Cybersecurity: Watch out for these unique fraudster tricks Loki would be proud of

Image: Disney

My household and I enjoyed the TV amusement "Loki," which portrays the deity of mischief entailed successful assorted shenanigans. I thought however galore "variants" of Loki are online—albeit little charismatic—trying to propulsion disconnected fraudulent tricks to bilk victims retired of wealth oregon individuality information. The tricks are getting much unique, unfortunately, arsenic the related tools turn much analyzable and wide available.

SEE: Security incidental effect policy (TechRepublic Premium)

I spoke astir unsocial fraudster gimmicks with Rick Song, co-founder and CEO of Persona, an individuality verification solution provider, and Johanna Baum, laminitis and CEO of information supplier Strategic Security Solutions.

Song pointed retired that it's present easier for malicious players with minimal exertion skills to prosecute successful fraudulent activity. "Deepfakes were erstwhile lone deployed by blase tech users, but are present arsenic elemental arsenic downloading an app," helium said.

Song said determination is simply a immense summation successful deepfake contented connected the internet, and amateurs person started to nutrient impersonation videos of celebrities that are believable to the untrained eye. "Fraudsters tin usage deepfakes for bribery, to dispersed lies and misinformation oregon to airs arsenic mundane individuals—such arsenic idiosyncratic you trust—in bid to get idiosyncratic accusation and login credentials. This enables them to unfastened fake recognition paper accounts, instrumentality implicit existing accounts, bargain wealth from unsuspecting victims oregon entree full databases of idiosyncratic accusation to merchantability connected the dark web," helium said.

Another illustration is called synthetic fraud, whereby a fraudster steals an Social Security fig and combines it with fake information, specified arsenic a mendacious sanction and day of birth, to make a mendacious individuality oregon biometric ID verification utilizing artificial intelligence and different exertion to mimic facial identities and fool facial designation software. "Companies request to instrumentality into relationship aggregate signals, similar behavioral patterns, to guarantee they're evaluating a implicit representation that a fraudster can't easy replicate."

Baum said astir accusation is disposable without immoderate unfortunate input: "Personal accusation is readily disposable from aggregate societal media platforms. Fraudster tricks don't person to impact the unfortunate directly. So overmuch accusation tin beryllium obtained without immoderate contact. The threats volition proceed to summation successful size, frequence and harm with important elapsed clip for the unfortunate to place it.

"Vacation and pandemic-related scams are continuing to summation arsenic individuals re-enter mainstream activities," she added. "Homes are being rented to aggregate parties by imposters who past cancel the rentals and bargain the deposits. There are akin issues with aggregate transactions placed connected the aforesaid autos oregon autos not owned by the alleged seller."

Song said users and IT departments should wage adjacent attraction to personally identifiable accusation to safeguard against these attacks.

SEE: How to negociate passwords: Best practices and information tips (free PDF) (TechRepublic)

"Consumers should wage attraction to however companies grip their PII," helium said. "They should work privateness policies, cheque their privateness settings connected immoderate apps, websites oregon societal networks they use, and cognize their information rights. Additionally, they tin enactment connected apical of the latest phishing campaigns, particularly arsenic these get much blase with AI. If you Google your name, you whitethorn beryllium capable to uncover brokers who are selling your information and opt out. The much of your information that is retired determination for fraudsters to find, the much ammo they person to bargain your identity."

He added that IT departments request to rethink their strategies from individuality verification systems to information retention successful bid to support consumers harmless and artifact atrocious actors. 

"IDV solutions tin mitigate relationship takeovers and fraud that tin hap during lawsuit onboarding, changing relationship accusation and high-risk transactions. However, businesses mightiness beryllium reluctant to usage them if they deliberation it volition wounded the idiosyncratic experience—asking the lawsuit to leap done hoops could origin them to wantonness the transaction earlier it tin beryllium completed. Businesses should store astir for individuality verification solutions that are customizable to their needs. IT departments should marque definite they store information successful arsenic fewer places arsenic possible, utilize encryption and physique a model that is compliant with planetary information and privateness standards." 

Song said it tin beryllium hard to expect what's coming but advised: "Companies tin support themselves by utilizing a multi-factor individuality verification approach. Companies should cod respective points of accusation (photo ID, address, day of birth, SSN) portion evaluating passive signals specified arsenic IP code oregon browser fingerprints and cheque collected accusation against third-party information sources (e.g. telephone and email hazard lists). Performing continuous checks passim the full lawsuit lifecycle wherever there's a imaginable constituent of compromise is critical."

But things volition change, helium added. "In the aboriginal the individuality verification acquisition volition request to germinate based connected what services are seeing with real-time signals. For example, arsenic the work detects a suspicious IP code oregon keystroke behavior, it should accommodate its request automatically and execute much rigorous checks."

Also see

• Colonial Pipeline onslaught reminds america of our captious infrastructure's vulnerabilities (TechRepublic)
• Ransomware attack: Why a tiny concern paid the $150,000 ransom (TechRepublic)
• How to go a cybersecurity pro: A cheat sheet (TechRepublic)
• Security threats connected the horizon: What IT pro's request to cognize (free PDF) (TechRepublic)
• Checklist: Securing integer information (TechRepublic Premium)
• Cybersecurity and cyberwar: More must-read coverage (TechRepublic connected Flipboard)