AI is transforming crime, too

0:00Okay, the story we're about to hear touches on the criminal dark web, cutting edge technology, and the global economy. But it begins somewhere more personal. Like anything, you know, it starts with my own anxiety. That is Cooper Katz-McKim, a producer for The Indicator from Planet Money and PR's daily economics podcast. There was this week-long period where I was opening up the news every day and there would just be some other data breach that was at the bottom. And it freaked me out. It freaked him out and he wanted to know, is this my imagination or is this problem getting worse? And when he dug into it, he found...

0:38The U.S. is on track for a record year in data breaches. Which a quick spin through NPR's newscast confirms. Cyber hackers have accessed the personal data of most of the 1.4 million customers of Alliance Lite. The Congressional Budget Office says it's been hit by a cyber attack partially disclosing government data to foreign banks. British department store Harrods... Cryptocurrency giant Coinbase says... I tried making a list at one point and it just got unwieldy. Hacked images were posted to the fringe right-wing message board 4chan. I mean, it's not just big businesses, though. The city of St.

1:12Paul in Minnesota is still recovering from a ransomware attack. It's local governments, it's schools, it's hospitals, it's government entities. So Cooper started looking into what is supercharging these hackers. And it turns out one big answer is artificial intelligence. They're faster, they're more opaque, and they're more autonomous than ever. Consider this. AI has made cyber criminals work easier, cheaper, and scalable. What does that mean for the rest of us?

1:44From NPR, I'm Elsa Chang.

1:54It's Consider This from NPR. Cooper Katz-McKim's question was, why does it seem like so many data breaches are happening? It opened a door into a whole world of modern vice. And just like the rest of the economy, it turns out that AI is really transforming the business of crime. Cooper and his colleagues at the Indicator podcast from NPR's Planet Money looked into this, and he's here with us now to talk all about it. Hey, Cooper. Hi, Elsa. Hey. Okay, so we mentioned that AI is kind of helping supercharge data breaches, right? Can you just explain how that's happening? Because it makes just about every aspect of data breaches easier.

2:34So let's say you're the type of criminal that wants a ton of passwords. You succeed and you find yourself with a million passwords. You've effectively just gotten a pile of keys. So generally, a criminal is very patient. They're willing to try every key in every metaphorical house in the neighborhood until it leads to something useful, say a bank account. Well, AI can automate that process and test which keys are useful way, way, way faster in hours rather than days. So it just makes them more efficient with less technical skill. And there's just suddenly a lot more access. Okay. So AI is enabling these criminals to better data scrape, data crunch.

3:12That makes sense. But I have to say when I first heard that AI crime is on the rise, I was imagining something a little sexier, like with a little more intrigue. Super sophisticated data collection just doesn't sound all that criminally sexy to me. Yeah. I mean, it is definitely used for more sophisticated crimes. You know, something like spear fishing, for example. Wait, like you're standing in a boat with a long spear ready to harpoon a fish? What? Not quite. It's like the metaphorical version of this. It's this targeted, personalized kind of cyber attack that goes after one individual. I asked Stuart Madnick about this.

3:54He's director of cybersecurity at MIT. That takes time and effort. Guess what? AI systems can do that splendidly, much faster, and in many cases, higher quality than humans could. Yeah. So imagine you're a criminal and you're trying to convince people you're this trusted person. Maybe it's their boss or their family member. You just need a lot of actual information to convince them of that. Maybe it's like the cadence of when they message you or how they talk. AI can help get all that information and make you more convincing as this spearfisher. So that's happening. And meanwhile, the criminal economic infrastructure is also advancing.

4:32So there's ready-made phishing kits that people can buy online too. Once I built a tool to do that, it's kind of easy to say for$10 ,000 or 50 % of the gain, here, I will give you this tool. So there's a multiplying effect going on on the bad guy world. There's this thing called SaaS, software as a service. It's the same kind of shtick, but this time for crime, where there's literally subscription tiers for some of these services. Okay, so let's say I'm a criminal and I want to go shopping. What are my options? Like, what is out there for me to buy? You have a lot more options than ever. You're in luck.

