Cyber crime costs the UK economy an estimated £27 billion a year. With the rise of AI and deepfakes, that eyewatering figure only looks to be heading in one direction.

That’s why education and re-education in the public sector is so important. Employees need to keep pace with the different tactics cyber criminals are using, as well as the psychological triggers they try to feed off. So they can get ahead and stop these cyber predators at source.

The new cyber threat in town: deepfakes

Deepfakes are types of synthetic media, generated by AI to impersonate or spread fake news. Using video, image, audio, text or a combination, deepfakes can be so high in quality that it’s difficult for a casual viewer to distinguish what’s real and what isn’t.

They’re increasingly being used in major attempts at blackmail and fraud. A recent incident tricked a CEO into believing he was speaking to the Group CEO, and convinced him to transfer a substantial sum of money to a third party bank account.

They were first called “deepfakes” because the technology involved in this content involves the use of deep learning techniques. However, that name might have to go under review. Deepfake technology nowadays is cheaper, takes much less resources to produce, and is easier for the less sophisticated criminal to take advantage of.

How to spot a fake from the real deal

Despite the quality of deepfakes improving and it getting harder to distinguish a phoney from the real thing, there are still some tell tale signs your people should be looking out for:

• Unnatural or lack of eye movement when reacting to the person they’re speaking with.
• A lack of regular blinking or no blinking at all.
• Unnatural facial expressions and facial morphing.
• Unnatural body shape, as the focus is more on the face.
• Unnatural hair.
• Abnormal skin colours.
• Awkward head and body positioning.
• Inconsistent facial positions.
• Odd lighting, shifts in lighting between frames, misplaced shadows or discoloured images.
• Bad lip-syncing.

Beat the deepfake risk with the basics

Even your basic security procedures can be effective at managing the deepfake threat. For instance, having automatic checks built in to any process for disbursing funds, and having a sceptical attitude organisation-wide to voicemail and videos can help avoid deepfakes and similar fraudulent attempts.

Make sure your organisation is media literate and uses reliable news sources too, and that you’re following cyber-security best practice. You also want to invest in a strong security package – one that provides anti-virus software, a Virtual Private Network (VPN) to stop Wi-Fi connections being hacked, and added protection for your webcams.

Download our latest cyber risk guide

As well as giving you more guidance around the deepfake threat, we expand out to other cyber tactics and the psychological triggers criminals try to target. Plus, some strategies and training methods you can use to better defend your organisation.

Get your copy here.

Sources:

https://www.dhs.gov/sites/default/files/publications/increasing_threats_of_deepfake_identities_0.pdf

https://www.insurancetimes.co.uk/expert-views/combating-social-engineering-and-deepfakes-gallagher-bassett/1452071.article

Disclaimer

This article and related document links do not purport to be comprehensive or to give legal advice. While every effort has been made to ensure accuracy, Risk Management Partners cannot be held liable for any errors, omissions or inaccuracies contained within the article and related document links.

Readers should not act upon (or refrain from acting upon) information in this article and related document links without first taking further specialist or professional advice.

Disclosure

Risk Management Partners Limited is authorised and regulated by the Financial Conduct Authority. Registered office: The Walbrook Building, 25 Walbrook, London EC4N 8AW. Registered in England and Wales. Company no. 2989025