Gary Slater, Head of Forensics; and Xolile Mthembu, Head of IT Governance, Risk Management, Compliance and Security; at Old Mutual Insure

The claim that almost paid the wrong person

It is late on a Friday afternoon. A claims consultant receives an email requesting a change to banking details for a motor claim nearing settlement. Moments later, a WhatsApp voice note confirms the instruction. The voice sounds familiar, the claim details are accurate, and the request appears legitimate.

But one routine verification call changes everything. The claimant confirms they never requested the change. The voice note was fake, and fraudsters had attempted to redirect the payment into a criminal-controlled account.

No systems were hacked. No firewalls were breached. The criminals simply attempted to exploit an employee’s trust. While this is an illustrative scenario, it reflects an increasingly concerning reality in financial services: cyber-enabled financial crime is no longer just about breaching technology. It is about manipulating the people who use it.

When trust becomes a vulnerability

For years, organisations have strengthened their cybersecurity through technical controls such as firewalls, sophisticated protective & monitoring systems and multi-factor authentication. These investments remain essential, but criminals are changing their approach.

Rather than breaking through technological defences, fraudsters are increasingly exploiting human behaviour. Trust, urgency, authority and the desire to help have become powerful tools for manipulating employees into making decisions they would otherwise question.

Artificial Intelligence (AI) has since accelerated this threat. Criminals can now produce convincing emails, imitate writing styles, replicate voices and generate deepfake videos that make fraudulent instructions from people we know and trust appear authentic.

The days of identifying scams through poor grammar or suspicious-looking messages are rapidly disappearing. A familiar voice, recognisable face or seemingly legitimate email can no longer be accepted as proof of authenticity.

As Xolile Mthembu, Head of IT Governance, Risk Management, Compliance and Security at Old Mutual Insure, explains:

“As artificial intelligence makes digital impersonation increasingly sophisticated, organisations cannot rely on familiarity as proof of authenticity. Strong security controls must be supported by employees who understand the risks, follow verification procedures and feel empowered to challenge suspicious requests. Our employees are increasingly becoming our first line of defence as “human firewall”.

Why the financial services industry is in the crosshairs?

Financial services operate on trusted relationships, sensitive information and high-value transactions. This makes insurers, financial advisers and brokers particularly attractive targets.

Routine requests involving claims settlements, banking detail changes, policy amendments and confidential client information can become opportunities for fraud when criminals successfully impersonate trusted individuals.

Ironically, the qualities that define excellent customer service, including responsiveness, efficiency and a willingness to assist, can become vulnerabilities when urgency overrides verification.

The challenge is not to become less trusting of clients or colleagues. It is to recognise that trust must be supported by independent verification, particularly when money, sensitive information or system access is involved.

Building the human firewall

Technology remains a critical defence, but people are equally important in preventing financial crime. A cyber-aware workforce starts with practical habits embedded into everyday decision-making.

Employees should independently verify unusual requests in accordance to our processes using established contact details rather than information supplied in a suspicious message. Urgent instructions, particularly those involving payments or confidential information, should trigger greater scrutiny, not faster action.

The same vigilance must extend beyond email to WhatsApp, telephone calls, SMS and video conferencing platforms. Employees should never bypass established controls because an instruction appears to come from a senior executive or familiar client.

Most importantly, organisations must encourage a culture where employees can pause, question and escalate concerns without fear of criticism. A moment of verification can prevent significant financial loss and reputational damage.

For businesses, this means moving beyond periodic cybersecurity awareness campaigns towards continuous education, practical fraud simulations, deepfake awareness and consistent reinforcement of verification procedures.

The future of fraud prevention is human

The next major financial crime incident may not begin with sophisticated malware or a compromised network. It could start with a convincing voice note, a familiar face on a video call or an urgent email appearing to come from a trusted or senior colleague.

As AI continues to blur the boundaries between authentic and manipulated communication, organisations must rethink how they establish trust.

At Old Mutual Insure, protecting our clients, partners and business requires a collective approach that combines technological safeguards, strong governance and human vigilance.

Ultimately, the strongest defence against increasingly sophisticated fraud is not simply the ability to recognise suspicious communications. It is the confidence to challenge what appears legitimate.

Because in an age where seeing is no longer believing, verification is not a barrier to doing business. It is what protects the trust on which business depends.

ENDS