The simple security solutions are often the best
The wave of recent sophisticated phishing scams, often driven by AI and increasingly delivered in the guise of a support call from an account provider, shows no sign of slowing down. Could a simple popup be the weapon to fight back against the phone hackers that we have all been waiting for? Starling Bank thinks so.
AI Phone Phishing Attacks Target Bank Customers
I’ve been around computers and cybersecurity, on both sides of the hacking fence, across five decades now. Popups have been a hateful thing to be wiped off the face of the planet for much of that time. But with my sensible and calm security hat on, I might have to change my mind in the light of a new system to fight off the AI support scam hackers that has been introduced by one challenger bank.
I got an email from Starling Bank today, Nov. 08, warning me about fraudsters who pretend to be from support and call you on the phone with authority and knowledge. This reminded me of a recent viral article of mine, recounting how threat actors using an AI-driven deepfake Google support call almost fooled a professional cybersecurity consultant into giving up his Gmail credentials.
Whether the attack is powered by AI or a bunch of low-paid workers in an overseas criminal call center is, to be honest, by the by. The methodology used in these phishing attacks remains the same: pretend to be from an organization, say you are support, claim something has happened to your account and need you to enter your credentials on a linked site or over the phone. The aim is the same: get access to your account and use it to spread malware, garner sensitive data for further criminal activity, or drain it dry of funds.
The Starling Bank email assured me that sometimes the best solutions are simple, before explaining how one straightforward popup could save me from the hands of the AI phone hack scammers.
AI Phoney On The Phone? Starling Bank Has You Covered
If you get a phone call claiming to be from banking support, Starling said, “with our new app feature, they’ll be much easier to spot.” That’s because if someone from the bank really is calling you, then a popup will appear in the Starling Bank app itself confirming that it is them on the phone and even telling you the name of the support technician you are talking to.
A simple popup lets Starling Bank users know if a support call is genuine
You can check the Starling app while you are on your phone in conversation with someone by swiping up from the bottom of the screen to minimize your call without hanging up. If you get a popup informing you that “We aren’t calling you,” then you are advised to end the call immediately and dial the number shown to connect to the real bank staff to report this.
Starling Bank said that a message is also displayed in the app within the payments section that shows the last time the bank actually called you. Again, if you have been called by anyone at any other time then it’s likely this was a scam and you are advised to call the bank for help.
Jake Moore, global cybersecurity advisor at ESET and a former police head of digital forensics, told me that new and innovative techniques created to tackle scam phone calls will always be welcomed as they offer customers that much-needed confidence in the moment they are called. “However, scammers are equally innovative and will cleverly adapt to continue their craft,” Moore warned, “one particular way in which customers will need to remain mindful of is the clever way phone scammers can use manipulative social engineering to conjure up excuses as to why this new feature may not be working that day.” Starling Bank has already thought of this and advised customers in the email to ignore any such claims, hang up and report to the bank using the known telephone number.
“It may even be possible for cybercriminals to create their own fraudulent copy of the Starling app with a call status built in to act as a genuine call,” Moore said, “however, the advice remains the same, never entertain unsolicited calls and choose to call back on the number on the card for extra security that the person you are speaking to is legitimately from your bank.”
The takeaway is that AI scam attacks are clever and convincing, but a simple popup is all it takes to warn users that all is not right. Kudos to Starling Bank for introducing this scam protection, along with any other banks doing likewise.
