Everything is fake

Who do you trust?

Your bank? Your boss? Your colleagues? Your friends? Your family?

What if I told you that the next time you see any of them on a video call, it isn’t them? What if the person you are talking to looks exactly like someone you know, sounds exactly like them and even behaves like them, but is actually a criminal trying to steal your money?

Welcome to the new world of digital trust, where seeing is no longer believing.

This is not science fiction. It is happening now.

The FBI has just discovered a North Korean cybercrime operation called FaceStealer, which has reportedly stolen more than $400 million in cryptocurrency over the past eighteen months.

FBI warns of ‘FaceStealer’ theft scheme

The criminals are targeting cryptocurrency executives, software developers and cybersecurity professionals, using fake video calls and stolen identities to trick people into giving them access to their computers and accounts.

The extraordinary thing is that the victims are often technology experts, people who understand cybersecurity, recognise phishing attacks and know how to protect themselves online … yet they are still being fooled. Why? Because the criminals are not just attacking the technology. They are attacking something far more vulnerable.

Trust.

Imagine that you receive an invitation to a video meeting from a colleague. It arrives through their usual account, and there is nothing particularly unusual about the request. You click the link, join the meeting and there they are, sitting in front of you.

You recognise their face, their voice and everything looks normal except it isn’t them.

The person on your screen is an AI-generated impersonation, created by criminals who have already compromised your colleague’s account. They have captured their image, stolen their contacts and are now using their identity to target you.

During the meeting, there is a technical problem. The sound isn’t working; the video freezes; or the software tells you that an update is required. Your colleague appears to suggest that you download a fix.

You do so, and that is when the criminals gain access to your computer.

The malware can steal credentials, access cryptocurrency wallets and compromise communications accounts. It can also capture your webcam footage, allowing the attackers to use your identity to deceive someone else.

The FBI reportedly recovered more than 900 webcam recordings connected to the operation, demonstrating how victims can become the unwitting faces of future attacks.

It is a remarkably effective form of social engineering because the criminals are not trying to persuade you to trust a stranger. They are exploiting the trust you already have in someone else.

Think about that for a moment.

For years, we have been told to be careful about suspicious emails, unfamiliar links and messages from people we do not know. We have learned to check the sender, recognise phishing attempts and avoid giving sensitive information to strangers.

FaceStealer turns that advice on its head.

The message comes from someone you know. The meeting invitation appears to be legitimate. The face on the screen is the person you know. The voice sounds right. Everything that would normally reassure you becomes part of the deception.

Then sprinkle a little bit of artificial intelligence into the mix and it makes the problem even worse.

Until recently, creating a convincing impersonation required access to recordings and considerable technical expertise. Today, AI can reproduce someone’s voice from a short audio sample, generate realistic video and create conversations that appear entirely authentic.

We are rapidly approaching a world in which anyone can impersonate anyone, anywhere, at any time.

What does that mean for banking?

Consider a relationship manager receiving a video call from a wealthy client requesting an urgent transfer. The client appears on screen, speaks in their familiar voice and explains why the payment needs to happen immediately. Or a finance director receiving a call from the chief executive asking for a confidential payment to complete an acquisition. The chief executive is there, on screen, giving the instructions personally. Or a customer contacting their bank after losing access to an account, using a voice and face that appear to match the bank’s records.

How does the bank know that any of these people are genuine?

Facial recognition? The face can be faked. Voice recognition? The voice can be cloned. An email from a trusted account? The account can be compromised. A video call to confirm the transaction? That can be fabricated too.

The fundamental problem is that we have built much of our digital world around the assumption that seeing and hearing someone provides evidence of who they are. FaceStealer demonstrates how dangerous that assumption has become. More than this, FaceStealer points towards something far more significant than stolen cryptocurrency. It signals the beginning of an era in which digital trust itself is under attack.

We have spent thirty years building a digital world in which anyone can connect with anyone, anywhere, at any time. We are now entering a world in which anyone can pretend to be anyone, anywhere, at any time.

That changes everything because what happens to an economy built on digital trust when we can no longer trust the people we meet online?

 

Postscript: the image with this article was generated by ChatGPT