AI-generated scams. #40

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being.

So let's get at it. Welcome to The Security Guy and CIA Spy. I am Robert Siciliano, The Security Guy, and this is Peter Wormka.

I guess I'm the CIA spy, former retired. And, uh, I was gonna say Orlando. I could be anywhere in the world right now, but yeah, I will try to fool the audience. I'm in Orlando. You're—

where are you, Robert?

I'm in Boston, Massachusetts, Peter.

Great time to be there.

Yeah, well, if you don't mind, uh, it being, you know, 40 degrees, but, uh, you know, we deal. It's all right. I think it might even be cooler than that. It's that time of the year.

I just came back. I don't, I don't think I told you, I just came back from Miami. Um, I was invited to get on the— you heard of Telemundo? Oh yeah, very large. It's the largest— I mean, it's one of the largest networks in Spanish that, you know, reaches households throughout North America as well as all of Latin America. And I had an interview on their show about, uh, AI threats and about my book that was recently released in Spanish. And I did the interview in Spanish. Can you believe that?

You didn't? Now, how did you do? Do you speak Spanish?

Yes, I do. I mean, I say fluent, but then again, when I hear myself, I said, well, I've heard people speak better. No, but I speak Spanish. I've had so many years living throughout Latin America and using that language every day. And I speak Portuguese. And actually, I'm going to be giving a conference for 4 days in December in Las Vegas for Brazilian magistrates, and it's all going to be in Portuguese. I know it's not easy, it's not easy, but some people prefer to have the presentation done in, you know, their language, because otherwise, you— if you hire, um, you know, a translator or interpreter, you know, the time it takes for you to speak, for the interpreter to speak, and then it's kind of like You just, you lose the flow. So yeah, I've been trying, but I'm not going to go to any other languages. That's enough for me.

So you speak fluent Portuguese?

Yes, I do.

Say artificial intelligence in Portuguese.

Inteligência artificial.

Oh, that's easy.

I'm still pretty good. A lot of the more recent terms, especially the technological terms, they're really similar to English. You know, the pronunciation, of course. Is different, but the actual words are, are very similar.

You are a talented dude, Peter.

I love it.

Okay, all right, so that being said, we're going to be speaking to artificial intelligence and a variety of scams, specifically, um, voice cloning, uh, deepfakes. So, uh, here is, um, an announcement from the Michigan Department of Attorney General discussing that artificial intelligence makes scams harder to spot. And that's really what artificial intelligence is best at right now in regards to fraud is that it just makes the scams that much more believable. It makes the scams that much more feasible. And just like any other artificial intelligence tool, it generates the scams, both video and audio and via text.

So I think we're going to see a huge, or at least very, very significant rise in our statistics regarding, uh, scams, you know, and, uh, fraudsters using this and with success, and people being scammed out of money. I think there's going to be a huge increase during this year and even more in 2024. We're gonna see it.

Okay, well, right here it says, um, AI is the technology that gives a computer the ability to think and learn on its own. It's the simulation of human intelligence. Into machines to do things normally done by humans. Using AI, computers can learn to see, understand, and translate spoken and written language. Essentially what they're saying is, is that AI, if not now, eventually will do it better than humans. AI provides many benefits to society. It's used to develop tools and methods to protect computerized systems and any personal information they hold. It can teach computers to detect when other computers are trying to breach their cybersecurity measures. It can quickly analyze data and make recommendations with increased accuracy, reducing human error. Got it. So even though AI provides many benefits, like any other technology, it can be used for malicious purposes. Okay, so AI allows scammers to easily create and personalize scams to make them more convincing. It uses personal information pulled from social media profiles and other online sources to tailor the scam to you. So customizable scams, spear phishing they may say, uh, can be used to create deepfake audio and video clips to trick us. Using technology, scammers can collect audio data to clone a person's voice. That seems to be the most effective way that AI is being used right now. They may clone a child's voice, a grandchild, or other family members. The impossible call, possibly spoofing a phone number You know, caller ID spoofing, that's doable. To show the loved one's phone number on your caller ID, they may claim to be in serious trouble and beg the relatives to send money. Hearing a loved one's voice and seeing their phone number on your caller ID is convincing enough and motivates us to respond to the request.

