A Villpress Intelligence investigation into what happens to digital trust once a face, a voice or a document can be manufactured for the price of an API call, and why the identity infrastructure Africa built too recently to inherit anyone else’s assumptions may be where the answer gets written first.
On a Friday in October 2023, officials in several European capitals, among them Estonia’s prime minister, Kaja Kallas, took a video call they believed was with Moussa Faki Mahamat, then chairperson of the African Union Commission. An email requesting the meeting had arrived from what looked like the office of his deputy chief of staff. The man who appeared on screen looked like Faki. He sounded like Faki. Several officials spoke with him before anyone worked out that he was not, in any sense that matters, there at all, a synthetic reconstruction, built from public footage of a real chairperson, deployed to walk through a door that only a familiar face could open.
Nobody has ever established what the fraudsters were after. The African Union’s own statement described the episode as phishing aimed at stealing “digital identities”, a strange, almost self-diagnosing phrase for a scheme that took nothing except the one thing that had made the call work in the first place: recognition.
That is the story underneath this report. Not deepfakes as spectacle, the technology has been a curiosity for years, but recognition, the quiet mechanism by which a face, a voice, a document or a familiar phone number lets one party trust another, breaking down as a piece of working infrastructure.
The recognition economy nobody built on purpose
No one designed the internet’s trust system in a single sitting. It accreted, deal by deal and platform by platform, out of a simple working assumption: that certain things are expensive enough to fake that seeing them is good enough. A face on a video call. A voice on the phone. A signature on a contract. A selfie beside an ID card. A WhatsApp thread going back three years. A verification badge. A bank’s outgoing one-time password. Each of these signals became load-bearing not because anyone proved it was unforgeable, but because forging it used to take more skill, time or money than most attackers had.
Group these signals and a pattern appears. Identity signals, face, voice, government ID, signature, answer “who is this.” Communication signals, an email address, a phone number, a familiar account, answer “is this really coming from them.” Behavioural signals, typing rhythm, login times, transaction habits, answer “is this consistent with how they normally act.” Reputation signals, a badge, a review history, an institutional domain, answer “has this held up over time.” Transaction signals, an OTP, an invoice, a digital signature, answer “was this specific action authorised.” Different questions, the same underlying logic: recognisability stood in for authenticity because recognisability used to be hard to counterfeit.
Generative AI breaks that logic by breaking the economics underneath it, not by inventing a new kind of lie. A convincing face in a live video call used to require a studio, an actor and days of work. Arup’s own chief information officer said afterward that he deepfaked himself, out of curiosity, in well under an hour using freely available tools. A convincing voice used to require hours of recorded speech; consumer voice-cloning tools now need three seconds of audio, the length of a voicemail greeting. What changed is not that deception became possible. It is that it became cheap enough to run at the scale of an industry.
The cost of faking a person just collapsed
In January 2024, a finance employee at the Hong Kong office of Arup, the UK engineering firm behind the structural design of the Sydney Opera House, received an email that looked like it came from the company’s UK-based chief financial officer, asking him to handle a confidential transaction. He was suspicious enough to ask for a video call to confirm it. The call put his doubts to rest: the CFO was there, and so were several colleagues he recognised, all discussing the transfer in real time. He authorised fifteen wire transfers that day, totalling HK$200 million, about US$25.6 million, to five Hong Kong bank accounts. Every person on that call, Hong Kong police later confirmed, was synthetic, built from video and audio scraped from earnings calls, conference recordings and the kind of footage any employee posts online without a second thought. The fraud came to light only when the employee mentioned the “secret transaction” to Arup’s real head office and was told none of it had happened. None of the money has been recovered.
The same collapse in cost shows up wherever a familiar voice is used to license urgency. The FBI’s 2025 Internet Crime Report, released in April 2026, broke out AI-enabled fraud as its own category for the first time in the bureau’s twenty-five-year history: 22,364 complaints and close to $893 million in losses. A slice of that, a little over $5 million in confirmed cases, came from “distress” calls in which a cloned voice convinces a parent or grandparent that a family member is in trouble and needs money immediately. Americans over 60, the group least likely to have grown up assuming a voice on the phone might not be real, reported roughly $7.7 billion in total cybercrime losses in 2025, up 59 percent on the year before. None of this required a technical breakthrough. It required the price of imitation falling below the price of caution.
