“I remember those emails back when I was graduating, some 20 years ago, from a purported Nigerian prince who was willing to send you part of his fortune, if only you gave him a few thousand euros first,” says Anna Wilbik, now a professor at the Faculty of Science and Engineering (FSE). “People fell for it then, too.” Which just goes to show, if scammers could be successful when sending a generic email to a complete stranger, what happens when they can send a personalised message that looks like it came from someone you know?
Because thanks to AI, that is increasingly the case. There are numerous examples: a fake text message from a son or daughter in need of some money in an emergency, a phone call from a fake police officer or bank employee about an insecure situation which requires you to transfer money to a ‘secure’ account, disclose login details, or hand over valuable items and bank cards to a ‘colleague’ in person.
Personalised messages
“Nowadays, scammers know a lot about their victims,” says Wilbik. “Just think about how much information people put on social media. But also on registers of places like the Chamber of Commerce.” AI can use that information to quickly and easily create thousands of ‘personalised’ messages, adds PhD researcher Spriha Joshi. “Or scammers use AI to make a situation look more realistic, by recreating entire websites, for example, or by creating deepfakes using the voice of someone you know.” It means people are more likely to fall for the scam, says Wilbik, referring to a report by the Central Bureau of Statistics, which showed that last year, one in six people in the Netherlands aged 15 years or older was the victim of cybercriminals.
At the same time, tracking down those cybercriminals is increasingly difficult. Not just because of a shortage of police manpower, says Frank Thuijsman, also a professor at the FSE. “But also because the perpetrator doesn’t have to be physically present, but can operate remotely, at home, somewhere far away. And can therefore target people in many different places at the same time.” Meanwhile, the police reports are still submitted regionally, says Joshi. “Often, detectives across the whole country investigate crimes, while being unaware that they involve the same perpetrator or organisation, or they don’t find that out until it’s much too late.”
Finding patterns
And that is where AI could come in handy. “AI is good at finding patterns, at making connections. It notices things that people might easily overlook,” says Thuijsman. It could be used to create a tool that analyses police reports from around the country and shows which cases might be connected, continues Wilbik. “It would make the police much more efficient and help solve more cases.”
It is precisely that sort of system Joshi is working on at the moment. Her PhD research – based partly at Maastricht and partly at the national police headquarters in Utrecht – is part of a collaboration that Thuijsman and Wilbik set up with the police two years ago. “At a BBQ, a member of the police force said they were looking for clever data scientists who had recently graduated,” says Thuijsman. “And I thought, why not set up a joint research project? That way, you’ll get a whole department working on it.” Thuijsman emphasises that the researchers at Maastricht don’t solve cases, but that they make it easier for detectives to solve them.
F-games
Not only by showing potential connections between cases, but also by giving more insight into how scammers operate online. That’s another thing AI is good at, says Joshi. “Revealing structures and networks. There are lots of different roles.” For example, there are the ‘clients’ or the people who make the initial contact with potential victims, but also the accomplices who physically collect victims’ bank cards or use them to withdraw large amounts of cash. “They’re often young people who have been recruited through social media, such as on TikTok, where it is presented as a sort of game, so-called ‘f-games’,” says Thuijsman. “They’ll earn some cash but might not always realise that what they’re doing is illegal.” There are also more and more “criminal services” popping up worldwide, says Joshi. “For example, agencies that send phishing emails for you, something you can just subscribe to like it’s Netflix. Those ‘companies’ sometimes even have actual call centres. Once you understand how everything is organised, you can pass that insight on to the detectives.”
Hide and seek
The three are unwilling to give examples of what information Joshi ‘feeds’ her AI tools so that they connect cases and reveal networks. “Cybercriminals are highly adaptable, so we don’t want to give them too much information,” says Wilbik. After all, investigating scammers is game of cat and mouse. “The time when you could use the same method of investigation for years has long since passed,” says Thuijsman. “Just look at the latest version of ChatGPT, it can do so much more than the last one. Criminals have more options every day. It’s a bit like playing hide and seek. Every time we get better at finding them, they try to get better at hiding again. If there were an easy solution, we’d have found it ages ago.”
It also serves as a warning, the researchers say. Scammers are getting smarter all the time, anybody can be taken in. “So, be careful, think about what you should look out for,” says Wilbik. And equally important, adds Joshi: “Never be embarrassed you were scammed, always report the crime. It also gives us more data we can use to create better models to track down the criminals.”