How to recognize online fraud using Deepfake technology

Recently, online fraud has been on the rise, especially fraud through Facebook or Zalo. After taking over Facebook and Zalo accounts, scammers have used many sophisticated tricks to continue to defraud relatives of the account owners.

Do not click on the voting links

To take over social network accounts, zalo, the most common trick is for scammers to send you a link via text message/messenger asking you to vote for your child in a contest.

If you click on the link as instructed in it, you will immediately lose your account.

To make you believe that the person texting is the account owner, hackers make video calls using Deepfake technology [creating fake technology products in the form of audio, images or even videos, by artificial intelligence - pv] with identical faces and voices to pretend to be relatives and friends to borrow money and appropriate property.

The scammers' method is to take old videos of users, cut and paste them or use Deepfake technology to play back the videos in a blurry, flickering form as if they were in a place with weak signal. After gaining the victim's trust, the scammers will send messages to carry out the scam.

According to cybersecurity experts, the method of these subjects is often to search and collect personal information posted publicly on social network accounts to create a scam scenario. When the careful victim will call or video to check, they use image editing software to deceive.

Ms. LNQM, a victim, said that after the hacker took over her Facebook account, she used Deepfake with a face identical to hers to text and video call to borrow money from her relatives and friends. Fortunately, Ms. LNQM warned everyone in advance about the loss of her Facebook account, preventing the hacker from being able to scam her.

Expert Ngo Minh Hieu - Cyber security expert, National Cyber Security Monitoring Center (NCSC) - Department of Information Security ( Ministry of Information and Communications ) said that Deepfake fraud has been applied by international criminals in recent times.

Mr. Hieu also presented a scenario of Deepfake fraud signs such as users when watching some videos or images where the character has some strange signs, the face lacks emotion and is quite "inert" when speaking, awkward posture, unnatural. Or the skin color of the character in the video is unusual, strange light and shadows are not in the right position, making the video look "fake" and unnatural; Or the sound is not consistent with the image, there is a lot of noise lost in the clip or the clip has no sound. Usually the scammer will interrupt halfway, say that the signal is lost, the signal is weak, then will text to request a money transfer.

According to Mr. Ngo Minh Hieu, the above signs are "red flags" of Deepfake. Mr. Hieu recommends that users should stay alert when someone on social networks in their friend list suddenly asks to borrow money or sends strange links. They should not rush, but stay calm, check and authenticate everything.

At the same time, actively authenticate by calling directly or Videocalling for at least 1 minute, then asking personal questions that only you and the other person know. Because Deepfake will not be able to fake a real conversation in real time with high accuracy.

Fake bank account in the owner's name

Ms. LNQM's case did not stop there. When carrying out the scam, the hacker sent her relatives and friends several bank accounts with the recipient's name also being LNQM to increase trust.

With this new and extremely sophisticated trick, many people have accidentally fallen into the trap.

Usually, when asking to transfer money, the scammer will say that he needs to transfer to someone, but the account does not have enough money and give the account number in someone else's name. However, this scam is easy to detect.

However, by transferring the name of the Facebook account owner to the bank account, hackers can easily trap the victim.

Vietnam+ reporter tried the service by making a money transfer order to the correct account number given by the scammer. After entering the correct number, the app displayed the correct name of the account owner.

There have been many questions, how can one create a bank account in the correct name of the Facebook account owner?

Some technology experts believe that there are 3 possible scenarios. First, the hacker uses the function to change the nickname of the bank account to the same name as the scammed person. Second, it is very possible that the hacker created a "junk" bank account with the same name to conduct the scam. Third, it is possible that in the message history of the owner of the lost Facebook account, there is a citizen identification card/passport... that the scammer can take to create a bank account.

In the first case, a bank representative confirmed that when a customer nicknames their bank account, only the account number will be replaced with a nickname with the customer's name, which will not change. This means that when making a money transfer to the account number or nickname, the real name of the recipient will still appear.

In the second case, at the regular press conference of the Ministry of Information and Communications, Mr. Tran Quang Hung - Deputy Director of the Department of Information Security (Ministry of Information and Communications) said that to solve the problem of online fraud, it is necessary to deal with bank accounts that are not owned by the owner. Fraudsters can easily buy bank accounts for only 2-3 million VND for victims to transfer money into.

In the third case, according to Mr. Vu Ngoc Son - Technology Director of NCS Cyber Security Company, currently banks allow opening online accounts and authenticating users through eKYC applications (electronic identification).

The weakness of this method is that some banks have not yet connected to the National Population Database system, so there is no mechanism to verify whether the information on the citizen identification card/ID card is real or fake.

This method only confirms that the person transacting with the photo on the document is the same but does not confirm whether the information is correct or not. Therefore, there is a phenomenon that a person can use fake documents (or genuine documents sent online) to register a bank account and pass the normal eKYC.

To overcome this loophole, according to Mr. Son, banks need to urgently connect with the National Population Database. Accordingly, when authenticating information, it will be compared with information already in the National Population Database, thereby detecting cases of forgery.

Principles to avoid falling into online scams

Nowadays, Facebook theft and text message or phone call scams to borrow money are very common. The tricks are becoming more sophisticated and unpredictable every day, so social network users need to pay attention to the most basic principles.

According to experts' recommendations, the number 1 principle that social network users should always remember to follow is: Be suspicious of all information requests (installing software, logging into websites, providing information, transferring money...) online.

All information for money transfers, loans, voting... needs to be verified through an independent channel such as a regular phone.

In addition, you should not access strange websites, do not install unknown software, software that requires high access rights to user information, access memory cards, contacts, locations, take photos, etc.

Another very important principle is not to send personal information via social networks, zalo... to avoid information disclosure. Absolutely do not provide personal information to unreliable establishments, do not click on strange links received via email, via chat.

When it is necessary to provide information for online transactions, after submitting the information, it must be immediately withdrawn and the transaction processing facility must be requested to delete the information according to the requirements of the newly issued Personal Data Protection Decree.

In case the transaction processing facility does not meet the requirements for deleting personal information, people can report to the authorities to conduct inspection and handling according to the provisions of law"./.

Minh Son (Vietnam+)

Source link