9 in 10 Americans have encountered a cyber scam as AI fuels fraud, Consumer Reports finds
Digital fraud is skyrocketing due to artificial intelligence, which is boosting criminals’ ability to separate Americans from their money, new research shows.
Cyberattacks and scams have targeted nine in 10 Americans, with 17% of consumers saying they’ve lost money to a digital security breach, according to a new report from Consumer Reports, Aspen Digital and the Global Cyber Alliance.
AI is lowering the barrier to carrying out scams that would previously have been costly or laborious, experts told CBS News. The tech is driving more data breaches because it allows scammers to quickly synthesize information, which they use to create personalized traps, experts told CBS News.
While leading frontier labs are warning about AI’s potential destructive capabilities, including the threats it might pose to all of humanity, some experts say such scenarios are unlikely to play out in the near term, if at all. But AI has already changed the nature of digital fraud, making consumers’ pocketbooks more vulnerable than they’ve ever been, experts told CBS News.
“People have stereotypes about who gets scammed, but it is truly everyone now, and AI is just going to accelerate that,” Stacey Higginbotham, a Consumer Reports cybersecurity fellow, told CBS News. “I don’t think we’ve seen even the beginning with the number and quality of scams reaching people.”
Consumer Reports, which polled nearly 5,000 U.S. adults in March and April, found that 90% had encountered a digital scam or cyberattack. A separate survey by the group shows that consumers are increasingly concerned about the safety of their personal data, including potential access by bad actors to their financial accounts.
“Nine in ten Americans have been targeted by a scam or cyberattack. That’s not a statistic, that’s almost everyone we serve,” Consumer Reports president and CEO Phil Radford said in a statement. “AI is making fraud faster, cheaper and more personal, and no one can outsmart that alone. Companies need to be held accountable. Governments need real guardrails. That’s the bar we’re setting – for ourselves and for them.”
Growing scale of cyber threats
The growing ubiquity of cyberattacks is a concern for even tech-savvy individuals, who tech experts said must upgrade their online defenses to keep their information private.
For example, even an individual wary of phishing emails, which often contain spelling errors and suspicious links, could fall victim to a much more sophisticated, AI-enabled scam that uses deepfake technology.
“When most people encounter scams, they are messages from people they don’t know,” Higginbotham said.
Armed with personal information obtained in a security breach, such as your physical address, a scammer could pose as a financial institution and offer you a tempting mortgage rate, for example.
“AI allows scammers to make better use of the personal data they have on consumers, and lowers the cost of reaching even more people with those personalized messages,” Higginbotham said.
She noted that one in every five scams includes some kind of customization, a share that’s expected to grow quickly.
“More data breaches mean there’s more personal information out there, and AI makes it easy to craft personalized messages,” she said.
The personalized nature of the scams is what makes bad actors more capable, experts said.
“Prior to AI, the level of effort required to personalize something was too great. You couldn’t personalize 50 phishing messages; it was too much work,” Colin Ferris, a cybersecurity expert at Silverfort, told CBS News.
Two-factor authentication is a must
Security measures, like some forms of multifactor authentication, that might once have seemed redundant or unnecessary are now essential, according to experts.
While personal precautions are necessary, they’re not sufficient, according to Brian Cute, president and CEO of the Global Cyber Alliance, who said in a statement that they “alone can’t stop the abuse coming from upstream via insecure routing and maliciously registered domain names.”
“Closing those gaps takes industry, government and philanthropy working together, and that collaboration is as essential to a safer Internet as any password or security patch,” he said.
The 9-second rule
One low-tech way to combat cyberattacks is to pause for a few seconds before clicking on, downloading or sharing a link. An initiative called Take9 encourages people to count for nine seconds before responding to suspicious texts or emails, prompting users to reset their bank passwords, for example.
