Nearly six months ago, we launched our Pindrop^Ⓡ Pulse^TM solution, a cutting-edge deepfake detection technology for our enterprise customers to help detect AI-generated voices in their call centers. Since then, we have collaborated with news organizations, governments, the music and entertainment industry, and corporate security teams to assess hundreds of suspected deepfakes. From AI-generated robocalls aimed at voter suppression to sophisticated smear campaigns, and from general misinformation in conflicts worldwide to attempts to distort public perception—each case underscores the critical need for robust deepfake detection mechanisms.

The implications of these deepfakes are profound: they threaten the integrity of news organizations, social media platforms, and elections worldwide. The potential for misinformation to sway public opinion and disrupt social order is a stark reality that we now face. 

In response to these grave threats, we’re thrilled to announce Pindrop^Ⓡ Pulse^TM Inspect in Preview, an Audio Deepfake Detection Solution to assist fact-checkers, misinformation experts, security departments, trust and safety teams, and social media platforms. As a forensics tool, Pindrop Pulse is designed to detect AI-generated speech in audio or video media, including both digital media (e.g., deepfakes on social media) and phone call media (e.g., voicemails). Users log into the web application, upload their media files, and within seconds, receive a determination on whether the content contains AI-generated speech. Additionally, users can integrate the Pindrop Pulse award-winning deepfake detection technology programmatically into their own workflows via our simple-to-use APIs.

A Rapidly Growing Problem

Simply stated, ‘deepfakes’ are AI-altered images, text, video, and audio files.

Specifically for speech, this means creating highly realistic audio clips that can convincingly mimic someone’s voice by training an AI-model from their publicly available speech. 

This problem is growing for several reasons. First, the technology has advanced so significantly that the quality of synthetic speech is remarkably high. Second, commercial platforms offering these services have become incredibly affordable. And, the number of available tools for deepfake creation, i.e. Text-to-Speech (TTS) and Speech-to-Speech (STS) have exploded over the past two years that there are now close to 2000 open source Text-to-Speech tools on Huggingface alone.

Humans are notoriously bad at detecting deepfakes. In a study, humans were only able to detect fake audio 54.5% of the time, and in the real world, distinguishing between genuine and fake audio is even more challenging. Scammers who are creating these deepfakes are becoming increasingly sophisticated, often adding background noise or music, or using very short clips of speech to make detection more challenging. These fraudsters are continuously evolving their techniques, making it imperative for us to stay one step ahead in the fight against misinformation.

Over the past 13 years, Pindrop has built a platform based on real-time analysis of +5 billion audio interactions. We have over 270+ patents on voice and security, and 25 patents on audio deepfake detection alone. Today, we’re proud to package our experience and technology into a tool that helps combat the most deceptive audio deepfakes, particularly for the news media or organizations that rely on the accuracy of their content to maintain customer trust and the credibility of their organization.

Good AI to Fight Bad AI in the Media

Pindrop has partnered with some of the market and technology leaders fighting misinformation online. For example, TrueMedia.org was among the first adopters to test our solution in their workflows and reported that the Pindrop Pulse audio deepfake detection had better accuracy than other alternatives in detecting synthetic speech. 

According to Oren Etzioni, CEO of TrueMedia.org,“TrueMedia.org is a non-profit, non-partisan AI project to fight disinformation in political campaigns by identifying manipulated media. Our comprehensive evaluation found Pindrop’s audio deepfake detection has better accuracy than other alternatives in detecting synthetic speech. We are excited to partner with Pindrop in this mission, and add Pindrop’s deepfake detection technology in the solution for our customers and users across the world.”

Pulse Inspect offers trust and safety teams a forensics tool to enhance their disinformation detection workflows.

