Spotting online scams is a lot harder than it used to be. Gone are the days of the Nigerian princes, horribly written emails and obviously fake web addresses.
Cybercriminals are more sophisticated than ever. They’re creating emails and texts that look just like shipping notifications from major retailers, pleas from your real friends for financial help or a memo from your boss asking you to pay a past-due invoice.
That’s because there can be big money in a successful scam. According to the Federal Trade Commission, American consumers lost a reported $8.8 billion to scams in 2022.
Experts say the rise of artificial intelligence tools like ChatGPT just make things easier for scammers, who can use them to create massive amounts of highly customized and often well-written messages. In addition, the technology could be used to create so-called deepfakes, which attempt to mimic a person in audio or video form, making it look like they said or did something they didn’t.
Officials from one cybersecurity company say the solution to that rapidly growing problem may lie in AI as well. Norton, a longtime maker of consumer antivirus software, is rolling out Norton Genie, a new free app- and desktop-based tool that helps regular people spot scams and avoid getting snookered by them.
Genie, which launched in an early access form on Tuesday in both Apple’s app store and on Norton’s website, uses AI to quickly analyze the text, addresses, included links and other components of an email, text message, website or social media post to look for red flags that could indicate that it’s a scam.
Michal Pechoucek, chief technology officer for Gen, Norton’s parent company, said that in recent years attackers have shifted from attacking networks and devices to going after the people that use them with scams, phishing and social engineering attacks.
“And what we’ve seen with AI as a whole is it’s making those attacks more difficult to detect and more dangerous to users,” Pechoucek said in an interview.
As a result, he said it’s become necessary to fight AI with AI in order to protect consumers from current threats as well as those that will emerge in the future.
In this case, what the AI does is give users a relatively quick way to compare the contents of an email or text to the millions of samples collected by Norton’s consumer antivirus software and other cybersecurity operations. Based on what it finds, the AI could deem the email or text to be a likely scam or possibly suspicious. It’ll also provide the user advice on what to do next and give some insights as to why it thinks the email or text might be malicious.
While there are other consumer services out there that do the same thing, they don’t work in real time, instead doing the research by hand and giving consumers a response within 24 hours, said Sahil Pruthi, Gen’s principal product manager. But by then, he says, they’ve already generally made a decision as to whether they’re going to click on that potentially dangerous link or respond to a questionable email.
“If you think you’re being scammed you should not have to call your friend, your brother, you should be able to have that answer at your fingertips and within seconds,” Pruthi said.
While Genie may not be lightning fast just yet, it does largely get things right when it comes to spotting scams. I got a chance to play around with the app version of Genie for a few days before its launch. Like a lot of pre-release apps and software, it’s a little slow and buggy, but it largely got things right.
To check if a particular text or email is a scam, users can either cut and paste text or drop a screen shot into the Genie app. These are examples of a text that turned out to be a scam, as well as an email that Genie correctly flagged as safe.
A text sent to my personal phone informing me that my “debit card had been locked” was flagged as an advanced fee scam, which is where cybercriminals try to trick people into sending upfront money for fake products or services. Copy and pasted text of an email from a scammer pretending to be the Social Security Administration also was flagged as this kind of scam, as was a screenshot of an email from someone pretending to be a top antivirus provider.
On the flip side, screenshots of email ads sent to me by Amazon and Starbucks were correctly flagged as legitimate, as was a photo of a text message I received from Google letting me know that my password had just been changed.
The main hiccup involved an email that looked like a billing statement from my former cable provider. When I copied and pasted the text from the body of the email, Genie said there was “nothing suspicious.” But when I fed it a screen shot of the top of the email that included the sender’s email address (clearly not an official address for the cable company), it said it couldn’t advise me based on the text but that “it looks suspicious.”
Screenshots of other fake billing statements and shipping notifications also generated inconclusive responses of “it looks suspicious” or “not sure.”
Pruthi acknowledged that Genie isn’t perfect, at least not yet, but perfection is something that its creators continue to strive for. In addition, the AI will continue to grow more knowledgeable and accurate as it “learns” from the scam samples submitted by its users.
“We are slowly getting there,” he said, adding that currently Genie gets it right about 80[%] to 90% of the time. “And we are continuously training to get to 100%.”
