The latest high-tech scams (and how to avoid falling prey)

Stephen Meurice Clone: I’m Stephen Meurice and this is Perspectives. Welcome to the show, let’s get started. 

SM: That’s not actually Stephen Meurice, I’m Stephen Meurice. What you just heard is AI generated audio. It was created using a one-minute sample of my voice. Pretty accurate, though, right? And it only took seconds to make using readily available online software. 

What could possibly go wrong?  
   
Tammy McKinnon: So, fraudsters are using AI to mimic voices. And these could be voices of your loved ones.  

SM: That’s Scotiabank fraud expert, Tammy McKinnon. 

TM: A grandparent might be getting a call in the middle of the night. It sounds like their grandchild, because the voice cloning is so close and there's urgency to it. It could be, ‘Grandma, I've been in a car accident.’ Sometimes they'll even say, ‘Somebody's coming by to pick up the money.’  
 
SM: That is just one example of the latest in advanced schemes being employed these days to trick you into parting with your money.   

TM: Fraudsters are becoming more sophisticated and they're leveraging new technology to trick customers.  

SM: And a new poll from Scotiabank tells us that newcomers to Canada are especially vulnerable, with nearly 40% reporting they’ve fallen victim to a scam compared to 17% of other Canadians. The poll also said a resounding majority of Canadians agree more education around financial fraud is needed. So, Tammy is our guest this episode to do just that. She is the Senior Vice President of Fraud Management at Scotiabank and she’ll walk us through some emerging scams, tell us some potential red flags to watch for, and some simple ways for you or someone in your family to avoid becoming a victim.  

I’m Stephen Meurice, for real this time, and this is Perspectives.

Tammy, welcome back to the show. Great to have you on again.

TM: Thanks very much. Glad to be here. 

SM: All right, so we're going to get into a bunch of scams that are going on these days, but maybe you can give us a bit of a general lay of the land first? Is the situation around fraud getting worse?  

TM: Yeah, there's definitely more scams out there that we want our customers to be aware of and to protect themselves against.

SM: So, you're actually seeing statistically more people becoming victims of different kinds of fraud?  

TM: Yes, definitely. If we look at statistics from the Canadian Anti-Fraud Centre, more and more individuals are being scammed each year. 41,000, I believe, last year and $545 million worth.

SM: Wow. Before we get into some of the specific scams that we're going to talk about, we can talk a little bit about the stigma associated with it. People probably feel a little uncomfortable even talking about it because they feel like they've been fooled and they've become a victim of it. Are scams so sophisticated now that really anybody can become a victim?

TM: Anyone can become a victim. It really is content and circumstance specific. I've talked to people who feel that they're well-educated, they're knowledgeable, they're smart, and they say, ‘I never thought I would fall for this.’ But depending on the circumstance, people do fall for it. It could be just a moment in time. Maybe somebody is asleep when they get a phone call, maybe somebody is heading out on vacation. You know, fraud thrives where there's chaos. And so, whenever someone is in a hurry to go somewhere, that's a moment that they're weaker and they may be more susceptible to fraud.

SM: Right. So, we'll get into some tips later on. But maybe the first one is don't act hastily. Take your time.

TM: That’s right. Be skeptical. Right. Take a moment.

SM: Okay. Are people reluctant even to come forward?

TM: Yes. It really affects people's well-being, their self-confidence, their self-esteem. It's very, very damaging to people. Fraudsters also will coach people not to tell anybody. And that's the first mistake. That's precisely what they don't want you to do.

SM: All right. And as I said, we'll get into some of those tips a little bit later on. We're going to highlight a few specific scams that are going on now. Why are we highlighting these particular ones? The ones that you're going to talk about, are they new? Are they emerging? Are they the ones that you're seeing more often?

TM: Yeah, they are emerging. I mean, fraudsters are becoming more sophisticated and they're leveraging new technology to trick customers.

SM: Okay, that's actually a great segue to the first emerging scam we wanted to talk about today. How is artificial intelligence being used to scam people?  

TM: So, fraudsters are using AI to mimic voices. And these could be voices of your loved ones. These near-perfect clones are being used to scam parents or grandparents. This is why we call one of these scams a grandparent scam, because the fraudster is using the voice of a loved one in distress to tell you that they need money to be able to get them out of jail, for example, or to free them in some way.

SM: Wow, that's scary.

TM: Yeah, there's some commonality that we see in this scenario where a grandparent might be getting a call in the middle of the night. They're a bit groggy. It sounds like their grandchild, because the voice cloning is so close and there's urgency to it. It could be, ‘Grandma, I've been in a car accident. It may be my fault. I'm really worried about this. I've been out late. I need you to help me. Can you send some money to this account?’ Sometimes they'll even say, ‘Somebody's coming by to pick up the money. I need to do this. You know, I don't want to report this to the authorities. I don't want this to hit my insurance, Grandma. I'm a new driver.’

SM: Wow. So generally, I would guess they're taking audio that they found, like on a person's social media or elsewhere, because everybody uses that and they're putting themselves out there in various ways. They'll take that audio that they find on social media and then use AI to have it generate different messages than what they were saying in that audio. But using their voice or what sounds like their voice.

