(Photo Illustration by Omar Marques/SOPA Images/LightRocket via Getty Images)
Password manager LastPass is warning the public to be on guard against AI-generated scam calls pretending to be your boss, after one such deepfake audio call targeted a company employee.
The LastPass employee received the audio call on Wednesday from a scammer who had created a WhatsApp account pretending to be LastPass CEO Karim Toubba.
The scammer somehow obtained the LastPass employee’s contact details. The fraudster then began messaging the staffer while impersonating Toubba. This included a series of missed audio calls and at least one voice message that used AI to replicate Toubba’s voice.
(Credit: LastPass)The good news is that the deepfake and WhatsApp impersonation attempt failed to convince the LastPass employee, in part because the WhatsApp messages arrived outside normal business communication channels. The WhatsApp messages also contained “forced urgency”—a tactic scammers often use to manipulate victims—which led the LastPass employee to rightly conclude the correspondence was all a sham.
In a company blog post about the incident, LastPass adds that it experienced no impact from the phishing attempt, which the employee reported to the company’s security team. “However, we did want to share this incident to raise awareness that deepfakes are increasingly not only the purview of sophisticated nation-state threat actors and are increasingly being leveraged for executive impersonation fraud campaigns,” the company said.
Indeed, other companies, including cryptocurrency exchange Binance, have encountered fraudsters using deepfakes of corporate executives as a phishing method. And in some cases, the AI fakery works. In February, Hong Kong police reported one such deepfake video call that convinced an employee at a multinational firm to send fraudsters $25 million. In that case, the deepfake impersonated several staff members.