INTERPOL reports widespread AI-enabled cybercrime in its 2026 Africa assessment. Five controls boards should test now.
A convincing message from a chief executive used to be reassuring. Today, a familiar writing style, or even a familiar-sounding voice, is not enough to authorise a payment.
Attackers are using AI to make established fraud techniques faster and more convincing. Defenders can also use AI to help detect and investigate threats. Neither development removes the need for a simpler discipline: verify important instructions, know who owns a response and practise before an incident occurs.
What INTERPOL’s figures say
INTERPOL’s 2026 African Cyberthreat Assessment, drawing on survey data from 36 African member countries and other reporting, says AI enables 55% of reported cybercrimes in its assessment. It also reports that cybercrime-related losses rose from US$192 million in 2024 to US$484 million in the latest figures it cites. Online scams remained the most reported form of cybercrime, while 72% of surveyed countries reported the presence of scam centres.
Those figures are serious, but they need careful reading. “55% of reported cybercrimes” is not a count of every cybercrime that occurred across Africa. Nor does the rise in reported losses prove that AI caused the entire increase: detection and reporting are incomplete and can change over time. The figures show why leaders should strengthen controls, not why they should repeat a dramatic statistic without its qualifications.
INTERPOL also describes differing regional patterns. It highlights mobile-money fraud and attacks on infrastructure in East Africa; business email compromise in parts of Central and West Africa; and Southern Africa’s exposure to global threat actors. Those are regional observations, not a substitute for assessing a particular company’s transactions, systems and vendors.
Where the immediate business risk sits
For many organisations, the most urgent test is not whether staff can identify an obviously fake email. It is whether a plausible instruction can bypass an approval process.
Consider a request apparently from the CEO to change a supplier’s bank details. If the accounts team can approve the change using only the email thread, a voice note or a message from an unfamiliar number, the organisation has a control weakness regardless of how sophisticated the message looks. The response is to verify the request through a previously known, independent channel and keep a record of the approval.
The same principle applies to AI vendors. If one of their systems is compromised or customer data is exposed, the organisation needs a named contact, a clear notification route, usable records and an escalation decision, not a vague promise that “the vendor handles security”.
Five questions for the next board meeting
- 01Can a single email, voice note or message change payment details or release a high-value payment? If so, require independent verification and a documented exception process.
- 02Who owns AI-related fraud and security risk? Name an accountable executive and define how security, finance, legal and operations work together.
- 03Are staff trained for plausible scams? Test realistic payment and credential-harvesting scenarios, not only messages with obvious spelling mistakes.
- 04Will vendors alert us quickly enough? Review incident-notification terms, escalation contacts and access to the records needed for investigation.
- 05Have we rehearsed the first hour? Test how the organisation identifies an incident, stops further loss, preserves evidence and decides whom to notify.
Defensive AI can support security teams by helping them sort alerts and investigate suspicious activity. But it should reinforce, not replace, strong identity checks, approval controls, logging and human judgement. INTERPOL has called for improvements in prevention, detection, response and AI literacy alongside action against criminal networks.
Law enforcement remains an important partner. Yet companies cannot delegate their first response to the police. In INTERPOL’s 2025 assessment, 90% of surveyed countries said law-enforcement or prosecution capacity needed significant improvement; 30% reported having an incident-reporting system and 19% a cyberthreat-intelligence database. The practical lesson is to build a response the organisation can initiate immediately, while knowing when and how to engage the authorities.
