AI mimics CEO voice to scam UK energy firm out of £200k
.jpg)
Criminals have impersonated a chief executive’s voice using artificial intelligence-based software to deceive an unnamed UK-based CEO into making a fraudulent transfer of £200,000 according to a report in the WSJ.
WSJ’s Catherine Stupp reported that: "The CEO of a UK-based energy firm thought he was speaking on the phone with his boss, the chief executive of the firm’s German parent company, who asked him to send the funds to a Hungarian supplier. The caller said the request was urgent, directing the executive to pay within an hour, according to the company’s insurance firm, Euler Hermes Group SA. Euler Hermes declined to name the victim companies." Rüdiger Kirsch, a fraud expert at Euler Hermes, a subsidiary of Munich-based financial services company Allianz SE was reported as saying that the UK CEO recognised his boss’ slight German accent and the melody of his voice on the phone. The CEO made the requested transfer to a Hungarian supplier and was contacted again with assurances that the transfer was being reimbursed immediately.
In an email to SC Media UK, Jake Moore, a cyber-security specialist at ESET commented: "I predict that we will see a huge rise in machine-learned cyber-crimes in the near future. We have already seen DeepFakes imitate celebrities and public figures in video format, but these have taken around 17 hours of footage to create convincingly. Being able to fake voices takes fewer recordings to produce. As computing power increases, we are starting to see these become even easier to create, which paints a scary picture ahead.
"To reduce risks it is imperative not only to make people aware that such imitations are possible now but also to include verification techniques before any money is transferred. Two-factor authentication is another powerful, inexpensive and simple technique that adds an extra layer of security to protect your money going into a rogue account. When being called about a money transfer, particularly of large sums, check the number calling and ask to call back. Do so using a number in your address book, rather than hitting the "call back" option in your call history."
Stu Sjouwerman, CEO at KnowBE4 commented in his blog "This is essentially the next step up in the escalation of using social engineering in a case of CEO Fraud. You need to step your employees through new-school security awareness training to prevent human errors like this."
Relevant to both this story and news reports about Chinese deepfake app Zao, Matt Aldridge, senior solutions architect at Webroot emailed SC Media UK to add:"Deepfake-style technology – where completely believable video and/or audio of a person can be generated or swapped out from other media – is extremely dangerous. It is already being used in highly effective, targeted spearphishing campaigns and this will only continue as the technology allows the stakes to get higher. The scope for disinformation at a nation-state level is also dramatically concerning. Fake news will become infinitely more difficult to differentiate from real stories and real videos. It is a magic bullet for any authoritarian state, organisation or terrorist group that wishes to recruit members or sway opinions to achieve its own goals.
"A future of widespread distrust is coming. We may think that we’re having a video call with a close colleague or a loved one, but the other party is actually an imposter. We need to start preparing for this now and understand how we can ensure that our communications are all real and secure."
source scmagazineuk
Industry: Cyber Security & Artificial Intelligence
Latest Jobs
-
- Public Sector Cyber Security Sales | UK
- England
- N/A
-
Public Sector Cyber Security Sales | UK UK | Remote / Hybrid A cyber security provider is seeking a Public Sector Sales professional to drive growth across UK government and public sector organisations. Must have current Cyber Security sales experience. Responsibilities Generate new business selling cyber security solutions into UK public sector Build relationships with CIO, CISO and senior technology stakeholders Manage the full sales cycle from opportunity to contract close Develop pipeline across central government, local government and public sector bodies Support bids, tenders and framework opportunities Experience Proven cyber security sales experience in the UK Track record selling into public sector organisations Familiarity with CCS, G Cloud or other government frameworks Strong stakeholder engagement and deal management skills Location UK based Security Requirements Eligible to obtain UK Security Clearance
-
- Security Architect | MoD - Security Cleared. OUTSIDE IR35 | Hampshire
- N/A
- Outside IR35
-
Security Architect | MOD | Security Cleared | Outside IR35 | Hampshire Commutable The successful candidate must be willing to undergo DV Clearance, ideally already holding active clearance. You will produce high and low level security architecture documentation, guiding and validating designs for systems deployed within sensitive environments. The role requires providing specialist security input into solution design, service transition and change initiatives, working closely with engineering, operations, client and third party stakeholders. You must have current hands on architectural experience, including VMware secure platform design and virtualisation architecture, alongside AWS expertise. This is an outside IR35 contract- 6 month rolling. Part of a longer term MoD project
-
- Active Directory | RBA engineer | UK Remote | SC Clearable
- United Kingdom
- N/A
-
Technical Active Directory (AD) and RBA specialist needed to play a key part in complex, enterprise scale Active Directory and access transformation programmes. You will work alongside senior team, helping reshape access models, modernise legacy directory structures and strengthen security posture across secure environments. This is hands on delivery within high impact projects where your work directly improves access control, compliance and operational resilience. Active UK Security Clearance required. This is a remote role with client travel. Implementation of Role Based Access Control across large AD estates Restructuring complex permission models, security groups and delegated access Supporting domain controller upgrades and core directory improvements Applying security hardening standards and remediating audit findings Enhancing authentication, policy and access governance frameworks Troubleshooting and resolving technical AD challenges within live environments Producing robust technical documentation and identifying project risks You must have the following technical experience Enterprise Active Directory administration Role Based Access and permission remediation OU design and governance Group Policy management Security group delegation models DNS and DHCP services Kerberos authentication / NTLM PowerShell scripting and automation Azure AD | Entra ID Hybrid identity environments Identity Governance PAM