• Best-in-class Performance: Pindrop has trained its deepfake detection model on over 370 deepfake generation tools with over 20M statements (both genuine and synthetic), enabling us to achieve over 99% accuracy against previously seen deepfake models and 90% of “zero-day” attacks that use new or previously unseen tools. We’ve also had third parties confirm that our solution had over 40 percentage points higher accuracy than competing solutions on audio. 
• Resilience: News and social media are global businesses and need support to detect deepfakes across various languages. Pindrop^Ⓡ Pulse^TM Inspect is language agnostic and its underlying training models have been tested and validated on over 40 languages that cover over 90% of the internet’s spoken languages. This technology offers resilience to adversarial attacks such as addition of noise, reverberance or speech changes. 
• Breadth of Audio: The same Pindrop Pulse technology that identifies over a million social engineering attempts in the call center has now expanded to digital media. Pulse Inspect supports both phone call audio (8kHz) and high-fidelity social media audio (44.1kHz). It also provides detection capabilities irrespective of whether synthetic speech is created using text to speech, speech to speech or voice conversion techniques.
• Video Support: Pulse Inspect supports audio deepfake detection in videos. The platform analyzes video files for AI-generated speech by extracting audio content out of video media types. 

Explainability: Pulse Inspect offers segmental analysis of uploaded media to aid in the detection of partial deepfakes. This feature provides a visual indicator to users to help determine which segment in a long-form media file is synthetically generated vs. segments which most likely do not contain synthetic speech.

Free trial

With Pulse Inspect in Preview, we invite those who are responsible for identifying and reporting on deepfakes to evaluate our technology, at no cost.

Request access to a free trial here.

1. https://www.pindrop.com/blog/pindrop-named-a-winner-in-the-ftc-voice-cloning-challenge
2. https://synthical.com/article/c51439ac-a6ad-4b8d-82ed-13cf98040c7e
3. https://www.pindrop.com/blog/exposing-the-truth-about-zero-day-deepfake-attacks-metas-voicebox-case-study
4. In the NPR study, Pindrop detected 81 out of possible 84 (96.4%) voice samples correctly, compared to the nearest competitor who detected 47 out of 84 (56% – excludes samples identified as inconclusive).
5. Statista: Languages most frequently used for web content as of January 2024
6. Terms and conditions apply.

Over the last few years contact center managers started putting more emphasis on the importance of agent satisfaction with executives ready to spend money to improve it. At the same time though, with the added impact of COVID-19, agent attrition rates got worryingly high. RingCentral’s 2022 Agent Experience Report includes a research piece where 66% of respondents indicated that attrition had increased over the past two years. As a matter of fact, one of the biggest staffing problems that call centers face today has been the staff turnover even dating back to 2015 and earlier.

Compounding this agent attrition problem are the increasing costs of hiring, training, and retaining agents. Per Ryan Strategic Advisory, this is a disturbing situation for contact centers, considering the impact that the vicious cycle of agent churn has on customer experience. When agents are unhappy in their jobs and frustrated with their work, these feelings may bleed into the interactions they have with customers. They may be less willing to go the extra mile for customers, quicker to lose patience with callers, and less invested in the customers’ satisfaction. It only takes one negative experience to lose business with 51% of consumers, so one unhappy agent can quickly create significant losses.

Impact of COVID-19 on Agent Satisfaction

With businesses laser-focused on customer experience, far too often the needs of agents get overlooked. This prolonged neglect has now led to a point where more radical changes may be required to see results, especially after the impact of COVID-19. Industry analyst Kate Nasser believes that COVID-19 tasked call center agents with having to sustain others, including callers and their coworkers, while being likely worried about their own safety and families. The agents who suffered personal losses may have struggled to maintain their daily responsibilities, even questioning if they want to stay in the contact center industry any longer.

Agent Empowerment: The Overlooked Key

Rather than just relying on performance metrics, it’s important to look for direct feedback from agents. It is helpful for leaders to compare customers’ feedback against the agents’ own to close perception gaps, and uncover more relevant next steps for empowerment. Tools that help agents self-monitor and communicate with managers as needed, mean that vital feedback can be gathered while it is still fresh.

It is this empowerment that makes for more engaged, effective agents which will lead to more ownership of work. That way, the supervisors will have a little more time to pay attention to agents’ needs rather than just handling escalations. This inclusive, engaging, lower stress and team based environment will help the agents see their average handle times drop and the customers’ satisfaction to increase.

