Publications
Partners
- Cybercriminals are cloning employees’ voices to trick organisations into disclosing passwords or authorising the transaction of large sums of money.
- The criminals use a clip of someone’s voice and create a deep fake that sounds realistic enough to trick victims.
- Companies that make financial transactions through WhatsApp are the ones that often fall victim to such scams.
- For more stories, visit the Tech and Trends homepage.
Generative AI has taken over the world in the last few years. Cybercriminals have found a way to exploit this tool to clone voices, and trick people and organisations into giving up passwords or large sums of money.
This is according to cybersecurity expert and co-founder at Nclose, Stephen Osler, who highlighted that cybercriminals have harnessed AI’s malicious capabilities to create convincing deep fakes, perpetrating unnervingly realistic voice scams.
To start with, cybercriminals need to compromise an employee's email and send out invoices with fictitious banking details targeted at the finance manager.
"All they do is create a WhatsApp voice note with these automated, voice generative tools and send it to the finance manager and request them to approve the transaction," Osler told News24.
“Theoretically, from the finance manager, they would say the CEO is requesting [this], here’s the invoice. The bank details might have been changed, or there could be a voice note requesting the transaction to be made."
According to the cybersecurity expert, targeting companies where such transactions are standard business practice is much easier.
Voice scams targeted at big companies have been around for some time. In 2019, the tech tool was used to impersonate the voice of a German CEO of an unnamed energy firm in the UK and scammed the company of $243 000 (R4.4 million).
Another similar incident occurred in 2021, where a Hong Kong-based company was defrauded of $35 million using the cloned voice of one director.
These kinds of voice scams are targeted not only at big businesses, but individuals as well. Some include kidnapping hoaxes, requests for money from friends or family, and emergency calls.
How to avoid WhatsApp scams
According to Olser, businesses have to put measures in place to avoid such scams, and that starts with not using a platform such as WhatsApp for payment requests.
Instead, Olser urges organisations to follow set governance procedures, allowing them to double-check and validate information before making any transactions.
"Check, double-check, and validate. Sometimes through manual means. One of the things to do when we get a request to change banking details is to validate via phone call [to find out if] it’s the CFO or that person who actually made the request," he said.
"We need to almost go back to the traditional way of validation as opposed to just receiving a request to complete a transaction or change details because the reality is that these voice-generating tools are very good, and it takes a keen ear to distinguish a true positive to a false positive. It’s not easy."
