Alain Sanchez, EMEA CISO at Fortinet through fraudulent emails, malicious links and fabricated requests. Generative AI has significantly expanded these capabilities.
Voice cloning can reproduce an executive’ s speech patterns from publicly available recordings. Realtime video manipulation can create the appearance of a familiar colleague participating in a meeting. Synthetic identities can combine genuine personal information with fabricated credentials to establish apparently legitimate digital personas. The danger becomes more pronounced when these techniques are combined.
Haber highlights the convergence of deepfakes with business email compromise, where a fraudulent message can be reinforced by a seemingly authentic telephone call or video conference.“ The future of social engineering is not simply convincing someone to click a malicious link. It is convincing them that the threat actor is someone they already trust and if you build a fake persona, with multiple traits from within your organisation, that trust could be easily compromised.”
Alain Sanchez, EMEA CISO at Fortinet, points to high-profile fraud cases illustrating the financial consequences. In a reported 2020 case involving a UAE bank, criminals used a cloned executive voice and supporting correspondence to deceive a bank manager into authorising transfers worth approximately $ 35 million.
Four years later, a finance employee at engineering company Arup was deceived during a video conference in which multiple participants, including the apparent chief financial officer, were deepfake impersonations. The resulting fraud involved approximately $ 25 million.
For Sanchez, these incidents demonstrate that attackers increasingly combine multiple channels to create a convincing narrative.“ The most serious technique is the combination of all of them.”
The next development is automation. AI can help criminals research targets, personalise communications and conduct interactions at a scale that would previously have required considerable human effort.
Ram Narayanan, Country Manager, Check Point Software Technologies, Middle East, identifies AI-powered conversational attacks as an emerging concern. Check Point researchers have documented a service called ATHR that uses AI voice agents to conduct account-recovery conversations and obtain one-time passcodes.
Rather than simply sending fraudulent messages, attackers can increasingly automate the conversations required to compromise accounts.
The convergence of synthetic media, stolen credentials and trusted communication channels makes these attacks especially difficult to identify through conventional security awareness alone.
Financial services face a new identity challenge
The Middle East’ s financial services sector has undergone a significant digital transformation. Banking transactions, account opening and customer verification increasingly take place through smartphones rather than face-to-face interactions. This shift has improved convenience and accessibility but has also introduced new identity assurance challenges.
38 WWW. INTELLIGENTCISO. COM / MIDDLE-EAST