SA languages make a great scam detector

The next scam message to reach your phone will be spelled correctly, carry your bank’s real logo, your name, and possibly the correct suburb a parcel for you might need to reach. Nothing about it will look wrong. It will also, almost certainly, be in English.

That is not, on its own, a tell. English is the language of South African banking, employment and officialdom, and a large share of the population reads it comfortably regardless of what they speak at home.

Census 2022 counted only 5,4-million South Africans who speak English as their primary language at home, or just 8,7% of the population. isiZulu accounts for 15,1-million speakers, isiXhosa for 10,1-million, Afrikaans for 6,6-million and Sepedi for 6,2-million.

The languages most South Africans actually speak are the ones the machines are worst at.

One of the few advantages ordinary people have in their back pocket – at least for now.

A criminal with a free chatbot writes better business English than most of us do before our second coffee. What they cannot do as easily, yet, is sound like your aunt in Mthatha.

Where the models run thin

The old warning signs disappeared because the machines got good at English.

Research published as AfroBench, which tested leading models across 64 African languages, found wide differences between how those models perform in English and how they perform in African languages across most tasks. Anyone who has watched an AI tool mangle isiXhosa noun classes or produce Sepedi that reads like a bad hymn translation has seen this without needing the paper.

And that actually leaves an asymmetry worth using more formally. A syndicate operating from anywhere on earth can produce a flawless English message impersonating a South African bank, a courier or SARS. Ask that same operation to hold a five-minute phone conversation in Tshivenda, with the right idiom and the right rhythm, and it will struggle.

But South Africans do this constantly without thinking about it. A person might start a sentence in English, drop into Sesotho for the part that carries the feeling, and come back to English again. Ordinary here, and close to impossible to fake.

Code-switching is a verification tool we all carry and nobody taught us to use. If someone phones claiming to be from your bank, switch to your home language mid-sentence and see what happens. A synthetic voice or a scripted overseas operator will stall, repeat itself, or push the conversation back to English awkwardly.

The same test works on the scam that frightens parents most, where a voice claiming to be your child asks for money to be moved right now. Ask a question in the language you use at home, about something only the two of you would know.

However, there is one big caveat: INTERPOL’s African Cyberthreat Assessment Report 2026, drawing on survey data from 36 member countries, found that 72% of them reported the presence of organised scam centres, with the highest concentration in Southern and West Africa.

A scam operation based in Johannesburg or Durban employs native isiZulu and Afrikaans speakers. Against that operation, a language switch achieves nothing at all. The test works against remote operators and synthetic voices. It does not work against a local human being who grew up speaking what you speak.

This buys you something specific, not something general. It raises the cost of the attacks that are run at scale from far away. It does nothing about the person down the road who already sounds like you.

The protection is also temporary

Attackers are already closing in on this quite unique natural defence. Speaking at Microsoft’s October 2025 briefing on its Digital Defence Report findings for Africa, the company’s chief security advisor for the continent, Kerissa Varma, said attackers are using AI to craft phishing messages tailored to local languages and cultural contexts, impersonate trusted individuals and exploit familiar platforms, describing Africa as a proving ground where such tactics are tested first. 

Microsoft’s own data puts the click rate on AI-enhanced phishing at 54%, roughly four and a half times that of conventional campaigns. INTERPOL’s African Cyberthreat Assessment Report 2026 links AI to more than half of cybercrime on the continent, and records scam centres operating in 72% of the countries it surveyed, concentrated in Southern and West Africa.

Every year the models get better at our languages, and every year this defence weakens. Use it now, but understand that it buys time rather than safety.

What the testing shows

The urgency is highlighted in KnowBe4’s 2026 Phishing by Industry Benchmarking Report, which analysed 42-million simulated phishing tests across 14,8 million people at 64 000 organisations. Africa recorded the highest starting susceptibility of any region at 35,9%, meaning more than one in three people engaged with a test phishing message before any training happened.

African organisations that ran continuous training cut that figure by 41,2% within 90 days and by 79% over a year. Residual risk after twelve months settled at 7,4% – still the highest of any region, but about a fifth of where it started.

That reveals a country being targeted heavily but demonstrably capable of getting much harder to hit.

Scams are engineered to force a considered decision through the part of the brain that doesn’t consider anything. Manufactured urgency for example is a popular feature of the attack. Once someone is operating at speed, under pressure, with a plausible story in front of them, their judgement is not really in the room. Any question that breaks this rhythm can bring back reasoning. The language switch is just one version that happens to be free, instant, and available to every South African. Heritage Month is usually about what we celebrate. This year it is worth adding what we can also use because of it.

What you can do about it

• Agree a word with your family that nobody else knows, for use if anyone ever phones in an emergency asking for money. A pre-agreed word beats a voice, because voices can now be cloned from a few seconds of audio.
• Treat caller ID as decoration. The number displayed on your screen can be set to anything the caller wants it to say.
• When an unexpected call claims to be your bank, hang up and dial the number on the back of your card. No legitimate bank will object.
• Switch languages on any caller you did not expect, and treat any hesitation as a warning sign.