Body
Cybercriminals often use fear, urgency, and trust to trick people into sending money, sharing sensitive information, or taking actions they normally wouldn't. Artificial intelligence (AI) is making these scams even more convincing by allowing scammers to imitate someone's voice or create realistic images and videos, known as deepfakes.
Imagine receiving an unexpected phone call from a family member who sounds distressed and urgently needs money. Or a video call from your manager requesting sensitive information. Everything may seem legitimate, but a familiar voice or convincing video doesn't necessarily mean the person is who they claim to be.
Learning to recognize suspicious requests, establishing a safe word with your family or team, and independently verifying someone's identity can help protect you, the people you work with or care about, and the Villanova community.
How Deepfake Scams Work
Cyber criminals generate their deepfakes using audio, video, and photos that are often scraped from social media or recorded public appearances. They will then contact you and create a sense of urgency to force you into acting without thinking. Examples of common deepfake scams include:
- A loved one has been arrested, kidnapped, injured, or stranded and urgently needs money
- A law enforcement agency claims you missed jury duty, owe outstanding court fines, face an active arrest warrant, or have a suspended driver’s license and demands payment
- An executive needs you to bypass normal processes to transfer funds or change payment information
- Your manager needs a password, verification code, or other sensitive information to complete a task
- Someone needs you to take an unusual action quickly and secretly
The most important thing to remember is that a familiar voice, image, phone number, or email address is not enough to verify someone's identity.
Establish a Safe Word
One way to protect yourself, the people close to you, and Villanova is to establish a safe word or phase. A safe word is something agreed upon in advance that can be used to verify a person's identity during an unexpected or urgent situation. Tips for creating a strong safe word include:
- Make it difficult to guess: Choose something that could not easily be learned from social media or other publicly available information. Avoid birthdays, pet names, addresses, or other common personal/professional details.
- Keep it private: Only share the safe word directly with the people who need to know it, preferably in person or on a video call. Never write them down and store them in plain sight.
- Don't reuse safe words: Avoid relying on the same word or phrase for every situation. A personal safe word with your family should not be the same you use with your team at work.
- Make sure everyone knows what to do: Set clear rules and agree together when and how to use safe words, as well as what to do it the person says they don't know it or avoids answering. Practice a quick scenario to help everyone remember before a real panic moment happens.
AI may make scams more convincing, but you can keep your head calm and take precautions like safe words pausing to help uncover what's real.
Extra Verification Steps
Just like cyber criminals can use deepfakes to replicate voices and images, they can use technology to spoof phone numbers and email addresses. In addition to using a safe word, we also recommend reaching out to the person independently through a second, trusted communication channel.
- Hang up the phone and call the person back using a trusted number stored in your contacts or found on an official website, even if they beg you to stay on the line.
- Ask to switch from a phone call to a video call, as it's less likely that the cyber criminal has both an audio and video deepfake created. Even still, ask for your safe word.
- If you feel too nervous to get off the call, use a Teams chat, text message, or other direct messaging format to reach out to the person.
- When possible, physically go to the person to verify the request.
Report Deepfake Scams
For work-related deepfake scams, report the incident to your manager and to Information Security through the Report a Security Concern form.
The Information Security team also wants to ensure you have the tools and support needed to respond if cyber crime affects your personal life. Review tips on responding to personal fraud or identity theft, including federal reporting resources.