“I Have Your Mom…”

THE SCAM: Technology is constantly evolving, but as the benefits increase, so do the detriments. On the one hand, amazing innovation brings comfort and convenience to our lives, offering a wide array of ways to simplify daily tasks. However, on the other hand, these same innovations can be used for evil, deceptive purposes. What would you do if you got a frantic call from a loved one because they were in danger? Or what if an unknown caller told you that someone dear to your heart would be harmed if you didn’t comply, as the shrieks of a familiar voice begged for help in the background? Would you hang up, or would you pay up? While many people would say they wouldn’t fall for something like that, it’s becoming harder than ever to tell the difference between a scammer posing as a loved one and a genuine cry for help. And as quickly as it begins, it’s over, leaving you with emotional trauma and an empty bank account.

THE SCHEME: In the quiet of a winter night, Robin, a woman in her mid-thirties, was nestled next to her husband, Steve, in their Brooklyn, NY, home. Her phone’s sudden buzz stirred her from a peaceful sleep. As an interior designer, Robin was no stranger to late-night calls, but this one was different. It was from her mother-in-law, Mona, who rarely if ever, called past midnight. Robin dismissed the late call as an accidental dial, but when the phone buzzed again, she couldn’t ignore it. Picking up, she was met with Mona’s distressed voice repeating, “I can’t do it, I can’t do it.” Robin’s mind raced to the worst possible scenarios. Mona and her husband, Bob, were in their 70s and split their time between Maryland, and Florida. They were active and social, often engaging in games of pickleball and canasta. Robin feared an accident, perhaps even involving her own parents, who also wintered in Florida.

The sound of Bob’s voice suddenly replaced Mona’s on the line, heightening Robin’s anxiety. He demanded to speak with Steve. Robin, interpreting this as a sign of grave news, frantically jerked her husband awake. Steve, a law enforcement officer, awoke to Robin’s shrieks of panic that his parents were on the phone. He immediately took the phone, expecting to hear a familiar voice, but instead, was greeted by a man with a calm, Southern drawl who issued a chilling threat: “I’ve got a gun to your mom’s head, and I’m gonna blow her brains out if you don’t do exactly what I say.”

Steve immediately grabbed his phone and covertly texted a colleague skilled in hostage negotiations. The colleague listened in silently while on mute, advising Steve through text to keep the conversation going. Steve continued the exchange with the man, attempting to get more information. Upon requesting to hear his mother’s voice, the man on the other end of the line countered with a violent refusal and threat that if he asked again, he would kill her. He then demanded Steve send five hundred dollars via Venmo. Despite the absurdly small ransom for his mother’s life, Steve complied, believing that a home invasion had occurred and that his parents were truly in danger. After a few failed attempts, the payment went through to a working Venmo account. The man instructed Steve to use a pizza emoji for the transaction description, and suddenly, the voice of a woman was heard confirming that the money was received.

When Steve inquired as to whether the man would release his mother, the man curtly cut him off, appearing to conceal what was happening from the woman who confirmed the transaction. The man then demanded an additional two hundred and fifty dollars, and after Steve sent the additional amount, the line went dead.

Twenty-five minutes had passed since the ordeal began. Robin was in tears, and Steve was in shock. His colleague reassured them, “You guys did great,” and advised them to check on Mona and Bob.

They called Steve’s father, Bob, who passed the phone to a confused but unharmed Mona. She was safe in bed, oblivious to the night’s harrowing events.

There was never a hostage situation. They were never in danger. It was a scam.

The relief was immense, but questions remained. Why and how had this happened? And why them?

Fraud Geek Explains:

How is it possible that the voices of Steve’s parents were heard during this encounter, yet they were not involved at all? Two words. Deep Fakes. Deep fakes are artificial audio and video recordings that are created using advanced technology, such as artificial intelligence. Deep fakes can mimic the appearance, voice, and facial expressions of real people, making them appear to say or do things that they never did. They can be used for various purposes, such as entertainment, satire, or deception. In this case, the scammers used deep fakes to impersonate Steve’s parents to make him and his wife believe that they were in danger. By creating a realistic and emotional scenario, the scammers manipulated Steve into sending them money without verifying the facts.