Pindrop’s Authentication Solution Impacting Agent Satisfaction

Pindrop’s voice technology is innovating customer experiences by combining the ease and security of voice authentication to make accessing your digital world more human. Pindrop uses passive technology to reduce average handle time, increase IVR containment, and improve the customer experience in your contact center.

Organizations utilize Pindrop’s solution to authenticate genuine customers, improve customer experience and help keep customer accounts safe. But the benefits they see are not only limited to those factors – there is one more: improved agent satisfaction.

Agents value ownership and belonging above all else. Pindrop’s authentication solution makes agents feel empowered to help the customers because agents are confident that the customers are authenticated. In a recent case study developed with one of its customers from the banking industry, Pindrop realized that, within eight weeks of implementing the Pindrop solution, the Bank started receiving great feedback from its own call center team members with almost three-quarters of those expressing a high satisfaction.

In fact, one of the Bank’s call center agents stated:

“I was ECSTATIC when Pindrop rolled out. It not only decreased MY Average Handle Time and Hold Time, but it also made the customers less cautious of all the information we were asking them when we were doing the 7 Step Verification process. This helped me greatly improve my Scorecard and my 5-Star Incentive each quarter.  Our customers noticed a decrease in hold times which they greatly appreciated and they were much more comfortable with answering less questions. Lastly, Pindrop has decreased the number of fraudsters who were getting past our normal verification process and is greatly protecting the Contact Centers assets. What a BLESSING!”

Customer authentication in the contact center today is a time consuming and clunky experience. But when done the right way, it can increase agent happiness and throughput.

Are you ready to authenticate better?

Fraudsters thrive during periods of chaos and uncertainty. Any disruption to the status quo provides an opportunity to seize sensitive consumer data and leverage it against individuals and their financial institutions.

Significant increases in phone, text and email phishing are enabling fraudsters to take advantage of the current financial uncertainty and public health concerns. Access to personal information leads to validating the data with targeted institution’s own customer services tools, mainly through contact center agents directly, or through the automated interactive voice response systems. 

With verified account numbers and some basic information, a fraudster has all they need to execute fraud through the phone channel using convincing scripts involving the current crisis to socially engineer contact center agents and individuals.  

Scammers are using new versions of old tactics to leverage times of uncertainty, fear and heightened emotion to expose individuals and contact centers to an increase in fraud incidents.
Today’s post will be a brief look at the tactics fraudsters have been using in the current climate of uncertainty. 

The New Fraud Scripts

In “normal” times, a fraudster’s script may have read something like this: 

I’m going to be traveling overseas, please lift any fraud monitoring for me for two weeks because I’ll be out of the country and don’t want my card blocked.
Or, a different angle: 

I’m leaving for a three-week vacation and I need you to wire me money as I want to have plenty of cash-on-hand for expenses and incidentals.

But times have changed, and just as fraudsters’ tactics are constantly evolving to meet the security measures to stop them, the same holds true for the scripts they’re currently adapting to profit from public fears and panic. By the middle of April, the FTC had already logged over 8,000 fraud reports with reported losses that total nearly $5 million.

Here are four categories of current fraud tactics to be on the lookout for, including examples of the most common “scripts” we’re hearing reported by contact center agents and fraud analysts around the country.

Travel-Related Inconveniences and Emergencies 

Many of the most common scripts involve appeals for emergency financial assistance due to travel restrictions and guidelines set forth by the federal and state government. One narrative that we’re hearing from a number of agents involves fraudsters claiming to be stuck outside the country. It sounds something like:

I left the country over a month ago and don’t even know when I’m going to be allowed to come home. This is an emergency. I need you to wire me money because of the travel restrictions from this pandemic, or make an immediate ACH transfer, now.

There’s typically a sense of urgency, as fraudsters are aware of the high call volumes that agents and analysts are currently contending with. Armed with the consumer data they’ve acquired from a vast increase in phishing scams, fraudsters are primed to scam the contact center and take advantage of agents who are attempting to assist people in genuine need.

Caretaker Fraud

What is an agent supposed to do when a scammer calls in frantically asserting that a person they’re caring for is in dire need of financial assistance to pay for emergency medical bills?

