‘I almost got taken’: Could AI be fuelling more text scams?

It is getting harder for people to spot smishing attacks as scammers turn to AI to make their text messages seem more legit. John Vennavally-Rao explains.

When Janean Compton received a pair of text messages this week claiming she had a speeding ticket, her first reaction was to wonder if they were legitimate.

The texts said she could avoid a court date by clicking a link to pay the fine. A believable scenario, she thought, given there are enforcement cameras in her area and she had received a real ticket earlier this year.

But something felt off.

“I thought, you know what? I’m going to Google this to see if it’s a scam,” Compton told CTV News from her Oshawa, Ont. home.

Her quick search confirmed her suspicions. The messages were a scam. She posted a warning on Facebook.

“I almost got taken, but I didn’t click on the link,” she said. “I don’t know what would have happened if I clicked on the link. I just blocked the number.”

Competition Bureau Canada says scams like this are becoming increasingly common, warning Canadians to be on alert for so-called “smishing” attacks.

Smishing, which is a blend of the texting term SMS and phishing, involves fraudulent text messages created to look like they’re from a government agency, bank or legitimate company. They often include links that, if clicked on, can install malware or lead to fake websites that steal personal or financial information.

“We do see an increase in it over the last several years,” said Josephine Palumbo, deputy commissioner for Deceptive Marketing Practices at the Competition Bureau.

Experts say fake texts once stood out because of poor grammar or spelling mistakes.

“Spelling mistakes used to be a tell, particularly when people had to write these messages themselves, and often it was people who didn’t necessarily speak English as their first language,” said Angus Lockhart, a senior policy analyst with The Dais at Toronto Metropolitan University.

One of the reasons these scams may become more frequent or harder to detect is artificial intelligence (AI). Now scammers are using tools like ChatGPT.

“ChatGPT spells perfectly every time, it never has any typos. So, anyone can write in coherent English with perfect grammar now,” Lockhart said. “You have to be much more careful, even if the message looks like it’s legitimate.”

Jeff Horncastle of the Canadian Anti-Fraud Centre said fraudsters are also using AI to personalize scam messages by searching for information about potential victims on the internet, as well as automating the mass creation of them.

“Some of the messages may include some of your personal information as an extra way to try to convince you that it’s a legitimate message,” said Horncastle who notes his organization has actually received fewer reports of smishing this year compared to the first half of 2024.

Such messages often include a sense of urgency, a tactic meant to pressure recipients into reacting before thinking. Experts urge people to slow down and try to verify the source. They also say don’t click on suspicious links and ignore texts even if asked to reply with “STOP” or “NO.”

“Whenever you receive a suspicious text message, remember that most legitimate organizations will not be asking you to reveal personal information through an email or text message,” Palumbo told CTV News.

Common smishing scams include fake Canada Revenue Agency refunds, Canada Post delivery updates and highway toll notifications.

“I got a text message just yesterday pretending to be a parcel delivery service that needed my information to help complete the delivery, and I’m not waiting on any packages,” said Compton.

The goal of smishing is often identity theft, targeting credit card numbers and other sensitive personal information.

The Competition Bureau advises people to forward suspicious text messages to 7726 (SPAM.)

“This will let your phone providers actually block future texts from the same number,” said Palumbo.

Horncastle noted that fraudsters will go as far as including real government phone numbers in their messages.

“So the target looks up the phone number, says, ‘Well, you know what? That’s the official phone number for the CRA. It must be a legitimate message, right?’” Horcastle said. “It’s just another way, another tactic the fraudsters are using to convince you that it’s an official message.”

As for Compton, those fake speeding ticket texts weren’t the only scam attempts she’s seen this year. She also received calls from fraudsters posing as employees from RBC and Telus with what appeared to be legitimate numbers on her call display.

“It’s quite easy to be taken,” she said.