{"id":55271,"date":"2024-02-07T00:00:00","date_gmt":"2024-02-07T00:00:00","guid":{"rendered":"urn:uuid:a01da4ac-984e-760e-4e30-459d24ce6f02"},"modified":"2024-02-07T00:00:00","modified_gmt":"2024-02-07T00:00:00","slug":"a-deepfake-scammed-a-bank-out-of-25m-now-what","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/a-deepfake-scammed-a-bank-out-of-25m-now-what\/","title":{"rendered":"A Deepfake Scammed a Bank out of $25M \u2014 Now What?"},"content":{"rendered":"

<\/p>\n

<\/div>\n

What happened?<\/span><\/span><\/p>\n

Over the weekend<\/a> a Hong Kong firm claimed a $25 million loss to fraudsters using deepfake technology to allegedly impersonate the company’s chief financial officer via video conferencing.<\/p>\n

This AI-driven incident reads more like the plot from a science fiction movie than a real-world event \u2014 but it\u2019s not just theory. If true, it\u2019s a watershed moment testing our collective ability to respond to the next evolution of social engineering and deception attacks.<\/p>\n

The potential for this novel attack was not entirely unforseen. At AWS re:Invent in No<\/span>vember<\/a>, Trend Micro detailed a similar business impact scenario, advising global business leaders on how to prepare and adjust internal processes and policy against the backdrop of rapidly advancing deepfake technology.<\/p>\n

Why are deepfake scams on the rise?<\/span><\/span><\/p>\n

AI-powered fraud uplevels existing attacker tactics and techniques to be more effective. This style of attack became inevitable with high accessibility to deepfake technology and tools as open-source software (generative adversarial networks or GANs), and as avatar-builder SaaS applications.<\/b><\/p>\n

AI tools like HeyGen make it easy for anyone to create a deepfake where an AI model is trained from a real video of the speaker, then generate scripted deepfake videos with turnaround time measured in minutes. The results are impressive and have long-range implications outside of this scenario for mass misinformation spread via social networking sites.<\/p>\n

In the context of the Hong Kong incident, attackers wouldn’t likely be able to power a real-time video call with ad-hoc conversation given that today\u2019s typical tools require 30 minutes of processing to generate a few sentences of video. We predict the technology will reach real-time ability soon, with recent reports suggesting text-to-video advancements are an evolution we could see sooner than later. While investigation is ongoing to fully understand the development and execution of the deepfake videos used in this scenario, it\u2019s likely the adversary pre-generated a set of content clips to play in real-time during the call.<\/p>\n

The evolution of AI-driven attacks<\/span><\/span><\/p>\n

AI is influencing three main categories of cybercrime: social engineering and fraud, jailbroken GPT services, and hijacking and model poisoning. Between these three categories, fraud is leading the way.<\/p>\n

This scenario marks a sharp escalation in the effectiveness of business email compromise (BEC) techniques \u2014 AI is steadily making BEC and phishing more compelling and effective \u2014 and makes it urgent for organizations to ensure their funds transfer processes are fraud-resistant. In this news story, an employee claims they received authorization on a live video call, which gave them confidence to proceed without additional process.<\/p>\n

How organizations can improve preparedness<\/span><\/span><\/p>\n

Defending against deception attacks is not solely a technological battle; it is equally a human challenge, necessitating a combination of adjustments across people, process, and technology to secure financial transactions, data transfers, and contracts against emerging threats.<\/p>\n

Strengthening process, collaboration, and awareness<\/span><\/span><\/p>\n

Despite the ongoing investigation surrounding this case, it’s a wake-up call for organizations to scrutinize and enhance their verification processes for funds transfers. Process questions for cybersecurity and risk leaders to consider:<\/p>\n