Businesses are being sucked into sophisticated AI fraud with ‘‘horror stories’’ extending to deepfake attacks using clone voices and faces in video conferencing calls.
Christchurch tech firm Lumin, founded by Max Ferguson, has released a Digital Identity in Business report after surveying 1000 business leaders in New Zealand, Australia and the United States.
More than half of New Zealand businesses were found to have fallen victim in the past year, with 67% increasing investment in identity verification over the next two years.
Initially a cloud-based PDF editor, Lumin has expanded to take on artificial intelligence and e-signature services in its document workflow services for businesses such as Airbnb, Netflix and Uber.
Most of the surveyed businesses were feeling vulnerable to fraud and worried about brand damage as AI-driven impersonation technology becomes more sophisticated and common.
Lumin said fraud stings were a growing threat to local jobs and supply chains as nearly 70% of businesses were afraid to work with partners who had been hacked.
The report found businesses believed their agreement workflows — processes used to sign, verify, and complete legally binding business contracts — were vulnerable to AI-powered fraud.
Chief commercial officer Joel Foster said fraud costs were even higher for some larger New Zealand companies hit by up to $4m.
‘‘There is cyber crime where people try to hack into systems and break through vulnerabilities in the systems themselves by people making simple mistakes by clicking on links or answering questions. But the deep fake technology is scary and you think you are talking to your boss and you are talking to an AI-generated image, and there are some real horror stories.’’
He said business boards convinced by deep fake visual and voice tech had transferred money after believing they had talked to their bosses.
Mr Foster said Lumin was using credential protection technology locked to the identity of business people so parties signing agreements and contracts could prove their identities and prevent fraudulent transactions from proceeding.
‘‘As they execute a document or perform a transaction and if they cannot provide the credential evidence as them then the system will stop.’’
Instead of operating a central data base — a fraud target — a decentralised digital trust model had different levels of secure identity verification such as passport-derived credentials.
The most common one being used globally was a digital driver’s licence which went into an online identity wallet.
Wallets storing credentials are installed once on a secure smartphone app or wallet holder to verify identity over many transactions.
Credentials can include proving someone is a director of a company.
Clever technology locks the document and unlocks it with the key of the credential of the user to confirm it has been signed by the right person and has not been tampered with by a fraudster.
Mr Foster said most business leaders were aware of the threat — because fraud was not new — and they had rules to check web addresses and avoid clicking on suspicious links and firewalls.
‘‘Where we go now though because of the sophistication is ... it’s now becoming crucial to find mechanisms that protect them.’’
Fraud was costly and created brand and reputational damage as businesses distanced themselves from victims of identity fraud, he said.
Mr Ferguson said he saw the reality of the threat every day, with scammers impersonating him to his staff and targeting accounts team with fake invoices.
‘‘AI has sharpened these fraud tactics to the point where they directly threaten the trust that keeps our business ecosystem interconnected and operating smoothly.’’
He said businesses needed to know fraud could strike any department and needed to address it at boardroom level.
Industries had to move beyond simply capturing a signature and shift towards verifying the person signing, he said.
‘‘By evolving how we secure identities now, we can protect our reputation and our future.’’
Cybersecurity investment lags behind Australia (82%) and the US (78%).
Many New Zealand firms supported the introduction of government-issued digital IDs to make identity verification easier.
