As the busy holiday season gets underway, cyberfraud is sure to spike, potentially showing up in promotional emails and even in phone calls—all aimed at separating you from your money.
Cyberfraud tends to increase during the holidays, and because of AI, it’s harder than ever to spot. A call from a relative, a celebrity in a promotional video, a website showing an unbelievable deal—all can be easily faked by AI. An email from “Target,” for example, might steer you to a fake Target site.
These days, “seeing is no longer believing,” said Thaier Hayajneh, PhD, founder and director of Fordham’s Center for Cybersecurity and AI, who oversees Fordham’s undergraduate, graduate, and certificate programs in cybersecurity.
How to Keep from Getting Taken
As Black Friday approaches, Hayajneh offered tips for avoiding cyberscams during the holidays. It’s a time when busy, distracted shoppers are more prone to letting their guard down; meanwhile, AI has “industrialized” fraud, making scams far easier to automate, personalize, and produce on a massive scale, Hayajneh said.
According to Norton, 30% of shoppers take more online shopping risks during the holidays, and 16% of adults have been scammed because of it, with most of them losing money—$394 on average.
Hayajneh advised patience and caution for enjoying the holidays without falling prey to fraud.
Don’t Be Too Quick to Believe Your Eyes and Ears.
Interpol and other authorities are sounding the alarm about deepfake videos, voice cloning, and other techniques for creating utterly convincing fake messages.
Criminals use these techniques in playing upon our desire to help family members, Hayajneh said. They might fake a FaceTime call from a loved one, drawing the image from online videos. They might clone someone’s voice—perhaps using online videos and social posts—and concoct a fake phone call to that person’s parents seeking emergency cash for holiday travel, as noted by the U.S. Treasury Department in an advisory.
How to respond to such suspicious calls? Call your loved one back, using their trusted number. Or call someone else who can verify what the caller told you, Hayajneh said, even though this could be hard. “Scammers always try to create some kind of a sense of urgency,” which can be a tipoff, he said. “Whenever you receive any unexpected request that involves money, take a moment to verify it.”
Family members can choose a “safe word” for verifying one another’s identities. And scammers may try to clone your voice by getting you on the phone, so don’t pick up calls from unknown numbers, Hayajneh said.
Be Warned: Scammers Can Now Spell ‘Happy Holidays’ Correctly.
Spotting fraudulent holiday promotions is harder in another respect: typos aren’t the tipoff that they used to be. AI can now write “better than native speakers” can, Hayajneh said. “Don’t assume an email is legitimate because it’s well written” and appears authentic, he said. Other things may give away the email if you look closely, he said. It might propose an unusual payment method, for instance, or the sender’s e-mail address may appear suspect.
And the content of email scams takes a holiday twist. Scammers know to send a malicious link in a message about a supposed prior order or refund, knowing that during the holiday spending scramble, people might quickly click because they lose track of all the orders they’ve been placing. “They rely on the fact that you’re not going to slow down and take a minute” before clicking, he said.
Emails and Websites Are Easy to Fake.
Using AI, cybercrooks can easily generate everything from customer service chatbots to product reviews, emails, ads, promotional videos, and entire websites, Hayajneh said. They could replicate a known retailer, like Amazon, or create an entirely new “company” to lure you into giving up your credit card number while holiday shopping.
Once again, he said, be careful: Don’t click any links in an unexpected email. If you want to grab the holiday deal it promises, go to the retailer’s website and look for it there. If you’ve never heard of the company, do your research on it by checking independent reviews and verifying its website address. The Google Transparency Report is one tool for this, although it may not have detected newer fraudulent sites yet, Hayajneh said.
Keep in mind that two typical security hallmarks—an “https” in the URL and a padlock icon next to it—don’t necessarily mean a site is legitimate, Hayajneh said.
Take Your Time and Verify.
These precautions aren’t foolproof, but they’re like seatbelts—“having them is better than not having them,” Hayajneh said. And don’t forget basic measures, he said: To keep your accounts from being hacked, set up multifactor authentication. Don’t use a password for more than one account.
And stay cool, he said: “Take your time, verify unexpected requests, secure your accounts. Don’t let just anyone pressure you into taking an immediate action.”
