How A.I. Is Helping Scams Blend In

Scams targeting small business owners is unfortunately nothing new. As we touched on our blog in a previous article, “73% of small businesses have suffered a cybersecurity attack in the past year”, and as the COO of Identity Resource Center said “the number of small businesses being attacked has grown tremendously over the past three years.”

However, the scams themselves are evolving at a rapid pace. Thanks to the explosion of accessibility to A.I. tools, scammers have gotten access to new ways to trick people into handing over their hard earned money. Scams have always changed and adapted with the times; from pop-ups saying you won a free iPad when you visited a site to sending fake messages and emails posing as services and companies such as UPS, Amazon, and FaceBook. However, now these scammers have started using A.I. to assist them in creating entirely fake companies and businesses to stand-in as.

We first found out about this next generation of scams from an article in 404 Media, where they reported on how the owner of popular digital newsletter Tedium, Ernie Smith, received a fraudulent copyright infringement notice from a law firm named “Commonwealth Legal”. It looked legit, however one thing stuck out: that instead of threatening a lawsuit or requesting the copyrighted material be taken down, they instead simply requested a “visible and clickable link” to their site.

In response to the apparent infringement notice and its unorthodox request for a link, Smith dug into the supposed firm, “Commonwealth Legal'', and found something odd. After scouring employment sites like LinkedIn, Attorney Databases, and performing reverse-image searches on the headshots of the "lawyers" on the site, the only results found on the web for any of the employees at this "firm" were from a now defunct website called "Generated.Photos", which as the article in 404 Media states offered a service to “use AI to generate people online that don’t exist, change clothing and modify face and body traits. Download generated people in different postures.”"

To add fuel to the fire, the address of the supposed "Commonwealth Legal" shows that the firm is apparently located on the fourth floor of a one story building with disconnected phone numbers. This inconsistency in location combined with the photos of its employees being associated with an A.I. Generative service leads us to believe that, no matter how crazy it sounds, this "Commonwealth Legal" doesn't really exist. But what is the point of this scam?

Simply put, building something called Backlinks. One of the many metrics that Google uses to decide which site(s) to give as results for a user's search query are backlinks, which in simple terms is how many other websites link back to your own, with more trusted or prevalent websites giving better quality backlinks. Think of it like Google's version of your friend giving you a restaurant recommendation, if a friend gives you a good review, you're more likely to trust that the food is good right? Same thing with Google. If a website Google already trusts "signs off" on another site by having a link to it, it raises its trust and reputation with Google and makes it more likely to recommend it as a result to users when they perform a Google search.

According to 404 Media, that was the moment Smith realized what was going on: "Smith realized that what’s happening here isn’t a copyright enforcement or copyright trolling attempt at all. Instead, it’s a backlink SEO scam, where a website owner tries to improve their Google ranking by asking, paying, or threatening someone to link to their website."

Although you as a small business owner may not be targeted specifically for a backlink scam, the main takeaway we aim for you to have from this article is that scams are getting more complex and deceiving than ever. Whereas before scammers used to impersonate real companies and platforms such as UPS, Amazon, and FaceBook, now with the advent and widespread use of A.I. technology scammers can pretend to be from entirely fake companies that never actually existed in the first place.

The best way to keep yourself safe is to always be skeptical when you receive a message or e-mail requesting either a specific action from you or sensitive information such as usernames, passwords, etc., even if the sender appears to be legitimate. You can also explore burgeoning online tools that help you detect the use or manipulation of A.I., such as Copyleaks for text or Reality Defender for images. These are just examples we found, there are a variety of different sites and companies who aim to help you parse when A.I. is being used.