The explosive growth of artificial intelligence is not only fueling stock markets, but also turbocharging cybercrime, which had already been surging higher.
In 2024, the U.S. Federal Bureau of Investigation recorded almost 860,000 complaints of suspected cyber crime, resulting in estimated losses of US$16 billion, a 33% jump since 2023. North of the border, Canadians lost $638 million to fraud in 2024, and more than $2 billion since 2021.
Larry Zelvin, Executive Vice President and Head of Financial Crimes Unit at BMO Financial Group, has been tracking cybercrime for most of his career, including for the White House, the U.S. Department of Homeland Security and the Pentagon. Here are some of the trends he’s watching:
Are there any industries or groups that are more likely to be targeted by fraud?
Today, most of us have experienced some type of fraud, whether it’s on mobile devices or emails. But certain industries are more prone to fraud than others. For instance, financial service companies are targeted because they handle large sums of money, which is what fraudsters are after.
The healthcare and education industries are big targets as they hold critical, valuable information and continue to scale up their security posture. Industries with less developed security controls in place are the areas fraudsters are more likely to exploit.
What about individuals? Are high-net-worth families at greater risk to fraud?
High-net-worth and ultra-high-net-worth individuals are more attuned to spotting fraud, because they are heavily targeted. They also have resources that keep them informed of the latest trends and threat tactics. The most important thing is to be current on the emerging threats, because the threat landscape is changing almost by the millisecond.
How has the threat landscape evolved in the past year?
AI has been a game changer. It has not only lowered the bar for learning how to commit fraud, but it also allows fraudsters to do it at scale and with a higher degree of sophistication. It’s not hard to generate highly sophisticated, highly convincing emails and send them to people. Today, fraudsters are also using videos and phone calls (known as deepfakes) where someone can look and sound like an individual you trust such as a friend, family member or executive at your company – but it’s AI.
How can someone figure out if they are interacting with AI?
There are little signs that can help you identify if you’re interacting with an AI video. For instance, if AI says complex words like “supercalifragilisticexpialidocious,” the mouth movement may not seem natural. If someone is using AI to mask their identity – changing their voice and appearance in real time – ask the person to wave their hand across their face, as some weaker AI can’t keep up with the movement. Or you can ask a silly question, like “Hey, isn’t it great when you eat something really sour?” You and I would wonder what that person is talking about; we’d be confused. A natural human response would be “Excuse me?” to get clarification but AI might respond, “Yes, that is very good. I like it too.”
What are the first steps a business or individual can take if they’ve been a victim of cyber fraud?
The first thing to consider is whether there was a financial loss or not. If there was no financial loss, cease and desist and report it to the appropriate authorities. In Canada, it’s the Canadian Anti-Fraud Centre, jointly managed by the Royal Canadian Mounted Police, the Competition Bureau Canada, and the Ontario Provincial Police. In the United States, it’s the Federal Trade Commission. You may also want to talk to the local police. If there was a financial loss, go to your financial institution.
Time is of the essence. The sooner you report, the higher the probability of recovery. It’s not a guarantee, but the probability goes way up. Look across your other accounts to make sure that the fraud is not deeper than you thought. If you’re part of a business, get the word out so people are aware and can take precautions.
Raising awareness is essential, but people may be shy to admit they’ve clicked a suspicious link or opened a risky attachment. How do we foster a culture where people feel safe to speak up?
You have to understand that people are going to make mistakes. A lot of elderly and adolescents won’t report because they fear embarrassment or blame. Employees will feel the same way. I’ve worked in security my entire career and I will tell you that there are people who won’t speak up, even though they’re not guilty of anything, just because they’re afraid. We need to be more understanding of the complexity of these crimes and forgiving when the people we love are impacted.
How much should someone invest in cybersecurity?
You have to assess your own risk. Should you devote an hour of your day, every day, to thinking about fraud and security? No. But you have to do it on a periodic basis. If you’re a business or a family office, you should have experts come in and review your program and how you’re preparing and let them offer counsel.
If that bad day happens, even if that happens late at night or on the weekend, you should know who you are going to call, what you’re going to ask them to do, and what information they need.
QR code manipulation has been a type of fraud you’ve been talking about this year. What does that look like?
QR codes are an emerging threat – they are everywhere, and many assume they are safe. However, we should all be aware of the risks. By clicking on a fraudulent QR code, you could download malware that you may never see, and now all of a sudden, it’s copying and stealing all your information. That is one risk.
The second risk is that it will take you to a website. Let’s say you’re going to buy shoes and you get offered a 10% discount if you use a QR code, which is fraudulent. You end up going to a site created by fraudsters that can now look realistic with AI. But when you go to pay, you’re actually giving them your credit card information and they steal it.
You’ve got to be careful – emails and links are more prolific now than attachments, but attachments are still a threat you need to watch out for.
What’s the one piece of advice you give to everyone to lower their risk of fraud?
You have to understand how to slow down. If something seems suspicious, stop. There’s an old expression, if you see something, say something. It’s simple, but it stopped terrorist attacks; it made people safer. Another one said, stop, think, connect. It hasn’t quite resonated, but it really still holds true.
If you want to know more about the latest trends and ways you can help protect yourself or your business from cybercrime, visit our website at BMO.com/security.
CAVous êtes sur le site de B M O au Canada
