Dubai: Dr Bushra Al Balushi, Director of Governance and Risk Management at the Dubai Electronic Security Center, warned that some fraudsters study victims before targeting them, gathering information about their work, interests and relationships to build detailed profiles.
She made the remarks on the sidelines of the Cyber Security Media Forum, launched by the Dubai Media Academy, affiliated with the Dubai Media Foundation, in cooperation with the Dubai Electronic Security Center on October 13 to coincide with Cyber Security Awareness Month.
Fraudsters use the information they gather to communicate in ways that appear natural and trustworthy, deceiving victims into clicking links or taking actions that give them access to data or accounts. Al Balushi warned against excessive sharing of personal information on social media.
She said the method, known as social engineering, exploits information available about people and manipulates their trust rather than relying solely on hacking technical systems.
A person may receive a call from an unknown individual urging them to click a link or take immediate action. The pressure of urgency can prompt them to comply without verifying the caller’s identity or whether the request is genuine.
Humans are the weakest link
Al Balushi stressed that humans remain the weakest link in cybersecurity, regardless of how advanced protection systems become.
Institutions, particularly banks, provide multiple authentication methods and secure systems, but hackers can sometimes bypass them by deceiving users into taking steps that facilitate access to their data.
Banks also have specialised units to combat cybercrime, but protecting users requires awareness of fraudsters’ methods and avoiding calls or messages designed to pressure them into making decisions without verification.
Attempted fraud
Al Balushi said the challenge is no longer limited to identifying obviously fake messages. The growing use of artificial intelligence by hackers and fraudsters has made it more difficult to distinguish genuine messages and links from deceptive ones.
Some messages appear official and convincing, making it harder for users to determine whether they are genuine or fraudulent.
She recalled receiving an official email invitation from someone introduced as the Deputy Secretary-General of the International Telecommunication Union. As she had never dealt with the Union before, she questioned the authenticity of the message and did not open or interact with it.
She waited two days before contacting the Telecommunications Regulatory Authority and the Digital Government to verify the person’s identity and the authenticity of the email. She then discovered that the invitation was genuine and the sender did hold the stated position.
Al Balushi said the experience showed that legitimate messages can appear suspicious, while fraudulent messages can look official and credible. Users should therefore take time to verify the sender and the authenticity of messages through trusted communication channels before responding or opening links.
Integrated system
Al Balushi said there is an integrated coordination system between the Dubai Electronic Security Center and Dubai Police, with responsibility determined by the nature of the incident and report.
Cybercrime cases were previously handled through a manual system before the launch of the “eCrime” platform in cooperation with Dubai Police.
The competent authority depends on the nature of the incident and the entity targeted. If an employee suffers a breach in connection with their work, whether in the government or private sector, the Dubai Electronic Security Center handles the incident.
If a person is subjected to cybercrime as an individual, Dubai Police is the competent authority. Some cases require cooperation between the two entities depending on the nature of the report.
Risks of deepfakes
Al Balushi warned about the dangers of deepfakes, fabricated content and misinformation. She said the country has been targeted through misleading content and that the volume of misinformation monitored was large compared with genuine information.
Mirage programme
The challenge prompted work on the “Mirage” programme, designed to distinguish genuine visual content from misleading material.
Al Balushi said the programme has an accuracy rate of 91% in verifying the authenticity of content, which she described as the highest globally among open sources.
The programme is scheduled to become available by the end of the year, after procedures to make it available within open sources are completed, helping users distinguish genuine content from fabricated material.
Efforts to combat deepfakes also cover other forms of cybercrime, including impersonation of individuals, websites and government agencies, with initiatives aimed at countering evolving fraud methods.
Al Balushi stressed that tackling these crimes requires both technical solutions and greater user awareness. Stronger protection tools cannot prevent fraudsters from exploiting trust or lapses in attention, making it essential to pause and verify before responding to messages or calls.
AI and malware production
Majd Sinan, Head of Business in the UAE and Oman at Kaspersky, said artificial intelligence has enabled hackers to shorten the process of carrying out cyberattacks.
People with basic technical knowledge can use AI tools to write malicious software code and produce viruses without advanced programming expertise, contributing to more attacks and greater automation.
While AI is increasingly used across businesses, hackers are also using it to develop their capabilities and attack methods. Producing malicious software no longer necessarily requires specialist coding expertise, as a person with limited knowledge can ask an AI tool to produce code for a malicious programme that can be used to develop a cyberattack.
Malware
Sinan said malware production is no longer limited to professional hackers. People with relatively little technical knowledge can produce large quantities of malware, requiring cybersecurity companies to continually develop their capabilities.
Kaspersky systems detect approximately 500,000 new virus and malware samples every day, reflecting the rapid development and growth of cyber threats.
AI has also made content used to lure victims more convincing. Available tools can produce images, videos and voice calls that may be difficult for the average user to distinguish from genuine material, making deception easier and potentially helping attackers bypass protection measures.
A major vulnerability
Sinan stressed that even advanced technical protection can be undermined by an employee or user without sufficient cybersecurity awareness.
Fraudsters can bypass technical protections by deceiving individuals into taking actions that provide access to data or systems.
Using security measures on mobile phones and computers is a basic step, but protecting privacy also requires avoiding the sharing of personal and sensitive files and information on social media. Such information can be exploited to prepare targeted attacks or carry out extortion.
Penalties for online fraud
UAE law does not treat electronic fraud merely as a financial dispute between two parties, but criminalises it as an attack on funds using information technology.
Under Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes, Article 40 provides for imprisonment for at least one year and a fine of between Dh250,000 and Dh1 million, or either penalty, for anyone who wrongfully appropriates movable property, a benefit or a document for themselves or another person using fraudulent means, a false name or impersonation through an information network or information technology.
Penalties vary according to the nature of the offence. Article 15 covers fraud involving credit or electronic cards or electronic payment methods and provides for imprisonment and/or a fine ranging from Dh200,000 to Dh2 million, according to the circumstances specified in the provision.
Fraud does not necessarily involve hacking a bank account. It can involve fake messages and links, impersonating a bank employee or official, or creating fraudulent accounts to lure victims.
The determining factors are the elements of the offence, evidence establishing the incident and the role of each perpetrator, rather than simply whether financial loss occurred.