This has been around for a while. I mean, this technology has been around for a while, and the use of, uh, AI to clone voices has been around for a while. About a year and a half ago, It took approximately 60 seconds of voice sampling to be able to actually make a pretty decent clone of the voice. Now it's down to 5 seconds of sample to produce a deepfake voice cloning. So it doesn't take much to get that, right? They can— an individual can just call and call you. I mean, a person would answer the phone and they wouldn't even have to get into a conversation per se. They could just say, you know, uh, the person's answering, hello, hello, who's there? And they got enough. Or if you let the call go to your voicemail and you use your personal— if you use your personal voice for your voicemail greeting, that's another way that they can obtain the sampling of your voice. Very simple.

Yeah.

And with me and you, we're all over the web, you know, our likeness, our video, our audio our everything is all over the web. And so basically recreating you and I via artificial intelligence wouldn't be difficult at all. I've got, you know, hundreds and hundreds of videos online, maybe thousands at this point, both TV and, uh, Shorts and, um, uh, my own, you know, uh, everything. So yeah, that's that, that for somebody to clone me is a no-brainer. For you, it's a no-brainer.

Yeah, well, no one should think that they're immune to this potential threat of getting their voice cloned, because as I mentioned, just a few seconds is all that's required. So we can get that from almost anybody. So I would suggest one of the first things you want to do is, if you have your personalized message for your voicemail, change that. Use the compute— use the, you know, the one that's the generated, the optional one that you can just use the phone to generate its own, uh, use the its own voice versus yours, that would be something you should do.

For most people, that's a really good idea. So it says to learn to recognize the ingredients of a scam. I like that, ingredients. So pressure to act immediately, that's always a part of most scams. You get all emotional, do this quickly or else. Yeah. You use of scare tactics or enticing offers, and that's the or else part. Uh, an offer too good to be true, we've seen that a million times. Demand for money, typically in an unusual form like wire transfer, gift card, a pay app like a Venmo or PayPal, or crypto. Requests for sensitive or personal information. So I think, like, we could tell you all day long, if you ever get a call from a loved one who's in distress, think twice before you act or react because that distressing call from a loved one could be true or it might not be true. And so the best thing to do right then and there is to hang up and call them back at a phone number that you know is good, or call a loved one like their father or their brother or their sister or their child to confirm the legitimacy of what's going on. But here's the deal. Even though I say, we say, if a loved one calls you in distress, it's their voice, it's whatever, and I say do this to check to see if it's real, you're going to be so emotionally charged up, you're going to forget what I'm saying to you right now. And/or like, your first impulse is to help that person, and everything else just flies out the window.

Well, there's another, there's another thing I would highly recommend. I actually mentioned this when I was on the air the other day, uh, being with Telemundo, is that establish, you know, we have the chance now, we're getting together for the holidays, most families, right? Thanksgiving and Christmas. And it's an important time to talk about this type of scam and how we can establish a safeguard in our— within our family of using a code. It could be a word, it could be a phrase that if that phrase or if that word is not used in that communication, it is not verified. It could very well be a scam. All right, so what we have to do— you just can't mention it once. You got to reinforce that with your family and say, this is the family code, and if we don't hear this code, that emergency is not real.

So that brings us to the Washington Post. Should you have a family safe word against AI voice spoofing scams? How and whether to plan for criminals pretending to be a loved one in distress. So, uh, he, meaning, uh, this guy Woods, who's a digital security executive, has researched, uh, rehearsed with his daughter as a code word so that if they're in danger, uh, to call their dad for help. Woods knows it, it's really them and not an imposter faking his child in distress. Woods. He's a digital security executive, a former law enforcement officer. He admits that, like, his methods might be a little over the top. I think it's great. But Woods also knows that criminals will say anything, even falsely claiming that they have kidnapped your loved one, uh, using artificial intelligence to fake their voice pleading for help. So should we all set up anti-imposter code words with friends and family? It doesn't hurt. Um, is it overkill for a terrifying but uncommon danger, like wearing a helmet everywhere? Uh, you're— so you— in case you're hit by false debris. Well, look at— I don't think it's a bad idea to have a code word, you know. Look at this right here, right? This is from CNN. Mom, these bad men have me. She believes scammers cloned her daughter's voice in a fake kidnapping. So there's the mom.

That's the one that was in Colorado that she went away on a skiing trip.