Fraud Geek’s Advice:

Steve and Robin were very lucky that in the coming months they were able to recover their money from Venmo and the initial loss was only $750. However, there are countless victims who have been scammed out of thousands simply because they genuinely believed their family was in danger. It’s important to remember that there are no limits to what scammers will do to exploit your emotions, whether it’s a call impersonating your parents or spouse or, for many, even worse, a plea for help from their abducted child. Your best course of action is to be vigilant and stay informed.

Here are some recommendations for how people can stay protected and avoid becoming a victim of deep fakes:

• If you think you are being scammed by a deep fake, do not panic or act impulsively. Stay calm and try to gather as much information as possible about the caller, such as their name, phone number, location, and reason for calling.
• Do not share any personal or financial information with the caller, such as your bank account, credit card, or social security number. Scammers may use this information to steal your identity or money.
• Remember: Deep fakes can be very convincing, but they are not perfect. There may be some signs that the audio or video is manipulated, such as unnatural pauses, glitches, or mismatched lip movements if it’s a video.
• If you receive a call from someone claiming to be a relative or friend in distress, ask them some questions that only they would know the answer to. Many families are now instituting a code word that only the family knows – to verify their true identity.
• Educate yourself and others about how deep fakes work and what they can do.
• Do not share personal or financial information with strangers or unsolicited callers.
• Do not click on links or attachments from unknown sources.
• Use strong passwords and security settings for your online accounts and devices.
• And always check the authenticity and credibility of the information you see or hear online or offline.
• If you believe you’ve encountered an FTC impersonation scam, report it immediately at https://reportfraud.ftc.gov

How financial institutions can protect their customers from deep fakes:

• Educate customers on the signs and risks of deepfake scams, such as unusual requests, altered voices or images, or inconsistencies in the message or sender.
• Encourage customers to verify any requests for personal or financial information before taking action, especially if they involve urgent or high-pressure situations, such as threats, rewards, or deadlines.
• Implement robust authentication and verification methods for online and offline transactions, such as biometric, multifactor, or behavioral-based systems, that can detect anomalies or discrepancies in the customer’s identity or behavior.
• Monitor customer accounts and transactions for suspicious or unusual activity, such as large or frequent transfers, changes in beneficiary details, or requests from unfamiliar sources or locations.
• Notify customers promptly of any potential fraud attempts or security breaches, and provide them with clear and timely guidance on how to report and resolve the issue.

The DefenseStorm Difference:

With DefenseStorm GRID Active Fraud Prevention, FIs can proactively detect fraud before funds leave the organization.  FIs can better monitor insider threats and review user actions to ensure their people are doing what they are supposed to be doing with the permissions they have and are not abusing their access. In addition, FIs can review user access to make sure their employees only have the permissions they need to perform their responsibilities to prevent a fraudster from accessing higher- level/sensitive data.  Using User Behavior Analytics (UBA) , FIs can better detect activities that are outside the norm of the customer. For example, a customer typically uses online banking for low monetary transfers but then comes into a branch with documents to do a large transfer to an account that has not been associated with that user before. UBA within GRID Active Fraud Prevention would flag that potential fraud, protecting both the FI and customer from any money moving out of the account until that transaction could be verified.

DefenseStorm is your ally in the fight against cybercrime. Want to learn more about how GRID Active Fraud Prevention can help your FI stop fraud before money ever leaves accounts?

Contact DefenseStorm today!

SOURCES:

The Terrifying A.I. Scam That Uses Your Loved One’s Voice

https[:]//www[.]newyorker[.]com/science/annals-of-artificial-intelligence/the-terrifying-ai-scam-that-uses-your-loved-ones-voice