I’m calling on behalf of Mrs. Smith, who’s in the hospital right now with complications due to COVID-19. She’s isolated from her immediate family, who live out-of-state, and she has asked me to help her get access to the funds she badly needs for bills, rent and everything else. I’m the only person she has access to and I’m the only one that can help her.

There has been a marked increase in fraudulent activity targeting the elderly. In an attempt to stay on top of important financial and health updates, seniors may inadvertently click on a scammer’s link and make their private financial data and login credentials vulnerable, which fraudsters then use to gain access to their banks, insurance companies, mortgage lenders, credit card issuers, and more.

Send Me a New Card / Raise Spending Limit

The current public health crisis has reverberated throughout financial markets, leading to an unprecedented number of unemployment claims in the past month, opening both individuals and FI’s to the associated scams that prey on peoples’ financial panic.

A red flag should go up for any direct requests for a new card or increased spending limit. Fraudsters aren’t calling in to set up payment plans or request payment forbearances. Rather, they’re attempting to scam the contact center with urgent messages about how the current pandemic has put them in a position where they need access to more of their money, and right now.

I lost my job due to all this craziness. At first, I worked from home but was laid off a month ago and I’m still waiting on the loan assistance and unemployment I filed for. I’m facing eviction, can’t afford groceries and need to feed my kids. I really need you to raise the spending limit on my card.

 -or-

I’m quarantined at my parents’ house in Michigan and all of my credit cards, not to mention everything else I own, are back at my apartment in New York. I need you to send me a new card. I was also furloughed, so please increase the limit on the card so I can bridge the gap until I receive unemployment.

Financial Surrogate Scams 

Finally, fraudsters are targeting some of the largest financial institutions by gathering consumer data with mobile and email scams that claim an individual’s account has been compromised. Unwitting people concerned about their financial security click on bad links, providing sensitive information to fraudsters who turn around and use it to drain their bank accounts and max out their credit cards acting as financial surrogates.

I have legal power of attorney for Mr. Johnson, who is gravely ill and in no position to speak to anyone in person, let alone over the phone. He has medical bills to pay. Please wire money / make a direct ACH deposit into this other account.

Even as most people are rallying together to get through the current challenges facing our world, bad actors are attempting to exploit vulnerabilities and capitalize on the uncertainty of the time. Contact centers should be on alert as fraudsters continue to adapt their tricks and tactics, appeal to emotions, and convey urgency to carry out their scams.

Pindrop Protect’s anti-fraud solution arms your fraud team with predictive analytics, machine-learning, and productivity saving accuracy. The technology allows you to identify fraudulent cross-channel activity — often before it occurs, utilize enhanced IVR monitoring capabilities, and stop potential phone fraud in real-time. To learn more about Pindrop® Protect, check out our on-demand webinar on Pindrop Pulse.

Researchers have found that a vulnerability in Android that allows attackers to trick users into granting apps elevated privileges affects more devices than had originally been thought–nearly 96 percent of all Android devices.
The vulnerability is not a typical bug. It relies on some user interaction and lies in the way that Android allows apps to draw over one another. Using that ability, an attacker can overlay an app on top of the Accessibility Services app in Android and trick the user into making a series of clicks that grants the app a broad range of advanced permissions. The attack is a variety of the old clickjacking technique used in desktop browsers, and researchers at Skycure discovered that 95.4 percent of Android devices are vulnerable to a mobile clickjacking technique.
The researchers disclosed the original problem in March during the RSA Conference, but said Tuesday that they’ve now confirmed that it works on devices running Marshmallow, as well as older devices. The target of the attack is the Accessibility Services portion of Android, a feature of the OS that is designed to help users with disabilities interact with a device. Many of those services have very powerful permissions, and can take a variety of actions on behalf of the user.
https://youtu.be/4cSRq7_Z26s
“Recognizing this potential, starting with Lollipop (5.x), Google added additional protection to the final ‘OK’ button that would grant these accessibility permissions. In other words, Android programmers wanted to make sure that if a user was going to turn on Accessibility Services, the OK button could not be covered by an overlay, and the user would be sure to know what they are allowing,” Yair Amit, CTO of Skycure wrote in a post explaining the issue.
However, Skycure found that by overlaying another app on top of the Accessibility Services screen–a behavior that is part of Android’s design–an attacker could guide a victim through the process of granting the malicious app high privileges by clicking on various parts of the app. Those clicks go through the overlaid app and press the OK button in the Accessibility Services app.
“Accessibility Clickjacking can allow malicious applications to access all text-based sensitive information on an infected Android device, as well as take automated actions via other apps or the operating system, without the victim’s consent. This would include all personal and work emails, SMS messages, data from messaging apps, sensitive data on business applications such as CRM software, marketing automation software and more,” Amit said in the original post on the issue.
Sky cure disclosed the vulnerability to Google, which controls the Android code base, before its initial public discussion of it in March, but the company is not going to fix it.
“Skycure takes pride in abiding by vendor’s responsible disclosure policy. Per that policy, we notified Google of this issue in March 2016. Following our correspondence with the Google Android Security team, they have decided not to fix this issue and accept this risk as a consequence of its current design,” Amit said.

