The voicemail from your son is alarming. He has just been in a car accident and is highly stressed. He needs money urgently, although it is not clear why, and he gives you some bank details for a transfer.
You consider yourself wise to other scams, and have ignored texts claiming to be from him and asking for cash. But you can hear his voice and he is clearly in trouble.
However, the voicemail is the latest way in which criminals are using technology to defraud people. By taking a tiny snippet of real audio – just three seconds is enough – from a person, they can “clone” the individual’s voice using freely available AI technology. From there, they can make an recording of the synthesised voice saying exactly what they want.
The criminals can record a voice from videos on social media or by calling someone and saying nothing. A victim just needs to respond with words such as “hello, who is there?” to give them material for their hoax.
Oliver Devane, a senior researcher at the online security company McAfee, says this is a sophisticated example of spear phishing, or a personalised, targeted attack.
“Having tested some of the free and paid AI voice cloning tools online, we found in one instance, that just three seconds of audio was needed to produce a good match,” he says.
“Cybercriminals will often source this information from public social media profiles and other places online where people post about themselves, their families, their travels, and so on in an attempt to cash in.
“The cybercriminal is betting on a loved one or family member becoming worried, letting emotions take over, and sending money to help.”
What the scam looks like
A phone call or a voicemail, or even a voice note, will come through on your mobile and sound exactly like a loved one or friend.
They will have been involved in an accident or they may have been robbed or injured. They will be distressed and there will be a sense of urgency.
Whatever the circumstances, they will ask for money. They may not give details of why they need the money but they will say it is urgent. They may ask you to transfer it to an account that belongs to someone else.
What to do
As with many scams, if you get a call or voicemail that asks for money, take a moment to stop and think. Does it really sound like the person you know? Are there strange speech patterns that are not accounted for by the fact that there is an emergency.
Even if the phone number comes up as coming from one of your children, this is no assurance as the number can also be faked.
“Try to remain level-headed and pause before you take any next steps,” says Devane. “Remember that cybercriminals are betting on emotions running high. They will play on your connection to the loved one and create a sense of urgency to prompt you into action.”
Call the person who it seems left the message. They may pick up and be able to reassure you that they are OK. Remember the message has come by phone, so even if there is a real emergency they clearly can reach their device and get a signal.
To prepare for the possibility of such scams, you can set up a codeword between you and your children so you know for sure when they are in trouble.
