Three seconds of audio. That’s genuinely all it takes now to clone someone’s voice convincingly enough to fool the people who know them best. A WhatsApp voice note. A snippet from a reel. A few words from a livestream. If your voice exists anywhere online, the raw material is already out there.
Why this stopped being a foreign problem
It’s tempting to file this under things that happen elsewhere. It isn’t. SABRIC has warned that AI is making banking fraud in South Africa noticeably more convincing, and the FSCA has issued repeated warnings about deepfakes being used locally, including fabricated videos of public figures used to push fake investments. In 2024, a South African cryptocurrency exchange caught a fraud attempt built around a WhatsApp voice note from what sounded exactly like one of their executives, authorising a wallet transfer. Internal controls flagged it before money moved. That one had a good ending. Not all of them do.
What actually changed
The old advice for spotting a scam was to look for sloppiness. Robotic voice. Broken English. A blurry logo. Something slightly off in the phrasing. That advice is now useless, and that’s the part most people haven’t caught up to. AI removed the seams. Voice phishing attacks jumped by several hundred percent through 2025, not because criminals got smarter, but because the tools got cheap and the output got clean.
The two versions you’re likely to meet
The family emergency. A call, late, from someone who sounds exactly like your child, your parent, your sibling. There’s been an accident. They need money now. The panic is the actual attack, the voice is just what gets past your guard.
The business version. A voice note or call from someone who sounds precisely like your director, your accountant, your biggest client. An urgent payment needs authorising, banking details have changed, this needs to happen before end of day. It usually arrives inside a real email thread, which is what makes it land.
The thing that actually stops it, and it’s free
Agree on a code word. One with your family, another with your finance team. Something no one could guess and nothing that appears anywhere online. If a call is genuinely urgent and genuinely real, the person on the other end can say the word. If they can’t, you hang up and call back on a number you already have saved.
That second part matters as much as the first. Don’t call back on the number that just called you, and don’t use a number from the message itself. Use one you saved yourself, months ago, from a time you know was real. AI can copy a voice perfectly. It can’t intercept a call you initiate to a number it doesn’t control.
Three more things worth doing this week
- Refuse to act under a countdown. Urgency is the actual weapon here, not the voice. Any request that can’t survive a five-minute pause and a call-back was never legitimate.
- Add a second approver for payments. For any business, a rule that no payment above a set amount goes out on a single person’s say-so removes the entire attack surface for the business version of this scam.
- Think about what you’re posting. Long, clear voice clips of yourself and your family are training data. That doesn’t mean going silent online, it just means a bit more thought about which recordings are public.
Where DDS fits in
Payment approval rules, verification protocols, and staff who actually know what to look for are the practical layer that stops this from becoming an expensive lesson. That’s the kind of thing our IT infrastructure and security work is built around.
The bottom line
You can’t spot these by listening harder, the sloppiness that used to give scams away is gone. What still works is changing how you verify: a code word, a call-back on a number you already trust, and a firm refusal to act under pressure. Set the code word up today. It costs nothing and takes about a minute.