Artificial Intelligence Risks and Scams

Artificial intelligence programs will process and store data entered into them. While every platform's policy on data retention and usage will vary, many public AI platforms will use this data to train the AI models. Because of this, your data may be used to influence the output of AI models, meaning that sensitive or proprietary information could be exposed to unauthorized individuals when the model answers their questions. If this information includes protected student or employee information (such as financial or health details), this could lead to legal repercussions.

Before you make use of any AI tools, it is best to consult your department's administrative policies on AI usage. It is equally important to determine which AI models may be used, as every AI model (ie. OpenAI's ChatGPT, Microsoft Copilot, Google Gemini) will be different in its handling of information and capabilities.

Students should remember that utilizing generative AI on coursework is prohibited, unless explicitly approved by their instructors. Using generative AI to complete coursework can be considered both cheating and plagiarism, depending on the context in which the AI model was used. The university's policy regarding student cheating and plagiarism (Policy 3-01.8) contains more information.

The rapid increase in the abilities of AI models has led to the creation of deepfakes. Deepfakes are video or audio messages generated by artificial intelligence, which can be used to impersonate an individual by mimicking their voice and face. Advanced AI models can generate deepfakes by using videos, audio clips, and images of their targets to create very realistic lookalikes. For those who have a large public social media presence, it is very easy for a scammer to obtain sample videos, audio and images, which could be used to generate a deepfake. It is typically much simpler to generate a deepfake that only uses audio, as videos require much more advanced AI models and need more resources to generate a convincing result.

From the scammer's perspective, the most important component of any social engineering attack is to make themselves seem convincing to the victim. While an email or text message may be quickly identified by a target as fraudulent, identifying a copy of a friend, family member, or colleague's voice or face may be much more difficult. This is what makes deepfakes such a useful tool for scammers.

While these deepfakes can be very convincing, there are still techniques that you can use to see through the scammer's ruse. First, consider how the message was sent to you. Consider this example: you receive a phone call from someone with your supervisor's voice who begins to ask for sensitive information. In this scenario, you can check the phone number that they are calling from. Do you recognize the number? If you have any doubts about the number, hang up immediately and contact your supervisor through a trusted method. This also applies to emails. If you don't recognize the sender's email address, report the message to phish@kent.edu for review.

Another technique that can be used to avoid these scams is to set up safe words with your closest friends and family. These safe words should be words or short phrases that you can easily remember, but would be difficult for someone else to guess. For example, you should not use your mother's maiden name or the name of your elementary school as a safe word; these are easily guessed or found through public records online. If you find yourself contacted by someone claiming to be a friend or family member, but you do not recognize the method they are using to contact you, ask them for the safe word. If they do not know it or respond incorrectly, do not interact with them further.

Attacks that use AI can be difficult to detect and mitigate. However, there are several techniques that you can use to recognize and avoid these kinds of attacks and scams.

• Never enter sensitive information into untrusted public AI platforms. This information is used to train the AI model and may be used as responses to other users in the future.
• Treat AI models like public forums. Think of it this way: if you wouldn't enter this information into a public online forum, would you enter it into an untrusted AI model?
• Always review policies before using AI for your role at work or as a student. Improper use of AI could lead to lawsuits or be considered academic misconduct, depending on the context.
• Use a safe word to determine whether or not the individual who contacted you is really who they claim to be. Make this word difficult to guess, and keep it private.
• Ask for video verification, as many deepfakes only clone someone's voice and do not create videos of the individual they are impersonating.
• Ask personal questions that only the real person would know the answer to. Be sure to make them difficult, not something simple such as "what was your mother's maiden name" or "which high school did you attend."
• Verify the sender's contact information. Ask yourself: do I recognize this phone number or email address? Would this person contact me with this number/address?

If you receive any correspondence that you suspect was generated by artificial intelligence in an attempt to scam you, please contact phish@kent.edu so that our team can investigate the scam in greater detail.