Deepfake phishing example: Protect your employees from deepfake scams

They say seeing is believing, but with the sudden rise in AI-generated deepfakes, what you see or hear on your next Zoom call might not be real. Deepfakes have been plaguing social media, news content, and professional meetings, and cybercriminals are becoming increasingly comfortable using them to defraud victims. 

A deep fake can look and sound convincing enough to fool even attentive, detail-oriented employees into divulging sensitive information or sending money. Therefore, training your employees on what deepfakes are and how to avoid falling for them is essential. 

The FBI highlighted the danger in a recent official warning, noting that "these AI-driven phishing attacks are characterized by their ability to craft convincing messages tailored to specific recipients and containing proper grammar and spelling, increasing the likelihood of successful deception and data theft." Whether it's an audio or video-based deepfake, the best way to avoid being deceived is to understand how to recognize them and what to do if you suspect an attack. 

We've created a video to help explain the deepfake challenge to organizations and employees. 

In this episode of Hacker Headlines, Keatron Evans, VP of Portfolio Product and AI Strategy for Infosec, explains how a deepfake Zoom call duped one employee. 

See Infosec IQ in action

From gamified security awareness to award-winning training, phishing simulations, culture assessments and more, we want to show you what makes Infosec IQ an industry leader.

Demo Now

What is deepfake phishing? 

So, what is a deepfake? A deepfake is when an attacker manipulates a video, image or audio clip to make one person look or sound like another. In many cases, it involves a combination of AI and phishing in an attempt to steal information or trick someone into sending money.  

Using deepfake technology, people can turn themselves into virtually anyone they want. For criminals, that's a payday just waiting to happen. Sadly, it's not hard to find real-life examples of deepfakes — all it takes is a brief search through the news headlines. 

Deepfake phishing example 

Recently, a Hong Kong corporation lost millions of dollars to a deepfake social engineering. 

The scam began with a phishing attack, but the deepfake sealed the deal. The scammers emailed an employee in the finance department. The message supposedly came from the company's chief finance officer (CFO), who lived in the UK. It told the employee to carry out a secret transaction. The employee was suspicious, so he joined a video call with the CFO and several other people — and recognized all of them. 

They told him to go through with the transaction. He did. Ultimately, he made 15 transfers to five different banks, totaling more than $25 million. 

But something still didn't feel right. After approving the money transfer, the employee reached out to the company's head office, and that's when the scam came to light. 

All of the people in that meeting were scammers. They used deepfake technology to impersonate the CFO and other executives. In this case, the employees couldn't even trust the evidence of their eyes or ears. Deepfake video scams — and deepfake audio scams — are here, and they're going to stay. 

Phishing simulations & training

Build the knowledge and skills to stay cyber secure at work and home with 2,000+ security awareness resources. Unlock the right subscription plan for you.

VIEW PRICING

Keeping your organization safe from deepfakes 

So, what does all this mean for you? More importantly, how can you avoid it? Here are some steps you can take to minimize the chances of becoming a deepfaker's next victim. 

1. Be suspicious 

With AI deepfakes becoming more believable, they're getting harder to spot. So, always start with a healthy suspicion. If you're being asked to break company policy or do something unusual, pause the interaction until you can verify that it's legitimate. 

For example, if an "executive" asks you to transfer money, you can kindly explain that you must verify the request due to recent deepfake activity. At that point, you can call people from other departments, such as finance, accounting and other executives, to verify the legitimacy of the request. 

In many cases, a deepfake video works by animating someone's face and upper body. Therefore, you can take several actions to spot a faker quickly: 

• Ask them to take out their ID, cover up any sensitive information and position it in front of the camera. 

• Have the person take a book off a shelf, pick up a stapler or move something else in their background or foreground. If it's a deepfake video, the things around them will be static, digitized images. 

• Have the person stand up and turn around or walk over to a door to open it. 

Currently, a deepfaker can't perform any of these tasks because their software only digitizes a person's face and body and positions them against a static background. 

2. Only use trusted verification methods 

It's best to use a verification method that you trust. For instance, you can call them using their work number or send them an email using an address you trust. 

However, it's important to never reply to a suspicious message and never use the contact methods in that message. For example, if they offer to verify their identity by having you call a number they provide, don't do it. The number may simply connect you to the deepfaker. 

Similarly, if they offer to verify their identity by having you click on a link in a text message or email, that could also be a trap. 

3. If you suspect a scam, say something 

If you think you've been scammed, report it. Concealing a problem won't make it go away. It's always smart to share your suspicions. While it may feel embarrassing, especially if you've already done what the deepfake artist wanted, it's best to let someone know. In this way, you can contain the problem and maybe even protect your company from financial damage. 

Keeping your employees educated is the key to preventing deepfake scams from impacting your organization. Deepfakes are relatively easy to spot — but only if employees know what they look like and how to test the veracity of the video or audio they see. 

See Infosec IQ in action

From gamified security awareness to award-winning training, phishing simulations, culture assessments and more, we want to show you what makes Infosec IQ an industry leader.

Demo Now

During your employee education sessions, it's just as important to establish a company culture that rewards, instead of shames, overly cautious employees. For instance, an executive should avoid irritation if asked to verify their identity during a video call. Instead, they should commend the employee asking for verification to remain vigilant. 

You can get the inside scoop on deepfakes and various other attack techniques by checking out our Hacker Headlines videos. For more security awareness training resources for your organization, speak to someone at Infosec.