AI-enabled voice fraud is on the rise. Research from McAfee found that 1 in 4 adults had been victims of this type of crime, with 77% of those individuals losing money.
Organizations need to know how is voice cloning used by cybercriminals, if they want to safeguard their financial information and confidential data. Cybercriminals have moved away from sending e-mails that seem suspicious to leveraging highly accurate voice deepfakes to replicate the voices of executives, vendors, trusted co-workers, or people the employee knows personally, and then put pressure on their targets to make urgent decisions.
AI-based voice deepfakes are so realistic that they are able to circumvent traditional doubts and scepticism. Therefore, AI-based voice deepfakes represent the fastest-growing category of business fraud today.
Using recorded audio samples, voice cloning uses artificial intelligence to mimic a person’s voice. Basically, software evaluates how a person produces sounds, including tone, speed, accent, and pauses, in order to create new speech that sounds like the original speaker.
Many people seem surprised by how few audio samples are necessary; in some cases, less than one minute of audio can be used to generate a deepfake voice model of a person.
Cybercriminals frequently gather samples from any public source, including:
Once cybercriminals obtain a person’s voice samples, they can use them to create a deepfake AI voice capable of saying anything an attacker wants.
Many companies are still not fully prepared for advanced cyber threats. According to a recent cybersecurity preparedness report, many organizations remain vulnerable to modern attacks.
To comprehend how voice cloning is used by cybercriminals, we can better understand this from the perspective of attacking real-world organizations.
A finance department worker may receive a call from someone who sounds exactly like the company CEO.
The caller will typically sound quiet yet rushed. The caller will relay a message, such as:
These imposter calls show just how realistic a deepfake voice attack can appear when combined with social engineering.
These attacks are similar to Business Email Compromise attacks, where cybercriminals impersonate executives to steal money from organizations.
Most voice deep fakes rely on urgency to trick viewers into believing that the request is really from the employer requesting immediate payment.
Attacks involving vendor or supplier impersonation are also fairly common. The attacker would typically call you and state that their bank information has changed. They then ask for payment to be sent to a new bank account going forward. Because the impersonated vendor sounds like your regular contact and the request seems routine, it is often approved without verifying the change. Often, the organization learns about the fraud only after many payments have already been made.
Not all attacks are about directly sending money. Criminals may also use the cloned voice of someone at your organization to extract confidential information. For example, they may request:
Even with a strong focus on data security, a well-designed AI voice deepfake could lead your employees to let their guard down.
Organizations of all shapes and sizes need to have an understanding of how is voice cloning used by cybercriminals
Despite the advancements in voice cloning technology, effective deterrence often relies on a basic level of vigilance.
Do not rely solely on voice communication to verify that an employee has requested money.
Employees must verify with at least one other method before making any payment request.
Even though the greatest, and most realistic-sounding, deepfake voices cannot circumvent good verification.
To reduce the opportunity for voice scams to succeed, organizations need to establish rules for how they will approve financial transactions.
For example, companies will establish:
Many employees are unaware that voice cloning technology exists.
Simply making more employees aware of voice cloning will help deter many scams.
Overall, simply limiting the number of these types of recordings available increases the possibility that an organization is going to be targeted with Voice Cloning technology. Organizations should also follow proper cybersecurity best practices to reduce the risk of voice cloning attacks.
It is easy to create deepfakes with a voice. Current AI technologies permit the creation of an AI voice deepfake from very short audio clips taken from publicly available video or audio.
The most effective way to prevent voice scam victimization is to verify using a second communication channel. Even if an AI-created deepfake voice sounds credible, verifying through alternate means will prevent being defrauded.
A reliable DMARC monitoring service is an important tool for protecting your domain from phishing and spoofing attacks. Monitoring...
When it comes to the finance industry, trust is paramount. Financial institutions such as banks/insurers/fintechs manage their clients’ funds...
One of the fastest-growing forms of cybercrime is AI vishing. In this instance, criminals use artificial intelligence to mimic...