Would-be threat actors can tap a cybercrime market worth tens of billions by spending just a few thousand dollars to acquire an off-the-shelf, AI-enhanced phone farm, researchers have warned.
Human Security’s Satori Threat Intelligence and Research Team acquired a phone farm kit and reverse engineered the hardware and software to understand more about the infrastructure which supports fake account creation, account takeover (ATO), romance and investment fraud, and much more.
Its findings are detailed in a report published on July 28, FunFoneFarm and the Off-the-Shelf Scam Economy.
The firm estimated that just $2790 per month could enable a scam outfit to cash in on a massive underground cybercrime market. Romance fraud alone cost victims nearly $930m last year, according to the FBI.
Read more on phone farms: Researchers Uncover ProxySmart Software Powering 90+ SIM Farms
“FunFoneFarm” is not a single operation but a moniker describing the new reality of how easy it is to build an off-the-shelf phone farm.
The main elements are:
- Hardware sold openly on mainstream marketplaces, with the cheapest versions assembled from salvaged phone motherboards
- Cloud phone services which eliminate the need to own hardware, reducing farm operation to a monthly subscription and enabling the operator to change device models and other identifiers on demand
- Orchestration software which enables a single operator to control a fleet of devices, and is delivered by providers with professional documentation and customer support
- An AI layer that writes automation scripts and manages scam conversations, removing the technical skill and language fluency which were once a barrier to entry
FunFoneFarm Enables Low-Cost, Scalable Fraud Operations
The ease with which each of these individual components “snap together” is what makes the FunFoneFarm model such a threat, the report claimed.
“Each layer described in this report removes a barrier that once kept casual actors out, including hardware you can buy with a search, orchestration software that ships with documentation and support, and cloud phones that reduce a farm to a subscription,” it explained.
“The result is less money, less skill, and less time required to run scams that were previously the domain of organized, resourced operators.”
However, it’s the AI layer that is the real differentiator in terms of lowering traditional barriers to entry for would-be phone farm operators.
“A task that once demanded real engineering skill (reliably automating a web browser) becomes a plain-language request,” the report continued.
“The labor that once capped a romance scam at however many conversations a person could juggle disappears when a bot can sustain hundreds at a time, collapsing an economy that once required compounds full of coerced workers into a subscription and a prompt. The persona, the script, the content, and the conversation can all be generated on demand. What used to require a team now requires a subscription and a prompt.”
UK government figures suggest cyber-enabled fraud costs the UK economy a total of £14bn ($19bn) a year, with one-in-14 adults, and one-in-four businesses having been victimized.
