AI phishing, deepfakes and payment fraud: African organisations must verify trust differently

The fraudulent request no longer needs to look clumsy

Business email compromise (BEC) succeeds when an employee believes a senior executive, supplier or partner has requested a legitimate payment. Spelling errors, unusual wording and weak contextual knowledge once exposed some attempted scams. Generative AI reduces those warning signs by enabling polished, contextual messages in the target's language. Voice or video cloning can add apparent human confirmation to the same fraudulent request.

On 16 March 2026, INTERPOL published its Global Financial Fraud Threat Assessment 2026. It states that threat actors operating in the African region, particularly in West and Southern Africa, are increasingly leveraging AI, deepfake technology and automated phishing tools to commit fraud at scale. At the global level, INTERPOL assesses AI-enhanced fraud as 4.5 times more profitable than traditional methods.

Confirmed African fraud activity and the limits of AI attribution

The scale of digital fraud affecting African markets is not hypothetical. During Operation Red Card 2.0, conducted from 8 December 2025 to 30 January 2026, authorities in 16 African countries made 651 arrests. INTERPOL reports that investigated scams were linked to losses exceeding USD 45 million, with 1,247 identified victims, 2,341 seized devices and 1,442 malicious IP addresses, domains or servers taken down.

The cases disclosed by INTERPOL describe recognisable operational models. Nigerian police dismantled a high-yield investment fraud network using phishing, identity theft, social engineering and fake digital-asset investments. Kenyan authorities arrested individuals associated with fake investment offers promoted through messaging applications, social media and fabricated testimonials. In Côte d'Ivoire, fraudulent mobile loan applications and messaging services harvested sensitive personal and financial data from vulnerable targets.

It would nevertheless be inaccurate to state that every Red Card arrest involved proven AI use. The operational release documents fraud infrastructure and methods; INTERPOL's separate assessment establishes that AI, deepfakes and phishing automation are increasingly being used by actors in the region. Taken together, the sources justify stronger controls. They do not provide public forensic attribution for every investigated incident.

Why African organisations face material exposure

African economies are expanding digital payments, mobile banking, messaging-based commerce and remote relationships with suppliers and agents. These efficiencies frequently rely on informal trust signals: a WhatsApp instruction from a manager, a voice call from a finance director, or new bank details emailed by a familiar vendor. Convincing synthetic communications are designed to exploit exactly those shortcuts.

An offender may not need to compromise core infrastructure. A lookalike email address, a changed invoice, public procurement information and a short cloned voice recording can be enough to trigger an authorised payment. A small company, government agency, NGO, bank or telecom operator can effectively approve the theft itself. Strong network security cannot compensate for a payment process that accepts an apparently familiar voice or video as approval.

Move from recognition to verification

Deepfake resilience cannot depend on staff reliably recognising an artificial voice or imperfect video. Synthetic quality changes quickly, and urgent payment requests are engineered to reduce reflection time. Effective control makes an imitation insufficient to authorise the action.

Any new beneficiary or exceptional transfer should be confirmed through a pre-established channel separate from the original request. An urgent executive instruction should require two-person approval and a call back to an already registered number, not the contact details supplied in the message. For valuable accounts, phishing-resistant authentication should replace reliance on SMS codes or personal information that can be obtained and convincingly presented by an impersonator.

A continental governance issue

The African Union's Continental Artificial Intelligence Strategy, endorsed in July 2024, seeks responsible AI adoption while minimising risks. AI-enhanced fraud demonstrates why implementation cannot sit only with innovation ministries. Cybersecurity authorities, financial regulators, central banks, telecom providers, public administrations and law enforcement need shared scenarios, reporting channels and disruption procedures.

African markets also need usable evidence of their own risk: BEC volumes, blocked or recovered amounts, attack channels, confirmed synthetic media use and reporting times. Without common reporting categories and aggregated publication, organisations can underestimate the threat or procure detection products without repairing the authorisation processes that fraudsters exploit.

Priority operational decisions

• Require out-of-band call-back and two-person approval for changes to bank details, urgent payments and transfers above defined risk thresholds.
• Train finance, procurement, customer support and executives to treat voice, video and senior-looking messages as challengeable inputs, never standalone proof.
• Deploy phishing-resistant authentication for high-impact email, administrative and payment accounts.
• Create rapid channels among banks, fintech providers, telecom operators, CERTs and police to freeze funds, preserve evidence and exchange indicators.
• Include synthetic voice or video payment fraud in incident exercises and measure the time required to halt a transfer.

Conclusion

Official reporting now supports a careful but urgent conclusion: fraud actors connected to African markets are increasingly making use of AI and deepfake capabilities, while recent operations demonstrate the scale of cyber-enabled financial fraud on the continent. The objective is not to label every scam an AI incident without evidence. It is to remove the weakness that AI exploits: no organisation should release money, access or identity changes merely because a message, voice or video looks familiar.

— ◆ —