AI Scams, Fake Voices and Fraudulent Payment Instructions.

Imagine receiving a voice note from your employer requesting an urgent payment, an email from your attorney advising that a trust account’s banking details have changed, or a telephone call from someone who sounds exactly like a family member asking for financial assistance. You recognise the voice, the message appears genuine, and the request seems urgent. You make the payment, only to discover later that the person you communicated with was a fraudster.

Artificial intelligence (AI) has made it easier for criminals to imitate voices, manipulate images, create convincing messages, and impersonate people or organisations. These techniques can make fraudulent communications harder to identify, especially when combined with traditional phishing, email interception, and social engineering.

For individuals, the financial and emotional consequences can be devastating. For businesses, a single fraudulent payment instruction can cause substantial financial losses, disrupted operations, and disputes over who is responsible.

South African law provides legal mechanisms to address certain forms of fraud and cybercrime. However, a victim’s legal options depend on the incident’s circumstances, the evidence available, the perpetrator’s identity, and whether the funds can be traced or recovered.

This article explains how AI-enabled scams operate, the relevant South African legal framework, the steps to take after discovering a fraudulent transaction, and the potential legal remedies available to victims.

Quick Answer: What Should You Do If You Have Been Scammed?

If you have just discovered that you paid a fraudster, act in this order:

1. Call your bank immediately and report suspected fraud.
2. Report the matter to SAPS and keep the case reference number.
3. Preserve all evidence (messages, voice notes, emails, invoices, proof of payment).
4. Secure your accounts by changing passwords and revoking suspicious sessions.
5. Warn anyone who was impersonated, using independently verified contact details.
6. Get legal advice on recovery, bank liability, and civil claims.

Each step is explained in detail below.

How Do AI-Enabled Scams Work?

AI-enabled scams use artificial intelligence or related digital tools to deceive individuals or businesses into disclosing information, granting access to accounts, or transferring money.

Although AI can make fraudulent communications more convincing, not every scam involves sophisticated technology. Criminals may combine AI-generated material with established fraud techniques to create a believable story and pressure victims to act quickly.

Common Types of AI Scams and Payment Fraud in South Africa

• Voice cloning: A fraudster uses an audio sample to imitate the voice of a family member, employer, colleague, or business associate and requests money or confidential information.
• Fake payment instructions: A criminal impersonates a supplier, client, attorney, or business executive and provides fraudulent banking details or requests payment into an alternative account.
• Business email compromise (BEC): A fraudster gains access to, or impersonates, a legitimate business email account to intercept correspondence, manipulate invoices, or redirect payments.
• Deepfake video calls: Artificially generated images or video are used to imitate a person during an online meeting, potentially misleading employees into believing that a payment instruction is genuine.
• Bank impersonation scams: A criminal pretends to be a bank employee or fraud investigator and convinces the victim to disclose sensitive information, approve a transaction, or transfer funds to a supposedly secure account.
• WhatsApp impersonation: A fraudster uses a compromised account, a fabricated profile, or a cloned voice message to create the impression that a trusted person is making a legitimate request.

These scams frequently rely on urgency, fear, trust, or authority. A victim may be told that a payment must be made immediately to avoid a financial loss, resolve an emergency, or prevent an account from being suspended.

The key point is that a communication that looks genuine does not necessarily mean the instruction is authentic or authorised.

Why Are Fraudulent Payment Instructions So Difficult to Detect?

Traditional scams often contain obvious warning signs, such as spelling mistakes, unfamiliar email addresses, or suspicious links. AI-enabled scams can be more convincing because criminals may reproduce a person’s speaking style, use familiar terminology, or create messages that resemble legitimate business correspondence.

In a commercial environment, a fraudster may know employees’ names, outstanding invoice details, the amount payable, and the expected payment date. This information can make a fraudulent instruction appear consistent with the business’s normal operations.

Example 1: The supplier banking-detail change. A business receives an email from what appears to be a regular supplier advising that its banking details have changed. The invoice contains the correct company name, reference number, and amount. If the business processes the payment without independently verifying the change, the money may be transferred to an account controlled by the fraudster.

Example 2: The family emergency call. A person receives a telephone call from someone whose voice resembles that of a relative requesting urgent financial assistance. The victim may act out of concern before they can independently confirm the request.

The Legal Framework: Cybercrime and Fraud in South Africa

South African law recognises various forms of unlawful conduct involving deception, unauthorised access to computer systems, and interference with electronic information.

The Cybercrimes Act 19 of 2020

The Cybercrimes Act 19 of 2020 is an important part of the legal framework governing cybercrime in South Africa. Among other things, it criminalises cyber fraud, cyber forgery, and cyber uttering, subject to the requirements of the relevant offences.

