News

The New Face of Fraud: How Impersonation Scams Are Tricking South Africans

Published

2 months ago

August 12, 2025

Chiraag

impersonation scams South Africa, cyberfraud rise SA, AI deepfake scams, phishing attacks South African companies, SAFPS impersonation report, caller line spoofing fraud, business email compromise SA, Joburg ETC

The scammer could be “you”

If you’ve ever picked up your phone to hear a familiar voice or read a WhatsApp from a trusted colleague, only to realise later it was a fake, you’re not alone. Impersonation scams, where criminals pose as someone you know to steal money or information, are sweeping across South Africa at an alarming pace.

Recently, journalists at the Daily Maverick received WhatsApps from someone using the name and profile picture of a senior colleague. The message was polite but urgent: they needed money transferred immediately. Fortunately, the newsroom smelt a rat, and the scam fell flat. Not everyone is so lucky.

A booming fraud economy

The South African Fraud Prevention Service (SAFPS) says impersonation fraud reports shot up by 356% between 2023 and 2024. Its CEO, Manie van Schalkwyk, calls it a new phase of crime that is “more sophisticated, more targeted, and more personal.”

It’s not just individuals being targeted. Mimecast’s 2023 State of Email Security report found 84% of South African organisations were hit by phishing or impersonation attempts. Add to that South Africa’s position as one of Africa’s leaders in data breaches, and you have a perfect storm: scammers have your name, ID number, address, and contact details before they even make contact.

Once leaked, that information often circulates for years on dark web marketplaces, ready to be reused in fresh waves of fraud.

How the scams work

Fraudsters use every channel they can, from “relative in trouble” SMS scams to intercepted invoices with swapped banking details and even calls that appear to come from your own number. Techniques include:

Caller line spoofing, which lets criminals fake the number on your screen.
VoIP header manipulation, which hides their true location.
Pre-RICAed SIM cards, bought cheaply and used to dodge identification laws.

These scams bypass South Africa’s SIM registration laws entirely, making it almost impossible to trace the true source of a call in real time.

Institutions are not immune

The damage isn’t limited to small victims. The Passenger Rail Agency of South Africa (PRASA) lost R30 million to phishing and impersonation attacks in 2023. Business email compromise (BEC), where attackers impersonate executives to request fake payments, remains one of the costliest cybercrimes in the country, according to Interpol.

Tony Anscombe, chief security expert at ESET, warns that without fixing the systems that allow these scams to happen, fighting cybercrime is like “playing Whac-A-Mole”; criminals will simply find new ways to exploit the same weaknesses.

AI is supercharging the threat

Artificial intelligence has made these schemes even harder to spot. The Financial Sector Conduct Authority (FSCA) has already flagged a rise in deepfakes, realistic AI-generated videos or voice clones used to trick employees into transferring funds or revealing sensitive information.

Some scams now involve live deepfake “drop-ins” on Zoom or Teams calls, complete with a fake executive approving a transaction in real time. AI can also churn out phishing emails tailored to your company’s tone and internal lingo.

Why the law isn’t enough

South Africa has strong laws on paper, from POPIA to the Cybercrimes Act, but enforcement gaps make life easier for scammers. The Information Regulator confirms it receives breach notifications, but many victims don’t report incidents quickly enough.

ICASA, which oversees telecoms, has no active caller ID authentication system to verify if the number you see is genuine before connecting the call. Cross-border spoofing calls remain virtually impossible to block.

How to protect yourself

While no single fix can stop all impersonation scams, layering defences is your best bet:

Verify unusual requests for money or sensitive data, even from trusted contacts.
Call back on an official number you already know or find on a verified website.
Enable multi-factor authentication on all accounts.
Slow down; urgency and secrecy are classic fraud markers.
Report scams to your bank, employer, and the police.

Most importantly, talk about it. Many scams rely on shame to keep victims quiet, but speaking up can help prevent someone else from being targeted.