Where the future is already arriving
If this were only a story about fraud in wealthy markets, it would end there, a caution about video calls and phone scams. It doesn’t end there, and the reason is data rather than geography. Smile ID, the identity-verification company that runs biometric checks for banks, fintechs and mobile money operators across the continent, processes hundreds of millions of identity checks a year, which makes its fraud data one of the largest live samples anywhere of what AI-assisted impersonation looks like once it is running at scale rather than in a single headline case. Its 2026 report on the year’s fraud found that AI-generated manipulation, synthetic faces, deepfakes, face-swapped documents, accounted for 69 percent of confirmed biometric fraud across Africa in 2025. In Southern Africa, 87 percent of rejected verification attempts were tied to AI-assisted spoofing or impersonation. High-fidelity document forgeries, built by swapping a synthetic face into an otherwise genuine-looking ID, rose 250 percent. The company’s deduplication tool caught 126,000 duplicate-identity fraud attempts in 2025, up from 52,000 in 2024 and 21,000 in 2023, a sixfold jump in two years its analysts attribute to organised syndicates now running supply chains in stolen faces and documents, ageing fraudulent accounts through dormancy before activating them.
None of this is happening because African institutions are unusually exposed to Silicon Valley’s newest models. It is happening because Africa’s financial system leaned harder, and earlier, on exactly the signals generative AI is best at faking. A continent that largely skipped the era of branch banking built financial inclusion instead on selfie-based onboarding, phone-based one-time passwords and voice-based call-centre verification, methods that were, until recently, both cheaper than paper KYC and harder to fake than a physical document. Sub-Saharan Africa now runs 1.1 billion registered mobile money accounts moving roughly $1.1 trillion a year, according to GSMA’s Mobile Money 2025 data, most of it authenticated by an SMS code or a spoken security phrase. One fraud-prevention vendor working across the region estimates SIM-swap fraud alone, a scammer convincing a telecom agent to reissue a victim’s number, now accounts for as much as 43 percent of mobile money fraud cases, because it defeats the OTP layer entirely. Add a cloned voice to that same attack and the last human checkpoint, a call-centre agent asking whether a voice sounds right, stops working too. The continent that built the most successful biometric-and-mobile onboarding system in the world is also the one where that system’s core assumption is being tested hardest, and first.
Infrastructure built too recently to have any excuses
There is a second, harder truth buried in the Smile ID numbers, and it has to do with timing rather than technology. Nigeria’s Bank Verification Number, the eleven-digit biometric identifier now required to hold a bank account, is barely more than a decade old. The National Identification Number system it increasingly interlocks with is younger still. These are not legacy systems groaning under decades of paper records; they are recent, digital-first, biometric-native builds, which is precisely why Nigeria’s central bank has been able to credit BVN-NIN integration with a genuine result: digital payment fraud losses fell 51 percent, to ₦25.85 billion, in 2025, with the bank’s deputy governor pointing specifically to the systems’ effect on impersonation and synthetic-identity fraud. A Watch-list, tied to the BVN rather than to any single bank, follows a confirmed fraudster across every institution that checks it, a mechanism the central bank tightened further in March 2026 with a temporary 24-hour watch-list for transactions under suspicion. That is, without anyone in Lagos calling it this, a small working model of portable reputation: a record of trustworthiness that travels with a person rather than sitting locked inside one company’s database.
But the same youth that let Nigeria build something oriented that way from the start also left it thin enough to be worked around. In July 2025, Nigeria’s anti-corruption agency, the EFCC, said it was investigating a black market in which more than 12,000 people were allegedly harvesting BVNs, NINs and passport photographs, paying ordinary Nigerians ₦1,500 to ₦2,000 for their identity documents, and reselling the bundled data to fintech companies for roughly ₦5,000, about $3.33, per identity. The national identity agency, NIMC, had already terminated more than a hundred front-end registration partners over violations. The lesson is not that Nigeria’s system failed; a system fraudsters have to buy real people’s documents to defeat is, in a narrow sense, working as designed. The lesson is that a verification system built around checking documents against a database will always be vulnerable to a market in real documents attached to willing sellers, a problem no amount of better deepfake detection solves, because nothing in that transaction is synthetic at all.
Zoom out, and the exposure looks structural rather than incidental. The World Bank’s ID4D initiative estimated in 2025 that 800 million people worldwide still lack any official proof of identity, down from 850 million in 2021, real, measurable progress, concentrated heavily outside Africa. Sub-Saharan Africa now accounts for more than half of that global total, with over 400 million people lacking legal identification and coverage in Eastern and Middle Africa stagnant at around 41 percent. At the digital layer the gap is starker still: as of 2024, only four countries in the region, Benin, Cabo Verde, Mauritius and Uganda, offered a functioning government digital identity for online transactions. Put plainly, Africa is being asked to defend against the most sophisticated identity attacks the internet has yet produced using an identity infrastructure that, for a large share of the population, does not yet exist in even its most basic form.
