A customer calls his bank's contact centre to change the phone number linked to his account. His voice sounds familiar. He knows his date of birth, his last transaction, and the answers to the agent's security questions.

The agent completes the required checks and updates the number. Hours later, an unauthorised transaction is reported.

Now imagine the caller was never the customer. His voice was generated using AI, and his personal information came from data exposed online.

This hypothetical scenario illustrates a growing challenge for banks: what happens when the information and identity signals used to establish trust can be convincingly imitated?

Deepfake social engineering makes that question increasingly important. For African banks, the risk extends beyond onboarding to account recovery, customer support, transaction approvals, and changes to sensitive account information.

What the 2026 Fraud Data Reveals

Deepfake fraud is no longer a distant concern.

The 2026 Anti-Fraud Technology Benchmarking Report from the ACFE and SAS surveyed 713 fraud professionals across eight regions.

Its findings reveal how quickly AI-assisted fraud is developing:

• 77% reported an increase in deepfake social engineering over the preceding two years.
• 72% reported an increase in deepfake digital injection attacks.
• 55% expected deepfake social engineering to increase significantly over the following 24 months.
• Only 7% considered their organisations more than moderately prepared to detect or prevent AI-enabled fraud.
• 84% identified financial or budgetary constraints as a moderate or major challenge to implementing anti-fraud technology.

These findings represent fraud professionals across multiple industries and regions, not African banks specifically. Banking and financial services was one of the largest groups surveyed, however, making up 23% of respondents.

Regional intelligence points to a similarly concerning environment.

According to INTERPOL's African Cyberthreat Assessment Report 2026, AI enables 55% of reported cybercrime across Africa. The financial impact is growing quickly: cybercrime-related losses in Africa have more than doubled since 2024, from USD 192 million to USD 484 million.

The report also describes how criminals combine genuine personal information with fabricated details to create synthetic identities that can be used to open bank accounts, obtain mobile loans and register SIM cards.

INTERPOL identifies a structural weakness that makes this harder to stop. Banks, telecoms and law enforcement lack real-time data sharing, which creates a blind spot in efforts to combat financial fraud. A fraudster who controls a SIM card registered under a false or stolen identity can exploit that gap.

The two reports measure different things, but together they illustrate why African financial institutions need to reassess how they establish and maintain trust in a customer's identity.

How Deepfake Social Engineering Exploits Banking Security Gaps

Deepfake fraud does not always require an attacker to break into a banking system.

Sometimes, the attacker only needs to convince an employee or customer to complete an action on their behalf.

Three weaknesses are particularly important.

1. Voice and video impersonation can undermine identity checks

Voice authentication and video-based verification help banks establish whether someone is who they claim to be.

But AI-generated speech can imitate a familiar voice, while manipulated video can make an impersonator appear to be a legitimate customer.

This creates problems when a contact centre treats a convincing voice as sufficient evidence to approve a sensitive request.

It also introduces risks for remote identity verification.

Gartner reported that digital injection attacks increased by 200% in 2023. In the same release, it predicted that by 2026, deepfake attacks on face biometrics would lead 30% of enterprises to stop treating those verification tools as reliable in isolation.

Unlike an attacker holding a fake image in front of a camera, a digital injection attack can feed manipulated media directly into a verification application. Gartner notes that current standards for presentation attack detection do not cover these injection attacks.

That means banks need to consider more than whether a face appears live. Gartner recommends combining presentation attack detection with injection attack detection and image inspection, then adding further signals such as device identification and behavioural analytics.

2. Stolen personal information can make impersonation more convincing

Banks have traditionally used personal information to confirm identity during customer support interactions.

An agent might ask for a date of birth, address, recent transaction, or other details associated with the account.

The problem is that some of this information may already be available to an attacker through leaked records, phishing, compromised accounts, or social engineering.

When those details are combined with a convincing cloned voice, the attacker may appear legitimate even though the real customer is not involved.

This is why knowledge-based questions should not be the only control protecting sensitive account changes.

3. Fraudsters target account activity after onboarding

A bank may have verified a customer's identity when the account was opened. That verification establishes a starting point, but it does not guarantee that every future interaction comes from the same person.

Consider a request to replace the phone number associated with an account.

If the bank approves that change based only on information provided during a call, an attacker may gain access to a communication channel used for subsequent account recovery or authentication.

This can create risks similar to a SIM-swap attack. In both cases, an attacker may gain control of a communication channel used for account authentication or recovery, potentially allowing them to receive one-time passcodes and recovery messages intended for the customer.

The same concern applies to changes in payout accounts, beneficiary details, transaction limits, and other sensitive settings.

The central problem is not simply that deepfakes are becoming more realistic. It is that some banking workflows place too much trust in a single identity signal.

What African Banks Can Do to Reduce Deepfake Fraud Risk

Defending against deepfake social engineering requires more than adding a new detection tool.

Banks need controls that consider who is making a request, the circumstances surrounding it, and the consequences if the request is fraudulent.

1. Identify the account changes that carry the greatest risk

Start by reviewing sensitive actions within the customer journey.

These may include changes to registered phone numbers, password resets, beneficiary additions, large transfers and account recovery requests.

For each action, determine whether the existing verification process provides enough assurance.

A phone number change, for example, should not necessarily rely on the same controls used to answer a routine balance enquiry.

2. Re-authenticate customers before high-risk actions

A successful KYC check at onboarding should not serve as permanent proof of identity.

Banks can introduce additional identity checks when a customer attempts a sensitive action, such as recovering access to an account or initiating a high-value transaction.

Biometric re-authentication with liveness verification can provide another identity signal without requiring customers to repeat the entire onboarding process.

