Dear Readers,

As a threat hunter and the founder of a company that helps clients become more resilient against cyberattacks, I am deeply aware of the rising threat of deepfakes. A year ago, those of us on the cybersecurity front lines advised people to look for artifacts in suspicious videos and images, or search image databases to determine whether a photograph had been stolen from a legitimate account.

Throw that advice out the window.

Today, deepfakes can be extraordinarily convincing and increasingly created by AI from whole cloth. And as you will see below, the best cons now resemble something intelligence services have perfected for generations: the legend, a carefully constructed false identity designed to survive scrutiny.

I’ve warned about this evolution since my first book Gray Day. Cybercriminals have entered the world of spies, borrowing and adapting the best techniques from the professionals of deception. Artificial intelligence is now making those techniques cheaper, faster and available to almost anyone.

The stories below are both a lesson and a warning. If we want to protect ourselves from the next generation of cybercrime, we need to stop automatically believing what we see and hear and start thinking like spy hunters. Because the person asking for your trust, your money or even your heart may be someone who doesn’t exist at all.

Trust carefully. Verify relentlessly. And always think like a spy.

Stay safe out there,

Eric

Daejon Love looked like a professional football player.

On social media, the 35-year-old wore San Francisco 49ers gear, posed in luxury cars, flashed expensive watches and projected the life of a wealthy professional athlete. At one point, he reportedly posted a Google search result identifying him as an NFL player. “That’s Google, not me,” he said.

Except Daejon Love never played for the San Francisco 49ers.

According to federal prosecutors, he played something else entirely.

For more than four years, the FBI alleges, Love built an elaborate false identity and used it to romance women he met through Tinder, Bumble, Hinge, Facebook Dating and other platforms. Sometimes he was a 49ers player. Sometimes he was a fabulously wealthy real estate investor. But the objective was allegedly the same: establish trust, build an emotional relationship and eventually turn romance into money.

Federal investigators have identified at least 26 women in Oregon, Washington, Idaho and California who lost approximately $1.3 million. The FBI believes there may be more victims.

Love allegedly didn't run the con alone. Prosecutors say 18-year-old Taylor Jamie Chan played his investment adviser. That detail is important. A good lie becomes much more believable when someone else confirms it.

The women were allegedly shown fake bank and investment accounts displaying millions of dollars. Some participated in FaceTime calls where they were shown fictitious investment gains. Love allegedly told women that he wanted to build wealth with them and create a future together.

That's where the romance fraud became something even more dangerous: pig butchering.

Pig butchering is an ugly name for a brutally effective crime. The criminal doesn't immediately ask for everything you have. He builds the relationship, establishes trust, introduces an investment and may even show enormous fictitious profits. Then he encourages the victim to invest more.

The victim is being fattened for slaughter.

Some of Love's alleged victims were encouraged to take out personal loans to invest more. Prosecutors say no identified victim received her investment returns.

The FBI arrested Love and Chan at the Boise airport on August 24. Investigators say Love had traveled to Idaho to meet new victims.

But there is another reason this case should get your attention.

As far as the public allegations currently show, Love didn't need a deepfake to pull this off.

Imagine what the next Daejon Love will be able to do when he does.

A few years ago, impersonating another person online required work.

You needed stolen photographs, fake profiles and a good story. You had to avoid video calls because eventually the victim would want to see your face. Every new interaction created another opportunity for the legend to collapse.

Artificial intelligence is eliminating those problems.

Ask Anne, a 53-year-old French woman who believed she was having a romantic relationship with Brad Pitt.

What followed was an 18-month relationship constructed through messages, fake social-media accounts, WhatsApp conversations and AI-generated images. When Anne became suspicious, the scammers manufactured more evidence.

When “Brad” supposedly developed kidney cancer, she received AI-generated images showing him in a hospital bed. The scammers claimed his accounts were frozen because of his divorce from Angelina Jolie and that he needed money for treatment.

Anne eventually sent €830,000.

There is an understandable temptation to laugh at stories like this. Don't.

Fraudsters don't need to fool everyone. They need the right person at the right moment and enough patience to manipulate that person's emotions. Loneliness, fear, greed, urgency and love are vulnerabilities that don't require a software patch.

AI simply gives the criminal better tools to exploit them.

Romance isn't the only emotion criminals can exploit. Fear works just as well.

Deepfake advertisements have circulated showing what appeared to be Bill Gates promoting miracle treatments for Alzheimer's disease and dementia. Other versions have impersonated celebrities and trusted public figures including Samuel L. Jackson, Steve Martin, Bruce Willis and Dr. Sanjay Gupta.

The videos, spread across Facebook, Google and other sites, funnel victims to fake news pages resembling CNN or Today. In one, an AI-generated Bill Gates invokes his father’s Alzheimer’s disease while promoting MemoPryl; in another, a deepfake Samuel L. Jackson claims the supplement helps him remember his lines. Yet MemoPryl’s website offers little more than a storefront, with no meaningful information about who develops or manufactures the supposed brain-health supplement.

