Don't click this button, there's a scammer behind it

Cybercriminals use artificial intelligence to deceive email users. New AI voice scam could threaten billions of email users.

Marcel Hozenek/t-online

Cybercriminals have developed a new, sophisticated scam that theoretically threatens billions of email users around the world. As American magazine Forbes writes, fraudsters rely on artificial intelligence (AI) to deceive their victims. The attacks are so sophisticated that even experienced users are at risk of falling for them, the report said.

This is how the scam works

The scam starts with a seemingly innocuous account recovery email – in this case, it affected Google's Gmail account. Soon after, the scammer received a call, pretending to be a Google employee. The tricky part is that the phone number displayed actually matches the official Google contact details.

The first stage of the attack is to recover your account through such phishing emails.

Attackers also use state-of-the-art speech synthesis technology to deceptively imitate human voicesit continues. They combine these with social engineering techniques such as feigning urgency. The aim is to convince victims to reveal their access data.

Currently, Americans appear to be the main targets, but phishing methods using cloned voices may soon target German speakers as well. To do this, the fraudsters would have to train the AI ​​voice in German, which would happen sooner or later.

Microsoft experts warn of phishing emails and scam calls

Microsoft employee Sam Mitrovic became aware of the scam attempt. He described the entire process in a blog and warned all Gmail users to be aware of this “terrible scam.”

At first glance, this appears to be one of many phishing attacks. Mitrovic received an email asking him to reinstate his account. So far, 2024 has been pretty normal.

Things got more complicated when Mitrovic received a call a few minutes later, which, according to the number, was also purported to be from Google. The IT consultant also ignored this and quickly forgot about it.

It was only a week later that the depth of the fraudsters' persistence in this case became apparent. Mitrovic received another email and a few minutes later another phone call. This time he accepted it.

“It was an American voice, very polite and professional,” the IT expert recalled on his blog. This alerted him to suspicious activity on his Google account, and it was reported that someone from Germany had logged into the U.S. account.

Scammers use artificial intelligence to commit fraud

To protect himself, Mitrovic asked over the phone to send him an email about the case – usually an easy option for detecting attempted fraud. But this works too; the corresponding sender address doesn't look suspicious at first. The caller's number can even be identified online as an actual Google support number.

“I know how easy it is to fake this number,” the expert explains. Seconds later it turned out that this was actually happening. Because when Mitrovic stopped responding to the caller's “hello,” he would only hear another “hello” that sounded exactly the same after a brief pause.