This week, we’ve been contacted in relation to no fewer than three highly sophisticated scams that each used artificial intelligence to impersonate real people, prose and generate convincing images. This article discusses what these scams mean and why this is the tip of the iceberg.
Until not long ago, scams followed a familiar pattern: the email was clearly hyped and contained typos, the attempt to get access to weak passwords was crude, or the order page lacked trustworthiness and relied on a lack of attention to detail. Those scams were still effective and impacted not only those who we might traditionally consider vulnerable to such scams but also doctors, lawyers, politicians, and others.
Over the past eight years, we’ve worked with a number of clients in seeking to respond to and reduce the impacts of such scams. When the money has been paid, there is not a lot that can be done unless the recipient can be identified or the bank or other service provider takes some responsibility.
Something significant has recently changed, and given what we’ve seen this week, we believe there is about to be a wave of sophisticated scams targeting businesses and individuals. Here are the three we saw this week.
Scam one: the impersonated podcaster
The first scam starts with a flattering email from what appears to be a well-established blog or podcast. The branding is right, the writing style matches, and the sender’s name belongs to a real person you can look up. They’re offering a paid opportunity: a product review, a sponsored feature or an interview. The sting comes later: a ‘booking fee’ or ‘processing fee’ payable upfront, a request for your bank details, or a link to a professional-looking page built to harvest your login credentials. AI makes it easy to clone a real person’s voice and writing style, so the pitch reads exactly like the genuine article.
Scam two: the fake family business
The second scam is an online storefront that looks like a genuine small or family business. There are convincing photos of the ‘founders’ and their workshop, a heartfelt origin story, and thousands of reviews, all five stars. Look closely, though, and the reviews follow a familiar pattern: similar length, similar tone, posted in bursts. The site is a front for a cheap dropshipping operation. If your order arrives at all, it will be a poor-quality product that bears little resemblance to the photos, and good luck getting a refund.
Scam three: the redirected payment
The third scam is the most sophisticated and the most costly. The scammer breaches a password or uses social engineering to get inside an email account, either yours or your supplier’s. They watch quietly, learn how invoices are issued and who pays them, and then strike: a legitimate invoice is reissued with the scammer’s bank details, or a well-timed email asks for a payment to be redirected to a ‘new account’. Everything looks normal, so the payment is made without a second thought. Neither party realises the funds have been diverted until the real invoice goes unpaid and by then the money is usually gone.
Five tips to reduce the risk
No single measure will stop every scam, but these five habits significantly reduce the risk:
- Verify independently. Before responding to an unexpected offer or request, contact the person or organisation using a phone number or email address you find yourself — never the details supplied in the message.
- Confirm any change to payment details by phone. If a supplier asks you to pay a different account, call a known contact on a known number and confirm verbally before paying anything.
- Use multi-factor authentication and unique passwords. A password manager plus multi-factor authentication on your email and banking accounts makes account takeovers dramatically harder.
- Scrutinise reviews and offers that seem too good. Check when a website’s domain was registered, search the business’s ABN, and be wary of reviews that share the same length and tone.
- Act quickly if something goes wrong. Contact your bank immediately, then report the scam to Scamwatch and ReportCyber — speed is the biggest factor in recovering funds.
For more government information on scams visit: https://www.scamwatch.gov.au