Communications of the ACM

(SaaS), platform-as-a-service (PaaS) and infrastructure-as-a-service (IaaS) facilities to those physical networks. Understanding that complexity, adopt-ing a roadmap that reduces it, and removing the least secure parts (probably the old legacy systems) is one key to enhancing security, Thornton-Trump says. “If you know what ‘normal’ is, and what systems you need to protect, this would make anomaly detection far more effective.”

Bounty Hunters vs. Fraudsters

Still another way to defeat doppelgänger fraudsters is to harness the skills of crowdsourced ethical hackers, says Laurie Mercer, a security engineer with London-based Hack-erOne, a bug bounty firm that offers cash rewards to the more than 400,000 ethical hackers it has registered on its books. By probing corporate systems, they can help firms find the kind of vulnerabilities that let criminals plant their data-stealing bots.

“Online payment systems and e-commerce brands have sophisticated technology in place to prevent fraud, but humans can often outwit these technical controls. And, it takes a human to outwit a human,” Mercer says, suggesting his organization’s hacker army is the best way to unleash human intelligence against the fraudsters. He’s not alone: Goldman Sachs, the U.K. challenger bank Starling, and the Germany-based direct bank N26 are all financial organizations working with white-hat hackers to secure their digital assets. “Anyone who finds a security vulnerability on these companies’ assets can report them to the company, potentially earning a bounty,” Mercer says.

The human factor matters at another level, too, says Amanda Widdowson, cybersecurity champion at the Chartered Institute of Ergonomics & Human Factors in London, noting that the Genesis Store’s doppelgängers are more of a threat if they include login/password pairs, something people have the power to limit spilling to fraudsters.

“The temptation is to use the same, easy-to-remember and so easy-to-guess password for multiple applications.

The danger is, if one application is
compromised, our other applications
are also at risk. What’s needed is more
investment in alternative methods of
user validation such as biometrics—
face, iris, and fingerprint recognition—
to reduce reliance on limited human
memory capacity,” Widdowson says.

Kaspersky Lab agrees, urging that people use strong passwords, biometrics, and multi-factor authentication to keep the bots out. “People should be practicing safe cybersecurity habits, implementing the same methods they would to prevent any malware infection on their personal devices,” says Lozhkin.

Most importantly, he says, since the
doppelgängers were constructed via
botnets, “strong cooperation and quick
information sharing between cyber-
security vendors and law enforcement
agencies around the world will be key
to a fast shutdown of such services.”
For the future, however, the banking
and finance industry’s move to voice-
based account management servic-
es—following on the success of voice
assistants like Amazon’s Alexa, Google
Home, and Apple’s Siri—may end up
making them vulnerable to hack at-
tacks via deepfake audio. That might
add a voiceprint component to digital
doppelgängers, with heavy ramifica-
tions for services.

Indeed, the threat that fake AI-gen-
erated voices pose to humans, rather
than voice assistants, is already more
than apparent. In September, it
emerged that the CEO of a U.K.-based
energy company had been convinced
that he was talking on the phone to
his boss in Germany, who asked him
to make a $220,000 cash transfer to
Hungary, which he did. However,
his supposed superior was actually a
criminal using very convincing voice
synthesizer software that had been
trained to mimic every aspect of the
target’s voice, from his tonality to his
German accent. The money is lost.
Such attacks will force changes on
the payments industry. “Since the at-
tack surface of deepfakes is primarily
banking information and money trans-
fer functions, I believe we will see man-
datory holds for cash amounts over
certain levels, with additional autho-
rizations required to complete money
transfers,” says Thornton-Trump.

“Although this may impede business agility, the risk of being victimized by a multi-thousand- or multi-million-dollar fraud exceeds the inconvenience.”