Section 8 of the Cybercrimes Act addresses cyber fraud. Broadly, the offence involves an unlawful, intentional misrepresentation made through specified computer-related means that results in actual or potential prejudice to another person.

Depending on the facts, conduct involving fraudulent payment instructions, manipulated electronic communications, or impersonation may fall within these provisions or other applicable criminal laws.

Does the Use of AI Change the Offence?

The fact that a fraudster used AI does not, by itself, determine which offence has been committed. The conduct, intention, method used, and available evidence must be considered.

A victim should therefore avoid assuming that every incident will be classified in the same way. The appropriate legal characterisation depends on the facts and the applicable law.

What If You Have Already Transferred the Money?

Discovering that a payment was fraudulent can be distressing, particularly where the money represents personal savings, business funds, or payment for essential services.

Although recovery may be difficult, victims should act immediately. Time is important because funds may be transferred between accounts or withdrawn before the relevant institutions can intervene.

Steps to Take After a Fraudulent Payment

1. Contact your bank immediately. Report the transaction as suspected fraud and request that the bank urgently investigate it. Ask whether the payment can be recalled, stopped, or traced, and whether the recipient account can be flagged or frozen through the appropriate process.
2. Contact the receiving bank where appropriate. Your bank may coordinate with the receiving institution. If you have the relevant details and can safely contact the receiving bank directly, report the suspected fraudulent transaction through its official fraud-reporting channels.
3. Report the matter to the South African Police Service (SAPS). Open a criminal case and retain the case reference number. Provide the available transaction details, communications, and other supporting evidence.
4. Preserve all evidence. Keep the original emails, WhatsApp messages, voice notes, telephone numbers, invoices, proof of payment, account details, and any correspondence with the suspected fraudster.
5. Secure affected accounts. If your email, messaging application, or banking profile may have been compromised, change the relevant passwords, revoke suspicious sessions where possible, and enable additional security measures.
6. Notify the relevant parties. If a supplier, attorney, employer, client, or family member was impersonated, inform them through independently verified contact details so that further fraudulent payments can be prevented.

A bank recall or recovery request does not guarantee that the money will be returned. Nevertheless, reporting the incident promptly may improve the chances of tracing the funds and preventing further losses.

Victims should also keep a record of every report made, the dates and times of communications, and any reference numbers provided by the relevant institutions.

Can You Hold the Bank Liable for the Loss?

One of the most common questions after a fraudulent payment is whether the bank can be held responsible for the money lost.

The answer depends on the circumstances. A fraudulent transaction does not automatically establish that the victim’s bank is legally liable, nor does it automatically exclude the possibility of a claim.

Factors That May Affect Bank Liability

Relevant issues may include:

• How the transaction was authorised.
• Whether the victim was deceived into approving the payment.
• Whether an account or payment instruction was compromised.
• The applicable banking terms and conditions.
• Whether the bank or another party acted negligently or breached a legal obligation.

For example, a dispute may arise where a victim alleges that a bank failed to respond appropriately to a reported fraudulent transaction or processed a transaction in circumstances that should have prompted further investigation. Whether such conduct gives rise to liability depends on the evidence and the bank’s applicable legal duties.

What If the Bank Refuses to Reimburse You?

If a bank declines a reimbursement request or disputes responsibility for the loss, the victim should request the reasons in writing and seek advice on the available options.

Depending on the circumstances, the victim may consider:

• The bank’s internal complaints process.
• An appropriate financial-sector dispute-resolution mechanism, such as the Ombudsman for Banking Services, where it is applicable to the complaint.
• Legal proceedings.

The merits of any claim should be assessed before proceedings are instituted. Do not assume reimbursement is guaranteed simply because the transaction resulted from fraud.

Can You Take Legal Action Against the Fraudster?

Where the perpetrator can be identified, and sufficient evidence is available, a victim may have grounds to consider civil proceedings to recover the loss.

The appropriate remedy will depend on the facts, the legal basis for the claim, the identity of the defendant, and whether the defendant has assets against which a judgment could be enforced.

Possible Legal Steps

• A civil claim for damages: Depending on the circumstances, a victim may have a claim arising from the fraud and the resulting financial loss.
• Urgent legal intervention: Where there is a proper legal and evidentiary basis, urgent proceedings may be considered to preserve assets or prevent further dissipation of funds. The requirements for the particular remedy must be satisfied.
• Execution of a judgment: If a victim obtains an enforceable judgment, the available execution procedures may be considered. However, a judgment does not guarantee recovery if the defendant has no recoverable assets.
• Criminal proceedings: Reporting the matter to SAPS may assist in the investigation and possible prosecution of the perpetrator. Criminal proceedings and civil recovery are separate processes, and a criminal complaint does not itself guarantee repayment.

