AI is making spear phishing scams more successful, BYU research finds

PROVO — As artificial intelligence grows ever stronger, new research from BYU shows people are more likely to fall for AI-generated scams than human-written ones.

"Our research is just the latest to show how sophisticated the current state of AI is," said Jerson Francia, a BYU cybersecurity PhD student.

The research, led by BYU cybersecurity professor Derek Hansen, found participants struggled to determine whether a message was written by AI or a person, correctly identifying the source only 52% of the time.

This research comes as debate worldwide grows over safety concerns amid calls to regulate artificial intelligence technologies.

BYU researchers found that in 80% of cases, AI matched or outperformed humans in generating a click on a scam link.

One of the most common methods scammers are using is spear phishing, where personal information such as a job, coworker or hobby is used to create persuasive messages that convince victims to click on a link. Basic information from company websites, LinkedIn profiles, social media accounts and organizational directories is enough to aid the creation of the scams.

Scammers are starting to use AI agents to help them generate these deceptive spear phishing attacks in greater numbers.

"In other words, you may no longer be able to recognize AI-generated phishing simply by how a message is written," the university said in a release.

AI-generated messages fooled people about 28% of the time compared to successful human-authored ones at 21%, the research found.

As details of people's lives become more readily available online, AI can gather that information more efficiently, constructing what appears to be trustworthy text messages and emails that reference personal details.

Scam messages with job-related personal details were found to be most convincing, as references to a workplace or occupation create a sense of relevance and credibility. In fact, messages mentioning a coworker are 2.3 times more likely to be clicked on than a message from a generic organization, the university said.

Manually compiling personal details to create convincing messages is a much more time-consuming process and is difficult to carry out at scale. But with AI, scammers can use the power of personalization in seconds, the researchers said.

"This study opened my eyes to just how good AI is at creating messages that use personal information about individuals," Hansen said. "AI can reduce the time and effort required to create personalized spear-phishing messages, thus making them more effective and more common."

The researchers shared some tips on how to not get scammed, including visiting the websites directly by typing in an address yourself rather than clicking on a message link. It is also smart to contact the person or organization through a phone number or other contact method that you already know is legitimate.

"If you receive a text message from an unknown number, don't trust it, even if it mentions personal details about your life," Francia said. "We need to more thoroughly verify the authenticity of messages through other means, rather than relying solely on the content of the message itself."

Researchers also warn against giving out passwords, ID numbers, financial information, or security codes in response to unexpected requests, and to report suspicious messages to your workplace, school, or relevant organizations. Links can also be run through scam checker websites such as VirusTotal, URLVoid or ScanURL, according to the researchers.

Related topics