Deep Voice: Removing Trust From a Multi Factor Safeguard

Artificial Intelligence has advanced to such a point where it can now be used to generate fake, but extremely believable recordings of a person's voice. These deepfaked voice recordings, sometimes referred to as "deepvoice" could potentially be used by threat actors to bypass the voice verification processes used by many financial institutions. This could greatly increase an organization's risk of falling victim to financial fraud.

Recommendations

Consider instituting a callback policy for any conversation regarding the transfer of funds or other sensitive information. This means that upon receiving a phone call requesting this kind of information, the call recipient would hang up, and call back on a line that has been pre-approved for this particular type of conversation with a particular party. Multiple lines may be needed for multiple parties, and specific numbers should be enforced. If a call is received from someone who does not know the correct callback number, sensitive information should not be shared
Consider enacting a policy requiring a passphrase for any action involving the transfer of funds. Require that any party requesting fund transfer use this passphrase prior to the sharing of sensitive information or authorization of fund transfer
Enabling one or both of these policies will help to mitigate the success rate of a deepfaked audio attack

Details

Threat actors are starting to leverage advances in artificial intelligence (AI) to undermine traditional secondary authorization safeguards around wire transfers. Standard best practice to reduce the efficacy of business email compromise (BEC) is to require voice verification of authorized wire transfers. Voice verification is frequently chosen in the financial realm both because it is perceived to be more secure and reduces the risk of human error with wire transfers. This additional confirmation does significantly increase the difficulty for a hacker. By using a voice confirmation, traditionally this means a hacker cannot simply compromise a single email account or even a mail exchange for a successful operation.

However, advances in AI are enabling a revolution in wire fraud. Rather than solely relying on BEC, some hackers are creating deep voice recordings of CEOs and other highly positioned members of companies and using that technology to request wire transfers. This technique is particularly effective for two reasons:

Because of the advances in technology, it is practically impossible to distinguish the voice of the real person from these deep fakes; and
The phone call requesting the wire transfer bypasses the traditional routes of BEC and plays on the inherent trust people place on voice communication.

Additionally, the perception of voice verification as the premier method for security reduces the likelihood that users of this method will recognize possible security risks

Current technology requires roughly three hours of voice recordings to make a convincing deep voice fake. This audio can be ripped from sources such as:

Earning calls;
Interviews;
Speaking engagements;
Personal videos; or
Any other public recording

In order to reduce your organization's risk of falling prey to this kind of attack, ZeroFOX recommends implementing the policies detailed above.