Donald Trump talks on the phone from the McLaren garage prior to the F1 Grand Prix in Miami on May 5, 2024. Credit – Clive Mason—Getty Images
“If you receive a message claiming to be from a senior US official, do not assume it is authentic,” the FBI warned in May. The public service announcement was written as advice for everyone but noted that many of the targets of “malicious actors” impersonating U.S. officials are other “current or former senior US federal or state government officials and their contacts.”
While every corporate worker today is probably familiar with HR-mandated trainings to try to combat “phishing”—scams that involve deception over email—and while “smishing,” which occurs over SMS messages, has become more prevalent, the FBI warned that “malicious actors are more frequently exploiting AI-generated audio to impersonate well-known, public figures or personal relations to increase the believability of their schemes” in what is known as “vishing.”
Read More: From Scams to Music, AI Voice Cloning Is on the Rise
And officials at the highest levels of government have been impersonated and targeted, according to reports.
On Tuesday, the Washington Post reported that Marco Rubio, President Donald Trump’s Secretary of State and acting National Security Adviser, was the latest to be impersonated by an unknown individual, who used AI to mimic his voice and writing style in voice and text messages on the non-government encrypted communications app Signal to “three foreign ministers, a U.S. governor, and a U.S. member of Congress,” according to a State Department cable sent July 3.
Read More: What Is Signal, the Messaging App Used by Trump Officials, and Is It Safe?
According to the cable sent to State Department staff, the imposter sought to manipulate officials with the “goal of gaining access to information or accounts,” which is a criminal offense. Officials declined to comment to the Post on the specific targets of the impersonation campaign and the contents of messages sent.
Rubio is not the first in the Trump Administration to be impersonated.
In late May, the Wall Street Journal reported that federal authorities were looking into an unknown individual’s impersonation of White House Chief of Staff Susie Wiles to try to reach out to prominent Republican senators and congressmembers as well as business executives.
Wiles claimed her personal cellphone’s contacts were hacked, and while calls and messages did not come from her number, recipients claimed the voice on the line sounded like hers, leading officials to believe AI technology was utilized.
As the White House and FBI said at the time that they were taking the incident seriously, Trump seemed unbothered, commenting: “Nobody can impersonate Susie. There’s only one Susie.”
The incidents within Trump’s orbit are particularly concerning as the President himself reportedly utilizes a personal cellphone and has answered calls from numbers he doesn’t know.
“It was only a matter of time,” David Axelrod, a former senior strategist to President Barack Obama, posted on X about the Rubio report. “This is the new world in which we live and we’d better figure out how to defend against it because of its implications for our democracy and the world.”
Nicholas Thompson, CEO of The Atlantic, whose editor in chief was unintentionally added to a Signal group chat earlier this year with top officials including Rubio, Defense Secretary Pete Hegseth, and former National Security Adviser Mike Waltz, who was dismissed from the role after the controversy, posted on X: “One reason top government officials are supposed to use secure platforms—instead of regular text services—is so that inevitable scams like this are less likely to work.”
The State Department told the Post that it would “carry out a thorough investigation and continue to implement safeguards to prevent this from happening in the future.”
How to avoid being a victim of ‘vishing’
Generative AI has made it much easier to mimic other people’s voices, which in turn facilitates vishing scams.
The FBI in its May PSA urged people to try to verify the identity of a caller or voicemail. “If contacted by someone you know well via a new platform or phone number, verify the new contact information through a previously confirmed platform or trusted source,” it recommended.
You should also pay close attention to a contact’s tone and word choice to try to differentiate a legitimate phone call or voice message from a malicious impersonation, though it warned that “AI-generated content has advanced to the point that it is often difficult to identify.”
“When in doubt about the authenticity of someone wishing to communicate with you, contact your relevant security officials or the FBI for help,” the PSA said, adding: “The FBI requests victims report any incident to your local FBI Field Office or the Internet Crime Complaint Center (IC3) at www.ic3.gov. Be sure to include as much detailed information as possible.”
Rev, an AI-transcription software company, outlines in a blog three distinct differences between an AI-generated voice and a human voice: a flat-speaking tone (generative-AI has difficulty replicating emotion and sentiment), slurred unnatural speech including stumbling on phrases or uncommon words, and strange background noises like repeated crackling. Though Rev also warns: “As generative AI continues to improve, synthetic audio will sound more and more like we do.”
Computer-security company McAfee pointed out several other potential signs of a vishing attack, including an unsolicited or unprompted phone call, an aggressive assertion of authority, and an urgent request for sensitive information like social security numbers.
“Somewhere in the script for a vishing attack, the caller will ask for information. It may start with something harmless, like asking to confirm your address. If they can get you talking, they will soon ask for more valuable information like a social security number,” McAfee warns. “It is a red flag when someone needs you to give them information immediately. Vishing attackers use the fear of harmful consequences to pressure victims into sharing data. They will tell you that you need to act now or that the call is your final opportunity to fix a problem.”
The Department of Veterans Affairs also issued general guidelines on how to prevent getting scammed over the phone, including signing up for the Federal Trade Commission’s Do Not Call registry to reduce robocalls, not providing personal details or payment information over the phone, and, simply, hanging up when you feel things aren’t right.
Contact us at letters@time.com.
