For years the advice for spotting a scam rested on surfaces: the clumsy grammar, the odd accent, the video call they would not take, the logo that was slightly wrong. That advice worked because producing a convincing person was expensive. It is not expensive any more. A voice can be cloned from a few seconds of audio, a face can be worn on a video call, and the pitch that arrives sounds like someone you have reason to trust. This is about what actually changed, what did not, and which checks still hold when your own senses can be forged.
What a cloned voice can and cannot do
Voice cloning needs remarkably little material — a voice note, a few sentences from a recorded meeting, a clip lifted from social media. What comes out is close enough to pass on a phone line, where compression already strips away the detail your ear would use. It handles a scripted request well: an instruction, a request to confirm a payment, a short emotional appeal.
What it handles badly is the unexpected. A cloned voice is driven by someone who does not share the history you share with the real person. It can repeat what it was told; it cannot answer what only the two of you would know, and it cannot improvise around a question it did not anticipate. Almost every practical defence flows from that one weakness.
Deepfake pitches and the borrowed face
The second use is broader and less targeted. Investment adverts now circulate featuring public figures — business people, broadcasters, sometimes officials — appearing to endorse a platform they have never heard of. The footage is real, the words are not. Because the face is familiar and the setting looks like an interview, the endorsement does work that a stranger’s sales pitch never could.
These campaigns rarely ask for money on the spot. They ask for a click, then a phone number, and the call that follows is where the persuasion actually happens. By then the deepfake has done its job: it has lent the caller the credibility of someone you already respect.
Why “just get them on video” stopped working
The instinct to demand a live video call is sound, and it is weaker than it was. Real-time face replacement exists, it runs on ordinary hardware, and it is good enough for a laggy call on a phone screen. Poor lighting and an unstable connection — which the caller may well engineer — hide most of what would otherwise give it away.
That does not make video useless; it makes it insufficient on its own. Treat a video call as one signal among several rather than as proof of identity, and be sceptical of any call where the picture quality conveniently collapses the moment you ask something specific.
The checks that still hold
Synthetic media defeats recognition, so the checks that survive are the ones that never depended on recognising anyone:
- Change the channel. End the call and reach the person on a number you already had, not one they gave you. A clone cannot answer a phone it does not control.
- Ask something unscripted. Not a password — a shared detail, the place you last met, something that appears in no profile.
- Check the money, not the messenger. Whose name is on the receiving account, and does it match the firm? Payments to a private individual, to a third-party “payment agent”, or to an account changed at the last moment are the constant across every version of this fraud, however good the pitch.
- Verify the firm independently. An endorsement, whoever’s face carries it, says nothing about whether a platform is authorised. The register does.
- Let urgency be the signal. Synthetic or not, pressure to act before you can verify is the one element fraud cannot work without.
What this changes about being deceived
There is a quieter consequence worth naming. People taken in by a cloned voice often describe the shame as worse than the loss, because they are certain they ignored something obvious. Usually they did not. When the signal your judgement leans on — a familiar voice, a known face — can be manufactured, being convinced is not carelessness. It is the predictable result of a system built to convince.
That matters practically, not only emotionally: people who believe they were foolish tend to delay reporting, and delay is the one thing that genuinely narrows what can still be done.
If it has already happened
Preserve everything before it disappears — call logs, the number that showed up, any recording, the advert or profile that started it, and the full payment trail. Deepfake campaigns are pulled down quickly, sometimes by the operators themselves, so a screenshot taken today may be the only surviving record of what you were shown.
Then move on the money without waiting: notify the bank or provider, get a reference number, and open a case with the South African Police Service. Where the pitch involved an investment product or a financial services provider, the Financial Sector Conduct Authority is the body that wants to hear about it — and a report helps the next person who sees the same advert.
Finally, expect a second approach. People known to have lost money are a market, and the follow-up call offering to recover it — for a fee paid upfront, or in cryptocurrency — is often the same operation coming back. No legitimate service asks for wallet keys, seed phrases or an “unlock” payment.
