KZ-CERT advisory on DeepFake-assisted bank video verification

Source record

KZ-CERT's 16 May 2024 advisory describes a fraud sequence in which an attacker records a bank customer's face during a messenger video call, uses the recorded material with DeepFake technology during bank video verification, changes the trusted phone number, authenticates through the changed number and transfers funds.

Read the original source ↗

Claim-level citations (4)

• supportsDeepfake-assisted bank video verification preceded trusted-number replacement: The reported sequence illustrates a high-impact recovery pivot: when successful video verification can authorize replacement of a trusted phone number, defeating that verification step can enable subsequent authentication through the newly trusted number.

  Reported sequence from DeepFake-assisted video verification through trusted-number replacement and authentication using the changed number

• supportsDeepfake-assisted bank video verification preceded trusted-number replacement: In the same KZ-CERT sequence, video verification was followed by changing the trusted phone number to the attacker's number, authenticating through the changed number and transferring funds to accounts controlled through third parties.

  Attack sequence bullets covering trusted-phone-number replacement, authorization through the changed number and subsequent transfer of funds to third-party accounts

• supportsDeepfake-assisted bank video verification preceded trusted-number replacement: KZ-CERT reported that an attacker recorded a bank customer's face during a messenger video call and then used the previously recorded material with DeepFake face substitution while confirming the customer's identity through bank video verification.

  Attack sequence beginning with the messenger video call and continuing through DeepFake face substitution, bank-application installation and customer identity confirmation by video verification

• supportsDeepfake-assisted bank video verification preceded trusted-number replacement: KZ-CERT specialists explicitly stated that DeepFake technology was used in the fraud type described by the advisory.

  Paragraph following the attack-sequence bullets in which KZ-CERT specialists state that DeepFake technology was used in this type of fraud