A familiar voice on a phone call has traditionally helped people recognise colleagues, managers and business partners. AI-generated audio and video make that assumption less reliable, giving fraudsters another way to impersonate people and persuade employees to share information or approve transactions.
The risk was discussed at the Safaricom Cybersecurity Summit 2026 in Nairobi, where panelists considered fake executive calls, synthetic media and fraudulent promotions that misuse familiar brands. Their central concern was practical: as impersonation becomes easier to attempt, organisations need verification procedures that do not depend solely on what a person hears or sees.
Why voice and video are no longer sufficient proof
A deepfake is synthetic or manipulated media designed to imitate a real person or create a misleading representation. Voice-cloning tools can reproduce aspects of a person’s speech, while video-generation and editing systems can be used to fabricate or alter visual evidence. The quality and accessibility of these tools vary, and not every suspicious recording is necessarily AI-generated.
For businesses, the key risk is that an impersonation attempt may arrive through a familiar communication channel and appear to come from someone with authority. A message could request an urgent transfer, a change to supplier bank details, access to an account or the release of confidential information. The attack succeeds when the recipient treats apparent identity as sufficient proof of authority.
Where impersonation can cause the most damage
Payment processes are an obvious target because a fraudulent instruction can cause direct financial loss. An attacker may pose as an executive or supplier, introduce urgency and ask an employee to bypass normal approvals. Similar tactics can target payroll changes, customer records, account recovery and the disclosure of internal information.
Public-facing brands also face impersonation risks. Fake promotions or customer-support accounts can mislead consumers into sharing personal information or sending money to fraudulent recipients. Organisations need to consider both the systems they operate and the trust customers place in their names.
How to build verification into everyday processes
The most useful defence is a process that remains reliable even when a request looks authentic. High-risk transactions should require verification through a separate, previously established channel, such as calling a known number rather than the number supplied in the suspicious message. Financial approvals should also follow defined authority limits and dual-approval procedures where appropriate.
Employees should not rely on a caller’s voice, a video appearance or details that could have been gathered from public sources. Verification should confirm both who is making the request and whether that person is authorised to make it. Changes to supplier payment details, requests for credentials and urgent transfers deserve particular care.
Technical controls can strengthen these procedures. Multifactor authentication, restricted account permissions, transaction alerts and secure account-recovery processes make it harder for one successful impersonation to lead directly to a larger compromise. Organisations should review whether staff can report suspicious requests quickly without being penalised for delaying an unusual transaction.
What staff should do when a request feels unusual
Employees should pause when a request creates unusual urgency, asks them to break established procedures or involves sensitive information that would not normally be shared through that channel. They should verify the request independently and report suspected fraud to the appropriate security or finance team. Staff training should include realistic examples so that people practise the steps rather than simply receive a general warning.
Businesses cannot prevent every impersonation attempt, and detection tools will not always identify synthetic media correctly. Strong verification procedures reduce the chance that a convincing fake can bypass the controls surrounding money, accounts or confidential information. As AI-generated media becomes part of the fraud landscape, identity checks need to be built into routine business processes rather than reserved for unusual incidents.
Real ESG impact doesn’t happen in panels alone, it happens in the rooms where financiers, operators, and policymakers actually align. Our GreenShift Forum 2026 cuts the noise, bringing together the people rewiring Africa’s sustainability and energy frameworks for one focused day in Nairobi. Secure your seat.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke
Follow Us
By George Kamau
I brunch on consumer tech. Send scoops to george@techtrendsmedia.co.ke