You receive an incoming call from an unknown number on the other end of the line you hear your child’s voice calling for help. The alleged “kidnapper” then asks you to pay a ransom or you will never see your child again. This is a virtual kidnapping incident, where fraudsters use artificial intelligence and clone the human voice to defraud families and extort money from their victims.

There are basic steps in a typical virtual kidnapping scam, points out the digital security company ESET. Scammers are looking for potential victims, whom they could call and blackmail them into extracting money. Soon after, they are ready to locate the prospective “kidnapping” victim, most likely the child of the person they identified in the previous stage. They can accomplish this by simply searching social media or locating other information that is publicly accessible.

Then they draw up an imaginary script, making sure to make it appear as convincing and terrifying as possible. The more scared the victim is, the harder it will be to make rational decisions. Like any good attempt at social engineering, scammers want to rush the victim into making a decision. Scammers may then research open sources to figure out when would be the best time to call. They may scan social media or other sources to determine this. The idea is for them to contact you while your loved one is away, ideally on vacation. Soon after, scammers create the audio deepfakes and make the call. Using readily available software, scammers will create an audio file of the victim’s “voice” and use it to try to convince you that they have kidnapped a relative. They may also use other information they gather from social media to make the scam sound more convincing, for example by providing details about the “kidnapped” that a stranger might not know.

There are other variations of this method, and the most worrying is the potential for AI tools like ChatGPT to make it easier for fraudsters to find their ideal victims by looking for the profile of people who are most likely to pay up if they fall victim to a scam. virtual kidnapping. They could also search for people within a specific geographic area, with public social media profiles, and with specific socioeconomic backgrounds.

A second option would be to use a SIM swapping attack (where a cybercriminal obtains a copy of a user’s SIM card) to intercept the phone number of the alleged “abductee” before the fraud. This would make the “kidnapping” phone call seem even more plausible.

A report published in May warned for legitimate text-to-speech tools that could be misused, as well as the growing cybercrime interest in Voice Cloning as a Service (VCaaS). If this scenario materializes, it could enable cybercriminals to launch such attacks, especially if used in conjunction with GenAI tools.

In fact, in addition to disinformation, deepfake technology is also used to hack business email and for sexual extortion.

Tips from ESET

Being informed can go a long way in reducing the threat of deepfakes in general, and virtual hijackings in particular. According to ESET, there are things that if people do, minimize the chances of becoming a potential victim of a phone scam:

  1. Do not share personal information on social media. Avoid posting details such as addresses and phone numbers. If possible, don’t share photos or videos/recordings of your family, and certainly not details about your loved ones’ vacation plans.
  2. Keep your social media profiles private to minimize the chances of threat actors finding you online.
  3. Be on the lookout for phishing emails that could be designed to trick you into giving out sensitive personal information or passwords to social media accounts.
  4. Encourage your children and close relatives to install geolocation apps.
  5. If you get a call, keep the “hijackers” on the phone. At the same time try to call the alleged victim on the other line or have someone you know do it.
  6. Keep calm, don’t share personal information, and if possible, have the scammers answer a question that only the abductee would know and ask to speak with them.
  7. Notify the police as soon as possible. Virtual kidnapping is just the beginning. Learn about the latest scams and you have a better chance of stopping attacks in the bud before they cause serious emotional distress.