The Big Phish: Has your mind been hacked?

THE victims of scams come from all walks of life and socioeconomic statuses. What is it that brings these people to be members of this unfortunate club? Why do some people fall prey? Is it just a matter of time until you are faced with the right con and con artist - are we all vulnerable and merely victims-in-waiting?

Some traditional economists believe that some people are just more gullible than others. However, this view stems from the hypothesis that in general, humans are in control 100 per cent of the time, and who make decisions using a logical and rational computational process.

Unfortunately, this is not the case. As highlighted in Thinking, Fast and Slow by Daniel Kahneman, humans have conflicting ways in which they think and operate. In the book, Kahneman describes how the brain has two systems - the first system is the "fast, automatic, intuitive approach", while the second system is the "slower analytical mode, where reason dominates".

A theatrical approach

Con artists leverage on these two systems, pitching one against the other, as the stage and props of their theatrics. Their goal is for us to use our own intuitive, fast, automatic thinking to override our slower, analytical, reason-dominated thought process. How? A three-step approach. First, get the aesthetics right. An email that is cosmetically identical to that from a trusted organisation (your bank, a school, a business you regularly transact with) - the logo is pristinely identical to what you are accustomed to, the language and tone of the email familiarly officious. The stage is set.

Second, put people into what psychologists call a "hot state". Of course, this is based on the assumption that the ability to think clearly is impeded or compromised when we are afraid or excited. So now, the curtain is drawn. Time to bring in the drama. The scammers' message can range from the ominous to outright propitious, pronouncing to you that something is amiss with your account or that your security or privacy has been compromised. They can be imploring you to accept a "once-in-a-lifetime" opportunity, usually involving considerable monetary reward. All these are calculated to send us into a frenzied headspace.

Third, execute the heist one small step at a time. Requests for information are often bite-sized, making it look innocuous enough: "We've noticed a new sign-in with your account. We recommend that you change your password immediately to secure your account. Click here to change your password now." "I am sorry to report that your bank account has been compromised. Just click here to enter your password and username, as you always do, and we will sort it out for you".

All these put together, applied with the right dose of fear, or greed, and the odds are stacked against you. The con artist attains a dopamine high at having successfully speared another victim. This process is often executed so smoothly, that often, we do not stop to think during the heist and only come to the realisation long after the stage curtains had already been drawn.

Contrary to the paternalistic beliefs of some experts, we are all susceptible and we certainly do not know when we may become victims of a scam attempt. Artificial intelligence-based solutions deployed by companies can now help to dynamically increase safeguards and pre-emptively alert potential victims to be vigilant.

For example, by augmenting AI with the development of a psychometric model, some financial institutions are helping to identify and predict which customers may be most susceptible to attacks, thus helping us to develop bespoke advisories or training programmes, to help inoculate these customers from falling prey to scams.

Agencies are also deploying technology to choke the pipeline of scammers from reaching customers. For example, the Singapore Police Force developed a new mobile application, called ScamShield, to identify potential scam callers and messages. As the authorities possess a database of phone numbers used in other scam cases, any citizen who downloads the mobile app will be able to block off future phone calls by these known scammers. The app also uses AI to identify potential scam messages and to filter them out.

Visceral narrations

Technological solutions alone are not enough. Compared to the more dry and didactic educational efforts, the experiences of peers play an equally effective role in raising awareness of phishing scams. Cyber ethnography studies show that victims, often traumatised at having lost money, would take to social media pages to vent and warn others, by sharing their own experiences. Such visceral narrations can encourage other users to activate their logical system thinking, so that they can be more attuned to checking carefully before jumping to the quick intuitive "hot state" of reacting to such emails.

There is a need to reverse-engineer the con, to allow our two systems to collaborate and calibrate. Effectively, "Stop. Think. Act".

• Stop. If we can stop ourselves from clicking on the email link for that attractive lucky draw prize, we would have won one-third of the battle against the con.
• Think. This momentary pause can help give us the necessary time to activate the slower logical system thinking. The end-goal of educational efforts is for customers to be able to check independently on the veracity of the notification. For example, asking simple questions like, "What is the bank's official address? Was the sender from the bank's official email address? I should check first..." David Chew, director of Commercial Affairs Department, Singapore Police Force, advised that our close friends and kin can serve as a sounding board for when we are not sure. For example, it can be useful to seek out a family member or a close friend, to ascertain if the offer at hand is indeed too good to be true.
• Act. Technology today can support such ground-up insights. Major email providers like Office 365, Gmail and Yahoo! have provided easy-to-click buttons in their email interface to report phishing emails. The earlier-mentioned mobile app developed by the Singapore Police, ScamShield, has a report function for the public to directly tell the police whenever they encounter a phone number or email they suspect to be from a scammer. When more users report such suspicious emails, phone numbers and messages, the authorities are better-equipped to stop as many of them as possible. Financial institutions should also actively encourage customers to report such attacks.

Knowledge certainly is power. The more we know, the better-placed we are to educate and prevent others from falling prey.

• The writer is senior adviser for data and AI at UnionBank Philippines. He is concurrently an external adviser to Singapore's Corrupt Investigation Practices Bureau (on AI) and to the Central Provident Fund Board (on data science). He was previously the Monetary Authority of Singapore's first chief data officer.