What to Know About the Growing Threat of AI in Phishing Scams

When it comes to the rapidly-evolving threat landscape of AI in 2024, most of us are still processing how this technology can create and spread misinformation in the form of fake news and digitally manipulated social media content. But unfortunately, the use of deepfakes to influence public opinion is just one of many AI-generated challenges we face on the communications front. Security experts are raising the alarm that we should also expect a significant increase in the use of AI tools by scammers intent on stealing our money and sensitive personal financial information.

As AI-driven scams roll out fast in an environment that is still largely unregulated, staying alert to the tactics fraudsters use to exploit this technology is a critical line of defense for safeguarding your assets and personal data. A fast-growing threat to have on your radar in 2024 is the ability of criminals to exploit AI technology to carry out highly convincing imposter scams.

Stay a step ahead of the fraudsters and protect your loved ones by familiarizing yourself with their schemes, and how to fight back:

AI technology enables scammers to carry out more advanced and effective phishing attacks to defraud victims.

You may have heard that advances in artificial intelligence and machine learning have made it cheaper and easier for scammers to simulate a loved one’s voice to create a realistic sounding but bogus emergency call intended to deceive you into handing over your money. While voice cloning and deepfake videos used to replicate a person’s voice or appearance continue to present a viable threat, AI language models like ChatGPT are making it possible for scammers to generate and rapidly deploy increasingly targeted and personalized phishing messages on a wide scale. As you may recall, a phishing scam is when an attacker poses as a legitimate enterprise or someone you know to try to get you to divulge sensitive personal information like your credit card details or password.

How AI technology is making it more difficult to detect fraudulent messages and email:

Al algorithms enable attackers to synthesize a robust amount of data for creating communications that seem highly credible.

AI tools like ChatGPT can be used to compile and analyze vast amounts of data for creating carefully crafted scam messages that appear to be legitimate. In what’s known as social engineering, the technology enables attackers to easily gain important insight into a potential victim that can be used to establish a false sense of trust and familiarity through communications such as an email, text or phone call. Machine learning algorithms scour publicly available information including online activities and social media to extract data on a target’s behaviors, relationships, interests, communication styles and more. Scammers may also use these tools to probe information harvested from a data breach.

Using the highly specific data they have cultivated, an AI program can then create plausible-seeming messages consistent with the communication dynamics and habits of a potential victim. For instance, you could get an email that claims to be from your health club requesting that you verify your credit card details to cover a past bill. As with many phishing scams, the goal is often to get you to interact with a link or attachment that directs you to a fraudulent webpage which prompts you to provide private information such as your account details. A link or attachment from an attacker may also contain malware, or intrusive software that is intended to steal sensitive data or otherwise compromise computers and computer networks.

Fewer grammatical errors reduce the likelihood that a message will be dismissed by a potential victim as fraudulent.

It used to be that misspelled words and poor syntax were a reliable indicator of a phishing scam. But these red flags might be becoming obsolete when it comes to fraudulent communications produced with AI. With a grasp of dozens of different languages, ChatGPT enables scammers to create more polished communications with greater linguistic precision and coherence. A lack of conspicuous grammatical errors means fraudulent email and other scam messages can more easily slip by individuals and spam filters undetected.

Machine learning enables scammers to get progressively better at deceiving potential victims.

It’s important to keep in mind that a primary feature of artificial intelligence is the ability of machines to improve learning over time as more data is processed and results are achieved. AI programs can instantly analyze millions of data points to identify patterns and communications that humans cannot grasp. With the capacity to process data and develop knowledge at rapid speeds, AI algorithms enable attackers to continually enhance their techniques in executing successful phishing schemes.

Attackers can generate fake email addresses that look real.

Cybersecurity experts point to the use of counterfeit email addresses as another ploy used by those perpetrating AI-powered phishing attacks. With personal data harvested through AI techniques, scammers can generate slightly-altered versions of real email addresses or create new ones with details specific to the target (e.g., their company or industry). Because the email address appears authentic, the user is more inclined to open and engage with the fraudulent message.

Scammers may integrate digital voice cloning or photorealistic videos.

Be aware that scams could potentially include deepfake technology, or the use of videos or audio recordings that have been manipulated in a way to feature people saying or doing something that they did not say or do. Chilling accounts of fake kidnappers placing calls for ransom demands using a replica of a loved one’s voice as proof of life have circulated in recent times. But another variation on a voice cloning scheme would be a call that sounds very much like your friend or relative claiming to be in a jam and in desperate need of money (as with the notorious “grandparent scam.”

How security teams can defend against AI-driven scams:

While threat actors continue to explore how AI and machine learning can be exploited for nefarious purposes, privacy and security developers are working fast to advance cybersecurity measures to identify and counter AI-driven threats. The good news is that the ability to use AI and machine learning to analyze a massive amount of data and make informed decisions in real time applies to cybersecurity teams as well. As Microsoft has pointed out, this includes developing AI algorithms that can flag real-time threats, analyze message context, and identify aberrations that would indicate a phishing attack.

Critical steps you can take right now to guard against AI-related fraud:

As security experts race to develop the tools to defend against AI-driven phishing scams and deceptive content, you can reduce your risk of becoming a victim of these schemes with these tips:

Enable multi-factor authentication on your accounts.

By setting up multi-factor authentication, a user cannot gain access to your account unless two forms of evidence are presented (e.g., a one-time code texted to your phone, a fingerprint scan). Taking this action adds an additional layer of defense against scammers attempting to breach your account.

Use strong security software.

Invest in updated antivirus and anti-malware software and use advanced email filters that can detect and block AI-related scams. For instance, McAfee Scam Protection can scan all received messages to warn you of any malicious URLs before you click on them. Once the software is granted permission, it will scan though emails, text messages, social media, and web browsers. 

Do the updates on your devices.

It’s critical that you regularly update your software and operating systems to keep your devices secure and operating smoothly. Keep in mind that the latest versions of programs don’t just fix problems in functionality and add new capabilities, they also contain security patches to prevent attackers from exploiting known vulnerabilities.

Approach unsolicited communications with caution:

• Take precautions with unexpected email, calls, texts, and online messages. Do not click on any links or attachments in these communications, even if they appear to be legitimate. Never log on to your account from a prompt or link provided by an unsolicited email or text.
• Before engaging with an unsolicited email, verify the source by checking the sender’s email address, website URL, or social media profile. Check for minor variations or misspelled words. If the communication seems suspicious, you could also check online for recent reports regarding AI-generated scams.
• Stay alert to the use of deepfake technology. If a video or audio recording demonstrates someone saying or doing something that doesn’t conform to your knowledge of that person’s behavior, try to verify the information with a trusted source.
• Beware of spoofed numbers. Fraudsters commonly fake the phone number that is displayed on the caller ID so that it appears to be from a trusted organization, such as your bank or credit union.
• Do not disclose your personal financial data to a person who calls, texts, or emails you unexpectedly. Be aware that scammers may impersonate a legitimate entity, or a friend, family member, colleague or acquaintance with voice cloning technology. They may also use information found online to gain your trust.
• Keep in mind that legitimate organizations generally won’t request sensitive personal information unless you initiated the contact.  For instance, your financial institution will not contact you to request that you provide your login credentials (i.e., user ID and password), a PIN, a verification access code, or account number. If you’re concerned about suspicious activity on your account, go to the official website and log onto your account. Or, call the provider at a phone number you know to be legitimate, such as the number on the back of your card or on your statement.

Tips on protecting yourself against fraudulent activity and keeping your information safe.

SECURITY CENTER