Remember the good old days, like last month, when phishing attempts were simple emails purporting to be from the boss, or a vendor, requesting a transfer of funds?
We’re kidding here, of course, because those scams continue and there’s nothing good about them. But in Hong Kong, phishing just went to a whole new level.
In this case, a finance worker made a series of payments totaling $25 million (US) after being instructed to do so in a video call with the company’s CFO. Except it wasn’t actually the CFO, but a deepfake video of him or her (neither the company nor the individuals have been identified). The video call featured not only the CFO but other ‘employees,’ making it even more realistic.
Ironically, the whole thing began when the employee received what appeared to be a phishing message purporting to be from the CFO, who is based in the UK. Justifiably skeptical, the employee was convinced by the video chat, resulting in 15 transfers to five different Hong Kong bank accounts. It took about a week for the scam to be detected.
So we’ve arrived at a place where deepfakes have become much more dangerous than faux naughty images of Taylor Swift. While deepfake phone calls have been in use for some time now, this attack is the first one to use video.
How could it have been prevented, and how can you be sure the person on the other end of your Zoom/Teams/Meet is really a person?
First, stay skeptical. If the content of the meeting involves any kind of financial transaction or activity that might compromise security (for instance, a request to share a password), it’s time to verify.
If the person making the request is someone you know, ask them to confirm a bit of personal information that isn’t readily available online (as in, something not found in their LinkedIn profile or their bio on the company website). Or simply ask them to move their head in a certain way, or to hold up three fingers on their left hand. Deepfakes will have trouble complying.
As we’ve been saying for the last couple of years, AI shows tremendous promise in fighting cybercrime, but the bad guys are using it too, creating an ever-changing arms race. A healthy dose of skepticism is the best way to stay a step ahead.
