Cyril Ramaphosa and Johann Rupert exploited in new AI scam

Key topics:AI deepfake of Cyril Ramaphosa used in scamFake “Wealthicator” promises R250k return from R4,200 investmentSA leads region in deepfake fraud, per Smile ID report.Sign up for your early morning brew of the BizNews Insider to keep you up to speed with the content that matters. The newsletter will land in your inbox every morning on weekdays. Register here.Support South Africa's bastion of independent journalism, offering balanced insights on investments, business, and the political economy, by joining BizNews Premium. Register here.If you prefer WhatsApp for updates, sign up to the BizNews channel here..By Jan Vermeulen.A new scam targeting South Africans has appeared online that uses an AI-generated fake video of Cyril Ramaphosa endorsing a scheme called “the Wealthicator project”.The scheme promises people a return of R250,000 for an initial investment of R4,200 and claims that it is either endorsed or developed by Ramaphosa and billionaire Johann Rupert.The scam was discovered and investigated by Artists Against 419 (AA419), a well-known international volunteer group dedicated to identifying and shutting down scam websites.A volunteer from the group told MyBroadband that their preliminary investigation found that the scam’s website appears to be exclusively targeting South Africans..Read more:.FT’s Martin Wolf: We must be able hold tech platforms accountable for deep fake fraud.When you visit the website normally, it looks like a regular Search Engine Optimisation company. However, when browsing from a South African IP address, it eventually displays the page promoting the scam.Like many such financial scams, it purports to be an automated trading platform that uses artificial intelligence (AI) to rapidly grow an initial investment.When MyBroadband visited the scam site, we saw two different variants of the scam. Both were presented on pages designed to look like the SABC’s website.The first variant presented the scam as an interview between SABC morning programme anchor Leanne Manas and Cyril Ramaphosa. It claims that Ramaphosa was one of the first users of the platform.The second variant we saw included an AI-generated video of Ramaphosa claiming that the government had developed the platform in collaboration with Johann Rupert.It also includes a falsified Standard Bank account statement for a Thabo Mokoena, supposedly living at Apartment 15, 123 Apartment Street, Durban.AA419 also found that the website is updated daily. It pulls scripts and content from a secondary domain, and the scam source code itself is in Russian.Russian financial cybercrime tends to involve independent, opportunistic threat actors who generate income by stealing money from victims around the world.While the Russian Federation usually turns a blind eye to these cybercriminals, the state itself generally doesn’t engage in such malicious cyber activity.According to the U.S. Cybersecurity and Infrastructure Security Agency, cyberattacks sanctioned by the Russian government have different aims.Russia typically engages in broad-scope cyber espionage, suppresses certain social and political activity, steals intellectual property, and harms regional and international adversaries.AI tools making convincing fakes easier.While this specific scam has many telltale signs that should warn any savvy Internet user in South Africa that it is a con, the new Ramaphosa video shows how far AI tools have come.A famous example of a Ramaphosa deepfake surfaced in March 2023, when a video circulating online showed the President announcing plans to demolish the Voortrekker Monument and Loftus Versfeld.However, in that video, Ramaphosa was unusually static, with his face and body hardly moving as he spoke. This latest deepfake appears much more natural.Although the video and audio still contain artefacts that betray it as a fake, the audio in particular has improved significantly, raising questions about the damage such technology could do in future.Smile ID published its 2026 Digital Identity Fraud Report earlier this month, revealing that South Africa has the highest share of deepfake-driven fraud in Southern Africa at 22%.The firm’s research also found that artificial intelligence was fueling biometric fraud in the region, with deepfake impersonation and spoofing rising significantly in recent years.“Fraud is overwhelmingly biometric in South Africa. Nearly nine in ten verification attempts rejected for potential fraud are due to impersonation and spoofing during biometric verification,” Smile ID said.“No-face-match dominates, meaning the person presenting cannot be credibly linked to the claimed identity — consistent with stolen identities, mule-assisted flows, and post-onboarding abuse.”.Read more:.Mailbox: Why don’t Rupert, Oppenheimer, Motsepe and Musk address deep fake adverts using their names?.No-face-match impersonation accounts for 47% of fraud, spoofing roughly 40%, and document integrity and presentment tricks 13%.Smile ID said spoofing attempts are effectively biometric integrity attacks aimed at defeating liveness and similarity checks. These include deepfake-assisted impersonation and face-swap techniques.Smile ID added that document integrity and presentment tricks, with a 13% contribution, are present but are “clearly secondary”.It also highlighted examples of high-profile impersonations in South Africa. The deepfake AA419 found and highlighted in this most recent scam is another example of this.Defanged URLs to the scam website have been posted in the MyBroadband forum for the more technically inclined who wish to probe it themselves..This article was first published by MyBroadband and is republished with permission.

Cyril Ramaphosa and Johann Rupert exploited in new AI scam

Related Stories

‘It looked completely real’: Another victim speaks out on alleged FXSI deepfake scam

Is this the beginning of the end for Cyril Ramaphosa?

SA’s Hidden Tax: When identity stops being certain in a world of AI and institutional drift

Ramaphosa axes police chief Masemola over R360m tender scandal