{"id":634491,"date":"2026-03-20T09:03:26","date_gmt":"2026-03-20T07:03:26","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=634491"},"modified":"2026-03-20T09:11:56","modified_gmt":"2026-03-20T07:11:56","slug":"cyril-ramaphosa-and-billionaire-johann-rupert-used-in-financial-scam","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/634491-cyril-ramaphosa-and-billionaire-johann-rupert-used-in-financial-scam.html","title":{"rendered":"Cyril Ramaphosa and billionaire Johann Rupert used in financial scam"},"content":{"rendered":"\n<p>A new scam targeting South Africans has appeared online that uses an AI-generated fake video of Cyril Ramaphosa endorsing a scheme called \u201cthe Wealthicator project\u201d.<\/p>\n\n\n\n<p>The scheme promises people a return of R250,000 for an initial investment of R4,200 and claims that it is either endorsed or developed by Ramaphosa and billionaire Johann Rupert.<\/p>\n\n\n\n<p>The scam was discovered and investigated by Artists Against 419 (<a href=\"https:\/\/aa419.org\/\">AA419<\/a>), a well-known international volunteer group dedicated to identifying and shutting down scam websites.<\/p>\n\n\n\n<p>A volunteer from the group told MyBroadband that their preliminary investigation found that the scam\u2019s website appears to be exclusively targeting South Africans.<\/p>\n\n\n\n<p>When you visit the website normally, it looks like a regular Search Engine Optimisation company. However, when browsing from a South African IP address, it eventually displays the page promoting the scam.<\/p>\n\n\n\n<p>Like many such financial scams, it purports to be an automated trading platform that uses artificial intelligence (AI) to rapidly grow an initial investment.<\/p>\n\n\n\n<p>When MyBroadband visited the scam site, we saw two different variants of the scam. Both were presented on pages designed to look like the SABC\u2019s website.<\/p>\n\n\n\n<p>The first variant presented the scam as an interview between SABC morning programme anchor Leanne Manas and Cyril Ramaphosa. It claims that Ramaphosa was one of the first users of the platform.<\/p>\n\n\n\n<p>The second variant we saw included an AI-generated video of Ramaphosa claiming that the government had developed the platform in collaboration with Johann Rupert.<\/p>\n\n\n\n<p>It also includes a falsified Standard Bank account statement for a Thabo Mokoena, supposedly living at Apartment 15, 123 Apartment Street, Durban.<\/p>\n\n\n\n<p>AA419 also found that the website is updated daily. It pulls scripts and content from a secondary domain, and the scam source code itself is in Russian.<\/p>\n\n\n\n<p>Russian financial cybercrime tends to involve independent, opportunistic threat actors who generate income by stealing money from victims around the world.<\/p>\n\n\n\n<p>While the Russian Federation usually turns a blind eye to these cybercriminals, the state itself generally doesn\u2019t engage in such malicious cyber activity.<\/p>\n\n\n\n<p>According to the U.S. Cybersecurity and Infrastructure Security Agency, cyberattacks sanctioned by the Russian government have different aims.<\/p>\n\n\n\n<p>Russia typically engages in broad-scope cyber espionage, suppresses certain social and political activity, steals intellectual property, and harms regional and international adversaries.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">AI tools making convincing fakes easier<\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Example of an AI Deepfake video of Cyril Ramaphosa\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/Kd4UxgSbGo4?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p>While this specific scam has many telltale signs that should warn any savvy Internet user in South Africa that it is a con, the new Ramaphosa video shows how far AI tools have come.<\/p>\n\n\n\n<p>A famous example of a Ramaphosa deepfake surfaced in March 2023, when a video circulating online showed the President announcing plans to demolish the Voortrekker Monument and Loftus Versfeld.<\/p>\n\n\n\n<p>However, in that video, Ramaphosa was unusually static, with his face and body hardly moving as he spoke. This latest deepfake appears much more natural.<\/p>\n\n\n\n<p>Although the video and audio still contain artefacts that betray it as a fake, the audio in particular has improved significantly, raising questions about the damage such technology could do in future.<\/p>\n\n\n\n<p>Smile ID published its 2026 Digital Identity Fraud Report earlier this month, revealing that South Africa has <a href=\"https:\/\/mybroadband.co.za\/news\/security\/631980-south-africa-named-the-capital-of-another-major-crime.html\">the highest share of deepfake-driven fraud<\/a> in Southern Africa at 22%.<\/p>\n\n\n\n<p>The firm\u2019s research also found that artificial intelligence was fueling biometric fraud in the region, with deepfake impersonation and spoofing rising significantly in recent years.<\/p>\n\n\n\n<p>\u201cFraud is overwhelmingly biometric in South Africa. Nearly nine in ten verification attempts rejected for potential fraud are due to impersonation and spoofing during biometric verification,\u201d Smile ID said.<\/p>\n\n\n\n<p>\u201cNo-face-match dominates, meaning the person presenting cannot be credibly linked to the claimed identity \u2014 consistent with stolen identities, mule-assisted flows, and post-onboarding abuse.\u201d<\/p>\n\n\n\n<p>No-face-match impersonation accounts for 47% of fraud, spoofing roughly 40%, and document integrity and presentment tricks 13%.<\/p>\n\n\n\n<p>Smile ID said spoofing attempts are effectively biometric integrity attacks aimed at defeating liveness and similarity checks. These include deepfake-assisted impersonation and face-swap techniques.<\/p>\n\n\n\n<p>Smile ID added that document integrity and presentment tricks, with a 13% contribution, are present but are \u201cclearly secondary\u201d.<\/p>\n\n\n\n<p>It also highlighted examples of high-profile impersonations in South Africa. The deepfake AA419 found and highlighted in this most recent scam is another example of this.<\/p>\n\n\n\n<p>Defanged URLs to the scam website have been posted in the MyBroadband forum for the more technically inclined who wish to probe it themselves.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Scammers are using AI-generated deepfake videos of Cyril Ramaphosa to target South Africans and con them out of their hard-earned money.<\/p>\n","protected":false},"author":15,"featured_media":634492,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[93211,1952,21385],"class_list":["post-634491","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-artists-against-419-aa419","tag-cyril-ramaphosa","tag-johann-rupert"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/634491"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=634491"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/634491\/revisions"}],"predecessor-version":[{"id":634495,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/634491\/revisions\/634495"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/634492"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=634491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=634491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=634491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}