Why you can't trust social media account verification: Internet Scambusters #920
Did we ever think that the account verification process launched by Twitter and Facebook would help us confirm the identity of political candidates and senior media figures?
If so, we were wrong, as we report in this week's issue.
Not only that. In the world of fakes, photos of non-existent people or high school graduates are key potential weapons in the hands of tricksters.
Let's get started...
Impostor! Social Media Account Verification Fails Key Test
Can you trust social media account verification -- the process that tells a user that the person they're looking at online is who they say they are? Not always.
Sites like Facebook and Twitter have done a lot to dump fake accounts. They've started a process to verify new accounts and flag up, with a checkmark, that they're safe. But it turns out that may not be enough.
The checkmark, used by both of the leading social media sites, is supposed to verify that certain political and media accounts have been verified and can therefore be trusted.
But in an unofficial security test of Twitter, not sanctioned by the company, a 17-year-old high school student created a false identity to open an account. He gave a false name and claimed to be a Republican candidate for Rhode Island. It earned him a trusted checkmark!
Worrying news, considering that prior to this, Twitter had allegedly stated: "Our worst-case scenario is that we verify someone who isn't actually the candidate."
That seems to be exactly what happened.
Reporting the incident, broadcaster CNN said: "The fact that a teenager using next to no resources was able to quickly create a fake candidate in his free time and get it verified by Twitter raises questions about the company's preparedness for handling how the 2020 elections will play out on its platform."
Naturally, Twitter suspended the account when they were told about it.
This is a serious issue for those who are trying to avoid falling victim to fake news.
The teenager explained that, in his attempt to fool Twitter, he set up a website and then grabbed a photo from a site called "this person does not exist." Yes, that's a real site.
Finally, he completed a survey, run by a third party on Twitter's behalf. This company subsequently admitted it had "made a mistake" in its verification process.
Within a short while, the account had 10 followers -- not a lot but enough to show how people are at risk of being tricked by fake identities.
Twitter subsequently told CNN that it had put additional procedures in place to verify political candidates.
Should we be worried? Well, we know from the 2016 Presidential Election that foreign entities, believed to be sponsored by their governments, tried to disrupt the campaign and voting process. So, we can be pretty darned sure they will be -- or are now -- active again. And we know that social media sites are fighting a battle against fake news on many fronts.
From a user point of view, avoiding these malicious activities is tough. But in the case of a potentially false identity, we now know it may not be enough to trust account verification.
So, before you "follow" even a supposedly verified person, you should do a search on their name, looking for photos and other data that can be compared with the "verified" social media account.
However, there's another important issue here -- that website from which the 17-year-old obtained a created photo of a person who doesn't exist.
What About Fake Personal Photos?
The site -- https://thispersondoesnotexist.com/ -- comprises just a single page showing one photo at a time. That is, when you visit, you just get a head photo with brief details of the person who "imagined" it. Pressing the refresh icon (a partly completed circle with an arrowhead on a web browser) produces another photo, and so on.
There's no other information but the site appears to be a showcase for image generators using artificial intelligence (AI). The single page site has a link to a person at the University of Michigan.
Its existence and purpose seem totally legitimate. Its purpose seems to be linked to competition among AI developers, known as a "generative adversarial network" or GAN. GAN developers try to competitively teach AI programs how to create photos. The results are amazing.
This all seems very technical but, as the teenager made clear, it's also a useful site for "snagging" photos of non-existent people. And if you visit the site, you'll see just how realistic they are.
So, here is more evidence that, when it comes to Internet use, you can't even trust your eyes in deciding whether a picture is genuine or not. Add this to the crooked practice of stealing other peoples' online photos for scams like online dating, and you can see the extent of the problem. The simple rule is you can't trust any photo until you've checked it out with other sources.
But that's not the only worry about photos.
High School Photo Dangers
We've previously warned about the risks you take when you post your own photo on social media. It may not only be a target for theft but also a big help for scammers trying to steal your identity.
The latest alert comes because of a social media hashtag #ClassOf2020. For those who don't know, a hash symbol used before one or more words enables social media users to search on the hashtag and then see everyone who has posted using the term.
In other words, they can see the high school graduation photos of everyone who has used the hashtag.
This gives an identity thief a start. They record victims' names, details of their school, and when they graduated. They then use this information to search for additional details.
Not surprisingly, consumer organizations have issued a warning not to post.
Then, imagine what would happen if an identity thief harvests a lot of information about you and then snags a recent photo.
He/she then has enough information about you, and a photo, to enable them to try to fool the social media account verification process. Which takes us back to where we started.
Alert of the Week
Scammers are phoning people to accuse them of money laundering and telling them a warrant has been issued for their arrest. For some reason, the crooks claim the "offense" is something to do with the Social Security Administration (SSA).
It's simply a prelude to an identity theft attempt. But the SSA says it does not have a role in investigating money laundering or, indeed, of seeking a person's confidential information.
So, just hang up.
Time to conclude for today -- have a great week!