Love is in the air…and so are cyber scams.
Singles looking for companionship are always ripe targets for scams and hacks, and Valentine’s Day is no exception.
The holiday provides scammers and threat actors with opportunities to prey on the lovelorn through a variety of attack tactics—some of which are utilizing new technologies like AI and deepfakes.
Sweet threat. David Divitt calls the attacks “romance scams.” Divitt, the senior director of fraud protection and experience at global identity verification firm Veriff, told IT Brew a romance scam is usually a process the attacker has put a lot of work into—and Valentine’s Day can offer a good opportunity to pull the trigger on extortion or theft.
“They could anchor around Valentine’s Day as, ‘I really want to come and see you, so can you send me money for tickets?” or, ‘I think it’s time we finally meet, so send me some pictures so I know what you look like,’” Divitt said. “And that kind of thing could be used as an anchor to convince the victim, unfortunately, to complete this scam.”
Hackers can use the information they obtain for myriad purposes, including manipulating the results of identity verification (IDV) sessions to impersonate victims.
“We are seeing the fraudsters trick the victim into doing an IDV session without them realizing,” Divitt said. “The fraudster might be trying to open up a crypto account in order to move some stolen crypto or take a stolen credit card and buy crypto with it. In order to do that, they need an identity.”
Heart of the hack. Threat actors are using more sophisticated methods to target their romance scam victims, deploying deepfakes and AI to supplement their existing tactics. Divitt warned that this technology has “massively pushed the boundary in terms of how easy it is to convince the victim.”
Top insights for IT pros
From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.
“Assuming they’re using the technology that’s at the leading edge of the deep fakes, it can look very, very realistic,” Divitt said. “They’re moving their head, they’re moving their mouth, talking...it’s really difficult to know that that’s not the real person that you think you’re talking to.”
While deep fakes aren’t 100% effective yet, the technology is moving quickly. Identity security firm SailPoint CISO Rex Booth told IT Brew at CES in January that his company tested out the tech with employees, sending them instructions from CEO Mark McClain that were built by AI from public recordings of the executive.
Booth said that the results were “more effective from an offensive perspective than a typical phishing email”—and that’s for employees of a company focused on security. When live interactions can match that level of sophistication, he added, then the technology could present major threats to consumers. IT Brew asked if the tech has evolved to the point that an AI-generated deepfake could take content written in one language, translate it, and have a believable video speak to a target all in real time.
“Right now, the answer is no,” Booth said. “Is the answer yes in 12 months? It’s closer to yes.”
Be careful. Divitt advised that users should take precautions when it comes to talking to people online you haven’t met. If you’re on screen, have them get up and move around. Deep fake technology hasn’t progressed to the point that it can mimic those kinds of movements. And if you’re asked for sensitive documents or money, proceed with caution.
“Trust your gut,” Divitt said, “and don’t be embarrassed to ask a few questions.”