How big is the problem?
Big, and growing on the phone. SABRIC’s annual crime statistics for 2023 put South Africa’s financial-crime losses at almost R3.3 billion. Digital banking fraud incidents rose 45% year on year and the losses from them 47%. Fraud on banking apps was 60% of all digital banking crime and grew 89% in a year. Fraudulent applications for vehicle finance more than doubled, and SABRIC noted criminals using generative AI for fake emails and deepfakes 1.
For a small business the exposure is specific. The invoice that arrives from a supplier with “new banking details”. The customer who pays with a card that is not theirs. The employee who approves the payment because the email looked like the boss. None of these is exotic and all of them are cheap to run against a business with no controls.
What should an SME do first?
Controls before software. Two people on every change to a supplier’s banking details, confirmed by phone on a number you already had. A payment gateway that handles the card so your business never sees or stores a number; that is why our products take payment through PayFast and nothing touches a card. A rule that no payment is made on the strength of an email alone. Staff who have seen what a fake invoice and a fake “urgent request from the CEO” look like. These cost nothing and stop most of it.
| Threat | Control | Where AI helps |
|---|---|---|
| Changed banking details on an invoice | Phone the supplier on a known number | Flag any account that differs from the last payment |
| Fake card at checkout | A gateway carries the risk | The gateway’s own scoring; not yours to build |
| Fake “urgent” payment email | Two approvals; never from email alone | An email agent classifies the sender and the pattern |
| Orders that do not fit the customer | A person checks large first orders | Score the order against the customer’s history |
| Unmatched payments | Monthly reconciliation | Match payments to invoices as they land |
Where is AI worth it?
On volume and on pattern. A business processing a few hundred invoices and payments a month cannot eyeball every one, and the fraud that hurts is the one that looks routine. An automated bookkeeping product matches every payment to its invoice as it lands and shows the ones that do not match. A custom agent can be trained on your own history to flag the order, the supplier or the payment that does not fit the pattern, and to route it to a person before it is actioned. That is a scoped build, not a product off a shelf; it is the kind of thing Custom AI is quoted for.
Where is it not worth it?
Where the control is cheaper than the model. A five-person business does not need a fraud model; it needs a rule that two people approve a payment and a gateway that carries card risk. AI does not replace those. It watches what the rules cannot: the thousandth transaction.
Is adoption real?
McKinsey’s 2025 survey found 88% of organisations using AI in at least one function 2, and risk and finance functions among the more common. For an SME the honest framing is that the criminals are already using it, SABRIC says so 1, and the defence is a mix of habits and, at volume, software.
Questions people ask
Does DoubleDown AI sell a fraud-detection product?
Not off the shelf. Our bookkeeping product matches payments to invoices; anything beyond that is a custom build scoped from your process.
Should my business store card numbers?
No. Use a gateway so that a card number never reaches your systems; our products use PayFast for that reason.
What is the single cheapest control?
Confirming any change of banking details by phone, on a number you already had, before paying. It stops the most common SME fraud there is.