VIDEO — 2025

Fake bank and post office messages, cloned voices and scholarships for cybersecurity students

A morning-programme interview on RTCG about fake bank and post office messages, cloned voices and first steps in a cybersecurity career.

Published in

RTCG

Role

Guest

Watch on YouTube

On RTCG’s morning programme, we talked about how safe we really are online. I brought examples of the most common scams in Montenegro and showed how AI can fake a video and clone my voice live. We also talked about regulation, our scholarships for University of Montenegro students and how to start a career in cybersecurity.

Safety starts with education

There are definitely moments when you can feel safe at a computer, and the main factor is education, followed by technology such as two-factor authentication and strong passwords. The emphasis is on how you use your devices, how careful you are and how well you spot bad things online. For an ordinary user, the antivirus that comes with the operating system is enough, as long as everything is updated regularly, while companies need more advanced protection.

The most common scams in Montenegro

The most common scams here come through SMS, Viber, WhatsApp and email, from scammers posing as banks, services or online shops in Montenegro to get you to pay or enter your card details, and every day we get asked whether a message is a scam.

Among the examples I brought were warnings that two banks and Pošta Crne Gore sent to their users, which I see as good practice. The message usually says something urgent has to be done about your bank account or a parcel, and in 99% of cases it asks you to click a link and follow the instructions.

The link is the first sign of a scam: in one example it was the bank’s name followed by .pro, clearly not your bank’s real address if you pay attention. The page copies the bank’s brand, sometimes down to an identical page, and leads you through claims and panic until you enter your card details, and then the money is often gone.

Two-factor authentication is a standard today, and I would not recommend any online account without it, because even if you give away your password on a fake login page, the SMS code or app notification comes to you and the attacker cannot go further. If you approve that step yourself because someone is talking you through it, they can still get in, and it was you who let them in.

The parcel that got stuck

The parcel scam is perhaps the most common, and I have received several of these messages myself. Online shopping has jumped since COVID, so attackers can assume that almost everyone is waiting for a delivery and wants a stuck parcel sorted quickly, which makes this perhaps the most successful scam of its kind. The page is a full clone of the Pošta Crne Gore site on a fake domain that does not even contain the company’s name, and the payment page even asks you to authorise your card, so in theory the attacker can save your details and charge a series of transactions you never made. This is the scam I have had the most complaints and upset calls about.

The address in your browser cannot be faked

The domain is the one part that cannot be faked, because the address at the top of your browser really is the domain you are on, so judge whether the name is right. The sender is harder to judge, because a message can even show a company’s registered name, an email often shows only a name until you click on it, and more advanced attackers can mask their phone number. Two signs usually point to a scam: someone urging you to do something involving money, or an offer that sounds unrealistic, such as a huge discount or something free right away.

A fake video and a cloned voice

In ten minutes, from a photo of myself and a photo of another person, I made a completely fake scenario between a fake me and a fake Elon Musk, which is frightening. I could put myself anywhere, saying words I never said, with people I have never been in a room with, and steer the narrative towards any goal.

The longer you watch, the more you notice the subtle movements, and if you know the person, you will be among the first to spot the fake. Even so, lip-syncing is getting close to perfection, and today even I find some examples very hard to identify.

Then I typed a message live and my cloned voice read it out, greeting the viewers of RTCG. That means I can call you with the cloned voice of someone close to you, taken from a short video clip of the two of you, and you will think you are talking to that person. When a call brings urgency, or something too good to be true, your paranoia has to kick in and you should assume it is fake.

There is no difference between generations here. In one video I speak French, Arabic and German, with my lips following every word, which can be very positive, because educational material can reach people in other language areas. Used for scams, it lets me pose as anyone, reach far more people or even influence elections by faking announcements by politicians.

Regulation lags behind the technology

The problem is that the technology advances faster than regulation, which is very slow, even though it is the main answer to misuse. Denmark has already made progress here, so that anything AI-generated with a person’s voice or likeness is their protected copyright and cannot be used without their approval, and if it is, they can take legal action.

Regulation has to speed up, in each country and in the European Union, whose recent EU AI Act tries to make companies developing AI build it safely and ethically, with security measures against misuse. How close we are depends on the ambition of our politicians, and those of us in the profession will keep pushing and educating, because these are burning issues that have to get on the agenda as soon as possible.

Scholarships and a free academy

We recently signed an agreement with the University of Montenegro to give scholarships to students who want a career in information security. It is part of a broader University programme in which companies give students €300 a month for ten months, along with an internship over the same period, agreed around their other obligations. Students gain practical knowledge, financial support and a chance of a job, because when we get close to someone, we are very likely to keep them. The call opens in October, and all the University’s students will be informed in time.

Anyone can start today, because there is so much free educational material online, and for someone who really wants to learn there are no obstacles beyond setting aside time and practising. We also have the UN1QUELY Cyber Security Academy, which is completely free for everyone who wants to get into cybersecurity. You can also ask people you know, or me on LinkedIn or any social network, for advice on what to learn first.

Three tips to remember

To finish, the host asked for three tips about scams that everyone should remember:

—Stay paranoid. When something seems suspicious, treat it as a scam, because it definitely is one.
—Keep basic IT hygiene for your accounts. Use complex, secure passwords and the password manager that is now built into every smartphone, so you need no extra app, and turn on two-factor authentication.
—Update your software regularly on smartphones, computers and apps, because it does a great deal for your security.

More conversations & talks