In today's digital era, the rapid advancements in AI have given birth to voice clones or deepfake voices, leading to a concerning rise in potential scams. As exciting as these technological innovations can be, they also carry significant threats. Here's a dive into the types of scams we can anticipate flourishing due to voice clones and how you can arm yourself against them.
The Three Major Scams to Watch Out For:
- Imposter Scams From Within: Imagine receiving a call from a superior or a colleague, asking you to execute an urgent financial transaction. The voice is identical. Why would you doubt it? Many believe that the future might even bring deepfake video calls, making the deception even more believable.
- BEC (Business Email Compromise) Scams: These scams are set to escalate, with fraudsters using AI voice to perfectly imitate CEOs or senior officials. Their main goal? Duping unsuspecting employees into making unauthorized wire transfers or leaking confidential data.
- Extortion and Ransom Scams: These are perhaps the most alarming. Scammers use AI-generated voice clones to mimic the voices of loved ones, often to convey fake emergencies or crises. The result? Victims may be coerced into paying a ransom, thinking they're helping someone they care about.
Additional types of scams:
- Tech Support Scams: Fraudsters might replicate the voice of genuine customer service representatives. They could claim there's an issue with your device or software, urging you to share sensitive information or make a payment.
- Insurance Fraud: Scammers could mimic the voice of an insurance agent, asking victims to renew their policies, upgrade them, or provide personal details for verification purposes.
- Banking Impersonation Scams: By imitating the voice of a bank representative, fraudsters might ask for account verification details, claiming it's for a routine security check.
- Healthcare Scams: With AI voice cloning, scammers could pose as doctors or healthcare providers, asking for personal medical details or payment for medical procedures that were never performed.
- Emergency Scams: Beyond just ransom, these scams play on emotions by imitating the voice of a friend or family member, claiming they've had an accident or are in some trouble and need financial assistance urgently.
- Subscription Renewal Scams: By pretending to be from subscription services (like magazines, streaming services, etc.), scammers could ask for credit card details for renewal purposes.
- Survey and Prize Scams: Scammers could pose as researchers or representatives from well-known companies, claiming you've won a prize. To "claim" your reward, you'd be asked to provide personal or financial details.
- Charity and Donation Scams: Especially after major events or disasters, scammers might imitate legitimate charitable organizations, asking for donations.
- Investment Scams: Posing as financial advisors or brokers, fraudsters might offer "too good to be true" investment opportunities, urging you to act quickly.
- Romance Scams: Using AI voice cloning, scammers can deepen the deception in online dating platforms by providing voice calls that align with the fake profiles they've created.
- Travel and Vacation Scams: Impersonating travel agents or tour operators, scammers could offer discounted trips or vacations, asking for immediate payment.
Protecting Yourself from AI Voice Scammers:
Here are some key ways to identify and prevent falling for these scams:
- Engage Them with a Random Question: Throw them off with an unexpected question like, "How's the weather in [random city]?" An AI, prepped with specific scripts, will falter.
- Test Their Musical Abilities: Ask them to hum a tune or sing a song. Current AI voice clones can't match the pitch and variation of genuine human singing.
- Introduce Humor: Tell a joke and observe the response. AI doesn't truly understand humor, and its response will be off-mark or entirely out of context.
- Watch for Repetition: AI voice clones tend to regurgitate the same scripted answers. If you notice repeated or eerily similar responses, you're likely dealing with a clone.
- Get Personal: Pose a question that the person they're impersonating would know. An AI, lacking that personal knowledge, will give an incorrect answer or deflect.
- Call Back: If you receive an unexpected call demanding action or information, hang up and call back on a known, trusted number for that individual or organization.
- Background Noise Assessment: Listen for inconsistencies in background noise. AI-generated audio might lack ambient sounds typical of a genuine call or might use repetitive background loops.
- Voice Analysis Software: There are emerging tools and software that can detect discrepancies between a genuine voice and its cloned counterpart. These can be especially useful for businesses or frequent targets of such scams.
- Temporal Consistency: Engage the caller in longer conversations. AI voice clones may show inconsistencies over time, especially in longer interactions.
- Use of Idioms and Phrases: Every person has specific ways they speak or certain phrases they use frequently. If the voice does not use these or uses them incorrectly, it may be a sign.
- Ask for Past Memories: Discussing shared memories or experiences can be tricky for a scammer. They might dodge the question or give a vague response.
- Emotional Consistency: Gauge the emotional consistency of the speaker. While AI can mimic voice tones, matching the correct emotional tone in a dynamic conversation can be challenging.