The first step in protecting against phone scams is understanding how they work. That’s why in this series, we’re breaking down some of the newest and most popular phone scams circulating among businesses and consumers.
The Scam
You’re a small business owner running a website through a popular hosting site. You have purchased the unique URL that fits your company, and you set up your website. You muddle your way through figure out SEO, meta tags, and keywords to get your website found upon a quick Internet search. Then, from a local number, you get a phone call from a Google specialist claiming they have a front page position for your business with unlimited clicks, 24 hours a day. Your business is struggling to gain traction on the Internet so you immediately press one at the behest of the specialist. You set your website up with the Google specialist. Quick and easy, you pay the local specialist for the front page spot and you hang up.
What Really Happened
You realize shortly after hanging up with the Google specialist that your website is not displayed on Google’s front search page. You also realize that several withdrawals have been made from your account that you have not authorized. Soon after, you catch on to what has happened. You’ve been scammed, and the fraudsters stole your credit card information. How did this happen?

• Robocalling – Scammers use robocalls to attack a multitude of people quickly while also being able to conceal their identity and location through Caller ID spoofing
• Vishing – Fraudsters use the phone channel to persuade victims to divulge sensitive information, like credit card numbers, to initiate account takeovers
• Impersonation – by falsely implying that they are associated with Google, they are gaining your trust and/or intimidating you with their importance

 
Google Listing Scam Examples
Another day, another “Google Listing” call – A variation of the robocalls surrounding the Google Listing scam. According to Pindrop Labs research, there are 8 variations of robocalls connected to this scam.
Avoid and report Google scams – A list of scams tied to the Google name.
Pindrop Labs presents Emerging Consumer Scams of 2016 – Pindrop Labs has researched and discovered the 5 emerging phone scams effecting consumers in 2016, including the Google Listing Scam, and will be presenting a webinar on these findings on Wednesday, February 24th from 2:00-2:30pm ET.
 
 
 

The first step in protecting against phone scams is understanding how they work. That’s why in this series, we’re breaking down some of the newest and most popular phone scams circulating among businesses and consumers.

The Scam

It’s a chilly January day. You’ve been busy hitting the ground running on your New Years’ resolutions, getting back into the daily grind at work, or stocking your pantry for impending snowstorms. One day in the midsts of all the hustle and bustle, you receive this call:
“You may already know effective January 1st of this year, federal law mandates that all Americans have health insurance. If you missed open enrollment, you can still avoid tax penalties and get covered during the special enrollment period, often at little or no cost to you.”

Oh no! Open enrollment has ended and you haven’t signed up for health insurance. You don’t want to be penalized on your taxes so you quickly press one for more information. Soon after you have selected the healthcare plan right for you, paid with your credit card, and avoided all penalties… or so you thought.

What Really Happened

Scammers used a fake robocall to gain your personal information including social security number, your bank account, and your address. With this information, these fraudsters racked up purchases on your credit card and opened new accounts.  Because the insurance you thought they offered you was made up, you also are penalized for being uninsured come tax time. Attackers have successfully stolen your identity using the following tactics.

