instruction. Tell employees where verified contact records are maintained and who owns updates to them. If the usual approver is unavailable, give them a defined escalation route rather than a reason to improvise. Practise an example involving a supposed director asking for an urgent exception. Success means following the verification process; it does not require the employee to prove whether a voice was generated by AI.

Sources: [2]

Keep identity and device protection in the same conversation

CISA’s Secure Our World guidance brings together phishing awareness, strong passwords, multifactor authentication and software updates. These are established protective measures, rather than a new October 2026 announcement. They provide useful context for an awareness programme, but buying a tool or completing a training module does not establish that a business process is safe.

Review implementation with your IT team or service provider. Which important accounts have the intended sign-in controls? Who follows up on exceptions? Can staff report a suspicious message without forwarding sensitive content widely? Connect those questions to the workflow review. Identity protection, email administration and employee guidance should reinforce each other, with clear ownership for changes and evidence that the controls operate across the relevant users and systems.

Sources: [3]

Run a short exercise and remove the friction it reveals

Use a fictional scenario rather than a real customer request. Ask finance, operations and IT to walk through a supplier banking change or an urgent access request. Identify the approved verification source, the person authorised to approve the change and the record that would be kept. Include an out-of-office situation so the exercise tests the escalation route as well as the normal process.

Record gaps in practical terms: an outdated supplier number, an unclear deputy approver or a reporting channel that nobody can find. Assign an owner and a target date to each improvement. Keep the exercise proportionate and avoid collecting passwords or unnecessary personal information. Its value comes from making the safe action easier to follow during ordinary work, not from catching employees out with increasingly elaborate demonstrations.

Turn awareness into an owned improvement plan

For the next review, choose measures that reflect your own processes. You could check whether sampled supplier changes have verification records, whether staff can identify the reporting route and whether high-risk exceptions have accountable owners. Treat these as internal management measures, not evidence of a guaranteed reduction in fraud. Review the findings with the people who perform and approve the work.

Eltrovema can help assess the connection between your security controls, identity administration and business workflows, then define a practical improvement scope. Start with the recurring decision that concerns you most and the outcome you need. A consultation should clarify responsibilities, priorities and an appropriate next step. The aim is a business that can question a convincing request and verify it consistently, while continuing to use AI productively.