Scams get smarter as AI joins the con game

Namibians should approach every unexpected digital communication with suspicion, according to cyber-security specialists Rigo Reddig and Lian Aldrich, who warn that artificial intelligence is helping criminals make scams more convincing, personal and difficult to detect.

Reddig, head of information security at Grant Thornton Neuhaus, said romance scams remained “a long con”, but scammers could now use AI to construct a convincing personality around a false identity.

He said romance scammers might create excuses to prevent victims from meeting them in person while gradually asking for money. He advises reverse image searches of profile pictures and the use of AI detection programmes for images.

“AI-generated content, especially images, has a ‘fingerprint’ which isn’t actually meant for this – it’s supposed to be a way for their AI to detect AI-generated content so it doesn’t train on AI-generated work, but it’s useful in this case,” Reddig said.

Calls, scams and payment traps

“We’re running out of ways to warn people,” Reddig said.

He said scammers in Namibia were increasingly using calls tailored to specific targets, with AI-generated voice calls adding another layer of risk.

Criminals have also become adept at persuading people to use USSD codes – short codes entered on a mobile phone – to make payments without realising they are authorising a transaction. “They’re good at persuading you that you’re not making a payment,” Reddig said. “They have a script for every scenario.”

The scams are not limited to obviously suspicious messages. Fraudsters work from prepared scripts designed to overcome hesitation and reassure victims that a payment, instruction or code is harmless.

‘Everything is a scam’

Aldrich, co-founder of Aphotic Security, said the safest approach was to regard every message as fraudulent until proven otherwise. “Everything is a scam until proven otherwise,” he said.

This mirrors a “zero-trust” approach: distrust communications by default rather than trusting them until a warning sign appears. “The most sensible approach is to assume that literally every message is scamming you,” Aldrich said.

“I don’t like the idea of giving people a block list, because scammers are constantly coming up with new tactics,” he said.

A block-list approach attempts to identify and stop known threats, while an allow-list approach requires people to treat everything with suspicion except communications, people or services that have been specifically approved.

The latter, Aldrich said, reduces the advantage scammers gain by constantly inventing new approaches that have not yet been added to a block list.

Ask what the sender wants

Aldrich urged people to imagine “the most evil person in the world” when assessing a message, call or request.

The first question should be: “What do they want?”

A message may be completely harmless, he said, or it may be an attempt to provoke a particular response or extract information.

When someone asks for information, Aldrich advises people to reframe the request as though it came from a malicious actor and reassess whether any of the requested information could be used against them.

This may include seemingly harmless details such as the names of pets, account information or other personal details that could later make impersonation attempts more convincing.

Verify outside the channel

Both experts emphasised the importance of verifying requests independently rather than replying through the email address, number or link used in the suspicious communication.

Aldrich said people should verify information “out of channel”. In practice, that means using independently sourced contact details, such as calling a known number, visiting an official website directly or speaking to someone in person.

He also cautioned against relying on several apparent confirmations if they all originate from the same compromised source. Instead, people should seek independent confirmation rather than simply collecting more messages from the same channel.

“If multiple separate, trusted sources agree, the information is more likely to be reliable,” he said.

Opportunistic attackers

“Attackers are opportunistic,” Aldrich said. “They do not create vulnerabilities.”

For individuals, the experts’ advice is to pause before responding, assume a message may be deceptive, ask what the sender stands to gain, and verify independently before sharing information, entering a USSD code or sending money.

“Scammers are smart – much smarter than most people want to admit to themselves. But [the question of] if they’re getting smarter is more complex, though I do think new technology is enabling them more and allowing them to scale their operation,” Reddig warned.