AI is making scams smarter. Let's make people savvier.
Updated: Oct 26
Scammers have evolved from sending emails riddled with spelling errors to flawless AI-written messages and deepfakes. Here’s why the best defence is teaching people how manipulation works, not just what red flags to look for.
Some IT and cybersecurity teams have a description for clients and colleagues who may not be as technologically inclined as they are: PEBKAC. Problem Exists Between Keyboard And Chair.
I get the joke, but I don't think the people in the chair is the problem. The problem often is that nobody has explained things to them in a way that's easy to understand. And these days it's not only about understanding the technology, it's about understanding how scammers use this technology to manipulate us.
That was the starting point of my talk titled "AI-powered threats, human-powered defence" at the annual cybersecurity webinar of the South African Banking Risk Information Centre (SABRIC) on 14 October 2026, to an audience of people who fight financial fraud every day.
Artificial intelligence (AI) might be changing how scams look, but it isn't changing how they work. That's why a defence that will last isn't only better technology. It's teaching people to recognise when they're being manipulated.
The numbers show why this matters. According to SABRIC's latest annual crime statistics, at least R2.41 billion was lost to digital banking fraud in South Africa in 2025, and 89% of cases involved banking apps. In many cases, the scam started elsewhere – a phone call, email or text message convincing people to transfer money or approve a transaction, which then happens on the app.
A scam is disinformation with a payment request at the end
I didn't end up working in online safety through IT or cybersecurity. I spent more than two decades working with information, first as a journalist and sub-editor, checking facts before they were published. Later, as head of education and training at Africa Check, I trained thousands of people across Africa to recognise false information online. Over and over, the same thing became clear: the people who fall for false information aren't stupid. They're human.
Disinformation – false information that's deliberately shared to deceive – succeeds because it plays on emotion. It creates fear, anger (think about the online disinformation related to anti-migrant protests in South Africa) and urgency, and often wraps a lie around a kernel of truth. Those who disinform sometimes "borrow" credibility from people and organisations we trust, using the logo of a news outlet or the picture of a public figure to spread false claims.
Scams work in exactly the same way. A scam is simply disinformation with a payment request at the end: false information, deliberately shared, to get someone to act. It's often more about psychology than technology. It's about understanding how information is used to manipulate us to do things we wouldn't usually do.
In the disinformation field, fact-checkers use a technique called prebunking. They show people examples of disinformation before they are exposed to it, for example, in the lead up to elections, so that they are better equipped to recognise it when they do see it.
That's what AI-proof scam education needs to be. Scams are becoming more sophisticated by the day, so we have to show people how to recognise scammers' tactics before they're confronted with them.
How scammers' manipulation has levelled up
One of the biggest challenges is that, with AI, scammers can hide many of the red flags we used to warn people against.
Then: the stranded astronaut
Years ago, most scams could be spotted a mile away. One such claim about an astronaut who has allegedly been stuck on a Soviet space station since 1990 and needs $3 million to get back home, has been circulating since 2004. And, if you help him, reads the message, you'll be repaid from the US$15 million waiting for him in a trust fund. Yeah, right!
It's so absurd that it makes most people laugh. It's filled with red flags: the "STRICTLY CONFIDENTIAL" in the subject line in an email from someone you've never heard of, a story that's too strange to be true, and spelling and grammar errors.
Now: polished, personal and perfectly spelt
Scammers now use AI to rewrite a clumsy message with flawless grammar, a professional and caring tone, a customer's name, and a realistic-looking email signature and invoice.
Now: someone you trust
One of the bigger shifts is the false credibility that's being created with AI-cloned voices and deepfake videos. Scammers are using fake news clips, complete with familiar TV anchors and channel branding, "reporting" about investment platforms.
In June 2026, the Financial Sector Conduct Authority issued a warning about a deepfake advert using two respected financial journalists, Maya Fisher-French and Bruce Whitfield. Scammers took footage from a genuine interview and altered the audio, promising ridiculously good returns. Fisher-French told EWN: "The minute you put a credible person with a reputation behind it, something switches off in people's brains, and they don't think further than that."
A few weeks ago, the South African Reserve Bank warned about a WhatsApp group claiming to share daily stock tips from none other than Governor Lesetja Kganyago himself.
The technology keeps improving. Tools such as Google's Veo 3 can produce video clips that are almost impossible to tell apart from real footage with the naked eye.
Now: our own warnings, used against us
This is the part that concerns me most. Scammers have started using the industry's own safety advice to build trust.
