What to Know About AI and Virtual Kidnapping Scams

As artificial intelligence (AI) advances, malicious actors have developed methods to exploit the technology for nefarious reasons. One way they have done so is by leveraging AI in virtual kidnapping schemes in which they use the tool to mimic the voice of a loved one, business partner or employee to make it sound like they have been kidnapped. A ransom demand may follow this.

Business owners must be aware of this threat and how criminals use it. This post provides more information on AI and virtual kidnapping scams and discusses strategies to prevent and respond to them.

What Is Virtual Kidnapping?

Virtual kidnapping is a deceptive tactic cyber criminals use to make an individual believe a loved one has been kidnapped. It seeks to take advantage of someone’s fear and panic by using technology to create a realistic illusion that an abduction occurred. The malicious actor typically aims to receive a ransom payment in exchange for the safety of the alleged kidnapping victim.

Common aspects of a virtual kidnapping include a perpetrator:

• identifying a virtual kidnapping victim and a close friend or relative of that virtual kidnapping victim;
• harvesting voice biometrics and other data regarding the virtual kidnapping victim from publicly available information or social media sites and using technology to make an audio file that sounds like the alleged victim is in distress;
• building an emotionally manipulative story to relay to the virtual kidnapping victim’s close friend or relative;
• calling the virtual kidnapping victim’s close friend or relative and using the story, data and artificially generated audio file to make it sound like the virtual kidnapping victim is in immediate danger;
• demanding ransom payment for the ensured safety or release of the virtual kidnapping victim; and
• covering their tracks by laundering any money received and deleting files related to the scheme.

How Is AI Used in Virtual Kidnapping Schemes?

Virtual kidnapping has evolved from relatively low-tech methods in which a perpetrator would spoof a phone number and then use it to call an alleged victim’s close friend or relative. They often used low-quality audio to trick their friend or relative into believing it was their loved one speaking.

As AI advances, criminals can use it to identify potential targets and create higher-tech virtual kidnapping schemes. In these situations, the malicious actor may use recordings of a victim’s voice they found online and manipulate it by using an AI voice cloning tool. This can make it sound like the victim is in distress and crying or asking for help in their voice. The criminal can then demand payment for release or threaten to harm the individual if no payment is made.

Criminals may use other editing tools to manipulate photos or videos to make the scheme appear more realistic. AI chatbots can use data about the victim to generate realistic conversations through AI natural language processing.

The resulting content, sometimes called deepfakes, is a growing concern as the technology becomes more available and advanced, and identifying the content as a forgery becomes increasingly difficult.

What Risks Do Businesses Face from Virtual Kidnapping?

Businesses must be aware of virtual kidnapping and its impact on their company and employees. Potential targets could include employees who travel frequently; it is challenging to communicate with them. Those with a high public profile who have data available for perpetrators to harvest are certainly at greater risk, as are executives whom criminals may view as being capable of paying a hefty ransom.

Not only can virtual kidnappings have significant financial impacts on a business due to the associated extortion and fraud, but they can also harm a company’s reputation if they don’t know how to handle those situations. Virtual kidnapping can lead to significant emotional and psychological distress for those involved, even though it turns out to be a scam.

How Can Businesses Prevent and Respond to Virtual Kidnapping Scams?

According to the FBI, virtual kidnapping schemes rely on speed and fear. Criminals know they have limited time to exact a ransom before the scam is unraveled.

While businesses should not outrightly dismiss the possibility that a kidnapping has taken place, they should take measures to prevent and respond to virtual kidnapping scenarios. Consider the following tips:

• Provide education. Enhanced awareness about virtual kidnappings can help employees prepare to recognize and handle these situations. Indications that a virtual kidnapping scheme may be taking place include the call coming from an unknown number, the caller creating a sense of urgency, and the caller demanding a ransom to be wired or sent digitally immediately.
• Be aware of what is posted online. Controlling what information is available online can reduce the data perpetrators can leverage in a virtual kidnapping scam. Posting information about upcoming travel should generally be avoided.
• Verify information. If an individual stays on the phone and suspects the caller is engaging in a virtual kidnapping scheme, they should ask questions only the alleged kidnap victim would know and avoid sharing their name or other additional information. Having a password can also be helpful in these scenarios, and if the alleged victim speaks, the individual should listen carefully to try and determine if it sounds legitimate.
• Try to contact the alleged victim. While on the phone, an individual can reach out via text or another method to try and contact the alleged victim. This can help establish if they are safe. Repeating the caller’s requests or telling them details are being written down can help buy time if needed.
• Develop a safety plan and implement robust security strategies. Businesses should have comprehensive safety, crisis management and emergency communication plans to help create order in a potentially chaotic situation. They should also implement security strategies and policies to minimize being targeted.
• Do not agree to pay a ransom. Paying a ransom can encourage the virtual kidnappers to repeat the scheme and fund their criminal activities. Paying a ransom in person can also be dangerous for the individual(s) delivering the money.
• Secure kidnap, ransom and extortion insurance. Adequate coverage can help offset the financial losses associated with a virtual kidnapping scheme, and some packages may include other benefits, such as kidnap negotiation services.

• Work with the authorities. The FBI or law enforcement can provide guidance on how to handle these situations. They should be alerted immediately if an actual kidnapping is suspected or if a virtual kidnapping scam is occurring.

Virtual Kidnapping Awareness and Preparation Are Key.

Unfortunately, AI technology advances have provided tools criminals can use to devise convincing virtual kidnapping schemes. By being aware of these situations, businesses can take steps to prevent and appropriately respond to them. For more risk management guidance, contact us today.

Related Reading: Understanding Common Types of Cyberattacks

The above information does not constitute advice. Always contact your insurance broker or trusted advisor for insurance-related questions.