Yeah, Jennifer DeStefano's phone rang one afternoon, uh, as she climbed out of her car outside of a dance studio where her younger daughter Aubrey had a rehearsal. So there is the mom, there's the older daughter. They look exactly alike. There's the younger daughter. They all look alike. Isn't that fun? Uh, the caller showed up as unknown, and she briefly contemplated not picking up. So if it was her, her daughter's caller ID versus unknown, forget it, right? But her older daughter, 15-year-old Brianna, was away training for a ski race, and the Stefano Feta could be a medical emergency. 'Hello,' she answered on speakerphone as she locked up her car, lugged her purse and laptop bag into the studio. She was greeted by yelling and sobbing. 'Mom, I messed up,' screamed the girl's voice.

'What did you do?

What happened?' Stefano asked. 'The voice sounded like it was Breeze, the inflection, everything,' she told CNN. 'Then all of a sudden heard a man saying, "Lay down, put your head back."' 'And I'm thinking she's being journeyed off of a mountain,' said the mother. Which isn't— which is common when you're skiing. So she started to panic. Oh man, these SOB scammers.

Can you imagine?

That's—

that is dramatic.

Yeah, dude. As the cries for help continued in the background, a deep male voice started firing off commands. Listen here, I have your daughter. You call the police, you call anybody, I'm gonna pop her something so full of drugs, I'm gonna have my way with her, then drop her off in Mexico. And you're never going to see her again. What an asshole. Then she ran into the dance studio, shaking her screams for help. She felt like she was suddenly drowning. Like, of course you would. My wife would lose her mind.

Well, a lot, a lot of people would. Yeah.

Oh my God. After chaotic rapid-fire series of events that include a million-dollar ransom demand, 911 call, and a frantic effort to reach Brianna. The kidnapping was exposed as a scam, but a puzzled Brianna called her to tell her mother that she didn't know what the fuss was and everything was fine. But DeStefano, who lives in Arizona, will never forget those 4 minutes of terror and confusion. So apparently she must have called her daughter, tried to, probably.

Maybe, you know, because a lot of kids don't answer the phone. It ends up, you know, you ring, ring, ring, maybe you leave a message. That's a problem too. If you're trying to call to verify, if the kids are not answering the phone immediately, that, you know, every second before they call you back 5 minutes later, you know, you can imagine what can happen in 5 minutes.

So it says, a mother knows her child. She later said, you can hear your child cry across a building and you know it's yours. So she must have like figured out at some point in the first couple of minutes that like something was just wrong, like, like it just didn't sound like her daughter crying in the background.

I think, I, I think— I don't know if I mentioned here, but I, I heard— I read another story. I think she— the mother called the father and explained what was going on. The father said, just wait, you know, calm down, uh, let's, let's look— let's slow this down a bit and trying to figure this— if this is real or not.

All right, so let's get on to something from, uh, Time Magazine over here. From scams to music, AI cloning is on the rise. Arizona family is terrified months ago. Uh, yeah, so Jennifer DeStefano, same deal. So all the data on how prevalent AI-powered scams are limited. Stories are— similar incidents continue to pop up on, on TikTok. Okay, so AI cloning in the music industry. Let's go to Yeah, it's a big problem.

Yeah.

Yeah. Okay. So did you see this one, Peter? So, confessions of an AI deepfake propagandist using ElevenLabs to clone Jill Biden's voice.

Yeah, I've seen a few of those.

Hmm.

A recent deep, deepfake video of the First Lady of the United States of America, Jill Biden, where she attacks her own husband, Jill Biden, uh, showed up on YouTube. Created by filmmaker and producer Ken Lurt, the video depicts Jill Biden delivering a speech critical of President Biden's policies regarding ongoing Israeli-Palestinian conflict. We haven't talked about that at all, Peter. That is just awful.

You—

using machine learning techniques, Lurt was able to generate a realistic-sounding voice for Jill Biden delivering remarks attacking the president for supporting airstrikes in Gaza. Well, I'm going to attempt to play this, Peter. I don't know if you're going to hear it. Let me— nod your head if you can hear this. All right, you ready? Can you hear it?

No.

Okay, so if you can't hear it, that means nobody else can.

This is the thing though, Robert, we're seeing more and more of these things pop up across social media. This is why, I mean, I've been, I've been moving myself away from social media when it comes to getting my news. When it comes to getting my news, I'm going with the pretty much the standard networks for news because at the very minimum, even though those standard networks many times are biased, every network is biased, right? I think you agree with me. But at least the news that they'll put on there, the videos, are typically— they're going to verify them before airing them. So I think at a minimum, we, you know, we can get some bias in the commentary of the news, but we can save ourselves from a lot of these really deepfakes that can go viral on social media, and then people are just going crazy.

