Deepfake Scam Calls: A Growing Threat

By now, you’ve likely heard of fraudulent calls that use AI to clone the voice of people the call recipient knows. Often, the result is what sounds like a grandchild, CEO, or work colleague you’ve known for years reporting an urgent matter requiring immediate action, saying wiring money, divulging login credentials, or visiting a malicious website.

Researchers and government officials have been warning of the threat for years, with the Cybersecurity and Infrastructure Security Agency saying in 2023 that threats from deepfakes and other forms of synthetic media have increased “exponentially.” Last year, Google’s Mandiant security division reported that such attacks are being executed with “uncanny precision, creating for more realistic phishing schemes.”

Anatomy of a Deepfake Scam Call

On Wednesday, security firm Group-IB outlined the basic steps involved in executing these sorts of attacks. The takeaway is that they’re easy to reproduce at scale and can be challenging to detect or repel.

Steps Involved in a Deepfake Scam Call

The basic steps are:

Collecting voice samples of the person who will be impersonated. Samples as short as three seconds are sometimes adequate. They can come from videos, online meetings, or previous voice calls.

Feeding the samples into AI-based speech synthesis engines, such as Google’s Tacotron 2, Microsoft’s Vall-E, or services from ElevenLabs and Resemble AI. These engines allow the attacker to use a text-to-speech interface that produces user-chosen words in a voice tone and conversational tics of the person being impersonated. Most services bar such use of deepfakes, but as Consumer Reports found in March, the safeguards these companies have in place to curb the practice could be bypassed with minimal effort.

An optional step is to spoof the number belonging to the person or organization being impersonated. These sorts of techniques have been in use for decades.

Next, attackers initiate the scam call. In some cases, the cloned voice will follow a script. In other, more sophisticated attacks, the faked speech is generated in real time, using voice masking or transformation software. The real-time attacks can be more convincing because they allow the attacker to respond to questions a skeptical recipient may ask.

“Although real-time impersonation has been demonstrated by open-source projects and commercial APIs, real-time deepfake vishing in-the-wild remains limited,” Group-IB said. “However, given ongoing advancements in processing speed and model efficiency, real-time usage is expected to become more common in the near future.”

Conclusion

Deepfake scam calls are a growing threat, and it’s essential to be aware of the risks and take steps to protect yourself. By understanding how these attacks work and being cautious when receiving calls from unknown numbers or familiar voices, you can reduce the risk of falling victim to these scams.

Frequently Asked Questions

Q: What is a deepfake scam call?

A: A deepfake scam call is a type of scam where an attacker uses AI to clone the voice of a person the call recipient knows, in order to trick them into taking a certain action or divulging sensitive information.

Q: How do attackers collect voice samples?

A: Attackers can collect voice samples from videos, online meetings, or previous voice calls. Samples as short as three seconds can be adequate.

Q: Can deepfake scam calls be detected?

A: Detecting deepfake scam calls can be challenging, but being cautious when receiving calls from unknown numbers or familiar voices can help reduce the risk of falling victim to these scams.