Shuman Ghosemajumder

How a $25 million deepfake scam reveals the dramatic stakes of cybercrime in the era of AI.

- 

Last year, a Hong Kong employee of Arup, a British engineering firm, got on a video call with the company’s chief financial officer and other colleagues. The U.K.-based CFO instructed the employee to transfer $25 million in a routine operation—and they did so. Only afterward did this person learn that they had not, in fact, been speaking with the CFO or any real colleagues, but instead with interactive, realistic deepfake simulations of them created by cybercriminals using artificial intelligence.

This sort of Mission: Impossiblestyle heist would have been completely unimaginable just a few years ago, but today it is a very real threat. Rob Greig, the CIO of Arup, said: “My understanding is this happens more frequently than a lot of people are led to believe. It’s that organizations choose to hide it.”

At a time when AI is being integrated into every industry and discipline, it’s no surprise that cybercriminals are taking advantage of it too. In fact, cybercriminals may be better positioned to leverage the current flavors of AI than the rest of us— and this has profound implications for how we think about cybersecurity today.

Most people are familiar with some basic principles of cybersecurity, such as choosing a strong password, making sure you don’t give personal information to companies you don’t trust, and not clicking on links that look suspicious. But this is a simplistic view that doesn’t address more sophisticated issues like the Arup incident (even if those practices are a good start). There is no single checklist to ensure appropriate cybersecurity for every business. Instead, there are multiple cybersecurity workstreams company leaders must identify and pursue. Here’s how to think about securing your company.