Background of computer code in blue, with three lock icons in foreground, the two outside locks blue and locked, the middle lock icon in red and unlocked
Background of computer code in blue, with three lock icons in foreground, the two outside locks blue and locked, the middle lock icon in red and unlocked

Fraud in the Age of AI: Breaking In through the Back Door

AI is making it faster and cheaper for more fraudsters to get through your safeguards

At a recent seminar hosted by First Financial Bank, leaders in cyber security and fraud protection discussed the ways that AI is changing the landscape.

In the age of AI, fraudsters aren’t just getting better, they’re getting better at extracting more money." – Panelist Isak Nti Asare, Co-Director of Cybersecurity and Global Policy Program at Indiana University Bloomington.

The Basics

At its core, AI is an information compiler and organizer. It combs through all the information available on the internet, then compiles and organizes it according to the prompt provided by its user — in this case, a fraudster.

How does this empower fraudsters? Think of your systems and passwords as the doors to your house. AI is a free and readily available tool that helps break into the house through an unsecured back door.

The Great (Hacking) Equalizer

Previously, fraudsters accessed accounts or funds using complex coding programs to crack passwords or detect system weaknesses. The hardware grew steadily more powerful, but fraudsters had to be either sophisticated computer hackers or criminal groups with the resources to hire hackers.

AI now allows anyone with access to the Internet to create programs that once required advanced technical skills and significant resources. Prompts for developing malware are freely available online, and new versions pop up faster than the FBI can remove them.

The risks, vulnerabilities, and protections are mostly the same for individuals and businesses. However, companies with confidential client data, financial information, and substantial assets are more likely to be a target.

The Next Steps

  • Unique passwords are more important than ever. There’s a reason why websites require a variety of characters for your password. According to Hive Systems1, an 8-character password of only numbers can be hacked in a maximum of 34 minutes, which one with numbers, upper and lowercase letters could take 141 years. Add a symbol to that, and it can take 373 years.
  • If an account is hacked, change your password everywhere. When hackers access information through a data breach, they hold onto that data indefinitely. Now your password is in their hands, so when they try to access new accounts, they don’t need to start from scratch; they can start with the known passwords they already stole. If that password is used for other accounts, your vulnerability increases exponentially. This is why you should never reuse passwords across accounts.
  • Save your passwords — and not on a sticky note. There are password manager apps and programs that create truly random passwords, encrypt them, and autofill your details when needed, even syncing across devices. You only need to remember one master password. Adding multi-factor authentication to your password manager adds an extra layer of protection.

Many web browsers can also save passwords for you. While not as secure as a separate password manager, if you unknowingly visit a fraudulent site the web browser won’t auto-populate your credentials — a key red flag that you should not log in.

The Final Step

With 76% of organizations experiencing attempted or actual fraud2, odds are high that an issue will arise. Clicking on a link, authorizing a fraudulent wire, logging into a scam website and revealing passwords — it happens, and it could happen to you. The key is to know what to do next.

Be Prepared: Fraud Incident Response Plans (IRPs).

The moment suspicious activity is detected it is imperative to isolate the threat.

  1. Disconnect any impacted programs or devices from your network to prevent spread. Alert your IT personnel.
  2. Scan your entire system to check for other compromised areas.
  3. Contact your banker and local law enforcement so that investigations can begin quickly. It is also recommended that you contact the FBI, as they maintain records of cybercrime patterns and trends to try to predict attacks and prevent them.

If you suspect you've been targeted by fraud, call the First Financial Bank Business Support Center (BSC) at 866.604.7964. Explore tips and information on how to prepare and protect yourself on our Commercial Fraud and Online Safety Resource Hub.