TM: That's right. There are easy sites now that people can go to to see how this works and that fraudsters are actually using to clone a voice.

SM: Right. So, it's becoming a lot easier to do? 

TM: Yes. 

SM: And then you have deepfakes. I guess that's doing a similar thing. But with video, right?

TM: Correct. Yeah. So deepfake videos, we've seen a fair number of these types of scams where a well-known person, a celebrity, is being used. It's a deepfake, but they're selling a product and somebody is lured in thinking that it's real, but it's really not.

SM: I see. So, they're using some famous person to make a fake video to entice a person to make an investment or buy a product or something like that.

TM: Yeah, that's right.

SM: So how do you protect against that? Like with the audio one that you're talking about, what you do hear about a lot, the sort of grandparent scam. And it's like, ‘Grandma, I've been arrested or been in an accident. You need to send me money right away.’ Are there methods that people can use to protect themselves ahead of time against that kind of thing?

TM: There are. I think, first of all, it's being aware. Another good tip is to proactively set up a secret word. The fraudster is not going to know the secret word. So, if you think you are on the phone with a grandchild, maybe ask what that secret word is something that only the two of you know and not something that could be found if a fraudster was to do some research on social media. So not a middle name as an example.

SM: Right. Okay. And I guess with the sort of video scams, you were talking about, the deepfakes. I mean, that's just a matter, I guess, again, of being skeptical of maybe not believing everything you see online.

TM: That’s right, the old adage: If it's too good to be true, it probably is.

SM: It probably is, right.

TM: Yep.

SM: And I understand that it’s not just deepfakes and voice cloning, but AI is also being used to sort of make existing scamming methods more effective, can you tell me a bit about that?

TM: Yeah. If I was to take out my phone right now, I could probably look through and find many different text messages that are phishing. In years before now, we would have seen grammatical errors, content errors, structure errors in the sentence. We would have said that's a dead giveaway. It's not right. Fraudsters are now using things like ChatGPT to make those texts much more believable. And people are clicking on them.

SM: Okay, so you get a text or an email or whatever. It's got a link in it, somehow it’s trying to induce you to click on the link. What happens when you click on the link?

TM: Well, sometimes when you click on a link, it takes you to a site that may look familiar, may not be entirely correct, but it might have enough in it that makes you think that it's right. Sometimes it can install malware on your device, which also is another mechanism for a fraudster to be able to see information.

SM: Okay. Alright, let's talk about the second emerging scam you wanted to highlight and that’s cryptocurrency scams. I hear that’s becoming more and more of an issue?  

TM: It is. Cryptocurrencies have gained popularity in recent years, both with investors and with scammers. Customers are being advised of an investment opportunity from someone either over the phone, on their computer or sometimes they're just scanning a social media site and they come across something that they think sounds like a good investment. Typically, these scammers are using high pressure tactics to get people to put their money into these investments. And usually, it's when they go to pull their money out that they realize that something's wrong. Either they aren't able to get their money out or this so-called investor goes quiet and they're unable to find them. And that's usually when they realize that they've been scammed.

SM: Right. Some of the cases that I've read about it really seems like the scammers invest a lot of time sometimes in developing a relationship with the person that they're targeting. They take their time working on these things.

TM: Sometimes they do, and they're willing to invest the time, particularly if they see they have a victim that's going to play along with them. We see this a lot in romance scams. It may take months to build that trust between two people, at which time they're starting to ask for money to be sent.

SM: Can you just remind us what a romance scam is?

TM: Yes, a romance scam is where a fraudster is building a relationship with someone, more or less convincing them that there is a real relationship, and over time asking them to send money. Lots of examples of this. If one was to watch Netflix, you'd see Tinder Swindler. You know, I just heard of an example the other day. I believe it was out of the U.S. where an individual thought he was in a relationship with a younger woman. He liquidated his retirement savings plan, sent all of it, went to a financial institution to take out a loan.

SM: Holy moly. 

TM: And that's when someone was able to convince them that this was likely a scam and that he should stop sending money.

SM: Wow. Is there any sense of whether these types of scams, these investment scams, cryptocurrency scams, romance scams, are they mostly coming from abroad? Are they being initiated within Canada? Do you have a sense of that?

TM: Yeah, it's hard to tell because so many times phone numbers are being spoofed, so you don't actually know where the individual is. They may be spoofing a bank number, for example. Hard to know where that's coming from. So, no, we don't actually know. I suspect that it could be from anywhere.

SM: Okay. I think that maybe brings us to the third scam we want to talk about, which is impersonation scams. I think spoofing is part of that. Can you tell me, what does that mean?