Just so we are clear, there is no miracle honey cure for Alzheimer's disease!

There is, however, a very effective business model for criminals willing to target frightened families.

One 82-year-old California man encountered what appeared to be a celebrity-backed advertisement for an Alzheimer's breakthrough. He considered himself savvy about fraud. He later told a reporter that he thought he was “un-scammable.”

He lost more than $500.

That's where deepfakes become much more dangerous than amusing videos of celebrities saying ridiculous things.

The criminal doesn't need to impersonate someone you personally know. He can impersonate someone you already trust. A billionaire. A physician. A journalist. A movie star. A CEO.

Or even your daughter.

When I worked counterintelligence for the FBI, we used a word for the carefully constructed identity that allowed an intelligence operative to become someone else: a legend. A good legend wasn't merely a fake name. It was a manufactured life supported by a believable history, relationships, documents and enough corroborating details to survive scrutiny. Intelligence services spent enormous time and money building them.

Generative AI is democratizing the legend.

That's the larger story behind the fake 49ers player. Love allegedly built his legend the old-fashioned way—with clothes, cars, social media, dating profiles, fake financial information and another human being playing his financial adviser. The next criminal can manufacture much of that with AI.

Photographs. Voices. Documents. Video. Writing styles. Supporting characters. Entire conversations in languages the criminal doesn't even speak. AI didn't invent fraud. It is industrializing impersonation.

For most of our lives, seeing and hearing someone helped establish identity. Those signals can now be manufactured. Our eyes and ears can provide evidence, but they can no longer provide authentication.

A spy hunter begins with a useful assumption: the person on the other side of the table may not be who he claims to be.

You don't need to become paranoid. You simply need to become harder to fool.

For years, the advice for identifying deepfakes was to study the image. Watch the blinking. Look at the fingers. Listen for strange pauses. Check whether the lips match the words.

Forget it. Those tricks may expose a bad fake, but betting your bank account on AI continuing to draw weird fingers is not a cybersecurity strategy.

The better defense is simple: Stop authenticating the person. Authenticate the request.

If your daughter calls saying she's in trouble and desperately needs money, hang up and call her known number. If your CEO appears on Teams ordering an emergency wire transfer, verify it through established financial controls. If someone you met online wants to help you invest, independently verify the company and the adviser.

Families should establish a private challenge-response phrase or question now. Businesses should build the same principle into payments, password resets and other sensitive requests. Most importantly, never allow the person making the request to control how you verify it.

Daejon Love allegedly convinced more than two dozen women that he was someone he wasn't. Prosecutors say the scheme extracted approximately $1.3 million—and he allegedly did it without AI manufacturing his face or voice.

The next guy won't have to and that should worry all of us.

If you enjoyed this week’s newsletter, you’ll find even more inside my new book, SPIES, LIES, AND CYBERCRIME. Drawing on my years hunting spies for the FBI, it reveals how espionage, cybercrime, and AI-powered deception intersect—and what you can do to stay one step ahead.

Praise for Spies, Lies, and Cybercrime in Forbes Magazine!

Ready for the next mission?

Already read the book? A quick review on Amazon or Goodreads helps more readers discover it. Thank you for your support.

This weekend I joined CNN News Central to discuss the Daejon Love case and how romance fraud can evolve into something even more lucrative: pig butchering.

The alleged scheme is a remarkable example of how much damage a convincing false identity can already cause before we add sophisticated AI impersonation to the equation.

Watch my CNN interview: The Fake 49ers Player Who Allegedly Swindled Women Out of $1.3 Million

Please support my sponsors. It only takes a click - no purchase necessary!

Most K-Cups sit in a warehouse for months before they reach your brewer — and you can taste it. Angelino's, a third-generation roaster in Los Angeles, does it differently: every pod is roasted, ground, and sealed fresh in-house, then shipped to your door within days of roasting.

Choose from 50+ specialty coffees — single origins, dark roasts, flavored favorites like Jamaican Me Crazy, plus decafs and teas — all compatible with your Keurig® brewer. Mix and match any coffees you like, and watch the savings climb: bulk discounts start at 5+ boxes and reach up to 34% off at 12+.

And here's the best part: new customers get an extra 15% off their first order, on top of bulk savings. It's applied automatically at checkout — no code, no subscription required. Free shipping on orders over $49 or 4+ boxes.

Fresh coffee shouldn't require a coffee shop.

Get 15% Off Today

If someone forwarded you this newsletter, join more than 4,700 readers every Tuesday for practical lessons from the worlds of espionage, cybercrime, artificial intelligence, and the human stories behind them.

Stay safe out there and keep thinking like a spy hunter.

Praemonitus Praemunitus!

Forewarned is Forearmed!

~Eric