Your voice could be your biggest vulnerability

AI technology is fueling a rise in online voice scams, with just three seconds of audio required to clone a person’s voice, according to McAfee.

McAfee surveyed 7,054 people from seven countries and found that a quarter of adults had previously experienced some kind of AI voice scam, with 1 in 10 targeted personally and 15% saying it happened to someone they know. 77% of victims said they had lost money as a result.

In addition, McAfee Labs security researchers have revealed their insights and analysis from an in-depth study of AI voice-cloning technology and cybercriminal use.

Scammers are using AI technology to clone voices

Everybody’s voice is unique, the spoken equivalent of a biometric fingerprint, which is why hearing somebody speak is such a widely accepted way of establishing trust.

But with 53% of adults sharing their voice data online at least once a week (via social media, voice notes, and more.) and 49% doing so up to 10 times a week, cloning how somebody sounds is now a powerful tool in the arsenal of a cybercriminal.

With the rise in popularity and adoption of artificial intelligence tools, it is easier than ever to manipulate images, videos, and, perhaps most disturbingly, the voices of friends and family members.

McAfee’s research reveals scammers are using AI technology to clone voices and then send a fake voicemail or call the victim’s contacts pretending to be in distress – and with 70% of adults not confident that they could identify the cloned version from the real thing, it’s no surprise that this technique is gaining momentum.

45% of the respondents said they would reply to a voicemail or voice note purporting to be from a friend or loved one in need of money, particularly if they thought the request had come from their partner or spouse (40%), parent (31%), or child (20%).

The cost of falling for an AI voice scam

For parents aged 50 or over, this group is most likely to respond to a child at 41%. Messages most likely to elicit a response were those claiming that the sender had been involved in a car incident (48%), been robbed (47%), lost their phone or wallet (43%), or needed help while traveling abroad (41%).

But the cost of falling for an AI voice scam can be significant, with more than a third of people who’d lost money saying it had cost them over $1,000, while 7% were duped out of between $5,000 and $15,000.

The survey also found that the rise of deepfakes and disinformation has led to people being more wary of what they see online, with 32% of adults saying they’re now less trusting of social media than ever before.

“Artificial intelligence brings incredible opportunities, but with any technology there is always the potential for it to be used maliciously in the wrong hands. This is what we’re seeing today with the access and ease of use of AI tools helping cybercriminals to scale their efforts in increasingly convincing ways,” said Steve Grobman, McAfee CTO.

Voice cloning made easy

As part of McAfee’s review and assessment of this new trend, McAfee researchers spent three weeks investigating the accessibility, ease of use, and efficacy of AI voice-cloning tools, with the team finding more than a dozen freely available on the internet.

Both free and paid tools are available, with many requiring only a basic level of experience and expertise to use. In one instance, just three seconds of audio was enough to produce an 85% match, but with more investment and effort, it’s possible to increase the accuracy.

By training the data models, McAfee researchers were able to achieve a 95% voice match based on just a small number of audio files.

The more accurate the clone, the better chance a cybercriminal has of duping somebody into handing over their money or taking other requested action. With these hoaxes based on exploiting the emotional vulnerabilities inherent in close relationships, a scammer could net thousands of dollars in just a few hours.

The evolution of voice cloning technology

“Advanced artificial intelligence tools are changing the game for cybercriminals. Now, with very little effort, they can clone a person’s voice and deceive a close contact into sending money,” said Grobman.

“It’s important to remain vigilant and to take proactive steps to keep you and your loved ones safe. Should you receive a call from your spouse or a family member in distress and asking for money, verify the caller – use a previously agreed codeword, or ask a question only they would know. Identity and privacy protection services will also help limit the digital footprint of personal information that a criminal can use to develop a compelling narrative when creating a voice clone,” concluded Grobman.

Using the cloning tools they found, McAfee’s researchers discovered that they had no trouble replicating accents from around the world, whether they were from the US, UK, India, or Australia, but more distinctive voices were more challenging to copy.

For example, the voice of a person who speaks with an unusual pace, rhythm or style requires more effort to clone accurately and is less likely to be targeted as a result.

The overriding feeling among the research team, though, was that artificial intelligence has already changed the game for cybercriminals. The barrier to entry has never been lower, which means it has never been easier to commit cybercrime.

AI voice cloning protection

• Set a verbal ‘codeword’ with kids, family members or trusted close friends that only they could know. Make a plan to always ask for it if they call, text or email to ask for help, particularly if they’re older or more vulnerable.
• Always question the source. If it’s a call, text or email from an unknown sender, or even if it’s from a number you recognize, stop, pause and think. Does that really sound like them? Would they ask this of you? Hang up and call the person directly or try to verify the information before responding and certainly before sending money.
• Think before you click and share. Who is in your social media network? Do you really know and trust them? Be thoughtful about the friends and connections you have online. The wider your connections and the more you share, the more risk you may be opening yourself up to in having your identity cloned for malicious purposes.
• Identity monitoring services can help make sure your personally identifiable information is not accessible or notify you if your private information makes its way to the Dark Web. Take control of your personal data to avoid a cybercriminal being able to pose as you.