4 ms·

There are similar versions of the scam aiming at companies, as the CEO needs money wired to him as part of a secret acquisition of some sort. There's training t

There are similar versions of the scam aiming at companies, as the CEO needs money wired to him as part of a secret acquisition of some sort. There's training trying to target this vector specifically, as the amounts are huge, but it also means more efforts can be made to be more realistic: Getting plenty of pictures and entire voice interviews from many CEOs is trivial. You can imagine how hard one can go crafting a fake message. It's not unlike people entering their credentials where they shouldn't. I've worked at a company you know about, where we had an expert in-house phisher. Her best attempt managed to get 50% of credentials... when targeting the security team itself! So yes, any attack that pulls on the right emotional levers will work on all kinds of people.

apantel 2y ago
Yeah with real-time deepfake audio this could be done by an attacker as an actual phone call in the voice of the person being impersonated.
irjustin 2y ago
We got "attacked" by this. The team was diligent enough to ask questions, but we are a financing company so money transfer requests are extremely common. We had processes in place and obviously made them stricter. My concern is as AI voice/video generation becomes stronger the social engineering can cause internal processes to be circumvented especially if you have a basic understanding of the inner workings of the org.
arp242 2y ago
Years ago there was a Dutch notary who transferred about a million euros from his escrow account to someone pretending to be the Dutch prime on MSN Messenger. The email address was "ThePrimeMinister@hotmail.com" or something like that. They had a long story about national security and urgent need to access the funds and whatnot. There were a lot of suspicions that he might be in on the scam, but as near as anyone could determine, he really was just scam victim. He did get disbarred and got a prison sentence of a year or so (IIRC) because while a victim, he also could and should have known better as a notary dealing with an escrow account.

apantel 2y ago

Yeah with real-time deepfake audio this could be done by an attacker as an actual phone call in the voice of the person being impersonated.

irjustin 2y ago

We got "attacked" by this. The team was diligent enough to ask questions, but we are a financing company so money transfer requests are extremely common. We had processes in place and obviously made them stricter. My concern is as AI voice/video generation becomes stronger the social engineering can cause internal processes to be circumvented especially if you have a basic understanding of the inner workings of the org.

arp242 2y ago

Years ago there was a Dutch notary who transferred about a million euros from his escrow account to someone pretending to be the Dutch prime on MSN Messenger. The email address was "ThePrimeMinister@hotmail.com" or something like that. They had a long story about national security and urgent need to access the funds and whatnot. There were a lot of suspicions that he might be in on the scam, but as near as anyone could determine, he really was just scam victim. He did get disbarred and got a prison sentence of a year or so (IIRC) because while a victim, he also could and should have known better as a notary dealing with an escrow account.