PJ was used in a massive fraud campaign using artificial intelligence

The Judicial Police (PJ) today warned of an “intensive and massive” fraud campaign in which the PJ itself is being used to make fraudulent calls to trick citizens into transferring money into bank accounts.

At a press conference held at the SP headquarters in Lisbon, criminal investigation coordinator José Ribeiro of the National Unit for the Fight against Cybercrime and Technological Crime (UNC3T) highlighted the use of foreign criminal networks and artificial intelligence techniques to spread the campaign, which has already led to an “unusual number of complaints” to the institution.

“Our current concern is the ongoing campaign, which has seen thousands of phone calls being distributed en masse and has resulted in an unusual number of complaints. We received over a hundred last weekend alone,” the person in charge said, assuring that the SP is “working with operators” to identify these “spoofing” methods (falsifying identities to obtain data).

According to José Ribeiro, since the beginning of the year the SP has already opened around 2,000 investigations related to different types of computer fraud, such as the “Hello Dad, Hello Mom” campaigns, but emphasized the evolution of these criminal schemes and ensured that the SP has already developed “some methods to identify threats”, but suggested that it is “difficult to predict behavior” in this matter.

“The concern with these methods is the mass distribution of campaigns and the ability to directly contact victims with an almost personalized approach. They are developing customized attack and fraud models, conducting profile analysis and using artificial intelligence. Targeted methods are now being developed, and this case is frightening because it will bring us additional difficulties,” he emphasized.

Citizens are contacted, informed that their bank account is at risk or has been accessed unauthorizedly, and then forced to choose from several options, including speaking to a supposed PJ inspector who will tell them to transfer funds from their hold to supposedly secure accounts.

Criminal networks linked to foreign groups use national mobile phone numbers to make these contacts appear credible, creating, according to José Ribeiro, two types of victims: “phishing” victims who end up transferring money, and the real owners of the phone numbers who are unaware of the abuse.

“The fact that they belong to national numbers does not mean that they were made by the owners of these numbers. We want to warn the population that the appearance of a national number does not mean that it can be traced,” he said.

Jose Ribeiro explained that the owner of the number from which the fraudulent contact was made does not have a record on his mobile phone, since it only serves as a “mask” for international numbers of criminal networks, which often obtain these contacts through databases sold on the Internet.

The criminal investigation coordinator stressed that these calls are based on “recordings to capture the interest of a citizen” and are then developed with a real person using “social engineering methods” (psychologically manipulating people to perform certain actions, namely providing data or sending money). He also suggested that the SP is not yet aware of people who have suffered financial losses.

“There are always victims, there are always careless people. This campaign is much more intense and massive in terms of reaching citizens. With this campaign of ‘fake’ and artificial intelligence, we have found that the way to reach citizens is much faster,” he noted, concluding: “We should not demonize artificial intelligence, but the fact is that criminal groups are using artificial intelligence methods.”