5:08There's ransomware as a service. You can literally rent banking malware kits, spam sending services. so one's ability to get into this world, the bar is very low. Like, I don't know if you've heard of DDoS attacks, but it's like this complicated cyber attack intended to bring down a site. People with no coding experience can now rent a kit for that and run them alone. So accessibility has just skyrocketed. Well, then how are companies trying to protect themselves from all of this? So we talked to a guy named Ben Coleman who's been looking at scams related specifically to voice cloning technology.

5:42He's the CEO of this startup called Reality Defender. He was telling me big companies like banks are paying them to protect themselves against scams and involve deepfakes because that's another use of AI to further crime. So, for example, fraudsters might call a bank using a deepfake of someone's voice and trying to break through the voice is my password protection. Wait, so how do you stop that? It's kind of funny. But what I learned was that AI itself is being used to fight AI. So Reality Defender has its own detection software utilizing artificial intelligence to identify these fake voices.

6:20So deepfakes are just so easy to do nowadays. Coleman doesn't even think banks should be using voice verification. It's too easy. Unfortunately, many institutions, not only banks, but also government organizations, insurance companies, media organizations, are still using what are called voice biometrics, which is a show of saying your voice is your password. Yeah. So why are banks still doing this? Good question. We spoke with Mark Kvapazeski at PNC Bank, and he basically said it's one piece of the puzzle. It's not the whole thing. I think if you're only using the one dimension, there's risk in everything.

6:53There'd be risk in accepting a driver's license, for example, somebody walking into your branch, which is why you're starting to see a lot more technologies that are looking for multi-factor authentication or even just those other signals. Other signals like where you're calling from, from what device, maybe a text verification code. But he says the bigger risk isn't just that banks will be targeted, but that customers will too. Targeting customers how exactly? So this is going back a little bit to what we were talking about earlier, where a fraudster might call you pretending to be this trusted person, like someone at your bank.

7:29They can spoof that number, pretend to be your bank, have all this information about you, and then say, hey, you've got to move your money quick. And it is almost a, it's a scam every time. The criminal calling might also pretend to be your child or grandparent. Jeez. Being in this part of the business I have with my family is essentially a safe word. And we all know if there's ever a situation where somebody is really in trouble and asking for money, it's consistent. We will ask for the safe word. That is such a great idea. I need to come up with a safe word. So, I mean, just listening to you talk, Cooper, it just seems like the range of potential vulnerabilities is huge.

8:12In this world where, you know, AI is cheap and totally accessible, it just feels like being a person in 2025 now requires a really high level of vigilance. Like, I'm stressed out just having this conversation with you. Yeah, I mean, that's the theme that came through in this reporting. AI has supercharged crime. It's made it easier. It's more accessible. It's more scalable. Just all barriers to entry have been torn down. And there's only so much an individual can do to protect themselves. Because, I mean, governments, businesses, academics, they need to work together, we heard from one expert, to assemble an actual solution.

8:47This piecemeal approach clearly isn't working. Stuart Madnick, who we heard earlier, expects things to get worse. Doesn't mean we're not going to try to hold back the tide, but the tide is rising against us. The tide is rising against us. That sounds so ominous. Yeah, I know. And we will leave it there on that ominous note. NPR's Cooper Katzmick Kim, he's a producer on the Indicator podcast from Planet Money. Thank you so much, Cooper. Thank you for having me. Additional reporting in this episode came from Darian Woods. And there's a lot more in the Indicator series on the evolution of crime. Check out the links in our episode notes.

9:24This episode was produced by Connor Donovan. It was edited by Kate Kincannon and Patrick Jaron Watanonik. with fact-checking by Sierra Juarez. Our executive producer is Sammy Yenigan.

9:38It's Consider This from NPR. I'm Elsa Chang.