TM: Yeah. Impersonation is when someone is like an imposter. They're calling, they're pretending they're from a government agency or from a bank. And what makes these a difficult scam is that they often have one or two pieces of legitimate information that hooks the individual into thinking they must know something because they know this information. And they're usually calling to get you to provide additional detail. Could be personal information or financial information. What we see a lot of is they're calling to ask for the one-time passcode. Now, this is something people would be familiar with if they're logging into a bank account or they're doing a transaction. Most banks have this additional level of protection or authentication to confirm your identity. And threat actors know this. So, they're calling to say, ‘What is the code that you see pop up?’ At the same time, they're typing that code in in order to get access to your account. So, I think what makes the imposter scams so difficult is that they know something about you. And that's the hook.

SM: And how would they know those initial things about you? 

TM: Could be social media, could be data breaches. We've seen a number of data breaches over the last several years that have exposed data. 

SM: Right. So with the spoofing that often, as you said, it can be a financial institution, but sometimes your bank might actually be contacting you or communicating with you in some way for legitimate reasons. How do you tell the difference?

TM: Yeah, that's right. A bank may be calling you for a legitimate reason. It may be related to a transaction that you've recently done or a claim that you may have recently opened. The difference is a bank isn't going to ask you for confidential information like the one-time passcode, like your credit card number, or even the CVV, which is the three or four digits on the card that are meant to be a form of protection. They're not going to be asking you for that information. That's a clue. If ever in doubt, hang up and call back.

SM: Call the number on the back of the card.

TM: Call the number.

SM: So, when the bank’s calling you, they’re not going to ask for any of that personal information that you were just talking about. But if you call them, and you might have a reason to call the bank, then they might have a reason to ask for that stuff.  

TM: That's right. When you're calling the bank, you're calling for a particular reason. You may be asked for certain information. When the bank is calling you, you shouldn't be giving them those confidential details.

SM: Right. So, broadly speaking, we've talked about different types of scams. What are the main things that you tell people in order to try to avoid these really increasingly sophisticated scams? I mean, the scammers are always finding new ways to go beyond the precautions that people normally would try to take.

TM: Yeah, I think you always want to step back and decide before you act. So, take a moment. Certainly not going to hurt to pause before you take an action. I think this is a really great time to decide who are those 2 to 3 trusted people that you're going to call should you need to think something through.

SM: So that sounds like a really interesting idea, actually identifying a couple of people that would be the people that you should call, or your elderly parents, or kids should call if anything seems off. 

TM: Yeah, that's right. Having a few people that you know you can have the discussion with just gives you that opportunity to step back and step away from the situation. Like I say, it gives you that moment to be skeptical and say it out loud. And sometimes even just saying it out loud helps people realize that the details of this situation sound concerning. And often having somebody that you trust tell you that this might not be a good idea, or they've heard similar things that have turned out to be scams is enough to help somebody realize that they need to stop.

SM: Right. And you should just never be afraid to somebody talking to you on the phone say, "I'm not going to make a decision about that right now. I need to talk to some people. Call me back."

TM: Yes. That's right. You know, I remember during the health crisis, people weren't sitting around a dinner table having discussions as often. And folks were vulnerable. They were isolated and they were vulnerable. So, it certainly helps to reach out to, particularly elderly relatives, to let them know that they can call you if they're faced with one of these situations. And they're just not sure. You know, people want a level of independence, and they want to be able to decide for themselves. But I think if you just open that door up and put the offer out and they know that there's not judgment, that you're there to help. I do this a fair bit, I think, ‘What does my mother need to know today?’ So those are great proactive actions. All of the advice that we've been giving people over the years still stands. Monitor your accounts to see are there any transactions that you don't recognize? Stay informed about the latest scams. You know, we talked about some scams, those scams are going to continue to evolve. We have a great site for Scotiabank. It's located at scotiabank.com/security. That's a great place to just keep checking in to see what kind of scams are out there.

SM: Okay, so this is your whole job, right? 

TM: Yes. 

SM: Is it largely about education? Is it about how the bank internally is trying to combat these things? 

TM: Yep. All of that, plus looking at new tools. You know, banks have great tools to proactively prevent fraud from happening. So more and more, we're working with customers to identify whether a transaction is legitimate or not. We don't want to stop legitimate transactions. We want our customers to be able to transact without any barriers. And so, working with customers, messaging a customer to say, ‘Is this your transaction, yes or no?’ We're not asking you for details. We're just asking, is this your transaction, yes or no? And so looking at what tools we can put in place to make it seamless so that our customers can continue about their business without ever having to think about it.

SM: Right. And I imagine, much like the scammers, you are also using technology. Is AI one of the tools that you're using.

TM: It sure is. AI can be used for good as well.

SM: Right. What's the one thing you would like people to take away from this? 

TM: My message is you're not alone. There's lots of help. Ideally, you can put some proactive measures in place to protect yourself. But should you find yourself a victim, reach out. Report it. Get the help that you need. It really can have a very profound impact on people and reporting it may help stop the same action against somebody else.

SM: Okay, one more thing. If I ever call you and it sounds kind of fishy. Our secret word is rutabaga.

TM: Rutabaga? No one's going to guess that.

SM: Tammy, thanks so much for joining us today, really appreciate it.

TM: Thank you.

SM: I've been speaking with Tammy McKinnon. She is Senior Vice President of Fraud Management at Scotiabank.