When the interview itself can’t be trusted
The signal breaking down in a boardroom in Hong Kong or a banking app in Lagos is also breaking down in an entirely different setting: the job interview. In August 2026, eleven governments, the United States, Japan, South Korea and, for the first time, France, Germany, Italy and the Netherlands, issued a coordinated advisory warning that North Korean state operatives are now using real-time deepfake video to impersonate real people in live remote job interviews, not just in submitted resumes and portfolios. The scheme, which the advisory said funnelled roughly $800 million to Pyongyang’s weapons programmes in 2024 alone, works by having a fluent, convincing candidate pass the interview on camera while a different person, sometimes several, rotating, does the job afterward, laptops shipped to US addresses and accessed remotely from operatives the advisory said were working from North Korea, China, Russia, Southeast Asia and Africa while appearing to sit in an American home office. One identity-verification company that screened 127,000 applications across three of its clients flagged between a fifth and a quarter as high-risk, a rate analysts had not expected to see broadly until 2028, arriving, by their own account, two years early.
The interview is a trust signal too, and one employers rarely think of that way: a live conversation is supposed to prove that the résumé in front of you belongs to the person on the call. One 2025 study on deepfake detection found that people primed and rewarded for spotting synthetic video correctly identified it only about a quarter of the time. If a hiring manager cannot reliably tell, the entire premise of “we interviewed them” as evidence of who someone is starts to look less like verification and more like theatre that happened to work for a while.
The bill for proof is paid in data
Faced with signals that can be faked, the obvious institutional response is to collect more of the thing that is hardest to fake, which usually means more biometric data, held for longer, checked against ever-larger central databases. That response has its own cost, and Kenya’s experience with Worldcoin shows exactly what it looks like when it goes wrong.
Worldcoin arrived in Nairobi in 2023 with an offer that read, to many participants, like easy money: scan your irises with a purpose-built device called an Orb, receive roughly $50 to $56 in cryptocurrency, and join a global “proof of personhood” network meant to distinguish real humans from bots online, a genuinely serious problem the project was trying to solve. More than 300,000 Kenyans signed up. Kenya’s data-protection regulator and communications authority suspended the company’s registration within months, and the civil-society group Katiba Institute sued, arguing that Tools for Humanity, Worldcoin’s operator, had never carried out the legally required data protection impact assessment, had obtained consent through a financial incentive aimed at people with limited alternative income, and had moved sensitive biometric data out of the country without authorisation. In May 2025, Kenya’s High Court agreed on all three counts and ordered the data deleted within seven days under regulatory supervision; by January 2026, the deletion of iris and facial data from every enrolled Kenyan had been confirmed. Kenya was not alone, Brazil, Indonesia, the Philippines and Thailand each suspended or banned the same biometrics-for-tokens model over roughly the same eighteen months, in each case citing consent obtained from people least equipped to weigh the trade-off.
The fix for unreliable signals is more verification, and more verification means more biometric data sitting somewhere, and the version of that trade society finds acceptable seems to depend heavily on who is asked to make it.
The irony is that the underlying idea did not disappear; it moved upmarket. By April 2026, the company was announcing partnerships with Tinder, Zoom and DocuSign to help those platforms verify that a user is a real, unique human. The same proof-of-personhood technology a Kenyan court found had exploited vulnerable citizens for their most permanent biometric marker is now being adopted, on different terms, by companies whose users mostly have other options.
From recognition to proof
Underneath the case studies is a conceptual shift worth naming plainly, because it explains why patchwork fixes, better liveness detection, another biometric factor, a stricter KYC form, treat the symptom rather than the structure. Recognition asks a static question: does this look, sound or read like the thing it claims to be. Proof asks a more demanding one: can this specific artefact, this video, this document, this transaction, be traced back to where it says it came from, independent of whether it looks convincing.
