With developments in artificial intelligence happening at seemingly breakneck pace, how do we arm ourselves against the growing creativity of criminals harnessing the power of this technology?
An employee at a multinational company in Hong Kong was duped into paying criminals USD 25 million, after they used deepfake artificial intelligence technology to simulate the company’s chief financial officer in a video conference call with the employee.
The incident, reported in news media extensively in February this year, describes how the employee initially did suspect there was something odd going on, as he received an email allegedly from the chief financial officer, about the need for a secret transaction. However, he became convinced it really was the chief financial officer when he attended a video call with him and other members of staff who looked and sounded exactly like his colleagues. It turned out that these ‘people’ were all deepfake simulations of his co-workers.
The same article reports that criminals in Hong Kong also used stolen identity cards to make 90 loan applications and 54 bank account registrations between July and September last year in 2023. The Hong Kong police say deepfake technology was used to create simulations of the people on the cards, in order to dupe facial recognition software.
Then, there is the emergence of AI-powered kidnapping scams. In April 2023, a woman in the US received an anonymous call from a stranger saying he had her daughter and would drug and rape the 15-year-old if the mother did not pay him US$1 million. The woman, Jennifer DeSteano, said she could clearly identify her daughter’s voice in the background, crying, screaming and pleading. The ‘kidnapper’ however refused to let her speak to her daughter. Before any of the ransom was paid, the actual whereabouts of her daughter were confirmed, and the girl was perfectly safe. The woman made a police report and they identified the incident as a virtual kidnapping scam. Such scams likely involve the use of AI voice-cloning to mimic the voice of the kidnapping ‘victim’.
So, how do we protect ourselves from such AI-powered scams?
If you get a suspicious request to send or transfer money:
Check sources. This adapts the technique of lateral checking of content on websites to weed out fake news. In the case of the employee in the Hong Kong firm, this would look like him going to his supervisor, and his supervisor’s supervisor, to verify that this request made by the firm’s alleged chief financial officer to transfer the huge sum of USD 25 million was legitimate. Watch out for red flags, such as the scammer’s claim that it needed to be a ‘secret transaction’. Making clandestine financial transactions would be extremely suspect in a corporate context.
To protect yourself against AI-powered kidnapping scams, the FBI provides the following tips via this article by CNN:
Refrain from posting information about your upcoming travels on social media. If details of your or your family’s travel plans are publicly available, scammers will know when to target you because you won’t be able to call your ‘kidnapped’ family member to check if they are actually okay.
Create a family password to be shared by all members of your family. Therefore, if you receive a call from someone claiming they have your child, you can insist they ask your child for the password.
If you receive a ‘kidnapping’ call, try to stall for time so you can create a plan and call the police. While you are on the phone, write a note to someone in your home or around you to let them know you are on the line with a kidnapper and to call the police. If you are alone, try to put the fake kidnapper on hold by saying you need to make a call to try and gather the ransom funds and use that opportunity to call the police.
Virtual kidnappers often demand a ransom be paid by wire transfer service, cryptocurrency or gift cards. So be very cautious about providing your financial details to anyone.
[CREDIT: https://edition.cnn.com/2023/04/29/us/ai-scam-calls-kidnapping-cec/index.html]
In all scenarios, trust your instincts. If your interaction with someone (who may or may not be an AI-created entity) causes you to feel extreme emotional responses such as fear, anxiety or panic, take a step back before you react to any request they are making. In almost all crime and scam scenarios, the criminal will request money. If something feels like it’s almost too good to be true, it probably is. For instance, if you receive a call or email telling you you’ve won a lottery or huge cash prize and there is a request for your bank account details so the prize money can be transferred to your bank account, don’t divulge your financial details.
Illustrations for SpudnikLab by Quek Hong Shin.