Crazy. AI-generated scam cons Sugarland man out of $17,000. An 82-year-old man reportedly received a call believing It was from his son-in-law. The caller convinced him to send thousands of dollars. Uh, Jerry, identified only by his first name, said he received a call from a stranger who introduced himself as Sergeant Matthew with the San Antonio Police Department. The caller told Jerry that his son-in-law Michael was in jail for Sarah's accident that he caused. Another voice, which Jerry then thought belonged to his son-in-law, came online asking Jerry to help pay for his release. The scammers convinced Jerry to take out $17,000 and hire a courier to deliver the cash from the assisted living facility where Jerry resided with his wife. Oh, man. Oh, man. Although Jerry wrote down the license plate numbers in the vehicles that drove off with his money, officers told the Sugar Land Police Department said leads in any linked courier service turned up short. Peter, what is going on?

No, this is increasingly a huge problem. And what we really— I think I may have mentioned this last— what we really need, the people need to share their stories. They have— everybody has a family member who's gone through something like this or similar to this. A good friend of mine told me the other day that actually he received a call and supposedly his daughter was kidnapped, and they had cloned the daughter's voice, but she— they used one term that she never She never referred to him as Poppy, and it was Poppy, Poppy. And he said, that's not my daughter. But the voice with the clone voice was real. And I said, you know, we need to share, share your story. And so I got a story on video, and I'm going to air it at some point. But if we get more and more people to share their stories, and I welcome those, I got a page on my website on counterintelligence.institute.com where people can share their stories. And I, and I want to start putting those out. And if they don't want to share their name, that's perfectly right. But the more people share what's going on, the better educated, and, and we can help other people from falling victim to these same types of things. Because this is really growing. And once in a while it comes out in an article, but, but it's a lot bigger of a problem than most people will, will recognize.

Huge.

Look at this: high schooler calls for AI regulations after manipulated porn pornographic images of her and others shared online via CNN. Yeah, this is like my absolute every nightmare. So this appears to be the mother and the daughter. They look alike too. So a student in New Jersey is calling for the federal legislation to address AI-generated pornographic images. She says photos of her and other female classmates were manipulated and possibly shared online over the summer. Westfield High student and her mother have expressed frustration of what they say is a lack of legal recourse in place to protect victims of AI pornography. In this situation, there's some boys or a boy, that's to be determined, who created without the consent of the girls inappropriate images, the mother said, speaking with CNN. The daughter, who said she was among more than 30 female students in her high school whose photos were manipulated and possibly shared publicly, is demanding accountability from the school and local, state, and government officials. School administrators became aware of the incidents in October when students informed them of the images were created and possibly shared over the internet. There was a great deal of concern about who had images created of them and they were shared, said the principal. At this time, we believe that any created images have been deleted and are not being circulated. And the school went on to, you know, talk about how they were involved in the— they were notified and they were investigating, and that, um, they provided specific details and that their networks, you know, that none of the fraud propagated from their networks or the devices and so forth. And like, here's the deal, right? Like, the problem here is that this is relatively uncharted territory, okay? And you're using— they're likely using the face or faces or images of the of the, in this case, probably 17-year-olds, which are minors, and attaching them to adult bodies. Okay, now the question then becomes, is that considered child pornography? No, it's an adult body, right?

But I mean, this has been going on, I mean, maybe not so much with minors, but this is going back to at least 2017 when these first, these images were uploaded to Reddit where they took the likeness, they took the, the image, the, the face of a celebrity, particularly female, and superimposed that onto the bodies of porn stars. And since then, there's been a lot, not only in celebrities, but a lot of other, you know, young women, probably adult, still adults, but young women that have suffered from this sort of, of, um, you know, pornography being, you know, delivered. And even if, you know, for revenge scams, even if there was no intimate photograph exchange between a woman and her boyfriend, let's say, partners, that if they got into, you know, decided to split and one was, you know, wanted to impose a little bit of revenge, they could still produce a type of deepfake pornography image to try to, you know, get back at them. So we've seen this for a long time now, and now it's getting— with nothing really being done about it from a legislative standpoint, except a few states have drafted or passed some legislation in regard to this, but only a handful of states. The federal government hasn't. And I know, how far are we going to go? Are we ever, never going to have anything to protect, you know, our youth regarding this?

