FINRA, FBI warn about generative AI and finances

As people adjust to artificial intelligence (AI) becoming more prevalent in their lives, there comes with it a concern: Can AI be used as a weapon to commit fraud?

The FBI says yes. It issued a public service announcement in December 2024 stating that "criminals exploit generative artificial intelligence ... to commit fraud on a larger scale which increases the believability of their schemes. Generative AI reduces the time and effort criminals must expend to deceive their targets."

While "the creation or distribution of synthetic content is not inherently illegal," quoting the FBI announcement, "synthetic content can be used to facilitate crimes, such as fraud and extortion."

The Financial Industry Regulatory Authority, a private corporation also known as FINRA, goes further: You need to protect your investment accounts from "generative artificial intelligence" or Gen AI. FINRA oversees member broker-dealers who do business in the U.S.

"Gen AI is making it easier for bad actors to fraudulently open new accounts using investors' identities and to improperly gain access to investors' accounts," warns FINRA. Gen AI can be used to "exploit traditional identification (ID) verification processes and commit new account fraud and account takeovers in multiple ways," they warn.

Among the fraud methods highlighted by FINRA:

Social engineering: "Fraudsters might use Gen AI to analyze your social media activity to create highly personalized phishing emails that could lead you to fraudulent websites embedded with malicious links."

Voice clones: "With Gen AI, fraudsters need only three seconds of audio of you speaking to create a credible-sounding imitation, or voice clone." FINRA notes that Gen AI could be used to impersonate the voice of a loved one in distress so that you provide access to your accounts.

Fake ID documents: "Fraudsters can use Gen AI to create convincing fake ID documents." Those documents could be used to take over an existing account or to open a new account.

Among the recommendations offered by FINRA to combat Gen AI:

Use a password manager: The U.S government's Cybersecurity and Infrastructure Security Agency describes a password manager as "an easy-to-use program that generates, stores and even fills in all your passwords." FINRA points out that the benefits of using a password manager include "secure storage, unique and complex passwords, and centralized management."

Enable multi-factor authentication: This provides "an extra layer of security beyond just a password by requiring you to also enter a code that's sent to your mobile phone via text message or through an authentication application to your account."

Monitor your account activity regularly to see if there are unauthorized transactions or new accounts that have been opened, and use identity-theft protection and credit monitoring services.

Be aware of phishing attempts -- emails, texts, links and calls that seek personal information. If you are receiving an inquiry coming from a company you recognize, don't reply. Instead, FINRA recommends contacting "the firm directly through its website or by a phone number provided on an account statement or its website."

"Gen AI has made it easier to impersonate consumers and commit fraud," quoting FINRA. "Although financial institutions are working to fight fraud on their platforms, it's in your interest to also take actions to protect yourself and to alert firms to any suspicious activity."

According to the FBI's most recent Internet Crime Report, released in 2024, three of the top five categories of reported crime were Phishing/Spoofing, Personal Data Breach and Investment, with a combined total loss of more than $5.3 billion.

If you feel that you may have been compromised, you can report possible Gen AI or other investment fraud attempts to FINRA, the U.S. Securities and Exchange Commission and the FBI's Internet Crimes Complaint Center.

The best advice? Don't assume legitimacy. Assume the opposite. If your caller ID identifies the caller as your local bank, don't take the call. Instead, initiate a call using the phone number that you normally use. If you receive an email telling you that your account has been compromised, don't assume that it's legitimate. Instead, contact your bank directly.

In this day and age, perhaps it's better to initiate rather than react. To stay safe, take the initiative to check your accounts periodically.

Seasoned Investment Counsel and award-winning columnist and author, Julie Jason, JD, LLM, promotes financial literacy and investor protection. Read her latest book, "The Discerning Investor: Personal Portfolio Management in Retirement for Lawyers (and Their Clients)," published by the American Bar Association. Write to Julie at [email protected]. While all questions cannot be answered, each email is read and reviewed and can lead to discussion in a future column.