Larry Magid: Voice cloning makes virtual kidnapping more convincing

Last week I wrote about a call I received claiming my wife had been kidnapped and demanding ransom. It came from a number that was nearly the same as my wife’s, began with a crying distraught woman, and as I explained in the column, the scammer used other tricks to make me think it might have been real. It was an extremely scary 20 minutes before I knew she was OK.

That column resulted in numerous emails, including some from readers who had similar experiences. One grandmother wrote, “A sobbing girl came on the phone claiming to be my teenage granddaughter and using her name. She said she had hit someone with her car and was in the police station. Said she was injured but didn’t want to tell her parents and get in trouble over the accident.”

But criminals are taking the scam even further by using AI to clone the voice of the supposed kidnapping victim to make the call even more convincing. As a Federal Trade Commission blog post explains, “A scammer could use AI to clone the voice of your loved one. All he needs is a short audio clip of your family member’s voice — which he could get from content posted online — and a voice-cloning program. When the scammer calls you, he’ll sound just like your loved one.”

CNN reported the case of Jennifer DeStefano who got a call from an unknown number, hearing what sounded exactly like her daughter Brianna saying “Mom, these bad men have me. Help me, help me.” DeStano told CNN “The voice sounded just like Brie’s, the inflection, everything.” The kidnapper demanded $1 million in ransom which he later reduced to $50,000.

DeStafano was around other people and had someone else call 911. In my case, I was alone but called 911 on the other line while putting my cell phone on speaker.  Like me, DeStafano figured out it as a scam and eventually got a call from her daughter who was fine. Neither she nor I paid any ransom, but many others have.

The Washington Post reported on another story where 39-year-old Benjamin Perkin’s “elderly parents lost thousands of dollars to a voice scam.” His parents got a call from someone claiming to be a lawyer saying Perkins was in jail for killing someone in a car accident and needed money for legal fees. “The voice sounded ‘close enough for my parents to truly believe they did speak with me,’” he told the Post. “In their state of panic, they rushed to several banks to get cash and sent the lawyer the money through a bitcoin terminal.”

Getting cheaper and easier

Voice cloning technology is getting cheaper and easier to use. Eleven Labs, which offers both free and paid voice cloning services, admitted on Twitter, “While we see our tech being overwhelmingly applied to positive use, we also see an increasing number of voice cloning misuse cases.” One of the company’s services is called “voice conversion,” which – according to a company blog post “lets you transform one person’s voice into another’s. It uses a process called voice cloning to encode the target voice and generate the same message spoken in a way which matches the target speaker’s identity but preserves the original intonation.”

The older voice cloning programs require 10 or more minutes of speech, but there are newer apps that can clone a voice based on a sample of as little as 30 seconds. Scammers can grab your voice by calling on the phone and getting you to speak for a short time, or perhaps from YouTube video or other social media posts. Many people – not just media personalities – have samples of their voices somewhere online.

Detecting virtual kidnapping scams

You may not be able to distinguish the cloned voice from the real person’s voice but there are things you can do if you get such a call:

• If another person is around, have them call 911 while you’re talking to the scammer. When it happened to me last week, I was alone, so I called 911 from my desk phone and let them hear the call through my cell phone’s speaker.
• Try to reach your loved one by calling them or having someone else call their phone as soon as possible. You can also try to reach friends or others who may be with them or know where they are.
• Ask to speak with the person they claimed was kidnapped and ask your loved one a question that they would know but the scammer wouldn’t like “where did we go on vacation last year” or “what kind of car does Uncle Joe drive.”
• Some families create code words that only family members would know.
• If it is a scam, they won’t put the person on the phone but still claim they have them so ask the alleged kidnapper to describe your loved one.

The FBI offers this additional advice:

• In most cases, the best course of action is to hang up the phone.
• If you do engage the caller, don’t call out your loved one’s name.
• Try to slow the situation down. Request to speak to your family member directly. Ask, “How do I know my loved one is okay?”
• Avoid sharing information about yourself or your family.
• Listen carefully to the voice of the alleged victim if they speak.
• To buy time, repeat the caller’s request and tell them you are writing down the demand, or tell the caller you need time to get things moving.
• Don’t agree to pay a ransom, by wire or in person. Delivering money in person can be dangerous.

To prepare in advance in case this happens:

• Discuss virtual kidnapping with family members now and before travel
• Don’t post news of upcoming or current travel and locations online
• Try to avoid having your phone number posted online
• Avoid having a recording of your voice online
• Say nothing or as little as possible to spam callers so they can’t record a voice sample.
• Avoid sharing personal details with people you don’t know. Scammers can use this information to make their claims more convincing or for other malicious purposes.
• If it’s OK with your loved ones, track their cell phone location on Google Maps, iCloud or other legitimate tracking services.
• If possible, make a mental or written note of what loved ones are wearing when they leave home and where they are going

Some of these tips are hard or even impossible to follow. Many people have good reasons to have their voice on YouTube and other sites. And it’s very difficult to keep your phone number and other personal information, including the names of family members, from the many people search sites on the internet. Most of the legitimate ones say they honor requests to remove your information and there are services, including one offered by Norton that will make the removal request for you, but this method is far from perfect.

As I pointed out in last week’s column, all calls like this can elicit a powerful emotional response that can impact your judgment. Knowing how these scams work and having a plan can help blunt that impact and, hopefully, prevent you from the anguish that I went through.

 

Larry Magid is a tech journalist and CEO of ConnectSafely.org.