ChatGPT AI voice cloning, plus fake income-tax refund scam

According to a May McAfee study, a quarter of those surveyed have experienced an AI voice scam. Ten percent have been personally targeted, and 15% said they know someone who has. The study says that of the 77% who lost money, more than one-third were out $1,000 with 11% of U.S. victims losing between $5,000 and $15,000. (See “Beware the Artificial Imposter: A McAfee Cybersecurity Artificial Intelligence Report,” mcafee.com, resources, May 2023.)

Although ChatGPT hype is waning somewhat, some organizations and individuals are coming across as authorities on the subject who have all the answers. It seems that everyone wants to get a piece of the pie. The reality is that ChatGPT and other AI programs like it are still in their infant stages. Like any new tech tool, they’ve raised a lot of questions about their uses and risks. One thing is for sure — identity criminals are obviously drooling. They view the rapid evolution in the AI landscape as a potential gold mine.

ChatGPT AI voice-cloning scam

Various versions of grandparent and family-emergency scams, in which fraudsters pose as grandchildren or children, have been major sources of revenue for criminals for years. But they can now perfectly clone voices to fool more victims. According to the U.S. Federal Trade Commission (FTC), scammers use family members’ short audio clips from online social-media posts to reproduce with voice-cloning programs convincing emergency messages to parents or grandparents. (See “Scammers use AI to enhance their family emergency schemes,” by Alvaro Puig, FTC, March 20, 2023.)

Aaron Drapkin, a lead writer at tech.co, says fraudsters will run clips of subjects speaking from social media accounts through AI voice generators. “Using machine learning, the generator will analyze the cadence, tone and pitch of the initial clip, and then allow the fraudster to produce unique, original audio” that mimics the subject’s voice near perfectly, Drapkin writes. (See “How to Avoid the Latest AI Voice Cloning Scam,” by Aaron Drapkin, tech.co, May 2, 2023.)

Of course, worried grandparents will now be more susceptible to crooked callers and wire money, send cryptocurrency or buy gift cards for fraudsters, and give them related numbers and PINs to resolve supposed crises.

How can you tell if the person calling you is a real family member or a scammer? Don’t trust the voice, writes Alvaro Puig, a consumer education specialist at the FTC. Call the person, with a verified phone number, who supposedly contacted you and verify the story. If you can’t reach your loved one, try to get in touch with them through other family members or their friends.

“Establish a safeword with your family and friends,” before a possible strike, Drapkin writes. “This is a code that means you and your loved ones can identify yourselves to one another. … This will be particularly useful for elderly family members, and if it’s never written down, can be kept quite simple.”

AI tools can be problematic in other ways. Criminals can use ChatGPT to write malware and design phishing email scams. Some financial institutions, with customers’ permission, will use their voice messages as passwords for opening their accounts. But let’s assume a hacker intrudes upon the network of a bank and gains access to the usernames of client brokerage accounts. The hacker, when asked to repeat a voice password to open an account, could do it with precision using the cloned voice of the client. The fraudster could then easily transfer money out of the victim’s account. Scary, isn’t it?

Fake tax refund scam

On July 3, the U.S. Internal Revenue Service (IRS) warned taxpayers about a new mailing scam that promises tax refunds but tries to steal personally identifiable information (PII).

The fraudsters mail information about supposed refunds in cardboard envelopes with the IRS logo and a line that reads the notice is “in relation to your unclaimed refund.” In typical scam fashion, the accompanying letter provides fake IRS contact information and telephone number.

To claim refunds, the letters state potential victims must first provide “filing information” that includes detailed PII (photos of driver’s licenses, banking account numbers, Social Security numbers, etc.), which fraudsters can use for fraudulent purposes, including, ironically, stealing tax refunds. The scammers can also send their fraudulent alerts via emails and texts. (See “IRS, Security Summit partners warn taxpayers of new scam; unusual delivery service mailing tries to trick people into sending photos, bank account information,” IRS, July 3, 2023.)

In another scheme, identity theft tax refund fraud, fraudsters file fake income tax refunds on behalf of victims via photos of driver’s licenses and other PII they obtain in this scam. (Also, see “Identity theft tax refund fraud: A growing epidemic parts 1,” and 2, by Robert Holtfreter, Ph.D., CFE, CICA; Tiffany McLeod; and Adrian Harrington, Fraud Magazine, March/April 2014 and May/June 2014.)

According to the IRS, the letter in the cardboard envelope includes awkwardly or poorly written worded requests and warnings, odd punctuation and a mixture of fonts as well as inaccuracies. For example, “You’ll Need to Get This to Get Your Refunds After Filing. These Must Be Given to a Filing Agent Who Will Help You Submit Your Unclaimed Property Claim. Once You Send All The Information Please Try to Be Checking Your Email for Response From The Agents Thanks.”

The IRS doesn’t handle “unclaimed property.” And the letter inaccurately states that “The deadline for filing tax is Oct. 17.” The extension deadline for 2022 tax returns is October 16.

The IRS provides advice about scams:

• The IRS never initiates contact with taxpayers by email, text or social media about bills or tax refunds.
• Never click on unsolicited communications that claim to be from the IRS because they may surreptitiously load malware and ransomware.
• Don’t respond to tax-related phishing or smishing messages or click on URL links. Send the email or a copy of the text/SMS as an attachment to phishing@irs.gov. Include the caller ID (email or phone number), date, time and time zone, and the number that received the message.
• Also, report scams to the Treasury Inspector General for Tax Administration or the Internet Crime Complaint Center. The IRS Report Phishing and Online Scams web page provides complete details. The Federal Communications Commission’s Smartphone Security Checker is a useful tool against mobile security threats.
• Be wary of messages that appear to be from friends or family but are possibly stolen or compromised email or text accounts from someone they know. This remains a popular way to target individuals and tax preparers for a variety of scams. Verify the identities of senders by calling numbers you know to be accurate.

Here to help

Please use information about these scams in your outreach programs and among your family members, friends and co-workers. As part of my outreach program, please contact me if you have any questions on identity theft or cyber-related issues that you need help with or if you’d like me to research a scam and possibly include details in future columns or as feature articles.

I don’t have all the answers, but I’ll do my best to help. I might not get back to you immediately, but I’ll reply. Stay tuned!

Robert E. Holtfreter, Ph.D., CFE, is a distinguished professor of accounting and research at Central Washington University. He’s the vice president of the ACFE Pacific Northwest chapter. He’s a member of the Accounting Council for the Gerson Lehrman Group, a research consulting organization and is a member of the White Collar Crime Research Consortium Advisory Council. He’s also on the ACFE Advisory Council and Editorial Advisory Committee, and he was recently selected to serve on ACFE’s inaugural CFE Exam Content Development Committee. Holtfreter was the recipient of the Hubbard Award for the best Fraud Magazine feature article in 2016. Contact him at doctorh007@gmail.com.