When Zelda la Grange, who you might remember as a personal assistant of the late former South African president Nelson Mandela, shared her story of how she was scammed, she described a call from "Vodacom". The caller said all the right things: "Please note that this call is recorded for quality purposes." And: "Remember that Vodacom will never ask for any personal details such as your banking or log-in details." He then talked her through the transactions and she lost R6 000.
When the scammer says it first, the warning, "We'll never ask for your log-in details or OTP" might no longer be enough.
Same playbook, better disguise
However, whether it's a fake promotion, a deepfaked journalist or a bank's "fraud department" calling your elderly parents, the same manipulation tactics still show up:
In September 2025, a retired teacher from Edenvale lost more than R1.2 million after a WhatsApp call from "Rose", who claimed she was calling from South African Airways (SAA). The airline's logo appeared on screen, and Rose knew her full name, her ID number and when she'd last flown. Rose persuaded her to download a fake SAA app through a link she shared with her, rather than from an app store, in order to access a promotion that she alleged was ending that same day.
The retiree, who is in her early 60s, told the Bedfordview Edenvale News, she didn't provide an OTP, PIN, or any biometric verification. One bank said its investigation pointed to malware installed through the fake app, which enabled the fraudsters to take control of her device and perform transactions.
When real messages look like scams: three questions worth asking
There's an unintended side effect of all this. When scams look like the real thing, the real thing can start looking like a scam, and consumers end up not trusting anyone.
Zelda la Grange's post ended with a telling detail. She'd previously ignored her bank's reminders to FICA her business account until the account was blocked. "It was a legitimate request from the bank after all, but you simply do not know," she wrote.
That's understandable. But a world where customers distrust everyone isn't a safe one either – it's one where legitimate messages are ignored and people feel powerless because they don't know what to believe.
These are three questions I believe are worth asking:
Can customers verify every request inside the app? If a customer can always check a message, call or request in a channel they already trust, they don't need to take anyone's word for it.
Is there one simple rule they can always rely on? With some of the red flags being disguised by AI, is there one clear, consistent rule that customers should always stick to? Personally, I use and recommend two:
Never click on a link if you're not 100% sure it's safe to do so
Never repeat, say out loud or share any number that you receive in a message or that pops up on your screen with anyone
Do our real messages avoid scammers' tools, for example, links, deadlines and threats? Every time a legitimate message uses a link, a countdown, or a warning that an account will be blocked, it makes the scammers' versions look more real.
These questions apply far beyond banking. Mobile networks, retailers and government departments should ask them too.
We need people who can explain things
The cybersecurity industry needs more experts, but it also needs people who can communicate. According to the ISC2 Cybersecurity Workforce Study 2025, 59% of cybersecurity teams report critical or significant skills needs. And communication is the top non-technical skill that professionals say they need.
That gap shows up every day in the space between what experts say and what ordinary people hear:
None of the advice is wrong. It's accurate, important and well-meant. But advice only protects people if they understand it and can act on it in the moment, often while someone on the other end of the line is rushing them.
At the recent Africa Trust and Safety Workshop hosted by the Global Anti-Scam Alliance in Johannesburg, the working group I joined focused on cyberpsychology, culture and scam behaviours.
We discussed how we need cybersafety education that is preventative and ongoing, on channels people already use, such as radio and social media, and in the languages people speak at home. I further believe that this should be built on real case studies, with no blame or shame.
Our group's chair, Sharon Knowles of Da Vinci Forensics & CyberSecurity Specialists, summed it up perfectly:
"The answer is not to teach people to distrust everyone. It is to teach people how trust can be manipulated."
A shared responsibility
Banks, financial service providers, cybersecurity companies, government and law enforcement are all fighting the same crime from different sides. No single organisation can solve this on its own, and no technology can fully protect someone who doesn't recognise when they're being manipulated.
The encouraging part is that online-safety skills can be learnt. Once people understand how fear, hope, urgency and false credibility work on them, they're far more likely to pause before they act.
Yes, AI is making scams smarter, but it's all the more reason for us to make people savvier.
Sources
Disclaimer: NetSavvy's services and content are for educational and informational purposes only and do not guarantee protection against cyberthreats. While we aim to deliver high-quality online-safety education, training and consulting services, threat landscapes and scam tactics continuously evolve and no single solution can ensure complete protection. Our content is not, and is not intended to be, legal, financial or cybersecurity incident-response advice. Read our full disclaimer here.
Comments