Choose the authentication method to match the risk. A one-time passcode sent by SMS may be insufficient for a phone number change or account recovery, particularly when an attacker may already control the customer's number.

However, biometric checks are not infallible. Banks should evaluate the technology's ability to withstand presentation attacks, digital injection, and other forms of manipulation.

3. Confirm sensitive requests through an independent channel

When a customer requests a change to sensitive account information, confirmation should not depend entirely on the same conversation.

For example, a request to replace a registered phone number could trigger confirmation through an existing trusted banking app or another previously established channel.

The bank should not send the confirmation exclusively to the new number supplied by the caller.

For especially sensitive changes, banks can also introduce additional review or temporary restrictions until the request has been verified.

4. Monitor device and behavioural signals

Identity verification establishes one part of the picture. Device and behavioural information can help reveal inconsistencies.

A customer may have passed an identity check, but other signals could still raise concerns:

• An unfamiliar device is accessing the account.
• The customer is connecting from an unusual location or network.
• Several account recovery attempts occurred before a successful login.
• A new beneficiary is added shortly before an unusually large transfer.
• Multiple high-risk actions occur in a short period.

None of these signals proves fraud on its own.

Together, however, they may justify additional verification, manual review or another appropriate control.

5. Strengthen contact centre procedures

Contact centre employees are particularly exposed to social engineering because they routinely handle customers who need help accessing or updating their accounts.

Banks should train agents to recognise suspicious behaviour, including attempts to create urgency, discourage verification or pressure employees into making exceptions.

More importantly, employees need clear escalation procedures.

An agent should know when to stop processing a request, what additional checks are required, and who can authorise an exception.

For the highest-risk changes, requiring an independent second approval may provide additional protection.

How Dojah Supports Layered Fraud Prevention

Deepfake social engineering shows why identity verification and fraud monitoring need to work together.

Dojah provides tools that can support different stages of this process.

EasyAuth: Re-authenticate customers at sensitive moments

Dojah EasyAuth enables businesses to re-authenticate returning users through liveness verification without repeating the full identity verification process.

A returning customer performs a fresh liveness check, which is matched against a previously registered liveness record. The result is available through the EasyAuth dashboard and webhook integration.

For a bank, this can introduce an additional identity checkpoint before high-risk activities such as account recovery or sensitive transactions.

EasyAuth needs a liveness record to compare against. That record comes either from an EasyOnboard session that included a liveness step or from a direct EasyAuth registration. The EasyOnboard flow must be linked before the customer completes onboarding, because linking it later does not backfill existing sessions. A bank adopting EasyAuth for existing customers should plan to register them first.

EasyAuth also supports authentication methods such as OTP, PIN, and magic links. For sensitive actions like phone number changes and account recovery, banks should avoid relying solely on SMS-based verification, particularly when the customer's phone number may already be compromised. Biometric re-authentication with liveness checks can provide an additional layer of identity assurance.

EasyAuth should form part of a broader control strategy rather than being treated as a guarantee against every form of deepfake attack.

EasyDetect: Assess suspicious behaviour beyond identity checks

Dojah EasyDetect supports fraud monitoring through behavioural intelligence, device analysis, transaction monitoring and configurable rules.

Banks can use these capabilities to assess signals beyond the customer's identity alone. Each event sent to EasyDetect receives a real-time Allow, Block, or Review verdict based on the bank's configured rules and risk policies.

Events flagged for review can become cases for the bank's fraud team to investigate. These insights help banks identify suspicious activity and determine when additional verification, investigation, or intervention is necessary.

For example, a high-value transaction following unusual account activity may warrant additional investigation before the bank proceeds.

By combining identity assurance with behavioural and transaction monitoring, banks can make more informed decisions about when to approve an action, request further verification or investigate.

Building Fraud Defences That Do Not Depend on a Single Identity Signal

Deepfake technology is making it easier for attackers to imitate familiar voices, appearances and identities.

For banks, the challenge is not only detecting manipulated media. It is designing processes that remain secure when an attacker can present convincing but misleading identity information.

A useful starting point is to identify the five account activities that would cause the greatest harm if approved fraudulently.

Review how each activity is authenticated, what behavioural signals are available, and whether an independent confirmation or additional approval is needed.

The goal is not to add friction to every customer interaction. It is to apply stronger controls where the consequences of impersonation are greatest.

Want to strengthen identity checks and fraud monitoring across your customer journey?

Talk to the Dojah team about combining re-authentication with risk-based fraud monitoring.

Frequently Asked Questions

• What is deepfake social engineering?

Deepfake social engineering involves using AI-generated or manipulated audio, video, or images to impersonate someone and deceive another person into taking an action. In banking, this can include attempts to influence customer support employees, authorise account changes or gain access to customer accounts.

• Can voice authentication still be trusted?

Voice authentication can provide a useful identity signal, but it should not be the sole basis for authorising sensitive activities. Banks should combine it with additional controls appropriate to the risk, such as trusted-device confirmation, independent approval or biometric re-authentication.

• Can liveness detection stop deepfake attacks?

Liveness detection can help identify certain forms of impersonation, but effectiveness varies by technology and attack method. Digital injection attacks may require additional safeguards beyond conventional presentation attack detection, such as injection attack detection, image inspection, and device signals.

• Is an SMS one-time passcode enough to approve a phone number change?

Not on its own. If an attacker has taken control of the customer's phone number, they may also receive SMS verification codes. Banks should use an independent trusted channel or additional identity verification before approving sensitive account changes.

• What should African banks prioritise first?

Banks should begin with the highest-risk account activities, particularly changes to registered phone numbers, account recovery details, transaction limits, and beneficiaries. These actions should receive stronger authentication and monitoring based on their potential impact.