An empty sound: how scammers use the theme of music online
Fraudsters are actively using the theme of music on the Web to deceive Russians, experts have warned about this. Streaming services are potentially interesting to intruders, because literally any action on them is easily monetized, and even listening to songs by itself already allows you to earn money. For more information about how online scammers use musical themes, how dangerous their tricks are and how to protect themselves from them, read the Izvestia article.
What is the topic of music content interesting to scammers?
Music streaming services attract scammers for several reasons, says the deputy director of the analytical center of the IT company Ural Center for Security Systems (UCSB) in an interview with Izvestia Diana Zhukova. First of all, they have a huge audience, which includes many teenagers and young people. Bank cards are linked to the accounts, and the subscription is automatically renewed, so the user often does not notice small charges immediately.
—Music services are potentially interesting to intruders, because literally any action on them is easily monetized: listening to a song by itself already allows you to earn money," says Sergey Polunin, head of the IT infrastructure solutions protection group at Gazinformservice.
According to him, given the fact that a huge amount of content is hosted on popular services and thousands of accounts are active, it becomes quite easy for attackers to disguise their actions. In addition, artificial intelligence (AI) has made it possible to create content faster and cheaper. In today's reality, its production can actually be put on the assembly line and simply receive money through cheating listening to your own works through bot farms.
It is also important that emotional attachment to artists can reduce vigilance, says Irina Zinovkina, head of analytical research at Positive Technologies. A fan who wants to go to a concert of their favorite band or get an exclusive track often acts impulsively, which is what scammers use.
How musical AI Frodsters work
Today, the development of artificial intelligence has stimulated the emergence of a new illegal business — musical AI-fraudsters. They work according to a simple scheme: neural networks compose tracks, which are then uploaded to streaming services, bots wind up listening, and scammers receive deductions for them.
— The main feature of the scheme is that with the help of AI, you can "glue" thousands of tracks, which, due to the huge number, will appeal to a wide variety of users, — Konstantin Gorbunov, a leading expert on network threats and web developer of the Security Code company, says in an interview with Izvestia. — Thus, due to the wide coverage, the amount of final profit increases.
Previously, intruders would wind up 1-2 tracks — and the anomaly was easy to spot, recalls Diana Zhukova. However, musical AI-frodsters take scale. The neural network creates thousands of tracks from fictional performers per day, and each of them is "listened to" a little bit in order not to exceed the thresholds of anti-fraud systems.
Bots often work through stolen or hacked accounts of real users. Therefore, if unfamiliar tracks and artists appear in the listening history, the account is most likely used in this scheme and it's time to change the password, the editorial interlocutor notes.
"Neural networks generate music based on a simple text query: you can set the genre, mood, instruments and text," adds Sergey Shcherbakov, technical director of Stakhanovets, an expert in the field of information security and IT.— Scammers create thousands of songs and upload them to the sites, then create thousands of bot accounts to cheat. This is no longer manual work, but an automated pipeline, not music, but digital spam with sheet music.
What other "musical" schemes of scammers are found on the Web?
Meanwhile, online scammers are now using other tricks on the topic of music services. According to Alexander Vurasco, Director of Development at the Solar AURA External Digital Threat Monitoring Center (Solar Group), one of these schemes is phishing under the guise of subscription renewal.
— The user receives an email stating that the next payment has failed and access will soon be terminated, — says the interlocutor of Izvestia. — On the fake website, he is first asked for a username and password, then for card details and additional personal data.
According to Andrey Kovtun, head of the email threat protection group at Kaspersky Lab, the company's specialists also encountered rather unusual letters in which users were offered to pick up an expensive piano for free. The authors of the messages explained such "generosity" for various reasons — moving to a smaller apartment or the death of the previous owner. At the same time, popular and expensive manufacturers of musical instruments were mentioned in some letters.
Konstantin Gorbunov cites the fake audition work as an example of another "exotic" scheme. Its essence lies in the fact that scammers offer users to earn money by listening to music on streaming platforms and leaving likes. They may even pay, but their main goal is either to force the user account into their hands (for example, by providing credentials), or to steal money.
— The latter is achieved due to the fact that scammers offer to pay a commission ostensibly to withdraw a large amount, — the expert explains. — If the user does this, he simply loses the money that the "employers" requested.
Finally, ticket sales schemes are also common among scammers. Irina Zinovkina notes that fake websites and social media accounts offer seats to concerts (often at a big discount), accept payment and disappear.
How to deal with music-themed fraud schemes
According to experts interviewed by Izvestia, music-themed fraud schemes carry a number of different risks. As Alexander Vurasko explains, honest musicians and copyright holders suffer first of all when AI fraudsters cheat deductions. If fictitious auditions are included in the calculation, some of the money is not distributed in favor of those whom the audience actually listened to.
"The popularity indicators that market participants are targeting are also distorted," says the expert. — Therefore, it's not just about "extra songs" in the catalog, but about interference in income distribution and demand assessment.
At the same time, according to the interlocutor of the editorial board, for an ordinary listener it is necessary to separate this risk from direct embezzlement of money. The fact that the user has enabled the generated song does not mean that his card is compromised. Direct losses occur in other scenarios.: when paying for a non-existent ticket, entering data on a fake page, or running a malicious program. Moreover, the consequences can go beyond the limits of a music account: a program installed for the sake of a "free subscription" is capable of stealing credentials and financial data from the device.
As for the protection mechanisms against "musical" fraudulent schemes, as Konstantin Gorbunov notes, in the case of AI-fraudsters, this is primarily the task of streaming platforms. Today, they are already dealing with this issue, increasing the effectiveness of AI detectors and tightening the rules of moderation.
As for schemes against users, standard anti-phishing rules work here: use only well-known services, check the sender's data, for example, the mailing address in an email offering a big discount, and do not follow links sent from unfamiliar addresses. It is also fair for musicians not to use the services of producers from the Internet, but to contact major labels directly, the expert concludes.
Переведено сервисом «Яндекс Переводчик»
