South Africans are increasingly being targeted by AI-generated fraudsters who sound just like bank employees. However, many local banks are still struggling with legacy tech, slow change processes, limited data visibility, and a risk that is growing faster than their response.
According to the 2026 Anti-Fraud Technology Benchmarking Report from the Association of Certified Fraud Examiners, which includes input from Sub-Saharan Africa, the AI‑driven fraud schemes most cited as having increased significantly over the past two years were deepfake social engineering (44%) and consumer fraud and scams (38%).
What’s more, over the next two years, significant growth is expected in genAI document fraud and forgery (55%), deepfake social engineering (55%), and deepfake digital injection (54%).
Despite this growing threat, the same report shows that only 7% of organisations are more than moderately prepared to detect and prevent AI-powered fraud.
“It’s not theoretical anymore. South African consumers are already speaking to well‑scripted AI agents posing as bank staff and being coached in real time over the phone to approve transactions and share credentials,” says Nishan Maharaj, fraud analyst at Entersekt. “In most cases, the fraudsters already hold key personal details like ID numbers, which instantly lowers a victim’s guard.”
Maharaj says this challenge is exacerbated by a growing gap between what consumers think banks will do for them, and what they actually can or will do when AI fraud is involved.
“The wider problem is that many consumers still believe their bank will catch fraud before it hits their accounts. But those days are gone. Once a customer is socially engineered into giving away login details or approving a transaction themselves, there is often no control that can fully protect them. South Africans need to develop a higher degree of fraud intelligence because the liability is now shifting toward them.”
While some banks have invested heavily in modernising their core systems, Maharaj says this security spend can remain trapped in a traditional mindset.
“Inside banks, fraud teams fight an uphill battle to secure budgets. Senior decision-makers look at current fraud losses of perhaps a couple of hundred thousand rand and weigh them against the cost of integrating sophisticated AI-based controls,” he shares.
“The uncomfortable business question is whether it’s just cheaper to absorb the current losses and adapt controls, which is often too late and reactive. What then gets missed, however, is how quickly that R200,000 exposure can jump to R10 million or R100 million once criminals find and exploit a weakness at scale.”
Banks face additional challenges that fraudsters aren’t encumbered by. According to Maharaj, local banks are incredibly competitive and remain understandably wary of sharing intelligence on confirmed fraud cases. The result is a cycle in which hard-won lessons remain siloed, even as losses mount.
Data privacy rules further complicate collaboration, with regulations like POPIA limiting how freely institutions exchange information on known fraudsters. Even within shared industry databases, conflicting signals (where the same ID is flagged as both victim and perpetrator) create uncertainty, reinforcing cautious and fragmented responses.
By contrast, fraud syndicates operate with a level of coordination that mirrors well-run enterprises, but with none of the regulatory pain. Maharaj describes organised networks that systematically test vulnerabilities across onboarding processes, branch staff, and call centres, before pooling insights to refine their tactics. “While banks treat fraud prevention as a competitive advantage, criminals treat it as a shared intelligence exercise,” he says.
Maharaj says financial institutions need a platform that evaluates biometrics, behaviour, device data, and transaction context in real time so that access, payments, and high‑risk actions are constantly re‑validated rather than protected by a single login event.
“The traditional approach has been to treat login as the main checkpoint, where if you’re in, you’re trusted. But in a world of AI-enabled social engineering and real-time coaching of victims over the phone, that model looks incredibly fragile,” Maharaj says. “Organisations that rely solely on rule-based systems will be left wanting.
“The emerging approach is continuous authentication, enabling banks to monitor behaviour and context across every login and transaction, rather than granting blanket trust at the front gate,” he says.
In digital banking, this approach would mean applying risk‑based controls to both logins and in‑session actions (such as adding beneficiaries, changing credentials, or initiating high‑value transfers), and adjusting authentication strength as risk changes.
“Continuous authentication is the equivalent of having keys to the front door, as well as for every room in the house, but still making the access seamless,” he says.
Maharaj adds that local banks no longer have the luxury of waiting. He warns that external pressure is beginning to mount, with international card schemes such as Visa and Mastercard enforcing fraud thresholds and imposing penalties and fines on non-compliant institutions.
South African banks can take heart that they are not facing this challenge alone. According to a new intelligence report from Liminal, global financial institutions are facing a sharp increase in AI‑driven identity fraud, with one institution reporting 8,065 deepfake attempts in eight months, tied to $347-million in verified losses.
“Continuous authentication, smarter analytics, and better consumer education are all part of the answer, but the first step is acknowledging that the balance of power has shifted. We can’t afford to be playing a constant game of catch-up,” Maharaj says.