Since the 1960s, I have worked in security. As a young boy, when I worked at my friend’s motel switchboard, we did the same types of things that people do today with deepfakes using far older tech. We had hard-wired telephones back then. But we would often fool people late at nights by pretending we were someone we weren’t.
Later, working with headhunters was a great way to locate people within companies. You would call and use the name of an executive that was not in town, to convince someone secretly that your external unauthorized request is legitimate. This was a skill that only the best headhunters could master. Deepfakes are a great way to fool people. But if you pay attention, they can’t fool you.
This week we will discuss deepfakes and close with Otherweb, a social media news service that is better than most in weeding out fake news, which has caused a lot of embarrassment, mistakes and fraud.
Deepfake Fraud of $25 Million
The HP Wolf Security quarterly briefing on the security threats trends for the previous quarter, and their answer to my question about creative new threats got me thinking.
HP shared with us a fraud scheme that was successful. An employee had been contacted by two deepfake executives whom they knew. They convinced him to wire 25 million dollars from a Hong Kong-based financial institution to a criminal organization. The fraud took two weeks to be discovered.
When I read this story, I immediately saw red flags. I was an IBM internal auditor. First, financial organizations have massive controls over the monetary system because no one would invest in a financial organization that was not secure.
Over the years, many industry practices and rules have been created to protect these institutions. A “separation-of-duties” rule states that no single person is allowed to authorize a payment of any size without the approval of an executive. If you are talking about millions, it may be necessary to have the CFO, CEO and a board member sign off.
You can immediately see that this process was not in place, and that the entity that committed the fraud knew both that it wasn’t there, but also who could authorize such an expense. This strongly suggests that the fraud was an inside job, requiring intimate information about the privileges of those targeted.
It was impossible to fail, because if criminals tried this and failed they would have usually sent an alert within the company. This would make other employees more aware of the fraud, and better able avoid it.
I have little doubt that the employee who was fooled will become a suspect — since that would be the easiest path — and that other employees who informed the attacking entity of the policy shortfall and identified the tricked or compromised target employee are involved.
The “separation-of-duties” rule, which states that no employee may authorize such an expense, would reduce the likelihood of this type of fraud being successful. It might even make it easier to use a different method like bribing employees.
Kidnapped loved one fraud
Deepfakes are a common fraud that is used to trick you into believing that your loved one is in serious danger, and that you must send money to them immediately. This technique has been used successfully over the phone for many years. If done right, video might help make the story more credible, but for now, this is still a rare skill.
The scam is designed to make you feel so panicked that you forget to contact your loved one, or the police. Instead, you rush out to a store and buy a gift certificate to send to the person who has defrauded you. Remember that the best way to avoid getting caught in a kidnapping is for the perpetrator to kill the victim, whether or not the victim paid the ransom.
As a result, you should always call law enforcement first If you are dealing with a kidnapping, it is important to have the right people on hand. If you call them, they have trained personnel to handle this situation, and it’s more likely the perpetrators will be identified, arrested, and charged. Depending on how big your local police force is, you may want to call the FBI. It has more resources to combat this type of fraud than your local PD.
Create a code word, which you will not share with anyone else outside of your family. It will help you to verify that the kidnapped person is really who they say that they are. You can call their mobile phone to see whether they answer. This is the fastest way to determine if the document is fake.
Giving Voice to Victims
A deepfake is a technology that can be used to create the voice of an innocent child who has been killed in a shooting. The technology is known as Shotline. The voices are used very effectively, I should add, for those killed in gun violence to speak against it. Giving voice to the voiceless can send a powerful signal to politicians and supporters who have not taken action to end gun violence.
This would require the parents of the child to give their permission. I would expect hearing your child speak against the violence which killed them to be a cathartic experience for parents. This sends a powerful message to those that put these children at risk, and it should increase empathy by politicians with kids for the victims, and especially the parents of the victims.
It’s one of the best ways to create change. It is difficult to push back against those who are advocating gun reform. However, if your constituents identify themselves with the children or their parents then it could be a career killer.
Deepfakes are not only used for evil.
Wrapping Up
Deepfake technologies are being used to cause harm. Existing methods to reduce or stop fraud should be sufficient to protect you from this technology. We need to create new laws for politics and find ways to enforce those laws. Some of these, although I doubt they will be sufficient, are in the works. Deepfakes, if used properly, can give the voiceless a voice. I think we’ll be seeing more of these.
When deepfakes have been used to do evil, they are not much different than the telephone scams which we have dealt with for years. If you keep your eyes and ears open when making the call, I don’t believe the risk is any greater than before. How often are political ads telling the truth?
If we stay alert and validated the controls that are in place, and if we remain vigilant to potential well-crafted fraud attempts, then this storm should pass. We are more vulnerable to fraud if our security is compromised.
Otherweb
Otherweb This is a social platform that provides a news service and filters fake news from the feed. The app allows you to select areas of interest and receive updates that are based on facts only, without any opinion. On the social media part of the application, you can see related conversations and join in.
(Image Credit: Otherweb)
It is possible to run this service on Windows but it works better on smartphones. You are less likely to spread a false story to your friends, family or co-workers, who could change their opinion about you. It happened to me very early in my career. I had to spend a lot of time repairing the damage that sharing a false news story did to my reputation.
Otherweb’s newest feature, “Discussions,” is available. The new feature, “Discussions,” is a social media platform that actively removes toxic content, such as trolls and instigators. It allows users to safely discuss current events, without fear of being attacked or swatted.
I know a number of us have grown tired of the bad actors, con artists, and conspiracy theory enthusiasts constantly filling up our feeds. They either make it up themselves or take it from others without checking. Fake news can lead to bad decisions. It would be beneficial for us all to get rid of this influence. Otherweb is therefore my Product of The Week. You can try it for free.
The views expressed in this article do not necessarily represent those of ECT News Network.
