Imagine for a minute, you are receiving a phone call from a well-known business associate of yours. You recognize the phone number on the screen and the voice on the other end matches the sound, tone and mannerisms of the person of whom you have spoken with before. The banter between you both feels normal and soon you are talking business. Your associate reveals that she is about to close the deal on an important acquisition and requires you to authorize the bank to begin transferring the funds. Email threads in your inbox between your associate and the legal team confirms what she is saying and that the transaction should indeed take place. You wish your associate well and hang up the call. Soon, you are calling the bank to initiate the transaction.
Deepfake 鈥� what is it?
The above scenario demonstrates what some may consider to be 鈥渂usiness as usual,鈥� including corporate executives, law partners or business directors. What few people may realize, however, is that this type of interaction is really part of an elaborate business scheme, where cybercriminals are using artificial intelligence-based software to recreate a person鈥檚 voice 鈥� known as 鈥渄eepfake鈥� technologies. Similar content using deepfake technologies have already been making their rounds on the Internet 鈥搚ou may already be familiar with 鈥�,鈥� whose videos began appearing on Tik Tok in summer 2021, or an earlier video from 2019 that uses deepfake technology to make appear to be impaired. While doctored videos usually appear for entertainment purposes only, they can have real world implications, and sometimes tremendous consequences, for public figures, business executives and even large corporations.
鈥�Cybercriminals are increasingly sharing, developing and deploying deepfake technologies to bypass biometric security protections, and in crimes including blackmail, identity theft, social engineering-based attacks and more,鈥� says Gareth Cottam, Crawford鈥檚 Head of Cyber for Asia Pacific. 鈥�We are seeing an increase in cyber incidents, particularly ransomware matters, where the Threat Actors are making calls to key stakeholders to apply additional psychological pressure, while remaining anonymous through use of deepfake voice software.
鈥淎s identified in a recent report from Experian, our vendor partner, synthetic identity fraud is growing and is identified as the fastest growing type of financial cybercrime, with the use of deepfake technology to create fake faces for biometric verification when forming a new identity.鈥�
How to spot it
So far there are only two known cases of deepfake technology being used in corporate swindles, as reported in
and the , but the threat to corporations is likely only going to increase. It鈥檚 important, then, to familiarize yourself with what deepfake technology is, how it can be used, and learn how to protect yourself and your business from potential deepfake scams.
Neal Jardine, Crawford鈥檚 Cyber Practice Leader for North America, agrees that being able to identify deepfake content can be incredibly difficult, as the overall purpose of the technology is to be foolproof:
鈥淲e鈥檝e tended to rely on technology even more during the pandemic as businesses have shifted to remote work. While we鈥檝e always trusted our colleagues鈥� email addresses or their signatures on PDF documents, this is becoming more and more risky given the ever-changing cyber threat landscape and deepfake technology. We therefore need to learn to start looking for those tiny imperfections in email syntax, or the overall quality of those voice or video calls, because now there鈥檚 always a slight chance that the person on the other end may not be who they say they are. Greater vigilance and security will be key for the future of online work.鈥�
It鈥檚 critical to assess the quality of audio or video conversations. In a video, for example, the speech may not be lined up with the movement of the person鈥檚 mouth, or one may notice unnatural speech patterns, a 鈥渞obotic鈥� sounding voice, or general distortions on the other end such as blurriness or fuzziness.
How to prevent falling victim to cybercrime
Crawford鈥檚 Cyber Incident Response team responds to social engineering attacks globally. As global leaders in cyber incident response and planning, we advocate that clients adopt the best practice principle of having at least two employees sign off on payments over an agreed threshold. Sign-off by two employees should also involve a call to the client via a previously known number that isn鈥檛 the number originally called from or on the email payment request.
We also strongly recommend that no payments be issued under pressure or in a rushed manner as this is often where social engineering and instances of deepfake are most prevalent.
Individuals or corporations who believe that they may be at risk of being a target of scams using deepfake technology may want to set up a secret code word with those in their inner circle to properly identify themselves. Good password hygiene is always recommended, which means using a diverse array of letters, numbers and symbols in up to 12 characters. Finally, learn how to spot phishing emails and never, ever, provide your user login and password after opening a suspicious-looking attachment or embedded hyperlink, as this will send your login information directly to the cybercriminals.
While the technology arms-race continues, security teams must look to use the same AI tools that create those attacks in the first place. Until then, evolving cybersecurity hygiene trends will likely transition to a 鈥渮ero trust鈥� environment where every user and every device will need to verify and validate with increasingly strict limits to access and privilege on systems.
What to do if you鈥檝e been targeted
If you believe that you or your business has been targeted or has fallen victim to a cybercrime, including via deepfake, it鈥檚 important for you to bring it to the attention of all the parties that may be involved, including the bank or credit card provider. In the case of identity theft you may also want to file a police report with your local police department or through your country鈥檚 cybersecurity agency, such as the or the in the United States.
How Crawford can help
At Crawford & Company, we rely on the expertise and experience of industry professionals to support the insured person(s) every step of the way, from the moment a security breach is reported through to resolution and recovery. Clients who are adversely affected by a cyber-attack will work with members of our cyber incident response team(s), who will help determine how and why the breach occurred while also assisting in the recovery of lost data and files. All of Crawford鈥檚 claims management services are strategically managed by a Crawford Loss Adjuster, who ensures consistent communication and quality assurance between all parties and stakeholders involved.
To request more information on cybercrime and what to do if you鈥檝e been attacked, please contact:
Jason Ponton, FCIP, CRM
Cyber Practice Leader, Canada
Jason.Ponton@crawco.ca
