When even your ears can’t be trusted

This happened to me at a hotel in the United States last month. I was asleep when the phone in my room rang. The caller identified himself as the front desk manager and said there was a problem with my credit card number. He asked me to give it to him again.

I was barely awake. I said OK, then looked at the clock. It was 2:35 a.m. What hotel employee calls a guest at that hour? Yet the caller sounded exactly like the manager. I had stayed at the hotel for a week and ridden its shuttle with him every morning. I knew his husky voice and the distinctive rhythm of his speech.

I hesitated, and the pressure began. “If you don’t give me the information now, your stay will be canceled,” the caller said. I offered to bring my card downstairs. He told me I had to give him the number immediately or lose the offer of a free stay. After several minutes of arguing, I said I did not care and would come downstairs anyway. He hung up. I called the front desk and asked for the manager. The employee on duty asked if I had received a call asking for my card information. “Don’t worry about it,” he said. “I got one, too.”

The next morning, I told the manager that someone had called me using his voice. He was horrified. He said the same scam was happening at hotels across the United States. Criminals call hotels and record employees’ voices. They then use AI to recreate those voices and impersonate hotel staff. “What worries me most is that it’s my voice,” he said. “I’m afraid it could cause problems for me later.” The fact that the call came at 2:35 a.m. also made me wonder whether an international crime ring could be behind it.

AI-enabled crimes involving stolen voices and faces are becoming more sophisticated by the day. The victims are not limited to individuals. When criminals deceive employees who control corporate finances, the losses can be enormous. At one global engineering company, a finance employee joined what appeared to be a routine video meeting with colleagues and transferred more than $20 million at the request of the chief financial officer. The employee later discovered that every face and voice on the screen had been generated by AI. In another case, an overseas subsidiary transferred a large sum after receiving a call that sounded exactly like a senior executive at headquarters. Caller ID spoofing made the deception even harder to detect.

The technology is advancing at a startling pace. People in the tech industry say today’s AI voice-cloning systems can create convincing replicas from just a few dozen seconds of audio. The same is true of video. There is no shortage of material to work with, from personal videos posted on social media to CEOs speaking during conference calls. Anyone can become a target. For the first time in 25 years, the FBI this year listed AI as a separate category in its internet crime report.

After a recent AI-related hacking incident involving South Korea’s financial sector, the government sternly told companies to be fully prepared. But there is little reason for confidence when the government has neither an agency equipped to investigate AI-related crimes as they spread across industries nor laws specifically designed to address them.

Security experts recommend one basic rule: zero trust. If a call involves something important, assume it could be fake. Hang up and call back using a number you have verified yourself. We are entering a surreal new era in which even what we see and hear may no longer be trustworthy.