Deepfakes.

[Wayne]

A number of years ago I was chatting to Steve Baker, who was at the time a part of the FTC. During that conversation we got talking about deepfakes, and he asked me about the possibility of scammers using it as part of their scam. I said that it was still a while off, and when it did happen it'd be the more organised scammers that'd be using it. I bring this up to show that it's a subject we've been monitoring and thinking about for a good while.

Today in our Skype chat, we site admins were discussing how deepfakes are now being used for the "grandparent" scam. The question came up about how we can deal with them. If a scammer can both look and sound like someone you know, how can you be sure it's them. The old suggestions that a scammer would be unwilling to appear on webcam is outdated, so what can you do? It's a toughie isn't it? Here's my thinking - a scammer may be able to look like someone and sound like them, but they can't think like them. Both FF and I are big sci fi fans, and the scenario of clones/robots/alternate reality doppelgangers is a popular storyline you'll see in pretty much every sci fi series. Using that as inspiration you'll see that the answer seems to be to do or know something the fake can't. Turning around on webcam to show the "HERE BE DRAGONS!" tattoo you have on your back isn't really an option here, nor is cutting off your pinkie finger so let's concentrate on things the scammer wouldn't know. One solution we can think of is to have a code word or phrase that can be used to prove your authenticity. It's not perfect, but it does at least offer a buffer. Imagine this scenario:

"Hi, this is your grandson. I've lost my phone and need a hundred bucks."

"Of course, but I've been told I need to ask you what the passphrase is before giving you money if you're not in the room with me."

"I have a HERE BE DRAGONS tattoo by my ass!"*

"OK honey, how can I send the money to you?"

This is of course a silly, completely exaggerated version, but you get the idea right? Having some kind of response that's needed to verify you are who say you are may be what's needed here. Let's forget the above scenario even and make it even simpler. Ask a question that only the genuine person would know. Nothing that a scammer can look up on social media. "What did we have to eat the last time you were here?" or "Why did you have to fix my computer for me last week?" for example.

What this all comes down to is "Never send money to someone you've never met in person - or someone you have met in person if they're not in the room with you and can't 100% prove they're really who they say they are".


*Tattoo does not necessarily have to be real, just the mention of it is enough.