- Set up Voice Passwords: For critical communications, especially within businesses, set up voice passwords or phrases known only to the involved parties.
- Use of Other Verification Means: Before making any financial transaction or sharing sensitive information, always verify the request through a different communication channel. Rely on other methods in tandem, such as video calls (though be wary of deepfake video technology), text verifications, or email confirmations.
- Unexpected Changes in Topic: Switch between topics rapidly or bring up something entirely unexpected. An AI, especially one operating on a script, might struggle to keep up or respond appropriately.
- Monitor for Latency: Listen for unnatural pauses or delays in the conversation. This could indicate the AI processing the received information to generate a response.
- Check Regularly with Contacts: Regularly checking in with contacts or setting up a routine can establish a pattern. Any deviation from this can be a red flag.
- Multi-factor Authentication (MFA): Introduce MFA in your business and personal dealings. This adds an extra layer of security even if someone has access to your voice or personal details.
- Stay Updated: With the rapid advancements in technology, always ensure you are abreast of the latest scams and the recommended safety measures. Stay informed about the latest in voice cloning technology. The more you know, the better equipped you'll be to detect fakes.
- Educate and Train: If you're in a business setting, ensure your staff is trained to recognize and report potential threats.
- Set a verbal codeword: Make sure it’s one only you and those closest to you know. (Financial institutions and alarm companies often set up accounts with a codeword in the same way to ensure that you’re really you when you speak with them.) Make sure everyone knows and uses it in messages when they ask for help.
- Protect your identity: Identity monitoring services can notify you if your personal information makes its way to the dark web and provide guidance for protective measures. This can help shut down other ways that a scammer can attempt to pose as you.
- Clear your name from data broker sites: How’d that scammer get your phone number anyway? It’s possible they pulled that information off a data broker site. Data brokers buy, collect, and sell detailed personal information, which they compile from several public and private sources, such as local, state, and federal records, in addition to third parties.
- Trust Your Instincts: If something feels off, it probably is. Always trust your gut feeling and take a moment to evaluate the situation.
Social Media Safety Tips:
Preventing AI voice cloning involves safeguarding your voice data much in the same way you'd protect other personal information. As AI and deep learning technologies become more advanced, even short audio samples can be used to recreate a person's voice.
When considering social media and online sharing, here are some steps individuals can take to protect their voices:
- Limit Public Videos: Refrain from posting long videos where you're speaking. If you need to share a video, consider using text overlays or subtitles instead of verbal communication.
- Privacy Settings: Ensure that your social media profiles are set to private, limiting access to known friends and family. Regularly review and update these settings as platforms often undergo changes.
- Be Mindful of Voice Apps: Be cautious when using voice-based social media applications or features, such as voice tweets or voice messages.
- Avoid Voice Challenges: Social media platforms sometimes have voice challenges or trends that encourage users to share voice notes or videos. Participating in these can expose your voice to a broader audience.
- Review Stored Media: Periodically check platforms where you've previously uploaded videos or podcasts. Consider removing or replacing older content, especially if it's no longer relevant.
- Beware of Voice Phishing: Be cautious of any unsolicited calls or messages asking you to verbally confirm personal information.
- Educate and Inform: Let friends and family know about the risks of AI voice cloning. The more people are aware, the less likely they are to inadvertently share content that features your voice.
- Voice Authentication: If you use voice authentication for any services, be aware that your voiceprint is a valuable piece of data. Ensure that such services have robust security measures in place.
- Check for Consent: If you're attending events or webinars, or if you're part of podcasts or interviews, always ask how your voice will be used. If possible, get a written agreement that restricts unauthorized distribution or use.
- Think before you click and share: Who is in your social media network? How well do you really know and trust them? The wider your connections, the more risk you may be opening yourself up to when sharing content about yourself. Be thoughtful about the friends and connections you have online and set your profiles to “friends and families” only so your content isn’t available to the greater public.
Scenarios Most Likely to Succeed in AI Voice Scams:
Emergency Situations:
- Car crash or breakdown
- Robbery
- Medical emergency or hospitalization.
- Unexpected legal trouble or arrest.
Lost Personal Items:
- Lost phone or wallet.
- Lost passport or travel documents.
- Misplaced luggage while traveling.
Travel-related Issues:- Claiming to be stranded abroad and needing help.
- Booking mishaps or hotel payment issues.
- Trouble at customs or border controls.
