Widely available artificial intelligence tools can be exploited to create convincing phishing messages. These scams become even harder to identify when bad actors have access to personal data.
Often, that data is readily available through consumers’ own social media activity. To demonstrate this vulnerability, researchers at the University of Texas at Arlington (UTA) used widely available AI tools to gather details from public social media posts and rapidly generate personalized scam emails.
Known as context-aware spear phishing, the tactic represents a more sophisticated variation of a longstanding fraud theme.
“Spear phishing certainly isn’t new, but AI tools are making it a lot faster and more efficient,” said Suzanne Sando, Lead Fraud Management Analyst at Javelin Strategy & Research. “Now, scammers can quickly turn someone’s posts into a convincing and timely message that feels incredibly relevant to their targeted victim.”
Tailoring the Message
This level of personalization makes scams more difficult to identify, particularly for vulnerable demographics such as seniors and children.
In the study, UTA researchers found that AI tools could extract substantial detail from consumers’ recent social media posts, including photos. They used this information to generate tailored emails reflecting users’ travel and entertainment preferences, as well as issues they had discussed or engaged with online.
The resulting messages included customized subject lines, sender names, and links designed for individual recipients.
Limiting the Exposure
The ability to personalize communications could amplify the already pernicious threat of impostor scams. While targeted phishing has been around for years, earlier versions typically relied on relatively static personal details like a person’s job title or location.
Context-aware spear phishing reflects the evolution of fraud, as criminals find new ways to exploit technological advances, especially AI. In the UTA study, participants rated the AI-generated emails as high-quality messages, highlighting how difficult these personalized scams may be to recognize.
The findings point to the importance of stronger fraud detection and data protection measures, while also underscoring the role consumers’ social media habits can play in limiting their exposure.
“It’s an important reminder for consumers that just because the sender knows something about them does not prove that the communication is legitimate,” Sando said. “Also, encouraging consumers to limit exposure to personal details through public posts about vacations or life updates adds a layer of privacy and protection from spear phishing attempts.”