Scary stuff and a call to action

Folks, today is a deadly serious post. I am going to talk tangentially about AI, and a threat you need to be aware of and to prepare for.

A recent "must take" training at work on the subject of tech safety was eye-opening. And the crux of it was that today, in the year 2025 of our lord, the generative AI is good enough to run a scam that used to be super easy to identify and avoid.

Have you seen the Mission: Impossible movies? Where Tom Cruise's voice is disguised in real time to match his disguise?

That was a cool effect, but today, that is a reality.

What happens: A bad actor obtains 15 - 30 seconds of a person talking. They use that to train a voice translator, and in about a half hour, they have an app that they can use to call your phone and scare you into sending them money.

This is AI voice cloning, and it is one of the things that Hollywood was on strike for last year. (n.b. the link is for a commercial service that will prevent this use, but there are MANY independent ones that are tailored to the seedier use cases.)

Once it is trained, they talk into it with their voice and out comes the voice that the AI was trained on. It matches inflection, tone, and characteristics. They even get stressed, panicked and other emotions across. In real time, like having a conversation. Eerie doesn't cover it.

I got an in-person demonstration of this, and holy fucking shit, it nailed my bosses voice, so damn good that it freaked me the fuck out.

But Sweaty, what's the harm?

Picture this. You get a phone call from your spouse, telling you that they are in a jam, and that you need to Venmo them $1,000 to get out of it. There is fear in their voice, and you are freaked out.

This is an old scam that has gone through multiple generations, and it used to catch people who were really not paying attention. But this, it is so real sounding.

Often these scams are combined with SIM cloning, a staple of phishing scams for quite some time. That means that the call that comes in is from the same phone number (so your caller ID tells you it's your loved on). And frankly, that is the first sign of authenticity that people use to judge it.

Pro tip: don't assume that their name popping up on a received call to signify that that is really the person calling you.

The caller ID is one you identify with, and when you pick up, it is a panicked loved one. They are telling you that they have been kidnapped by some street gang, and that you need to transfer some amount of money to them immediately or they will be harmed.

That gets your 4F response queued in, the adrenaline hits the blood stream, you are thinking "shit, I gotta find the money to send", and because you don't want your loved one to be hurt, you start scheming how to fulfill the demand.

How the fuck do you respond to this?

You can combat this increasing threat!

This is the crux of that training. You need to gather your family together, explain what this is, and that it is a real threat.

You need to have a family pass code. Something that only your family or circle would know. It must be something everyone will remember.

Some ideas:

• Your WiFi SSID name
• Name of your pet(s)
• something completely random

Don't use things that are often used to confirm ownership of your bank account (father's middle name, color of your first car, city you were born in) especially since that will not be something everyone in your circle will know.

And if you get one of these calls, ask for the passcode. A scammer will not know that, even if they have bought all your data from the dark web.

Don't despair

First, this is pretty rare at the moment. But it is increasing, and it is happening to normal people. $500 or $1,000 may not seem like enough to be attractive to these scammers, but this, like email scams, is a numbers game. They need to find enough people to fall for it to make a comfortable living.

Second, some up-front preparation can save you from this attack. Most successful cyber-attacks on individuals or companies starts with social engineering like this. Your awareness of this is the first step in combatting it.

Third, when you get a call like this, the initial instinct is to panic. Force yourself to calm down, and to think rationality. Use your preparation outlined above to validate that this is a real situation before you take any action.

Lastly, you need to remain vigilant. These threats used to be very difficult to pull off, but the generative AI tools available today make this almost point and click, and there are lots of bad actors who will exploit these tools to extract money from unsuspecting people.

Final thoughts

I came home and showed my wife this threat, and suddenly, she got how bad it can be. She wasn't blase before, but she figured that she (and we) weren't worth the effort. Now this is real.

Some preparation, a cool head, and you too can halt this before it sucks you in.

The world is dangerous, but you got this.