AI-Based Phishing Scams Are On The Rise This Valentine’s Day
Valentine's Day is typically associated with red roses, overpriced chocolates and soppy love cards. The more formidable side of the holiday however, are the love scams attacking dating apps.
Phishing attackers are now using AI and open-source intelligence (OSINT) to send personalised impersonation attacks of well-trusted brands followed by sextortion attacks, in an attempt to extort money from the victim.
Egress Threat Intelligence reports that Tinder is the most impersonated dating app, with a staggering 43% increase in attacks compared to the same period last year, and 53% of those attacks pretending to be sent by the brand. Across the board, Egress noted that men were targeted more, receiving 85% of attacks in comparison to 10% sent to females and 5% to other. The other sites receiving the most attacks are:
- Tinder (53.25%)
- Bumble (22.88%)
- Hinge (14.46%)
- thursday.com (5%)
- match.com (3.57%)
- Other dating apps, i.e. Zoosk, SilverSingles, ChristianMingle, JSwipe (0.84%)
The most common subject lines the Egress Threat Intelligence team identified when analysing the attacks included:
- Someone matched with you on Tinder!
- Want to spend valentines with me? Message me back!
- Feeling lonely this valentines? Download Bumble today
- Someone from <<INSERT LOCATION>> sent you a message on Tinder.
“Cupid is firing his arrows, and threat actors are lowering their phishing hooks. Valentine’s Day is a prime opportunity for cybercriminals to flex their social engineering muscles, and with 7% of all UK online adults using a dating app in the past year, there’s no wonder that we’re seeing a spike in dating app impersonation attacks,” says Jack Chapman, SVP of Threat Intelligence at Egress.
“AI can make impersonation attacks more personalised and convincing, particularly when cybercriminals use other social engineering tactics to exploit people’s emotional insecurities around Valentine’s Day. Interestingly, our data found that 85% of the target recipients were men, suggesting that cybercriminals believe they’re more vulnerable to romance-based attacks.”
Jack Chapman is an experienced cybersecurity expert and serves as SVP of Threat Intelligence at Egress, where he is tasked with deeply understanding the evolving cyber-threat landscape to remain one step ahead of cybercriminals. Leveraging these insights and his extensive R&D skillset, Chapman oversees the product development for Egress Defend, an inbound threat detection and prevention solution that mitigates all zero-day phishing attacks.
Prior to Egress, Chapman co-founded anti-phishing company Aquilai and served as their Chief Technology Officer, working closely with the UK’s intelligence and cyber agency GCHQ to develop cutting-edge product capabilities. Aquilai was acquired by Egress in 2021.
“The increase in these phishing scams also signals how threat actors are using multiple channels for malicious campaigns. Whether it be romance-based scams through email or directly within dating apps, it is important for individuals to be alert for attackers using fake profiles,” Chapman continues.
“One of the main telltale signs people can look out for to identify a dating app scam is when individuals send sudden, overly affectionate messages followed by requests for money or personal information. Caution should also be exercised with individuals who request to move the conversation to alternative instant messaging apps outside of the dating platform, as some of these can often be less secure, offering cybercriminals a perfect environment to continue their campaign. Vigilance must be practised for all email accounts; personal email addresses aren’t solely being targeted, as we’ve seen these attacks effectively executed via large numbers of business accounts.
“Love may be in the air, but cybercriminals are all around, and it’s crucial to remain vigilant to the opportunity Valentine’s Day offers for threat actors to launch advanced impersonation attacks.”
Love scams — where, how, and when?
Avast reports a rise in online dating scams worldwide, with Slovakia being the most impacted so far in 2024. The top 30 countries most impacted by dating scams so far in 2024 are:
- Slovakia
- Germany
- Hungary
- Denmark
- Belgium
- Czechia
- Luxembourg
- Austria
- Slovenia
- Poland
- Norway
- Switzerland
- Finland
- Sweden
- Netherlands
- France
- Portugal
- Malta
- Canada
- Tunisia
- Greece
- Serbia
- Croatia
- New Caledonia
- Estonia
- Lithuania
- United Kingdom
- Iceland
- Latvia
- Italy
Cequence Security, pioneer in API security and bot management, reports that in 2023, more than 660 million bot requests on popular dating apps were detected, with 28% spoofing an iPhone app.
“This Valentine's Day, love is in the air, but so are scammers targeting lonely hearts on dating apps and looking for ways to extort money,” says William Glazier, Director of Threat Research at Cequence
“Thanks to the recent advancements in AI, bad actors are now leaning on automation to scale their operations, increasingly exploiting APIs to get the accounts they need to continue their scams. While legitimate end users should always watch for red flags, organisations that develop and manage the social and dating applications where these scams occur must take the appropriate measures to curb this malicious activity.
“To combat romance fraudsters, dating sites and apps must find the perfect, long-term match to help protect their users from automated attacks. These organisations must adopt a holistic security strategy that protects their APIs at every lifecycle phase. This means treating API security and bot management as interconnected challenges, not separate issues solved by isolated teams. This combined approach involves identifying and registering all APIs, ensuring rigorous adherence to industry standards, and deploying advanced threat detection and mitigation tools to defend against attacks.”
Protecting your heart — and wallet
Despite The National Fraud Intelligence Bureau (NFIB) reports that £92m was lost to romance fraudsters in the UK alone for the financial year ending April 2023, it is possible to safely navigate the world of dating apps. Javvad Malik, lead security awareness advocate at KnowBe4, shares some advice for dating app users to stay safe when online dating.
"Valentine's Day. A time where love is in the air, florists work overtime, and restaurant tables are as scarce as a truthful politician. But as we're busy swiping right in hopes of finding that special someone, cybercriminals are swiping left...on your security. Heartbreak hits differently when it's your bank account that's been ghosted.
“Imagine this: you're online, and suddenly, you're in contact with an astronaut. Yes, a space-faring, rocket-riding, possibly tang-eating astronaut. They're alone, floating in space, and somehow, amidst their interstellar travels, they've fallen for you. The only thing standing in the way of your cosmic love story is a small issue of unpaid space parking tickets. Just a few thousand dollars should clear that right up.
“Sounds absurd how anyone could fall for that. But, it’s what happens somewhere almost everyday. Granted not with astronauts, but with a far-flung prince, a military hero in dire straits, or just an unusually attractive person stuck in a peculiar, money-solving bind, and you've got the makings of a classic romance scam.
- Keep your feet on the ground: If your online love interest’s story sounds like it was written by a committee of soap opera writers, it’s probably not legit.
- Money for nothing: Never send money or give out financial information.
- Reality check: Use reverse image searches on profile pictures. If your significant other is actually a stock photo model, it might be time to rethink your relationship.”
Whilst you can never guarantee that you’re safe from heart break when using dating apps, using these steps can help you stay safe from cyber attacks and keep Valentine’s Day about love, not loss.
**************
Make sure you check out the latest industry news and insights at Cyber Magazine and also sign up to our global conference series - Tech & AI LIVE 2024
**************
Cyber Magazine is a BizClik brand
*************