• Robocalling – Scammers use robocalls to attack a multitude of people quickly while also being able to conceal their identity and location
• Confusion – You’ve heard something about Obamacare and tax deadlines, but you haven’t paid much attention to the details. Fraudsters take advantage of your confusion.
• Cross-channel Fraud – Fraudsters use many different channels to extort sensitive information. In the case of the Healthcare Scam, fraudsters use the phone channel to collect personal information and use that information in other channels, like online or in the call center.

Healthcare Scam Examples

5 Obamacare Scams and How to Avoid Them – In addition to offering healthcare, scammers will also tell victims they can get lowered insurance rates, pretend to be government agents, or even offer nonexistent “Obamacare cards”.
Expert Warns about Healthcare Scammers – Brownsville, TX – fraudulent robocallers warn residents about $695 penalty for not enrolling in healthcare.
State Warns of Multiple Scams and Fraudulent Practices in Oregon – Phone scammers are preying upon the financial troubles of Moda Health, calling and intimidating those using Moda as their primary insurance carrier.

The first step in protecting against phone scams is understanding how they work. In this series of blog posts, we’re breaking down some of the newest and most popular phone scams circulating among businesses and consumers.
**For more information on how phone fraud affects banks, register for our upcoming webinar, “Bank Fraud Goes Low Tech”

The Scam

Imagine that you’re a customer service agent at a banking call center. You receive a call from someone who sounds a bit like a chipmunk. You talk to so many people every day that it’s nothing too out of the ordinary. Before you can start helping the customer, you must verify her identity. You ask for the customer’s mother’s maiden name.

“My father was married three times, so can I have three guesses?” replies the customer.
“Of course,” you reply with a smile. She gets it on the third guess – It was Smith.
After that, the customer, who tells you she is recently married, just needs help with a few quick account changes: mailing address and email address. She checks on the account balance and ends the call. You wish all of your calls were this easy.

Here’s What Really Happened

A month later, the newlywed’s account is cleared of money. It turns out, she wasn’t a newlywed after all. She hadn’t changed her address or her email. Instead, the person you spoke to on the phone was an attacker, performing the first steps in an account takeover. After changing the contact information on the account, the attacker got into the customer’s online banking and changed her passwords and PIN numbers. It wasn’t long before the attacker began to steal funds from the account.
It’s called Account Takeover Fraud, but it actually combines several popular scam techniques:

• Voice Distortion – Attackers have many tools for changing the way their voice sounds over the phone. They may be trying to impersonate someone of the opposite gender, or simply attempting to avoid voice biometric security measures. Less sophisticated attackers sometimes go overboard on this technique and end up sounding like Darth Vadar or a chipmunk.

• Social Engineering –Think of social engineering as old-fashioned trickery. Attackers use psychological manipulation to con people into divulging sensitive information. In this scam, the attackers acted friendly, and jokingly asked for extra guesses on the Knowledge Based Authentication (KBA) questions.

• Reconnaissance – Checking an account balance for a customer may seem like a low-risk activity. But this is exactly the type of information that an attacker can use in later interactions to prove their fake identity. Pindrop research shows that only 1 in 5 phone fraud attempts is a request to transfer money. Banks that recognize these early reconnaissance steps in an account takeover can often stop the attack months ahead of time.

Account Takeover Fraud in the News

In Wake of Confirmed Breach at Home Depot, Banks See Spike in PIN Debit Card Fraud – Home Depot was quick to assure customers and banks that no debit card PIN data was compromised in the break-in. Nevertheless, multiple financial institutions contacted by this publication are reporting a steep increase over the past few days in fraudulent ATM withdrawals on customer accounts.
Account Takeovers Can Be Predicted – Apart from collecting publicly available information about the victim, generally posted on social networking websites, cybercriminals resort to contacting call centers in order to find something that would help in their nefarious activities.
Time to Hang Up: Phone Fraud Soars 30% – Phone scammers typically like to work across sectors in multi-stage attacks. This could involve calling a consumer to phish them for bank account details and/or card numbers; then using those details to call their financial institution to pass identity checks and thus effect a complete account takeover.
**For more information on how phone fraud affects banks, register for our upcoming webinar, “Bank Fraud Goes Low Tech”