The most developed attempt to build that second kind of system is the Coalition for Content Provenance and Authenticity, or C2PA, a standards body formed in 2021 by Adobe, Microsoft, the BBC and others, now with more than 200 member organisations. Rather than trying to detect fakes after the fact, an arms race generative models are structurally advantaged to win, since every detector trained on today’s fakes becomes a training target for tomorrow’s, C2PA attaches a cryptographically signed record to content at the moment of creation, noting the device or software that made it and every edit since. Leica built it into a camera in 2023; Nikon and Sony have followed; Google has built support into Pixel hardware and its search and YouTube products; the EU’s AI Act, taking effect in August 2026, requires the kind of transparency labelling C2PA’s manifest was designed to provide. It is a genuinely useful piece of the answer, and it is also, on the evidence, not yet a mature one: an independent 2026 security analysis of the specification described it as flawed, incomplete and inconsistent in its current implementations, noting that most social platforms strip the very metadata the standard depends on the moment a file is uploaded. Provenance can prove where a real photograph came from. It cannot, by itself, prove that what is in the photograph is true, and it does nothing at all for the video call, the phone conversation or the live interview, the interactive, real-time cases where most of the fraud in this report actually happened.
Nigeria’s BVN watch-list, described earlier, is a smaller and less elegant version of the same underlying idea, arrived at for entirely practical reasons rather than any grand architecture: a record that travels with a person, checkable by any institution, revocable when abused. It is not cryptographic and it is not portable across borders, but it answers the proof question rather than the recognition question, was this specific person previously and verifiably flagged, not does this person look trustworthy. That a fraud-fighting mechanism built inside a Nigerian central bank and a provenance standard built inside Adobe and the BBC are converging on the same underlying logic, from opposite ends of the world’s wealth spectrum, is itself a piece of evidence for where this is heading.
Who builds the next layer
Whoever ends up owning that layer will have got there by solving a problem investors in wealthier markets are only starting to take seriously, in a market that had no choice but to take it seriously years earlier. Smile ID’s own numbers are the clearest evidence of the underlying opportunity: fraud attempts during login and account recovery are now several times more common than fraud at initial registration, meaning the frontier has already moved from “who is signing up” to “is this still the same person logging back in”, a harder, far less-served problem than onboarding KYC, and one most identity-verification budgets still under-invest in. The gaps that remain are unglamorous rather than exotic: interoperability between BVN, NIN, passport and voter-card systems that Nigeria’s own compliance vendors describe as still poorly cross-linked; a digital-identity gender gap the World Bank’s 2025 data found emerging in several middle-income countries even as the paper-ID gender gap closed; and rural coverage that continues to lag urban onboarding wherever agent networks, rather than government registries, do the actual verifying.
None of this argues that Africa will simply skip the mistakes other regions are making with digital identity, Kenya’s Worldcoin case shows the same predatory version of “solve identity with more biometrics” lands just as easily there as anywhere. It argues something narrower and more defensible: that the institutions forced earliest to work through the shift from recognition to proof, for reasons of necessity rather than foresight, are accumulating operating knowledge, what actually stops a synthetic face, what a watch-list has to look like to survive being gamed, what happens when biometric consent is purchased rather than freely given, that the rest of the internet is only now starting to need.
The Villpress Intelligence take
If AI has made recognition unreliable, the internet does not get to keep pretending otherwise, and it does not get to solve the problem by acquiring more of what made the last generation of fraud possible: giant, centralised stores of biometric data that themselves become the next thing worth stealing. What should replace recognition is proof that is specific, revocable and no larger than the question being asked, a system that can confirm a transaction was authorised by a given person without needing to know, or store, everything else about them. Nigeria’s watch-list and C2PA’s manifest are early, imperfect drafts of that idea, arrived at independently from very different starting points, which is itself a reason for cautious optimism rather than despair.
For businesses, the practical shift is to stop treating “we spoke to them” or “we saw their face” as evidence and start budgeting for verification the way a bank budgets for fraud losses, an ongoing cost of doing business, not a one-time onboarding checkbox. For African institutions specifically, the opportunity is not to import someone else’s identity stack wholesale but to keep building the version already taking shape, proof-based, portable and, ideally, governed by the region’s own regulators rather than handed to whichever well-funded foreign platform arrives next offering cash for an iris scan. For entrepreneurs and investors, the more interesting number in this report may not be the size of the fraud but the fact that verification spending is still concentrated at the moment of sign-up, while the fraud has already moved to the moment someone logs back in, a gap wide enough to build a company inside. For anyone reading this on their phone, the honest takeaway is smaller and more immediate: the person on the other end of a video call, a voice note or an urgent WhatsApp message from someone you love is not guaranteed to be who they sound like, and the habit worth building is not paranoia but a simple, boring check, a call back on a number you already had, before you had this one.
The internet spent three decades teaching people that if something looked and sounded right, it probably was. It is going to spend the next few teaching them the opposite, and the places that learn fastest may not be the ones with the most money to spend on the lesson, but the ones that never had the luxury of assuming it in the first place.
