The FBI has been warning about deepfakes since 2021 but are people actually listening?

‍

What are deepfakes? 

Deepfakes are manipulated digital images, video, audio, and text - for example, deepfake videos pairing Tom Cruise’s face with the body of a different actor - but there’s a sinister side to deepfakes as well.

“The advent of deepfake technology - a whole, new, revolutionary technology - can add good benefits but it also has very serious consequences when we talk about human hacking,” said Peter Warmka, a former senior CIA intelligence officer.

The Binance cryptocurrency exchange reported, for example, that hackers used an AI hologram in Zoom calls to scam executives. In another instance, criminals used artificial intelligence (AI) voice cloning to fool a bank into believing a company executive authorized the transfer of $35m to complete a business deal. In a third case, a CEO was targeted in a $243,000 scam.

Deepfakes are dangerous but you can fight back.

Virtual Private Networks (VPNs)

Good security practices can counter deepfakes including using a VPN to stop your Wi-Fi connections from being hacked. A VPN makes it all but impossible to follow your online movements because they redirect your Internet traffic to a server somewhere away from where you are, where your data is encrypted and rendered unintelligible.

A VPN doesn’t protect your system from malware (malicious software) or clicking on malicious links, but it does offer an additional layer of security. If you connect to a VPN when using public Wi-Fi (which you should avoid, if possible) then a VPN encryption hides everything you're doing online, protecting you and your data, photos, and videos from rogue hotspot operators as well as hackers.

‍

‍

Trust but verify your instructions

When it comes to wire transfers or transferring other assets outside of your organization, verify the instructions via email, a direct phone call, person-to-person, or use another method. Incoming phone numbers can be spoofed so you only think you know who’s calling. Artificial intelligence can mimic the voice of your boss or a relative, so proceed with caution if you are wire transferring money or authorizing an access pass to get into a facility.

”You can have a threat actor that all of a sudden gets someone to issue an access pass and they shouldn’t have that access but all of a sudden they are walking freely within your organization,” Warmka cautioned.

‍

‍

‍

Know how to spot deepfakes‍

Ensure employees and your family know how deepfaking works and offer tips on how to spot a deepfake. That can be as simple as asking someone on a video call to turn sideways for an authentication check, much like they would for a mug shot. AI models might be good at recreating someone’s face or voice, but they often aren't good at side-on profiles.

If you are watching a video online and questioning its authenticity, keep an eye on the speaker’s mouth. Although some deepfakes are quite sophisticated, others are sloppy when swapping out the audio. Also look for blurry areas - can you see jewelry or wrinkles clearly? Does the person appear to have double eyebrows? What do you see in the shadows of the image?

Read up on the topic with the US Homeland Security guide. There are also plenty of online videos that will guide you through steps to detect deepfakes, including MIT’s Detect Fakes website and the Election Misinformation Symposium: Fighting Misinfo Through Fact-checking and Deepfake Detection.

‍

Check the original source of videos and photos

Use a reverse-image search engine to check the source of photos and questionable videos. If it’s a video, take a still screenshot of the image, upload the still shot to Google Images, Tineye, Yandex, or Bing Images, and investigate the video's online history. If you’re new at reverse-image checks, the Snopes fact-checking website explains how to perform reverse-image searches.

‍

‍

Use cyber-security best practice ‍

Use best-practice to ensure your cyber security is top notch. Regularly back up data to protect against ransomware. Vary passwords for different accounts so if one is compromised they are not all compromised. Use anti-virus software. Keep software and hardware up-to-date, avoid opening suspicious emails, and check links before you click.