Legal advice can help determine which remedies are realistically available and whether the likely cost and prospects of recovery justify further action.

What If a Business Pays a Fraudulent Invoice?

Businesses may face particular risks where payment processing depends on email correspondence, urgent instructions, or informal arrangements between employees and suppliers.

A fraudulent change of banking details can cause a business to pay the wrong recipient while its actual supplier continues to demand payment of the outstanding invoice.

The business may then face two separate problems:

1. Recovering the money transferred to the fraudster.
2. Determining whether its payment obligation to the genuine supplier has been discharged.

Businesses should therefore avoid assuming that a payment to a fraudulent account automatically settles the underlying invoice.

Steps a Business Should Take

Where a fraudulent payment has occurred, the business should:

• Notify its bank and report the transaction immediately.
• Inform the genuine supplier through independently verified contact details.
• Preserve the original invoice, correspondence, payment records, and relevant internal approvals.
• Review whether an employee’s email account or other business system was compromised.
• Assess the contractual position and obtain legal advice before making admissions or deciding how to address the outstanding invoice.
• Consider whether any insurance policy may respond to the loss and notify the insurer in accordance with the policy requirements.

The legal position will depend on the facts of the transaction. Businesses should obtain advice before deciding whether to pursue recovery, dispute an invoice, or make further payment.

Protecting Personal Information and Confidential Business Data

AI-enabled fraud may involve the unauthorised use of personal information, confidential business correspondence, or information obtained from compromised accounts. Where personal information has been accessed or acquired unlawfully, the Protection of Personal Information Act 4 of 2013 (POPIA) may be relevant.

Section 22 of POPIA addresses security compromises involving personal information. Where a responsible party has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the statutory notification requirements must be considered. The applicable obligations depend on the circumstances, including the nature of the information affected and the role of the organisation involved.

Practical steps may include:

• Securing affected systems.
• Preserving relevant evidence.
• Assessing the scope of the incident.
• Obtaining appropriate legal and technical advice.

Organisations should have an incident-response process that enables suspected breaches to be escalated promptly. A delayed response can increase the risk of further fraud and may complicate the investigation.

How to Prevent AI Scams and Payment Fraud: Practical Tips for Individuals and Businesses

Fraud prevention remains one of the most effective ways to reduce the risk of AI-enabled fraud. Although no verification procedure can eliminate every risk, individuals and organisations can take reasonable steps to make fraudulent transactions more difficult.

• Verify banking-detail changes independently: Call a known and previously verified telephone number rather than relying on the contact details contained in the message requesting the change.
• Introduce a second approval process: Businesses should consider requiring independent approval for significant payments and changes to supplier banking details.
• Do not rely on a familiar voice alone: If a family member or colleague requests an urgent transfer, verify the request through another trusted communication channel.
• Be cautious of pressure and secrecy: Requests to act immediately, bypass normal procedures, or keep a transaction confidential should prompt further checks.
• Obtain legal advice when necessary: Where a significant loss has occurred, responsibility is disputed, or recovery efforts are unsuccessful, legal advice may help identify the available remedies and the next appropriate steps.

A strong fraud-prevention process should not depend on whether a message looks genuine. It should require independent verification before sensitive information is disclosed or money is transferred.

Conclusion: Verify First, Act Fast, and Get Advice Early

AI-enabled scams, fake voices, and fraudulent payment instructions present serious risks to individuals and businesses. As digital communications become more convincing, it is increasingly important to independently verify financial instructions and respond promptly when fraud is suspected.

South African law provides mechanisms to address cybercrime, fraud, and certain forms of financial loss. However, the legal remedies available will depend on the circumstances of the incident, the evidence, the identity of the responsible parties, and the prospects of recovery.

If you discover that you have been deceived into making a payment, act immediately. Contact your bank, report the incident to SAPS, preserve all relevant evidence, and seek advice on your options.

Businesses should also assess whether contractual disputes, data-protection obligations, or internal security failures require further attention.

The most important lesson is that a familiar voice, a convincing email, or an apparently legitimate payment instruction should never replace independent verification. Where fraud has occurred, early action and proper legal guidance may help protect your position and improve the prospects of an effective response.

For further assistance with fraud, cybercrime, or disputes arising from fraudulent payments, consult an attorney at SchoemanLaw Inc in Cape Town or Paarl. We will help you understand your options and decide on the next step with confidence.