People can no longer rely on poor spelling or suspicious-looking messages to identify fraud, cyber experts have warned.
Deepfakes, phishing and voice cloning are among the threats becoming more sophisticated as criminals use AI to gather information about potential victims and create convincing messages, calls and videos.
Amer Sharaf, chief executive of the Cyber Security Systems and Services Sector at the government-run Dubai Electronic Security Centre (Desc), said AI was allowing attackers to speed up methods that had previously required far more manual work.
But he said the same technology was also improving cyber defences and helping security teams respond faster.
“The AI threat has been a challenge across the entire globe,” he told The National at the Gisec Global event in Dubai.
"The world is awakening to this threat that is out there, that's being used by adversaries, by attackers, hackers, etc, trying to speed up the process of what they did before.”
Safe words and caution
AI is increasingly being used to create fake social media profiles, clone voices and create convincing videos of public figures and people’s relatives.
Mr Sharaf said deepfakes were among the threats people should be most alert to, particularly where a person appeared to be asking for money or making an unusual request. His advice was simple: double-check.
“Any email you get in your business relevant to your work, always double-check through your normal means before you transact in that manner,” he said. “Call the person and double-check. Go to his office, especially when it comes to transferring funds.”
With voice and video cloning technology becoming increasingly sophisticated, people are advised to agree “safe words” with family and friends to establish whether a message is genuine.
Solomon Gilbert, a former hacker who now advises UK government and police forces on cyber security, said one of the simplest protections was to pause when a message or caller created a sense of urgency.
“If you're unsure about something, or if someone's asking you to do something, and certainly if someone's giving you a sense of urgency, stop,” he said. “Take five seconds, think about why they're asking you, and just allow your logic brain to engage.
“Two-factor authentication, using a password manager, not giving out too much personal information. We want people to be empowered,” he said. “We want them to learn, be informed, be up to date.”
Keeping devices updated is also important, because software updates often contain fixes for newly discovered security weaknesses.
'Both terrifying and encouraging'
The potential of the technology was highlighted during a Gisec panel featuring Michael Kelly, the four-time Emmy-nominated actor known for roles in House of Cards and Jack Ryan.
Kelly described how similar technology had been used legitimately during production of Jack Ryan after he tested positive for Covid on the final day of filming. His stunt double filmed a scene in his place before Kelly was scanned on a stage in New York.
“They took my face and they put it on that actor,” he said, describing how the technology “seamlessly put my face on another person”. He described it as “on the one hand terrifying, and on the other hand, incredibly encouraging”, because of its potential as a useful tool.
Deepfake detection
Desc announced on Wednesday that it was launching an AI model to help detect deepfake videos. Named Saraab and developed by an Emirati team, the technology was unveiled on the opening day of Gisec Global.
Mr Sharaf said the tool scans videos frame by frame and examines areas of the face using a heat map to identify signs of manipulation that can be difficult for a person to detect.
“It will look at every picture frame by frame, and there is a heat map on the face,” he said.
Saraab will be made available as an open-source tool for people to download and use, Mr Sharaf said.
Limit information sharing with AI
Experts at Gisec Global also warned people to consider what they upload to publicly available AI services.
Jans D'Hert, a certified instructor at the Sans Institute, a cybersecurity research and training organisation, said users often do not understand how the information they enter into AI tools can be handled.
“The number one mistake is that people are going out there using AI and they're not knowing which AI they're using,” he told The National.
“Anything that is publicly facing, if you submit data to it and it's not a private subscription you have with them, it's public,” he said. “Unfortunately, the data that you submit is potentially going to be used to train their model.”
Mr D'Hert said the biggest immediate risk was not AI itself but how people choose to use it.
“We cannot just let an AI agent loose and give it keys to the kingdom because we don’t know what it might do with the kingdom. So, this is where we need to regulate it and govern it.”
