An AI Conceived a Cyberattack Involving Christine Benz. A Cybersecurity Expert Explains

We had no idea quite how creepy the conversation would get when we booked cybersecurity expert Mike Piper to be a guest on The Long View podcast.

The full episode covers why passkeys offer stronger protection from scams, the interplay between cybercrimes and cognitive decline, and how to make your financial accounts harder to compromise.

In this excerpt, Piper discusses how artificial intelligence is making scams more sophisticated and touches on why we should all be skeptical of incoming communication about our accounts.

How AI Is Making Targeted Cyberattacks Easier and Cheaper

Christine Benz: You note that the increasing sophistication of AI is a big factor here. What types of AI-related scams and frauds have you been seeing, and you’re most concerned about?

Mike Piper: There’s a ton. In many ways, it’s really AI making it a lot easier and faster to do the same types of frauds that people have always been doing. One example: Before, it might’ve been very easy to look at a fake email that’s pretending to be from your bank and quickly identify that there’s a whole bunch of typos, misspellings, and grammatical errors in it. Whereas now, using an AI chatbot, it’s very easy for somebody who doesn’t even know English at all to write a convincingly worded email with perfect grammar in English. Something as simple as that.

But there’s also the fact that it’s much easier, much less expensive for the bad guys to create very targeted attacks now than it used to be because you can automate research. You can ask an AI bot to research an individual person, find everything they’ve posted on social media, find anything that other people have posted on social media, look at obituaries, look at whatever articles you can find, and craft a very highly targeted attack. Before, that used to be an extremely manual, labor-intensive process, so something like that would’ve been reserved only for very high-value targets, whereas now you can automate that at a very low cost and deploy that type of attack against all sorts of people at broad scale.

‘If I Were to Craft an Attack Against You’

Just to give one example, Christine, you might personally find this interesting because you’re involved, actually. Not long ago, I asked a particular AI—it knows who I am already, and it knows I’ve been writing about cybersecurity—and so I asked it, “Create a profile of me as if you were going to plan an attack against me and what would you do?” It thought for a couple of minutes, and it came back and shared all sorts of information about me. Of course my job is fairly public, so a lot of this is pretty easy to find, but it also found some things that I’ve never written about. I guess perhaps another family member shared it on social media or something, so that was interesting.

But then here’s the most interesting part. It said, “If I were to craft an attack against you, I would probably impersonate Jim Dahle, Christine Benz, or Jon Luskin, because those are people who I know that you have known for a long time, you trust them, and you consider them to be friends. If they asked you to do a favor, you would be inclined to do it. … There’s lots of public record of the three of you speaking and talking, so it would be easy to mimic you, to create a deepfake video or voice message impersonating you.”

When I saw that, it was just, wow, because that’s exactly right. I do consider the three of you to be friends, and I would be likely to want to do a favor for you if you ask. It’s so on the mark, and I know a lot of people might say, “Oh, my life isn’t as public. I don’t post things on social media,” and that’s good, but sometimes the attack won’t be that. It will be that they researched your granddaughter, who does post everything on social media, and they don’t actually need to know very much about you because the attack is convincingly mimicking your granddaughter, and they have lots of material to use for that.

That’s how they come after you. It’s just much easier now for very targeted attacks to be created at a low cost.

The Bad Guys Are ‘Skilled Professionals With Very Powerful Tools’

Amy Arnott: That’s pretty scary. One of your pieces of advice is that you have to know your opponent when it comes to these cybercriminals. Why is that important, and what should we know about them?

Piper: The message that I’m trying to get across is that these are professionals, right?

When you think of yourself and the people you work with, you’ve had this career for however many years, and you’ve spent all this time building up your skills and learning technologies, and that’s what these people are doing, too. This is their career, and they probably work as a team with other skilled professionals, each with their own areas of expertise.

You’re working against skilled professionals with very powerful tools. It’s important to recognize that that is who the bad guy is in this case.

That Email About Your Account? Verify Before You Reply

Arnott: You also note that as an overall policy, everyone should be skeptical about any type of incoming communications, email, text, et cetera, about your financial accounts. What should people do instead?

Piper: The first step is to gain your trust somehow, and that’s going to be through some sort of incoming communication. We need to be very skeptical of them.

That plays out in a number of different ways. Number one, we don’t want to click links in emails. We don’t want to be following QR codes. Also, replying is not something we want to do.

If it’s an incoming phone call, if it’s from a number that we don’t know, just let it go to voicemail rather than answering it.

Basically, to the extent that it’s possible at all, we don’t want to interact with incoming communications unless we have some very, very clear way to know that it was from a genuine source. And probably the best example of that would be a text message thread that’s existing, you’ve already been discussing with this person; whatever, it’s OK to continue to reply to that.

But emails out of the blue, you need to be very skeptical.

The next step is that if you do receive an email or a text or a message from some other messaging app or a phone call when they leave a voicemail and you’re not sure if it’s legitimate, but you are concerned that if it is legitimate, this is a thing that you need to deal with, then what you need to do is: On your own, rather than replying to that email, rather than calling back that phone number, on your own, reach out to the institution in question by some means that you know is legitimate. So, going to your browser and typing in vanguard.com or whatever the appropriate URL is, or opening up the app on your phone to chat with them, or if it’s your bank, that would be calling the number that’s on the back of your debit card, that sort of thing. Reusing a means of communication that you know goes directly to the actual entity in question in order to get in touch with them.

Listen to the Full Episode

That’s just an excerpt from our recent episode of The Long View, but you can listen to the full conversation below (or read the transcript at this link).