Somewhere this week a South African bookkeeper received a voice note from her boss. Slightly rushed, background noise, the usual verbal tics. She could hear it was him. It wasn’t him.
That scenario is no longer exotic here. It’s a Tuesday.
We’re top of a table nobody wants to lead
Smile ID’s 2026 Digital Identity Fraud Report puts South Africa at the highest share of deepfake-driven fraud on the continent, with 22% of cases involving AI-generated impersonation. Across Southern Africa, close to nine in ten rejected identity verification attempts are now linked to AI-assisted impersonation or spoofing rather than old-fashioned forged documents.
The trajectory is worse than the level. Deepfake attempts in the region went from fewer than 200 a month in 2024 to more than 3,000 by the end of last year. A separate report published in the past fortnight found that deepfaked voice notes and clean phishing text have erased the tell-tale signs South Africans were taught to look for, alongside 8.72 billion spam calls in the first quarter of this year alone.
Two more numbers, both uncomfortable. Cloning a voice convincingly takes roughly three seconds of audio. And in controlled testing, about one person in a thousand can reliably identify a deepfake.
You are not the one in a thousand. Neither am I.
Your marketing is the training data
Here’s the part that turns a security story into a brand story.
Where does a criminal get three seconds of your voice? Your Instagram reel. Your LinkedIn video. The podcast you did for exposure. The site visit clip your videographer cut beautifully. Your face is on your About page because we all correctly advised you to put it there.
None of that was a mistake, and the answer is emphatically not to delete it. A business nobody can see is not safer, it’s just poorer. The material that makes you findable is the same material that makes you copyable, and that trade is worth making.
But it does mean the thing your marketing was quietly doing for twenty years has stopped working.
Recognition used to be the proof
Think about how trust actually operated before this. A customer recognised your voice on the phone. They recognised your logo on an invoice. They recognised the writing style in an email, the number that always calls them, the face in the video. Recognition was the verification. It was free, it was instant, and none of us ever thought about it.
Every one of those signals can now be manufactured for less than the price of a coffee. Recognition has been fully devalued as proof, and most businesses have not replaced it with anything.
That’s a marketing problem, not an IT one. Nobody is going to install software to fix it. What’s needed is a place customers can check, and being that place is a branding job.
Becoming checkable
The fix is unglamorous and mostly costs attention rather than money.
Publish one official set of details and make them impossible to miss. One phone number, one WhatsApp number, one email domain, in the same format everywhere a customer might look, on your site, your Google profile, your invoices, your signatures. Inconsistency is what fraud hides inside.
Put named humans on your website. Not a stock photo team, actual people with actual roles, so a customer can confirm that the person emailing them exists and does that job.
Tell customers how you communicate, in writing, on your site. We only email from this domain. Our banking details never change. If anything asks you to pay somewhere new, phone the number on our website, not the number in the message. That last sentence prevents most of the damage this class of fraud causes, and almost nobody publishes it.
Then hold the line internally. Any payment change gets verified on a number you already had, by someone phoning out rather than picking up. Say it out loud to your team, because roughly four in five companies have no plan for this at all, which mostly means the junior person is left to decide alone at 4pm on a Friday.
The upside nobody mentions
There is one, and it’s substantial.
When impersonation is this cheap, being verifiable becomes a genuine competitive advantage. The business with one clear number, real names, consistent details and a stated policy is the one customers trust with the invoice. The business with three different WhatsApp numbers, an info@gmail address and a website last touched in 2022 is the one they hesitate over, and hesitation is where the money goes elsewhere.
The tell-tale signs are gone. Customers know it, which is why they’re getting warier with everyone, including you. What’s left is giving them somewhere solid to check.
If a stranger can’t confirm you’re real in thirty seconds, that’s the thing to fix.