Deepfakes, Directory Listings & the Joy of Public Data Abuse!

To all you good people of the modern surveillance state, that which you are more familiar with in its curated form as ‘the information age’! This missive is addressed to honour our unsung hero: publicly available data, the ultimate gift that keeps on giving… to cybercriminals.

Imagine a world where you can impersonate someone using only their telephone book (yes quaint I know, but still a thing, albeit dgtal) listing, a blurry headshot from their local council’s website and their dog’s name from a 2012 tweet. Oh wait, you don’t have to imagine. Welcome to digital reality, where data protection means politely asking scammers not to use your LinkedIn bio against you.

Let’s talk deepfakes, because why stop at pretending to be someone online, when you can become them in glorious 4K? All it takes is 30 seconds of public speech footage, which every CEO thoughtfully provides in annual investor day livestreams. Combine that with a few choice phrases from their corporate press releases, and bingo … you’ve got yourself a synthetic executive issuing fake wire transfer instructions with the credibility of a Jimmy Bond villain and the digital trail of a ghost.

Meanwhile, Karen in Accounts is flattered to receive a personal video message from “the CFO” asking her to urgently approve a £2 million payment to a “strategic partner” in the Cayman Islands. Who knew fraud could be so… personable?

And the real punchline? Much of the data fuel for this criminal buffet is served into the public domain with good intentions, transparency, openness, democracy. Bravo!

If you’ve ever wondered just how easy it is to execute a believable social engineering attack, worry not, national insttutions have done most of the prep work for you. Need a target? Try the open Electoral Roll. Fancy their job? It’s on LinkedIn. Want to know where they live? Companies House filings, planning applications, or perhaps their local tennis club’s committee minutes. The data is all out there, dutifully exposed for “the public good.”

So let’s raise a glass to the humble data point: scraped, stitched, and weaponised with AI. The future of cybercrime isn’t hacking firewalls, it’s hacking humans. And thanks to public records, the hackers don’t even have to try that hard.

Smile for the camera … someone’s deepfake is training on your face right now.

And if you have got this far (thank you) click here to download an Excel spreadsheet that took little time which proves the point. NB: SOurces are predomnantly UK centric, but please try your own local registry of choice.