WeeklySA_AdminTRAP: AI is helping fraudsters impersonate relatives, employers and trusted suppliers. Independent checks before paying — and swift action after a scam — can help limit the damage…
By Annastacia Willemse
An urgent voice note from your employer. An email from your attorney announcing new banking details. A desperate telephone call from someone who sounds exactly like a relative.
The voice is familiar, the message looks genuine and the request seems reasonable. You transfer the money — only to discover that you have paid a fraudster.
Artificial intelligence (AI) is giving criminals more convincing ways to impersonate people and organisations. Voice cloning, manipulated images and fabricated messages can make deception harder to spot, particularly when combined with intercepted emails and stolen personal information.
Consumer guidance from SchoemanLaw warns that the consequences can extend beyond the initial financial loss. Individuals may lose savings, while businesses can face disrupted operations and disputes over unpaid invoices.
Although South African law provides mechanisms to investigate fraud and pursue recovery, getting the money back depends on the evidence, whether those responsible can be identified and whether funds or assets can be traced.
When trust becomes a trap
AI scams exploit familiar human responses: concern for a relative, respect for an employer or fear that a bank account is under threat.
A cloned voice may be used to request emergency assistance. A fabricated video call may appear to show a senior executive authorising a transfer. An impersonator posing as a bank investigator may instruct a customer to move money into a supposedly secure account.
Not every scam requires sophisticated technology. Criminals also use compromised WhatsApp accounts, false profiles and business email compromise, in which legitimate correspondence is accessed or imitated to redirect payments.
Correct details can make a fraudulent instruction particularly persuasive. An invoice may carry the supplier’s real name, the correct amount and an expected payment date — but list a criminal’s bank account. The safest response is to verify the instruction independently. Telephone the supplier using a number already held on record, rather than one supplied in the suspicious message. If a relative asks for urgent help, contact them through another trusted channel.
Pressure to act immediately, keep a payment secret or bypass normal procedures should trigger further checks.
Businesses should require a second, independent approval for significant payments and changes to supplier banking details. The process should apply even when an instruction appears to come from a senior executive.
Paid already? Act immediately
If you discover that you have transferred money to a fraudster, contact your bank’s official fraud-reporting service immediately.
Provide the transaction details and ask whether the payment can be stopped, recalled or traced, and whether the receiving bank can be alerted. Recovery is not guaranteed, but delays can give criminals time to move or withdraw the funds.
Report the matter to the South African Police Service and retain the case reference number.
Preserve original emails, invoices, WhatsApp messages, voice notes, telephone numbers, banking details and proof of payment. Keep a record of when you contacted the banks and police, who assisted you and any reference numbers issued.
Secure any affected email, messaging or banking accounts. Change compromised passwords, end unfamiliar account sessions and enable additional security measures. Also warn the person or organisation that was impersonated, using independently verified contact details. This may help prevent further losses.
Who carries the loss?
Being defrauded does not automatically mean that a bank must reimburse you. Equally, it does not rule out a claim. Responsibility may depend on how the payment was authorised, whether accounts were compromised, the applicable banking terms and whether a party breached a legal duty.
If reimbursement is refused, request written reasons and use the bank’s complaints process. Consumers can also approach the National Financial Ombud Scheme South Africa for free assistance with complaints falling within its jurisdiction. The scheme replaced the former Ombudsman for Banking Services and three other ombud offices in March 2024. NFOSA
Where a fraudster can be identified, civil proceedings may offer a route to recovery. In appropriate cases, urgent legal action may be considered to preserve assets. However, even a successful judgment may produce no repayment if there are no recoverable assets. A criminal investigation and a civil recovery claim are separate processes. Opening a police case does not itself guarantee that the money will be returned.
Businesses face an additional complication: paying a fraudulent account may leave the genuine supplier’s invoice unsettled. They should preserve internal approvals and correspondence, investigate any system compromise, assess their contractual obligations and notify insurers where relevant.
Legal protection starts with evidence
South Africa’s Cybercrimes Act provides for offences including cyber fraud, cyber forgery and cyber uttering. The applicable offence depends on the conduct and evidence; using AI does not, by itself, determine the legal classification.
Where personal information has been accessed unlawfully, organisations must also consider their obligations under the Protection of Personal Information Act. The Information Regulator says responsible parties must report security compromises and notify affected people as required; they should not wait for an investigation to be completed before reporting.
For consumers and businesses, the practical lesson is straightforward: build verification into every unusual payment request.
A familiar voice can create confidence. An authentic-looking invoice can lower suspicion. Neither should replace an independent check before money changes hands. – GoLegal
Anastacia Willemse is a candidate attorney at SchoemanLaw Inc
