Standard Bank has raised the alarm over a sharp rise in “spoofing” fraud, warning customers to be extra careful as criminals now use artificial intelligence tools to sound and look like real bank officials. The lender, South Africa’s largest by assets under management, said many victims are fooled because the phone calls and emails appear to come from legitimate Standard Bank contact details. In several cases, the caller ID shows a real bank number, while emails carry official-looking addresses and branding that mirror genuine bank communication. The growing use of AI voice cloning, deep-fake videos, chatbots and auto-written phishing messages is making these scams harder to detect across Africa’s banking system.
Spoofing happens when criminals pretend to be trusted organisations by manipulating caller ID or email addresses so they look authentic. The fraud is often paired with “vishing” — voice phishing — where a scammer calls a customer from what appears to be a valid Standard Bank number. The caller then copies the tone and structure of a real bank conversation, even asking routine security questions or reading out standard disclaimers. To build credibility, they may mention personal details such as a customer’s birth date, address or the type of account they hold. While this information may seem harmless, it is used to make the conversation feel legitimate and to lower a customer’s guard.
Typically, the script follows a well-rehearsed path. The caller claims to be phoning about a new service, a security upgrade, or an urgent red flag on the customer’s profile. They may say there are suspicious changes to contact details or unusual activity on the account. Once panic sets in, the fraudster offers a “solution”: move your money to a so-called “safe account”, read out a one-time password (OTP), generate an instant money voucher, scan a QR code or click a link “to secure the account”. Some victims are told to install a “verification” app that secretly gives the criminal remote access to the device. None of these steps are part of a real bank security process.
Email is another attack route. In these phishing attempts, messages are dressed in genuine-looking Standard Bank branding and sometimes reference compliance checks like KYC or FICA to create urgency. The emails often come with tight deadlines — a few hours or a couple of days — to push immediate action. Hidden in the message are malicious links, attachments, icons or QR codes. Clicking or scanning them can install harmful software on a device or redirect the user to a fake but convincing website designed to harvest passwords, card details and OTPs. The goal is simple: trick the customer into handing over control of their banking.
Advocate Athaly Khan, Head of Fraud Risk Management at Standard Bank, said the rapid development of artificial intelligence has made the threat more serious. According to Khan, AI gives criminals access to advanced tools like voice cloning and deep-fake content that “look and sound more real than ever”. Khan urged customers to stay calm, stay alert and learn “what not to do and what not to share” during any unexpected contact that claims to be from the bank. The bank stressed that customers should never be pressured into urgent action during a phone call or email and should always verify independently before taking any step.
Customers are reminded that a genuine bank will not ask them to transfer funds to another account to “secure” money. The bank does not require customers to generate instant money vouchers at someone else’s request, and it does not send links, icons, attachments or QR codes via unsolicited digital messages for account “verification”. If a call or email demands any of these actions, it is almost certainly a scam. For personal safety, customers should end the call immediately and contact the bank using numbers listed on the official website or at the back of their bank card. It is safer to dial back yourself rather than accept a call-back from the same number that has already raised suspicion.
There are also clear red lines on information-sharing. Customers must never disclose internet banking usernames or passwords, card expiry dates, the CVV (the three digits on the back of a card), OTPs, or ATM PINs to anyone — even if the person claims to be a bank employee or a law enforcement officer. They should also avoid discussing other financial holdings, investments or account details with unknown callers or email senders. Sharing such information can turn a victim into an unknowing “money mule” if criminals use their details to move stolen funds.
Cybersecurity experts say a few practical habits can reduce risk. Always type the bank’s web address yourself instead of clicking links. Use official mobile apps where possible and switch on in-app notifications for transactions. Keep phones and laptops updated, and install trusted security software. Review bank alerts closely and set low thresholds so any transaction triggers an immediate notice. If something looks unusual — spelling mistakes, odd phrasing, a sense of rush — treat it as a red flag. Above all, never act in panic. Take a breath, hang up, and verify on your own terms.
The warning from Standard Bank is relevant beyond South Africa because cross-border criminals target customers across the region. Standard Bank Group operates in several African markets, and Nigerians are familiar with the brand through its affiliate operations. The same spoofs, vishing and phishing techniques are used widely against customers of many banks. Financial fraud is constantly changing, and scammers rely on fear and urgency to manipulate victims. Staying informed, thinking critically and slowing down before responding to any request can make the difference between safety and loss. If you suspect you have been targeted or compromised, contact your bank immediately through official channels and report the matter to the relevant authorities.
