Cyber expert Richard Mallam has warned that criminals can now rebuild a person from leaked personal information, social media photos and short voice clips, creating an AI digital twin capable of opening loans, credit cards and leases in the victim’s name. Mallam, a former Google executive, told the Daily Mail on October 24 that rapid advances in deepfake tools make it frighteningly difficult for businesses to tell a real person from a sophisticated impersonation. Victims, he said, may learn nothing until a debt notice arrives. He also cautioned that the worst-case scenario, money vanishing from bank accounts overnight, has not arrived yet, and argued that institutions holding sensitive data must carry more of the responsibility for stopping it.
How A Digital Twin Gets Built
According to Mallam, the raw material for a digital twin is already public. Criminals can find personal information that has leaked, take imagery from social media, and take a clip of voice from TikTok, then use AI deepfake tools to recreate the person. The result, he said, is very difficult for a business to assess: it cannot easily understand whether it is dealing with the real person or a deepfake of them.
The warning describes a risk rather than a named case. No specific victim was identified in the account, and the figures Mallam cited, including thousands of fraudulent calls to financial institutions each week, were presented as his own assessment rather than a published dataset. What makes the warning concrete is the mechanism he described: identity verification systems that were built for a world of documents and passwords now face replicas built from a few seconds of voice and a handful of photos.
From Fake Identity To Real Debt
Mallam said a digital twin could be used to sign up for services and operate on a person’s behalf, from leasing vehicles to taking out loans and credit cards. Scammers can originate a loan or a payment plan using data, face and voice stolen from the victim, he said. The victim’s first sign of trouble may be waking up to a debt notice, with many people unaware they were scammed until the bill arrives.
Financial institutions are already in the firing line, according to Mallam. Banks and super funds receive thousands of fraudulent calls every week from hackers using AI bots attempting to take over customer accounts. He warned Australians against staying on the phone to toy with suspected scammers, because criminals could potentially capture their voices in the process. All they need, he claimed, is a few seconds of voice, bank details, and access to a phone or email to confirm a bank’s verification. The same pattern of AI systems reaching into bank accounts without proper vetting has already troubled the financial sector.
Scale Changes The Threat
Mallam said AI is not only making scams more convincing but letting criminals target vastly more people at once. Where an attack used to be one person against one victim, one operator can now coordinate tens of thousands of agents running scams concurrently, hitting more people and more businesses with more sophisticated attacks.
He described organised criminal networks behind the shift, including scam farms where large groups of people are lured with false job promises and set to work phones targeting people in richer countries. More sophisticated hackers, he said, may work with organised crime gangs or state actors under profit-sharing arrangements, coordinating mass attacks with advanced AI tools. Government services such as the ATO and Medicare will become increasingly attractive targets, he warned, because they hold vast amounts of sensitive personal and financial information. Without dramatic strengthening of cybersecurity defences, he said, it is almost inevitable that one or more of these critical services will be breached.
Why It Matters
The digital twin warning matters because it moves the scam threat from persuasion to replication. Older scams needed a victim to believe a story; a convincing replica needs only to pass a check. That puts the weak point on verification itself, and on institutions that still treat a voice on the phone or a face on a screen as proof of identity. Mallam’s argument is that individuals cannot reasonably be expected to spot replicas that are built to defeat exactly the checks they are given, which is why he wants banks and governments to shoulder more of the defence. Governments are already drawing up statewide AI cyberattack plans as the same class of threat spreads beyond individual victims.
Background
Warnings about AI-driven impersonation have escalated through 2026, with Australian banks warning about cloned voices and faces built from seconds of public content, and a week of AI-assisted exploitation waves showing how quickly a disclosed flaw turns into mass scanning. Mallam’s warning extends that pattern from impersonating a trusted contact to impersonating the victim outright, and his protection advice is deliberately basic: unique passwords for every service, multi-factor authentication wherever available, passkeys and biometrics, and extreme caution about sharing personal or card details with unfamiliar businesses online.
Source: Daily Mail
0 Comments