As a tech reporter, I may not consider myself particularly tech-savvy. When something goes wrong, my go-to troubleshooting method is simply turning it off and on again. However, I recently discovered that even someone like me could easily create a deepfake of my own voice to impersonate my bank. This alarming trend underscores how generative AI has made it increasingly simple for scammers to mimic voices, raising significant concerns over privacy and security.
For years, we've seen deepfakes of public figures—politicians, celebrities, and even the late Pope—used to spread disinformation on social media. Recently, however, hackers have turned their attention to everyday individuals. All they need is a few seconds of your voice, which can easily be sourced from platforms like Instagram or TikTok, combined with sensitive information like your phone number or debit card details that may be found in data leaks on the dark web.
In my own experiment, I downloaded the audio from a radio interview I participated in a few weeks ago, subscribed to a service for just a few dollars, and trained a voice generator on my voice. I then used a text-to-voice function to engage with my bank, producing a voice that, while slightly robotic, closely resembled my own. During a five-minute call with both an automated system and a human representative, my deepfake triggered almost no suspicion.
This method of scamming is becoming more prevalent as fraudsters exploit affordable, widely available generative AI tools. By deepfaking individuals, they can access bank accounts or even create new accounts in someone else's name. This technology not only simplifies the creation of deepfakes but also complicates their detection.
A stark example of this occurred last year when a financial worker in Hong Kong mistakenly authorized a $25 million payment to scammers who had deepfaked the company's chief financial officer during a video call. While such massive frauds grab headlines, it's essential to recognize that the tech allows organized crime to automate scams, targeting numerous individuals for smaller amounts.
A report from Deloitte projects that fraud losses in the United States could soar to $40 billion by 2027, up from $12.3 billion in 2023, largely due to the impact of generative AI on fraud tactics. In a recent survey by Accenture involving 600 cybersecurity executives at banks, 80% expressed concern that generative AI was enhancing hackers' skills faster than financial institutions could counteract them.
Ben Colman, CEO of Reality Defender, emphasizes that these fraudsters leverage the best engineering and research skills to automate their attacks. "If they can automate fraud, they will use every single tool," he stated.
Alongside voice cloning, generative AI enables criminals to forge documents, facilitating identity theft or the creation of entirely new identities for fraudulent account creation. The scammers are playing a numbers game; even if a financial institution blocks their attempts, they can simply target another account or service. By automating these attempts, they can achieve success without needing a high success rate.
The FBI's Internet Crime Complaint Center reports that the average online scam amount in 2024 reached just under $20,000, with over 250,000 complaints received. The data shows that people of all ages are vulnerable, with significant losses reported across demographics.
While some banks have proactively addressed the challenges posed by deepfakes, others have been slower to respond. A 2024 survey revealed that over 10% of business executives across various industries had encountered deepfake fraud attempts, yet more than half reported that employees had not been trained to recognize or combat such attacks.
Inquiries to several major U.S. banks about their strategies for detecting and combating deepfake fraud yielded minimal responses. Citi declined to disclose details regarding its fraud detection methods, while JPMorgan Chase's Darius Kingsley acknowledged the challenges posed by rapidly evolving technologies exploited by criminals, committing to advance security protocols continuously.
Detecting deepfakes remains a complex issue. Even OpenAI discontinued its AI-writing detector shortly after its launch in 2023, citing low accuracy rates. The rapid improvement in image, video, and audio generation tools has made it increasingly challenging to identify fraudulent content. Generative AI has become adept at masking its tracks, which is advantageous for scammers.
During my deepfake call with my bank, I had the generated voice read sensitive information, including my debit card number and the last four digits of my Social Security number. While I had this data readily available, it is disturbingly easy for criminals to acquire such personal information through dark web purchases resulting from data breaches.
Authorities are beginning to recognize the widespread ease of creating deepfakes. The Financial Crimes Enforcement Network recently issued an alert about the risks of identity fraud linked to generative AI. Michael Barr from the Federal Reserve noted a twentyfold increase in deepfake attacks over the past three years, calling for new policies to raise the cost of such attacks for criminals while reducing the burden on banks.
Scammers are not only targeting banks; they also impersonate friends or familiar services. Experts advise being cautious of unexpected calls, especially those that create a sense of urgency. If you receive a suspicious request, verify the caller's identity through different means or contact your bank directly using the number on your card.
While there are steps you can take to reduce your risk, such as limiting what you share on social media and utilizing two-factor authentication, there is no foolproof way to avoid becoming a target. Barr's policy suggestions include harmonizing cybercrime laws internationally and enhancing coordination among law enforcement agencies to complicate operations for criminal organizations.
Despite the availability of deepfake technology through free and low-cost applications, the issue is often exacerbated by organized crime syndicates employing automated methods to execute mass attacks. Banks are encouraged to remain agile and implement layered security approaches to swiftly adapt to evolving fraud tactics.
Although my attempt to fully hack my bank was unsuccessful, I did manage to listen to my account balance. With more preparation and expertise, it’s conceivable that I could have transferred funds. Each bank has varying systems that could either facilitate or inhibit such scams. While I'm uncertain if my bank detected my generated voice, I find some comfort in knowing that there are protective measures in place.
As the landscape of deepfake technology continues to evolve, staying informed and vigilant is crucial for individuals and institutions alike. Amanda Hoover, a senior correspondent at Business Insider, covers the tech industry's biggest trends and challenges.
