Many times a day worldwide, a boss asks one of their team members to perform a task during a video call. But is the person assigning tasks actually who they say they are? Or is it a deepfake? Instead of blindly following orders, employees must now ask themselves if they are becoming a victims of fraud.

Earlier this year, a finance worker found themselves talking on a video meeting with someone who looked and sounded just like their CFO. After the meeting was over, they then dutifully followed their boss’s instructions to send $200 million Hong Kong dollars, which equals $25 million.

But it wasn’t actually their boss — just an AI video representation called a deepfake. Later that day, the employee realized their terrible mistake after checking with the corporate offices of their multinational firm. They had been a victim of a deepfake scheme that defrauded the organization out of $25 million.

Businesses are often deepfake targets

The term deepfake refers to AI-created content — video, image, audio or text — that contains false or altered information, such as Taylor Swift promoting cookware and the infamous fake Tom Cruise. Even the recent hurricanes hitting the U.S. led to multiple deepfake images, including fake flooded Disney World photos and heartbreaking AI-generated pictures of people with their pets in floodwaters.

While deepfakes, also referred to as synthetic media, targeted at individuals typically serve to manipulate people, cyber criminals targeting businesses are looking for monetary gain. According to the CISA Contextualizing Deepfake Threats to Organizations information sheet, threats targeting businesses tend to fall into one of three categories: executive impersonation for brand manipulation, impersonation for financial gain or impersonation to gain access.

But the recent incident in Hong Kong wasn’t just one employee making a mistake. Deepfake schemes are becoming increasingly common for businesses. A recent Medus survey found that the majority (53%) of finance professionals have been targeted by attempted deepfake schemes. Even more concerning is the fact that more than 43% admitted to ultimately falling victim to the attack.

Watch Unmask the Deepfake

Are deepfake attacks underreported?

The key word from the Medus research is “admitted.”  And it raises a big question. Do people fail to report being a victim of a deepfake attack because they are embarrassed? The answer is probably.  After the fact, it seems obvious it was a fake to other people. And it’s tough to admit that you fell for an AI-generated image.  But the underreporting only adds to the shame and makes it easier for cyber criminals to get away with it.

Most people assume that they could spot a deepfake. But that’s not the case. The Center for Humans and Machines and CREED found a wide gap between people’s confidence in identifying a deepfake and their actual performance. Because many people overestimate their ability to identify a deepfake, it adds to the shame when someone falls victim, which likely leads to underreporting.

Why people fall for deepfake schemes

The employee who was tricked by the deepfake of the CFO to the tune of $25 million later admitted that when they first got the email supposedly from his CFO, the mention of a secret transaction made them wonder if the email was actually a phishing email. But once he got on the video, they recognized other members of his department in the video and decided it was authentic. However, the employee later learned that the video images of his department members were also deepfakes.

Many people who are victims overlook their concerns, questions and doubts. But what makes people, even those educated on deepfakes, push their concerns to the side and choose to believe an image is real? That’s the $1 million — or $25 million — question that we need to answer to prevent costly and damaging deepfake schemes in the future.

Sage Journals asked the question about who was more likely to fall for deepfakes and didn’t find any pattern around age or gender. However, older individuals may be more vulnerable to the scheme and have a hard time detecting it. Additionally, the researchers found that while awareness is a good starting point, it appears to have limited effectiveness in preventing people from falling for deepfakes.

However, computational neuroscientist Tijl Grootswagers of Western Sydney University likely hit the nail on the head as to the challenge of spotting a deepfake: it’s a brand new skill for each of us. We’ve learned to be skeptical of news stories and bias, but questioning the authenticity of an image we can see goes against our thought processes. Grootswagers told Science Magazine “In our lives, we never have to think about who is a real or a fake person. It’s not a task we’ve been trained on.”

Interestingly, Grootswagers discovered that our brains are better at detection without our intervention. He discovered that when people looked at a picture of a deepfake, the image resulted in a different electrical signal to the brain’s visual cortex than a legitimate image or video. When asked why, he wasn’t quite sure — maybe the signal never reached our consciousness due to interference from other brain regions, or maybe humans don’t recognize the signals that an image is fake because it’s a new task.

This means that each of us must begin to train our brain to consider that any image or video that we view could possibly be a deepfake. By asking this question each and every time we begin to act on content, we may be able to begin detecting our brain signals that are spotting the fakes before we can. And most importantly, if we do fall victim to a deepfake, especially at work, it’s key that each of us reports all instances. Only then can experts and authorities begin to curb the creation and proliferation.

The post Are successful deepfake scams more common than we realize? appeared first on Security Intelligence.

In our mobile-first/mobile-last world, many employees’ work days both start and end on a mobile device. Mobile devices are now essential tools for productivity and communication. As many organizations transition to hybrid work environments, mobile devices offer a rich target for malicious actors because they are often the least protected corporate devices and offer platforms from which to launch social engineering attacks.

Unlike traditional computers, which are generally well-defended with antivirus software and cybersecurity protocols, mobile devices are frequently left vulnerable due to a lack of user awareness and proper protection.

Mobile devices have unique vulnerabilities that cyber criminals increasingly exploit. Yet, because mobile device security has historically received less attention, most users and IT teams don’t fully recognize these risks. This lack of awareness often translates into a lack of cyber hygiene, such as timely updates and the installation of essential security software, leaving devices susceptible to a growing number of cyber threats.

