Fake resumes, fake employees: AI amplifying fraud at 'staggering' rate, security watchers warn

OTTAWA — Criminals are harnessing artificial intelligence to defraud Canadian people and companies at “staggering” rates never seen before, warn top private sector security officials.

“We’ve never seen such an increase in fraud as we’ve seen recently. It is not a linear curve, it is accelerating and accelerating. The threat actors, the people who don’t have any values in life and are willing to abuse the elderly, people in need, they are doing it faster, more convincingly and at scale,” warned André Boucher, chief technology officer at National Bank.

Boucher was speaking on a panel with James Bouchard, the chief information security officer at Enbridge Gas, and Nicholas Payant, who holds the same position at at Bell Canada, at the Macdonald-Laurier Institute Energy Security Summit last week.

All three senior security officials said that AI had been a boon to their organizations’ productivity. Boucher spoke of a “fantastic moment in history” where there is an “unending appetite” for new AI-powered projects.

But they also warned that threat actors were doing the same, with risks to their companies growing at breakneck speed.

“The rate of change has never been as high” with scamming techniques, Payant said. He specifically cited the danger of internal threats, with artificial intelligence posing as job candidates and getting hired, only to defraud the company from the inside.

In recent months, law enforcement agencies across the world have warned of a scam where North Korean agents use AI to create fake IT workers to be hired in remote-work positions in Western organizations. The goal is to steal secrets and money to fund the country’s dictatorial regime.

Last week, Microsoft’s Threat Intelligence team published a blog post detailing the activity of one such group called “Jasper Sleet” that creates fake IT workers.

“Jasper Sleet has been observed using the AI application Faceswap to insert the faces of North Korean IT workers into stolen identity documents and to generate polished headshots for resumes. In some cases, the same AI-generated photo was reused across multiple personas with slight variations,” reads the blog post.

“Additionally, Jasper Sleet has been observed using voice-changing software during interviews to mask their accent, enabling them to pass as Western candidates in remote hiring processes.”

The North Korean groups are also using AI to generate realistic profiles of people for specific local markets by offering in-demand skills and certifications in applying for dozens of available jobs en masse.

For Boucher, AI has allowed scammers to create “synthetic human beings” that sound and even look exactly like another person on screen. It’s a far cry from the era of spam emails replete with spelling mistakes and grammatical incongruities that made scams more easily detectable.

That poses new challenges for banks and other critical industries who, along with their clients, are prime targets for scammers, hackers and foreign state-backed threat actors.

“You know, when you get into a meeting and you have to ask yourself: ‘Is this a real person that I’m looking at and talking to?’, it’s a whole different world,” said Boucher, the former associate head of the Canadian Centre of Cyber Security.

“From the fraud landscape, it’s staggering. So… we need to get really good, really smart,” he added.

Bridget Walshe, the current associate head of the Canadian Centre for Cyber Security, and the moderator of Wednesday’s panel, said that her organization is using AI to triage data in ways that were previously impossible.

AI can and should be used to defend organizations against threat actors, she said, but there are risks.

“We use it to explore data that some of our analysts would never have time to look at, and it can speed some of their processes,” she told the crowd.

“But it also comes with a lot of risks. Risks in how we deploy it and use it, when we trust it,” she added. “We’re learning how to use it, we’re learning how threat actors are using it.”

Payant and Boucher both argued that Canada is now at a “tipping point” where fraud prevention and privacy expectations are set to clash. He said there is a need for new regulations that will allow companies to access more data to help fight fraud.

“Of course, we cannot spy on conversations that are taking place, but there’s going to have to be a reflection as a society around, ‘Is there something we need to think about differently to detect patterns?’,” Payant said.

Another challenge, according to Enbridge’s Bouchard, is that many fraudsters are located abroad, making it even more difficult for Canadian law enforcement to act against them.

National Post

cnardi@postmedia.com

• China's premier gifted Carney an 'action camera.' Security experts suggest: 'dump it'
• Cyber criminals increasingly targeting Canadians' water, cyber defence agency says

Our website is the place for the latest breaking news, exclusive scoops, longreads and provocative commentary. Please bookmark nationalpost.com and sign up for our politics newsletter, First Reading, here.