This voice is auto-generated. Please let us know if you have any feedback.
Dive overview:
-
Generative artificial intelligence tools such as ChatGPT may be fueling the proliferation of more convincing email scams aimed at stealing money from businesses.According to cybersecurity firm Fortra.
-
In the first quarter of 2023,Threats within corporate inboxes hit an all-time high, with a quarter of all reported emails categorized as malicious or untrustworthy. Fortra said in a recent report:almost everything These threats (99%) were classified as impersonation attacks.
-
John Wilson, a senior researcher in threat research at Fortra, told CFO Dive that the scammers were well-crafted at scale without the poor spelling and grammar traditionally associated with scams. He said the company seems to be looking at generative AI so it can compose email messages. Recent evidence also suggests the scammer may rely on AI for language translation, he said.
Dive Insight:
Fortra joins the list of organizations reporting increased use of social engineering by cybercriminals. Social engineering refers to manipulation techniques designed to exploit human actions or errors to gain access to valuable information or assets.
“Social engineering has come a long way from basic Nigerian Prince scams to much harder-to-detect tactics,” Verizon said in its 2023 data breach investigation report.
Business Email Compromises, in particular, tend to target office workers who carry out fund transfer requests. According to the company’s report, such scams have nearly doubled across Verizon’s incident data set and now account for more than 50% of incidents within the social engineering category. The median amount stolen from these attacks has also increased to $50,000 over the past few years.
A Microsoft study published in May found that cybercriminals are using residential Internet Protocol addresses to make their intrusions look local and avoid security warnings.
The FBI reports that the Internet Crime Complaint Center received 21,832 fraud complaints from business email compromise fraud last year, with adjusted losses totaling more than $2.7 billion.
According to Fortra, these attacks have previously impersonated the organization’s CEO and other senior executives to trick recipients into initiating large financial transactions. However, threat actors are increasingly expanding their target lists to include vendors associated with their intended victims.
“By compromising third parties and business partners, victim organizations tend to receive highly realistic emails containing important inside information, greatly enhancing the legitimacy of the attack,” Fortra reports. says.
Poor grammar and spelling have historically been known as classic signs of email fraud. But Wilson said Fortra is observing an increase in fraudulent messages that appear to be “crafted words.”
The company’s cybersecurity firm has also increased the number of languages used in its payroll diversion plans, which were almost entirely in English just two years ago.
“We are currently seeing similar scams being attempted in French, Polish, German, Swedish, Dutch and several other languages,” Wilson said in an email. “It is not clear whether the generative AI was used to improve grammar or to perform translations beyond the capabilities of Google Translate for certain messages, but it is not clear whether it was used to improve grammar and the target language. Considering the timing and amount of expansion of , it would suggest the use of generative AI.
According to Fortra, security awareness training can be an important tool in combating threats. The cybersecurity firm report also recommends additional email security layers optimized to detect and respond to advanced email threats.
“The thorough and accurate inspection of emails will increasingly require the application of machine learning algorithms to help detect anomalies and patterns,” the company said.
