Maine-based artist and writer Ann Tracy was initially thrilled when she got an email inviting her to be a guest on "The New Yorker Radio Hour," a show and podcast hosted by New Yorker editor David Remnick and co-produced by the magazine and WNYC Studios.
But then she realized the email address didn’t look like it belonged to the organization.
“ I'm thinking, 'Oh my God, how did they figure out little old Ann Tracy,'" she said. “Then my intuition kicked in, and I started looking at the email itself a little more closely, and noticed number one, it was from a Gmail account, not from 'The New Yorker Radio Hour' account, and I thought, ‘hmm.’”
According to WNYC’s in-house data security expert, Kenneth Atkins, Tracy was one of dozens of people, many of them authors, who got similar “phishing” emails — fraudulent messages that aim to steal personal information — from accounts impersonating producers or hosts of different WNYC shows, inviting them to be on-air guests. WNYC is part of New York Public Radio, an organization that includes Gothamist.
“The important thing here is that ultimately they ask the authors to provide either some sort of voluntary contribution or a fixed fee to be on the show to cover the cost of promotion and to cover the cost of production,” Atkins said on WNYC’s "Brian Lehrer Show" last week.
But, as host Brian Lehrer emphasized: “Our interviews and our airtime are never for sale, nor do we collect fees from our guests for logistics, production, or anything else that goes into making the show. We will never ask you to pay to come on.”
New York state’s Division of Consumer Protection has tracked more than 6,000 similar impersonation scam reports in the past 12 months across the five boroughs. The agency didn’t find any complaints specifically mentioning WNYC, but instead found three other similar complaints across the country impersonating other public radio stations.
“They were all filed within the past month, so this may be an emerging scam model,” said Mercedes Padilla, a spokesperson for the division.
Tracy told Gothamist the email she received from the phony account was well written, parroting career highlights such as her “continued engagement with theatre through the SnowLion Repertory Theatre Company’s Play Lab” and “your multidisciplinary creative life, spanning performance, writing, and media” as reasons why she would be a good fit for the show.
“ It was almost too well-written to be a scam. And I thought to myself, ‘Well, it could be real or it could be someone using AI crawling my website, getting the information from that, and then working that with AI into an email,” she said.
Tracy’s hunch could be correct, said Rachel Tobac, CEO of San-Francisco-based SocialProof Security. More scammers are using a tactic called “spear phishing,” a targeted form of cyberattack that uses information about their targets available online to craft personalized, deceptive emails with the goal of extracting personal information or money.
“ They're definitely increasing in believability and scalability because of AI,” Tobac said. “Previously, attackers will have to go and draft a phishing message for each and every individual person. It takes a really long time for the attacker to do that.
But now?
"AI can do all of the research, choose the targets, develop the text message or the email or the phone call, even do a voice clone or a deepfake to sound like somebody that they're not.”