The first step in protecting against phone scams is understanding how they work. That’s why we’re starting a new series on the blog, breaking down some of the newest and most popular phone scams circulating among businesses and consumers.
**For more information on how phone fraud affects retailers, register for our upcoming webinar, “The State of Retail Phone Fraud.”
The Scam
You work in a call center as a customer service representative for a retailer with lots of big customers – maybe colleges and universities, hospitals, or construction companies. These customers typically make large, bulk orders, and they can come from many individuals or departments within the companies.
It seems like business as usual when one of your biggest customers calls to get a quote for a bulk shipment of toner and electronics. Once you deliver the quote, you get the purchase order, requesting Net-30 payment terms. Everything looks normal, so you process and ship the order.
Here’s What Really Happened
That order was really placed by a scammer, who probably found your real customer’s details online. To receive the products, the scammer may have changed the customer’s usual shipping address. Alternately, he may have called the customer directly, claiming that the order had been incorrectly shipped to them and offering to send a courier to pick it up. Because of the Net-30 terms, there is a full 30-day window for the scammers to get away with their crime – plenty of time to pick up the shipment and resell the goods on the black market.
A few of the techniques these attackers use for purchase order scams are:

• Cross-channel fraud – Attackers combine email and phone communications to better impersonate real customers. Attackers often set up fake email accounts that look like they are coming from a real customer, then follow up with a phone call to complete the order.

• Courier fraud – It’s hard to say no when there’s a legitimate-looking courier at your door. Attackers often send couriers to physically pick up fraudulently purchased goods.

• Reconnaissance – Many large organizations like universities or hospitals have easy to access corporate information posted publically on the company’s domain. This is all the information attackers need to generate a very real looking purchase order.

Retail Purchase Order Scam Examples
Purchase Order Scam Leaves a Trail of Victims – Last Fall, the FBI issued an official warning about purchase order scams. Investigators found approximately 400 actual or attempted incidents that targeted some 250 vendors, and claim nearly $5 million has been lost so far.
Purchase Order Scam Targeting University Suppliers – CSO magazine reported a rash of scams targeting universities, going back as far as May 2013. The article includes links to official warning from Ohio State University, Penn State University, Texas A&M and more.
Purchase Order Scams Now Targeting Construction Suppliers – Earlier this year, KGC Inc, an industrial and commercial construction company reported falling victim to the purchase order scam. Scammers impersonating the company attempted to place orders for $25,310 worth of equipment.

Recently, Pindrop Security researchers were alerted to a phone scam targeting a financial institution. As part of the scam, fraudsters had purchased phone numbers that were similar to a financial institution’s main phone line and were using those numbers to target consumers who misdialed. A recording set up by the fraudsters would then offer a call back to the customer and ask for information about the consumer’s account by pushing a free gift card and soliciting their credit card information.
We decided to investigate the extent of the scam, which we’ve dubbed ‘misdial traps,’ to better understand the risk posed to banks and financial services institutions.
To do so, we took a sample of approximately 600 banks and financial institutions and determined the most-likely ‘misdialed’ variations of their main phone numbers. We then ran those variations against our database of phone number reputations to determine how many were likely being used by phone fraudsters.
The results confirmed that the scam is common. Of the 600 institutions we analyzed, 103 appear to be similarly afflicted by the misdial trap scam. The size of the affected institutions varies widely and includes mid-size banks as well as some in the top twenty. Some institutions also have multiple numbers under attack. This is just over 17 percent, or one out of every six banks. Considering there are nearly 17,000 financial institutions in the U.S., this scam presents a sizeable threat.
Pindrop is taking the necessary steps to notify each of the institutions affected by the misdial trap. For information about how to determine if your financial institution is affected by the misdial trap, please see our scam advisory.
Fraud is a multi-channel activity, and phone fraud costs banks and financial institutions nearly $2 billion each year, yet investment in anti-fraud technologies tends to focus heavily online. The misdial trap scam is the latest example of how sophisticated criminal rings are taking advantage of vulnerabilities in the phone channel to collect consumer information and defraud banks.
-Scott Strong, Raj Bandyopadhyay, David Dewey, Yatin Kanetkar and Valerie Bradford