So in 2022, Congress created a federal civil cause of action for victims of revenge murder. Complaint can seek compensatory and punitive damages and attorney's fees in such action. So state revenge porn laws. I think it's also known as non-consensual pornography or revenge porn laws state to state. So I think that, uh, whether it's the actual physical body of the victim or it's the just the face of the victim along with somebody else's body, I think that would be considered non-consensual pornography. So there is currently a law against it., and then if even if it's AI generated, and then if it involves a child, then I think that they could probably prosecute that under child pornography.

But just think about this for, for these young ladies that have this happen to them. I mean, I mean, when people get raped, it is tremendous trauma, right? And but many times no one knows about it except the victim and the person that did it, but the victim just doesn't want anybody to know. Here, you know, it's rape, but in a sense it's sort of like it's a violation when they all of a sudden they produce these images and they post them on the World Wide Web where everybody sees and believes, or, you know, or fast, you know, or fascinates over that this person, that's their naked body, you know, and they see their picture.

It's—

I mean, what kind of trauma is that? And how can it ever be, you know, erased from the, from the victim?

I think I personally don't allow my children 15 and 17 years old to post their photographs online. That just doesn't happen. That hasn't happened yet. Now, that said, there's going to be a time when they are going to, and then, you know, that's that. Hopefully not until they're 18 years old. Meanwhile, Peter, everybody else, you know, keep your kids offline as much as you possibly can, at least their photographs. No need to post kids' pictures online. Adults, just be aware that this stuff is going on. And know that it is against the law, and that you have some form of, you know, ability to report it. Whether that's any consolation is another story. But just be aware of it. And don't completely freak out if it does happen, because, you know, it's the world that we live in today. And I think, you know, people understand that's the world that we live in. So, it's not the end of the world. For kids, though, that— what I just said, it's not the end of the world for kids, with that type of pornography with them online, even if it is their face and not their body, they could be so devastated by stuff like that. We have seen situations where, you know, kids have engaged in self-harm as a result of it.

Well, even worse, I mean, there is a number of cases that are growing in regard to cybersexual extortion. And these also target young people, high schoolers, where they will create these fake, you know, deepfake images of them with their face superimposed upon a, you know, um, a body, a body in a sexual illicit situation, and then tell them that if, you know, if you don't pay me this money, we're going to release this to your family and friends. And so these poor kids, even though they hadn't done anything wrong per se, now what are they going to do? And they're afraid to tell their parents, so they start to pay, right? They'll start paying the amount, whatever it is, a few hundred bucks or a thousand bucks, maybe on a credit card. That they find the money somehow. And, but that doesn't go away. It doesn't go away. They keep on coming back to them to try to get more and more money. And there have been cases of suicides. They really have, because these kids find no way out of this. This is a terrible problem.

Yeah, parents, you need to talk to your kids, you know, as far as like them posting stuff. And, you know, I have a good friend whose son did the same thing, and, you know, 17 years old. And I said, listen, listen, Like, it's— so you spent the money in Bitcoin, whatever. At this point, just pay attention to your son. Like, just get him close to you. Like, just make sure that he's okay because this is traumatic for him. And the more that, that he festers over this, the more upsetting it's going to be for him. Just stay close to your boy right now. Like, this is a parenting issue at this point. Pay attention to your boy's mental well-being at this point. All right, Peter, so tell everybody what you got going on.

Well, right now I'm preparing to head over to— I'm going next week to Washington, D.C. to attend one of the major security conferences. I'm looking very much forward to that. And then shortly after, I'm going to be heading to Las Vegas to give a training workshop in Portuguese to Brazilian magistrates. So anybody that's interested, though, I really— I know I'm preparing for next year. Interested in having me come out and do a doing a workshop, especially focusing on AI threats these days, please reach out to me. You can find my information on counterintelligence-institute.com or my LinkedIn page.

Yeah. And you can also get Peter's book, Why Are You Messing with Me? Senior Survivor's Guide for Privacy Security on Amazon.

Yes, sir.

Nice job. And for y'all want to touch base with me, we are at Protect nowllc.com. That is protectnowllc.com. Uh, we presented a ton of real estate, uh, CE, continuing education training programs. We've got a bunch coming up for lawyers, so just touch base if you're interested in that. Otherwise, Peter, final words?

Take care of your family and loved ones and establish that code word, right, during the upcoming holidays. You won't regret it.

Yeah, and be nice to each other. Thank you, Peter.

Thank you, Robert.