Financial Urgencies:
- Unexpected bills or debts.
- Taxes owed immediately to avoid penalties.
- Business or investment opportunity that's "too good to miss".
Personal Relationship Tactics:
- Relationship problems needing financial assistance.
- Unexpected pregnancies or related issues.
- Urgent need for money for family events, like funerals or weddings.
Housing or Living Situation:
- Eviction notice or immediate rent payment.
- Utilities being shut off due to unpaid bills.
- Natural disasters causing urgent relocation.
Digital Compromises:
- Ransom for supposedly compromised explicit photos or videos.
- Alleged hacking of personal accounts demanding money for recovery.
- Payment demands following unauthorized software or media downloads.
Employment or Job Opportunities:
- Unanticipated travel expenses for a "guaranteed" job offer.
- Payment for training or certifications for an "exclusive" opportunity.
- Advance payment for freelancing or work-from-home opportunities.
Account Takeover Prevention:
AI voice impersonation can be alarmingly effective, especially when combined with other tactics, in the context of bank account takeovers. Here's how:
- Phishing Calls: Using a familiar voice (like a bank or credit union executive or staff) to convince account holders to share sensitive information such as PINs, passwords, or OTPs (One-Time Passcodes).
- Two-Factor Authentication (2FA) Bypass: Impersonating the account holder to request or intercept 2FA codes through a call.
- Resetting Account Credentials: Using voice impersonation to call customer support, posing as the account holder, and requesting a password reset or account changes.
- Fake Account Alerts: Posing as the financial institution's fraud department to report suspicious activity and convincing the user to provide or confirm account details or move money to a "secure" account.
- Manipulating Account Security Settings: After gaining initial access through voice impersonation, the attacker might alter account settings to ease future unauthorized access.
- Authorizing Fraudulent Transactions: Using voice commands to authorize payments or wire transfers via phone banking systems that rely on voice authentication.
- Gathering Additional Information: Engaging in casual conversations to extract more personal information from victims which can then be used in further scams or for security questions.
- Social Engineering of Bank or Credit Union Staff: AI voice impersonation can be used to sound like a senior banking executive, instructing junior employees to make unauthorized transactions or changes to an account.
- Mimicking Recorded Verbal Approvals: If a financial institution records verbal consent or approvals for documentation purposes, AI voice cloning can be used to forge such consent.
- Combination with Deepfake Technology: Combining voice impersonation with deepfake video can lead to convincing video calls, further fooling victims or bank personnel.
- Creating Fake References or Verifications: Using AI to simulate voices of references or contacts that the financial institution might call for account verification.
Remember, while these tactics are potential threats, it's essential to be aware of them to put defenses in place. Financial institutions are continually enhancing their security measures and training their personnel to recognize and prevent such attempts. On the user's end, being cautious and verifying any unusual requests independently can be a strong defense against potential AI voice impersonation scams.
How AI Helps Fraudsters Overcome Language Barriers
AI can be trained to impersonate any voice in virtually any language or dialect, allowing fraudsters who may not be fluent in English to conduct scams in perfect English.
Improving Authenticity: Even if a fraudster can speak some English, native speakers might detect an accent or grammatical inaccuracies. AI voice impersonation can produce a flawless, native accent, increasing the credibility of the scam.
- Scalability: Fraudsters can use AI-generated voices to mass-produce scam calls or messages without requiring a team of English-speaking individuals.
- Adaptability: AI systems can be quickly updated or adapted to use different voices, tones, or specific vernaculars to better target various demographics.
- Use of Pre-existing Data: With vast amounts of voice data available online (from public speeches, podcasts, interviews, etc.), it's easier for AI models to be trained to mimic a particular voice without the fraudster having any knowledge of the language.
- Integration with Other Technologies: AI voice impersonation can be combined with other AI-driven technologies like chatbots. This means a fraudster could deploy an English-speaking chatbot, armed with AI voice impersonation, to interact with victims in real-time, adapting to the conversation as it progresses.
- Less Risk of Human Error: Humans can make mistakes, forget scripts, or react emotionally. AI-driven voice scams can be more consistent, reducing the risk of errors that could give the scam away.
- Bypassing Voice Biometrics: As banks and other institutions increasingly use voice biometrics for identification, AI voice impersonation could potentially be used to bypass such security measures, even if the fraudster has no understanding of the ongoing conversation.
- Scripted Responses: Even without understanding the conversation, fraudsters can program AI systems with scripted responses to common questions or prompts, ensuring the conversation flows naturally.