A little more than a year since the launch of ChatGPT, artificial intelligence chatbots — and the so-called prompt engineers that use them — have become trailblazers.
The trail being blazed, however, is not one of some hitherto-unrealized utopia, but of hyper-enhanced fraud, phishing and scams.
Verification platform Sumsub in November found a “10x increase in the number of deepfakes detected globally across all industries” between 2022 and 2023, highlighting a 1,740% surge in fraudulent deepfake incidents just in North America.
Cybersecurity experts have told TheStreet in recent weeks that AI text, image and audio generators supercharge the business of cybercrime by granting criminals unprecedented speed, specificity, personalization, scale and accuracy. Experts have said that the accessibility of these tools has ushered in a new era of fraud: identity hijacking, an evolution of identity theft in which individual personas can be easily recreated for malicious purposes.
Related: Deepfake program shows scary and destructive side of AI technology
Reported instances of a variety of levels of AI-generated fraud have spiked meanwhile, from deepfaked scam phone calls, to deepfaked images of Taylor Swift, to deepfaked video of senior company officers, to a deepfaked robocall of President Joe Biden that urged voters not to participate in the New Hampshire primary.
The latest iteration of AI-powered fraud, according to cybersecurity and data analysis company LexisNexis Risk Solutions, is all about taxes.
Related: Deepfake porn: It’s not just about Taylor Swift
What is AI tax fraud?
Tax fraud — the stealing of personally identifiable information (PII), including birth dates and social security numbers, to file a tax return in someone else’s name — is not a new phenomenon, Haywood Talcove, the CEO of LexisNexis’ Government group, told TheStreet.
Talcove said he and LexisNexis first alerted the Internal Revenue Service (IRS) to the scope of the problem back in 2010.
He said that the past 18 months have seen vast improvements in the capabilities and sophistication of AI tools, an acceleration that is moving “faster than government entities can put controls in place.”
The scam that Talcove is tracking on Telegram and dark web pages is simple: fraudsters obtain PII which they use to create fraudulent, but passable, driver’s licenses, purchasable through the dark web.
Some PII, such as social security numbers, can be stolen through phishing attacks, impersonation scams, malware attacks and data breaches. Such scams have been supercharged by AI. Other pieces of personal information that are needed to put together an accurate false ID can be found, in some cases, sitting on the internet.
“It’s very easy for me if I wanted to — and I won’t do it — to pretend I’m Ian. You’re a reporter. I Googled you before. There’s a ton of information about you; I think I kind of know when your birthday is; I clearly get a sense of where you were born,” Talcove said. “And I can go in and get a picture with my face on it, with your information and get through and then I can start filing taxes in your name.”
The licenses feature the scammer’s face, but the victim’s information. Using these fraudulent licenses, scammers can then log into or create an account at IRS.gov, which uses facial recognition — or a live video call with trusted referees — to cross-check the person logging in with the image featured on a given license.
Once in, the scammer uses AI tools to file a perfect-looking tax return that “has virtually no chance of getting audited,” according to Talcove. The scammer then enters their banking information and receives a fraudulent return.
AI is supercharging fraudsters in their attempts to file fraudulent tax returns.
TheStreet
Scammers won’t just do it at the IRS, Talcove said. “There’s 43 states across the country that have income taxes, and I’m going to insert you in every single state.”
It goes beyond taxes, as well — any agency that uses trusted referees to cross-check someone with a driver’s license is at risk of this same impersonation scam, according to Talcove.
More deep dives on AI:
OpenAI CEO Sam Altman says that ChatGPT is not the way to superintelligenceMajority of people are at odds with tech billionaires over one fundamental pointTo these U.S. veterans, AI is a tool that could help prevent mass shootings
The victim, he said, won’t even know about the fraudulent filing until they file their real tax return, at which point, they’ll “get a note back from the IRS and that note is gonna say, ‘I’m really sorry. You already got your refund.’ And there starts 16 to 18 months of hell for you,” as, until proven innocent, the IRS considers the victim the fraudster “since in all likelihood you owe them money, yet you (or someone using your name) received a refund.”
The notifications from states across the country, he said, will likely follow.
Talcove and LexisNexis have been tracking the scam on Telegram and the dark web; they are already seeing examples on the dark web — which TheStreet reviewed — of scammers boasting about the fraudulent tax refund checks they’ve received.
“We have no idea how widespread this is, and neither does the IRS — since from their perspective, no fraud has taken place,” LexisNexis said. “They just see ‘verified’ accounts submitting returns. It isn’t until the people whose identities were stolen actually go to file that anyone even realizes something has happened.”
“It’s not your street-level criminal,” Talcove said. “These are sophisticated, organized groups, some of which are domestic, but many of which are transnational in nature. And they’re taking advantage of technology and the use of online tools, and the lack of sophistication in government.”
What you can do to protect yourself
The best thing taxpayers can do to protect themselves against this brand of tax fraud, according to Talcove, is to file their taxes as early as possible.
“Whoever gets it in first is in the best position,” he said.
He also said that people must put in place multi-dimensional security checks. An IP address check or facial recognition — or a plain password — on its own is too easy to game. Talcove said that people must combine multiple security elements, including two-factor authentication, facial recognition, IP address checks, etc.
Talcove additionally suggested that government agencies using facial recognition should cross-check faces directly with the Department of Motor Vehicles’ database, for instance, rather than with a license, which, as proven by this scam, can be gamed.
AI news from across TheStreet:
New platform seeks to prevent Big Tech from stealing artMarc Benioff and Sam Altman at odds over core values of tech companiesSenate Judiciary Committee seeks to build new framework to rein in Big Tech
TheStreet contacted the IRS for comment, asking if the IRS is aware of the scam detailed by Talcove, if it is working on a solution to such a scam and if there is anything taxpayers can do to protect themselves.
An IRS spokesperson, declining comment and requesting not to be named, instead pointed TheStreet to several links regarding tax scams and fraud on IRS.gov.
Among these was a link to an IRS page detailing the agency’s identity protection PIN, a six-digit number that prevents someone else from filing a tax return in your name — even if they have your social security number.
Taxpayers must use a valid social security number or taxpayer identification number to apply for the pin, which the IRS called a “proactive step to protect yourself from tax-related identity theft.”
It is important to note that the IRS will never contact taxpayers by email, text or social media to request personal or financial information. The agency will likewise never call taxpayers with threats of lawsuits or arrests, or request identity protection PIN numbers via phone, email or text.
If a taxpayer suspects they are the victim of tax-related identity theft, the IRS recommends that the person respond immediately to any IRS notices, file an Identity Theft Affidavit and contact the agency for assistance.
Contact Ian with tips and AI stories via email, [email protected], or Signal 732-804-1223.
Related: IBM exec explains the difference between it and prominent AI competitors
