Bay Area mom out thousands after scammers use AI to mimic daughter's voice

[dead]

This is why we need to prevent data breaches by not collecting the data in the first place as well as move to non-persistant identifiers for contacts. Nobody could scam you if you only used Signal usernames or SimpleX addresses because you just change them for each contact and they don't get breached because services don't ask for them.

This scam wouldn't have been possible if the scammer couldn't easily look up someone's name, pay a few dollars, and see where they live, their phone numbers, email addresses, and family members. It's not as much of a problem in Europe because of the GDPR, but in France their government cybersecurity is nonexistant so everything has been breached repeatedly so it's the same effect.

It's insane this type of data broker hasn't been banned and why I will never register to vote.

Every piece of data you give away is a liability, not just for the services tracking you, which some people might defend, but for cybercrime and data breaches.

TOTP can be used today to authenticate a couple to each other over an untrusted medium.

It’s rather high friction; you have to set it up in advance, and then read a six digit number over the phone. And I am not sure that it mitigates the threats… in this situation, I suspect it wouldn’t. It could even make the situation worse if the daughter is genuinely in trouble but can’t access the authenticator.

But I can’t think of a better solution. Any other ideas?

I didn't downvote you, but I suspect you're getting downvoted because your recommendations wouldn't address the actual threat described in the article. This is the process the scam likely used:

1. Dial random phone numbers.

2. When someone answers, play a recording saying "we've kidnapped your daughter."

3. If a live human voice responds, transfer to a live operator who plays a muffled, staged recording of a panicked generic-sounding female voice.

4. Continue standard pig-butchering script.

I doubt the caller ever said the daughter's name. I don't think AI voice cloning was used. These kind of criminals know how to prey on people's instincts. It's not by compiling databases of accurate personal information. It's by scaring people with emotional, exigent, and plausible circumstances.

Even if 999 of 1,000 these calls are not to English-speaking people with a daughter who kind of sounds like the voice on the recording, the 1,000th is profitable enough for the scheme to continue.

This scam has existed for decades, just hasn't used "AI" before to fake the voice. My grandma was often a target of scammers calling up and pretending to be her daughters or grandsons and wanting to get money out of her. She was luckily mentally quick enough to realise what was happening and hang up.