Also sending this article to family members so they're aware of this kind of thing.
Once you secret is "said" apart, over technology, it could be considered compromát.
----
Maybe have your "secret" be about a particular vacation or time period, using a novel recollection dependingupon severity of each conversation.
He says it “feels like 007 stuff.” “AI will never trick me!”
We also have a duress code word, listed in the notes of that KeePass(ium) entry with the TOTP.
My guess is that my friend is listed on a company website as an executive, and scammers are using company pages to find targets worth spending money on. Scams like these aren’t free, but they’re cheap enough to cast wide nets. The nets are only going to get wider as AI becomes cheaper and more available.
Security by obscurity, as effective as it was, is coming to an end. AI enables scammers to spear phish indiscriminately.
A similar problem is emerging for photos and videos. We also soon need cryptographically signed devices in order to be used in journalism or to be admissible in court.
Otherwise we are going back 150 years where we depend on in-person communication and eyewitness accounts.
Scammers aren't looking to defeat or even challenge voice identification. They're looking for that one person who's having a bad day and is susceptible to getting tricked. All they need is to find that person to earn their quota for the day. They'd actually appreciate it if 99% of the population used Voice Supr-Sure-Auth 3000™ technology, because that would make it more efficient for them to reach the 1% who don't.
This is why the Nigerian prince emails have typos. They're not trying to convince you their email is authentic. They're trying to find the person who isn't sophisticated enough to think in terms of email authenticity.
More broadly, I think this an instance of how AI/Deep Learning is turning over technologies (photos, video, voice communications) we have come to rely upon, and for us to continue to rely upon, they will need to be radically reworked with security as a starting point, not an afterthought.
Wouldn't have helped in this case if the description of the events is accurate.
This scam wouldn't have been possible if the scammer couldn't easily look up someone's name, pay a few dollars, and see where they live, their phone numbers, email addresses, and family members. It's not as much of a problem in Europe because of the GDPR, but in France their government cybersecurity is nonexistant so everything has been breached repeatedly so it's the same effect.
It's insane this type of data broker hasn't been banned and why I will never register to vote.
Every piece of data you give away is a liability, not just for the services tracking you, which some people might defend, but for cybercrime and data breaches.
1. Dial random phone numbers.
2. When someone answers, play a recording saying "we've kidnapped your daughter."
3. If a live human voice responds, transfer to a live operator who plays a muffled, staged recording of a panicked generic-sounding female voice.
4. Continue standard pig-butchering script.
I doubt the caller ever said the daughter's name. I don't think AI voice cloning was used. These kind of criminals know how to prey on people's instincts. It's not by compiling databases of accurate personal information. It's by scaring people with emotional, exigent, and plausible circumstances.
Even if 999 of 1,000 these calls are not to English-speaking people with a daughter who kind of sounds like the voice on the recording, the 1,000th is profitable enough for the scheme to continue.
Facebook, Discord, and Twitter may sell "your data", but when they do, it's likely by selling distillations of their internal databases. (Or, of course, through vulnerabilities like the one the Cambridge Analytica Facebook app used.)
Small-ball Web sites like KGO, on the other hand, just get proposals from data aggregators to plop a snippet of HTML/JS on their site, and they get money for it. There's no control on the number of quality of them.
Big sites can't do that because they'd risk introducing serious vulnerabilities that would compromise accounts. No one has a KGO "account" to compromise. And the amount of revenue they'd provide is likely peanuts to someone like Facebook.
So: they're for revenue.
It’s rather high friction; you have to set it up in advance, and then read a six digit number over the phone. And I am not sure that it mitigates the threats… in this situation, I suspect it wouldn’t. It could even make the situation worse if the daughter is genuinely in trouble but can’t access the authenticator.
But I can’t think of a better solution. Any other ideas?