Hacker News Reader

Comment by Traster | Hacker News Reader

If your level of security is "This guy on the phone sure sounds like someone I should wire several hundred thousand dollars for" you should probably look at improving your security procedures.

Whilst it's funny these guys did this with AI I can't help but feel that they could have done this with someone who is halfway decent at accents and saved themselves a lot of effort.

View on HN

I think you are seriously underestimating the difference.

Imagine getting a call from your wife. Do you doubt right now if it’s her or something that just sounds similar.

This man could have know the ceo quite well.

I wouldn’t wire my wife $250k based solely on a phone conversation.

It's just a matter of scale. For some companies $250K is pocket lint.

Would you tell your wife your credit card number if she called you and told you her card is blocked for some reason and she needs to refill the gas tank or buy something?

A while ago a friend who I hadn't seen since 2011 messaged me on Facebook asking if I could take a look at his account on a guitar forum we both used to frequent, because he thought his account was stolen, but couldn't check it for activity without making a new one(and probably also having enough posts to be considered "in").

So I asked who sold him that Music Man Petrucci 7-string in 2009(or so) and after he answered correctly, I followed through with his request.

My point being: it helps to have such a question prepared for everyone - or alternatively - a question concerning some fact about you that only people who know you could answer.

Funnily, companies for whom $250k is pocket lint since they're big enough to have processes for payments and it's often incredibly difficult to circumvent those processes.

That's because this is not a usual request. It could be for the CEO - only they know how likely that was to happen.

One thing is caller id spoofing (would it be possible to spoof my wife caller id), another thing is how reasonable my "wife's" request is.

1. Yes, the ease with which attackers can take over a phone number is a big security issue in general 2. You might question your wife's request but people are far less likely to question their CEO in the same way, it might be seen as insubordination

It's dead easy to spoof caller IDs. Any kid could do it.

Somehow looks it's not so easy to do in EU. Especially with mobile phone numbers. Or i'm just bad at googling.

I just have to assume that they got a good impersonator which sounds a lot more doable than having an AI.

but the deepfake thing is a good story.

>Whilst it's funny these guys did this with AI I can't help but feel that they could have done this with someone who is halfway decent at accents and saved themselves a lot of effort.

On the contrary, it seems like they did save themselves a lot of effort by deploying the de-centralised 'deepfake' AI model. It would be significantly hard for the opportunistic scammers to go out talent-scouting locally, trying to match the exact vocal characteristics of a person. It would also create a vulnerability, notably the person hired to impersonate the CEO.

Reply on news.ycombinator.com