Africa records the world’s highest workplace phishing susceptibility. South Africa’s 12 official languages are an unplanned defence against this, but they too have a shelf life.

Chances are, the next scam message to reach your phone will be correctly spelt, carry your bank’s real logo, your name and, possibly, the right suburb for a parcel you’re expecting. Nothing about it will look wrong. It will also, almost certainly, be in English.

This is not, on its own, a tell. English is the language of South African banking, employment and officialdom, and a large share of the population reads it comfortably, regardless of their home language.

Census 2022 counted only 5.4 million South Africans who speak English as their primary language at home, or just 8.7% of the population. isiZulu accounts for 15.1 million speakers, isiXhosa for 10.1 million, Afrikaans for 6.6 million and Sepedi for 6.2 million.

The languages most South Africans speak are the ones the machines are the worst at replicating.

Anna Collard, SVP content strategy and Cisco advisor at KnowBe4 Africa, says this is one of the few advantages South Africans have for now.

“A criminal with a free chatbot writes better business English than most of us do before our second coffee,” says Collard. “What they cannot do as easily, yet, is sound like your aunt in Mthatha.”

Where the models run thin

Research published by AfroBench, which tested leading models across 64 African languages, found wide differences between how those models perform in English and how they perform in African languages across most tasks. Anyone who has watched an AI tool mangle isiXhosa noun classes or produce Sepedi that reads like a bad hymn translation has seen this without needing the paper.

A syndicate operating from anywhere can produce a flawless English message impersonating a South African bank, a courier company or SARS. Ask the same operation to hold a five-minute phone conversation in Tshivenda, with the right idiom and the right rhythm, and it will struggle.

But South Africans do this constantly without thinking about it. A person might start a sentence in English, drop into Sesotho for the part that carries the feeling, and come back to English again. This casual mixing of languages is nearly impossible to fake.

“Code-switching is a verification tool we all carry, and nobody taught us to use,” says Collard.

“If someone phones claiming to be from your bank, switch to your home language mid-sentence and see what happens. A synthetic voice or a scripted overseas operator will stall, repeat itself or push the conversation back to English awkwardly.”

The same test works on the scam many parents fear: A voice claiming to be your child asks you to move money urgently. Ask a question in the language you use at home, about something only the two of you would know.

However, there is one significant warning: Interpol’s African Cyberthreat Assessment Report 2026, drawing on survey data from 36 member countries, found that 72% reported the presence of organised scam centres, with the highest concentration in Southern and West Africa.

A scam operation based in Johannesburg or Durban employs native isiZulu and Afrikaans speakers. Against that operation, a language switch achieves nothing at all. The test works against remote operators and synthetic voices. It does not work against a local human who grew up speaking what you speak.

“This buys you something specific, not something general,” says Collard. “It raises the cost of the attacks that are run at scale from far away. It does nothing about the person down the road who already sounds like you.”

The protection is also temporary

Attackers are already closing in on this unique natural defence. Speaking at Microsoft’s October 2025 briefing on its Digital Defence Report findings for Africa, the company’s chief security advisor for the continent, Kerissa Varma, said attackers are using AI to craft phishing messages tailored to local languages and cultural contexts, impersonate trusted people and exploit familiar platforms. She described Africa as a proving ground where such tactics are tested first. 

Microsoft’s own data puts the click rate on AI-enhanced phishing at 54%, roughly four and a half times that of conventional campaigns. Interpol’s African Cyberthreat Assessment Report 2026 links AI to more than half of cybercrime on the continent, and records scam centres operating in 72% of the countries it surveyed, concentrated in Southern and West Africa.

“Every year the models get better at our languages, and every year this defence weakens,” says Collard. “Use it now, but understand that it buys time rather than safety.”

What the testing shows

The urgency is highlighted in KnowBe4’s 2026 Phishing by Industry Benchmarking Report, which analysed 42 million simulated phishing tests across 14.8 million people at 64 000 organisations. Africa recorded the highest starting susceptibility of any region at 35.9%, meaning more than one in three people engaged with a test phishing message before any training happened.

African organisations that ran continuous training cut that figure by 41.2% within 90 days and by 79% over a year. Residual risk after 12 months settled at 7.4%, still the highest of any region, but about a fifth of where it started.

Collard sees that as a country being targeted heavily but demonstrably capable of getting much harder to hit.

“Scams are engineered to force a considered decision through the part of the brain that doesn’t consider anything. Manufactured urgency, for example, is a popular feature of the attack. Once someone is operating at speed, under pressure, with a plausible story in front of them, their judgement is not really in the room. Any question that breaks this rhythm can bring back reasoning. The language switch is just one version that happens to be free, instant and available to every South African,” she says.

Heritage Month is usually about what we celebrate. This year, says Collard, we should also consider how our linguistic diversity can protect us.

What to do about it

• Agree on a word with your family that nobody else knows, for use if anyone ever phones in an emergency asking for money. A pre-agreed word beats a voice, because voices can now be cloned from a few seconds of audio.
• Treat caller ID as decoration. The number displayed on your screen can be set to anything the caller wants it to say.
• When an unexpected call claims to be your bank, hang up and dial the number on the back of your card. No legitimate bank will object.
• Switch languages on any caller you did not expect, and treat any hesitation as a warning sign.

Breaking news at your fingertips… Follow Caxton Network News on Facebook and join our WhatsApp channel.

Nuus wat saakmaak. Volg Caxton Netwerk-nuus op Facebook en sluit aan by ons WhatsApp-kanaal.