Fewer than one in four South African enterprises rate their identity verification systems as highly effective at preventing fraud, despite more than half suspecting or having observed attacks using AI-generated phishing, voice impersonation or deepfakes.
These are among the findings of the iiDENTIFii South African Identity Index 2026, a survey of 200 enterprises conducted by World Wide Worx on behalf of digital identity verification platform iiDENTIFii.
The proportion rating verification processes in their organisations as “very effective” has declined from 24.5% in 2024 to 22.9% in 2026. This percentage forms the Identity Index, which tracks businesses’ own assessments of their ability to prevent identity fraud.
“Businesses are encountering fraud that puts their existing verification systems under increasing pressure,” said Arthur Goldstuck, CEO of World Wide Worx. “More than half suspect or have observed AI-generated attacks, yet fewer than half express confidence in detecting AI-assisted fraud. That gap gives businesses a clear priority for their next investments in technology.”
AI-driven fraud is the leading emerging identity fraud threat for which businesses believe they need to prepare, cited by 76.6% of respondents, up from 59.2% in 2024.
A combined 52.2% suspect or have directly observed AI-generated phishing, voice impersonation or deepfake attempts. Within that total, 18.9% report directly observing such incidents and 33.3% suspect them. Only 44.2% describe themselves as confident or very confident in detecting AI-assisted fraud.
Limited detection capabilities are the most commonly named barrier to defending against AI-driven identity threats, cited by 47.3% of respondents.
According to iiDENTIFii, Deloitte forecasts that fraud losses enabled by GenAI in the US could reach $40 billion a year by 2027. The same tools are available to criminals targeting South African businesses.
“AI gives criminals cheap, convincing ways to impersonate a customer,” said Marco Wagener, CEO of iiDENTIFii. “The question for every business is whether its verification can continuously prove a real person is present, even under the most sophisticated attack. And the only way to know is to test it against those attacks.
"Fraud is no longer something done only to your customer. Increasingly, it is done as your customer, using a deepfake face. Concern about deepfakes among South African businesses has nearly tripled in two years, yet almost two in three have not updated their liveness or face-matching controls. For two decades, identity was something you checked. Now it is something you must prove continuously, at every moment of risk, not just once at onboarding."
Company size exposes a protection gap
Among enterprises with more than 1 000 employees, only 45.6% rate their verification processes as very effective. Enterprises with 201 to 500 employees record only 17.1%, and those with 501 to 1 000 employees record 17.8%.
“The largest enterprises are more than twice as likely as businesses with up to 1 000 employees to give their systems the highest rating,” said Goldstuck. “That difference tells us that companies of every size face increasingly sophisticated attempts to exploit their identity checks, but the smaller they are, the less likely they are to be prepared.”
Just 27.9% of respondents have updated or strengthened facial liveness detection or biometric matching controls to address AI-driven or deepfake fraud.
Synthetic identities, which combine fabricated and real identity information, are named by 66.2% as an emerging threat requiring preparation, up from 42.8% in 2024. Deepfakes are cited by 21.9%, compared with 7.5% in the previous study.
Preparedness also depends on how businesses respond when an attack occurs. Only 22.9% have formalised and tested response procedures for biometric fraud or identity compromise. A further 29.4% rely on informal processes, while 36.3% lack defined procedures.
Investment plans strengthen
The proportion of businesses planning to invest more in identity verification technology over the next 12 to 24 months has increased from 34.8% in 2024 to 54.7% in 2026.
Cost is the most commonly cited implementation challenge at 53.7%, followed by user acceptance at 47.3%. Integration complexity is cited by 38.8%, highlighting the difficulty of adding stronger verification to existing business systems.
The report recommends prioritising high-risk uses of identity verification and introducing stronger detection capabilities in phases. Regular testing against AI-assisted fraud scenarios would help businesses assess the effectiveness of those investments.
Industry co-operation is another area requiring action. While 60.2% want better collaboration to address identity fraud, only 14.4% report frequent collaboration with industry groups, regulators or law enforcement to share intelligence and combat fraud, down from 23% in 2024.
“Trusted robust verification at onboarding cannot defend an interaction a year later,” said Wagener. “Businesses should establish trust at the moments of risk, where fraud does the most damage, and then let customers re-use that trust, instead of proving who they are over and over.”
Wayne Meisel, market growth and customer officer at SAP, said GenAI has done to cyber crime what it has done to content production: collapsed the cost and the skill required to produce convincing output at scale.
According to SAP, by early 2025 most phishing e-mails being detected were AI-generated, a dramatic rise from a low base just a year earlier. AI-automated spear-phishing campaigns are now matching the click-through rates of skilled human attackers while cutting the cost of running a campaign by more than 95%.
Business e-mail compromise (BEC), already one of Africa's most damaging attack categories, is following the same trajectory, with a meaningful share of detected BEC campaigns now judged to be AI-crafted. Deepfake-enabled fraud, though still a smaller share of total attacks, has grown more than twentyfold since 2022.
South Africans are falling for fraud despite being aware of the danger, according to WhatsApp-native research platform Yazi. Three in four already know AI can clone a voice or fake a message – but that awareness is not changing what happens next.
Yazi’s Global Digital Fraud Study, Who Pays for Trust? found that 85% of South Africans were impacted by fraud in the past 12 months, and that among the lowest-income victims the median loss equalled 40% of one month's household income. Three in four victims recovered none of the money they lost, and 64% believe bank or institution staff may be complicit in fraud.
“The study combined structured quantitative questions, open text responses, voice notes and AI-moderated follow-up interviews. We wanted to understand fraud from the consumer’s side, not only count incidents after the money had already disappeared. What the study told us is that when fraud succeeds, the financial and emotional cost can be disproportionately severe,” said Tim Treagus, CEO of Yazi.
He added that the awareness figure is the study’s most uncomfortable finding, because it rules out the easiest explanation: “South Africans are not uninformed about fraud. Most already know the tricks. What the data suggests instead is something closer to hope outweighing caution: the promise of a way out is often worth more than the risk of being wrong.
"That instinct isn’t unique to fraud. It’s the same pull that keeps people buying lottery tickets long after they’ve worked out the odds, and in a market where the upside of escaping financial pressure feels large and the downside feels abstract, a growing number on a screen can be more persuasive than any warning."
Share
