Here’s how deepfake vishing attacks work, and why they can be hard to detect

In today's digital landscape, the emergence of AI-driven fraud schemes has raised new alarms, particularly deepfake voice phishing attacks. These scams leverage artificial intelligence to mimic the voices of familiar individuals, such as a grandchild or a company CEO, often delivering urgent messages that push victims to take immediate actions like transferring money or revealing sensitive information. Experts and government authorities have long warned about the escalating risks associated with deepfakes and synthetic media. In 2023, the Cybersecurity and Infrastructure Security Agency highlighted that these threats have surged sharply. A report from Google’s Mandiant security team noted that attackers are executing these tactics with remarkable accuracy, enhancing the efficacy of their phishing efforts. Recently, security firm Group-IB detailed the straightforward process these fraudsters use. The simplicity and scalability of these attacks make them particularly concerning. The first step involves gathering voice samples of the targeted individual, often requiring as little as three seconds of audio. These samples can be sourced from various platforms, including social media videos or prior phone conversations. The next phase involves utilizing AI-based speech synthesis technologies, like Google’s Tacotron 2 or Microsoft’s Vall-E. These tools enable attackers to generate lifelike speech that mirrors the tone and mannerisms of the impersonated person. While many service providers implement restrictions to prevent misuse, reports from Consumer Reports indicate that these safeguards can often be circumvented with ease. An additional tactic involves spoofing the phone number of the impersonated individual, a method that has been prevalent in scams for years. Once the stage is set, attackers make the fraudulent call. In some instances, they follow a pre-written script, while in more sophisticated attacks, the speech is created live, utilizing advanced voice modulation software. This real-time impersonation can be particularly persuasive, as it allows fraudsters to engage directly with the victim, addressing any questions or doubts they may have. While the use of real-time deepfake voice scams remains limited, Group-IB warns that advancements in technology are likely to make these tactics more prevalent in the future. As processing power and efficiency improve, the landscape of voice phishing could become increasingly complex and difficult to detect.