Why are mobile devices more vulnerable?

Mobile devices face different security challenges than desktops or laptops, as they rely on various applications, connect to public networks and carry sensitive data in pockets and purses. Here are a few ways they are at greater risk:

1. Frequent connection to public networks: Mobile devices frequently connect to public Wi-Fi in coffee shops, airports and other common spaces, making them easy targets for attackers. Public Wi-Fi networks are often unsecured, allowing hackers to intercept sensitive data, including login credentials and personal information.
2. Lack of routine updates: Unlike desktop computers, where security patches and updates are standard practice, mobile devices are often left with outdated software. This is problematic as mobile operating system updates are essential to patch known vulnerabilities.
3. Inconsistent security across devices: Businesses often use a mix of iOS and Android devices, each with its own security protocols and vulnerabilities. Android, for instance, has a more fragmented ecosystem, where updates are not universally applied across devices, leaving users exposed. In addition, iOS users may not be aware that jailbreaking their phones disables important security features.
4. More personal apps and data at risk: Mobile devices often hold both personal and professional data, including emails, contacts and payment information, as well as business data. The mixture of personal and business use increases exposure to potential breaches, as malicious apps downloaded for personal use can compromise corporate security.
5. Malware-laden apps: Although app stores like Google Play and Apple’s App Store vet applications, malicious apps still manage to slip through. These apps can contain malware that gathers data, spies on activity or even takes control of a device, risking both personal and business information.

Common mobile threats

In addition to the vulnerabilities mentioned above, there are specific mobile threats every user and IT team should be aware of:

• Phishing attacks: Phishing remains one of the most effective attack vectors, and mobile users are highly susceptible due to the small screens and simplified user interfaces. Emails, SMS texts and even social media direct messages can carry phishing links that result in credential theft or malware.
• Malware and spyware: Malicious apps can install malware that collects sensitive data or tracks a user’s activity without consent. Known as spyware, this malware can access everything from location to keystrokes, making it a prime threat to both personal privacy and business security.
• Man-in-the-middle attacks (MITM): Public Wi-Fi networks are ideal for MITM attacks, where attackers intercept communication between a mobile device and a server. Sensitive information, such as login credentials, can be exposed without the user realizing it.
• Unsecured devices and theft: Because mobile devices are portable, they are also at a higher risk of being lost or stolen. When devices don’t have proper security, such as screen locks or device encryption, sensitive information can be accessed by anyone who picks up the device.

Best practices for mobile cybersecurity

While mobile threats are on the rise, there are ways to reduce the risk of attacks. Individuals and organizations can take proactive measures to secure their mobile devices and protect sensitive data. Regularly updating operating systems, using mobile security software and employing strong authentication are essential steps for protecting mobile devices. Additionally, limiting app permissions and promoting cybersecurity training among employees can significantly reduce risks.

For businesses, implementing a mobile device management (MDM) solution, like IBM MaaS360, is particularly valuable. MDM provides critical control and visibility, allowing organizations to enforce security policies, manage devices remotely and wipe data if a device is lost or stolen — ensuring comprehensive security across all mobile devices accessing company resources.

Embracing mobile security for the hybrid workforce

As more organizations embrace hybrid work models, mobile device security is no longer optional. In a world where business data is accessed on the go, employees and IT teams must take mobile security seriously. Without proper safeguards, the productivity benefits of mobile devices are outweighed by the increased security risks they pose.

IBM MaaS360 Mobile Threat Defense add-ons (Professional and Advanced) represent a major evolution in the endpoint security capabilities of the IBM MaaS360 platform and the enterprise mobility market. The new add-ons consolidate devices, users, threats and vulnerabilities into a unified endpoint management and security platform. MaaS360 Mobile Threat Defense provides device management, mobile threat defense, seamless integration with existing cybersecurity stacks and AI-driven security insights to accelerate threat assessment and response.

IBM MaaS360 Mobile Threat Defense Advanced represents a significant advance in how organizations adopt and leverage mobile device defense. As an integrated extension of IBM MaaS360, IBM MaaS360 Mobile Threat Defense Advanced combines simplicity and security in a single solution with a fully automated deployment and zero-touch device activation. The platform provides on-device protection powered by machine learning and features near real-time dashboards to identify risky users and devices, as well as detect and respond to advanced and persistent mobile threats.

MaaS360 Unified Endpoint Management, combined with the MaaS360 Mobile Threat Defense Professional add-on, provides IT administrators with a comprehensive, integrated, end-to-end solution that brings together best-in-class endpoint management and mobile threat defense. Administrators can manage and protect their mobile ecosystem from a central point of control with granular endpoint security policies and automated, proactive threat detection and response.

These offerings provide organizations with protection from evolving mobile threats. They also improve employee productivity while reducing risks to corporate data and employee privacy.

If you want to learn more about the significant evolution of the IBM MaaS360 platform and how IBM MaaS360 Mobile Threat Defense provides you with a simple way to protect your mobile users and corporate data from advanced mobile threats, register for our FREE webinar on January 14th here.

The post Mobile device security: Why protection is critical in the hybrid workforce appeared first on Security Intelligence.