Doña Ana County

Kent English

Cybersecurity Defense Leader

The Growing Threat of AI-Enabled Crime

Criminals are using Artificial Intelligence as an engine to bypass security and commit digital crime. They have effectively weaponized AI by making deception, targeting, and scale cheaper and faster.

For government entities, the main risk is not rogue super intelligence—it is ordinary fraud, disinformation, harassment and cybercrime attacks made more convincing and automated.

Common Weapons in AI-Enabled Crime

Impersonation is used to convincingly portray someone’s likeness, voice, or writing style using publicly available information. Real-time audio cloning and deepfake videos during phone calls or video chats are used to extort money for mock accidents, medical emergencies, and fake kidnappings. AI deepfakes are used to impersonate employees or vendors to bypass authentication based on voice recognition. Voice cloning from public recordings, voicemail, meetings, or social media clips can be used for urgent payment requests, false “IT support” calls, and emergency scams. AI voice engines linked to automated robocallers can place realistic emergency calls like active shooters or bomb threats, which strain public safety resources and put people in physical danger.

Identity Fraud is used to create authentic-looking invoices, résumés, IDs, and claims to commit procurement fraud, benefits fraud, and take over accounts. Generative AI models can produce synthetic driver's licenses, passports, and utility bills that bypass identity verification algorithms at banks, crypto exchanges, and remote job application portals. AI can also be used to create realistic online profiles to gain employee trust before launching an attack.

Disinformation is used to produce false or misleading content, which is easier to personalize and harder to distinguish from real communications. AI can generate large volumes of posts, comments, emails, generated images, and fake local “news” articles. Disinformation campaigns erode trust, exacerbate public controversy, and disrupt elections or emergency responses. False claims often spread faster than can be verified. Even after they have been corrected, confusion and distrust may linger.

Harassment is used to generate abusive content targeting individuals, public employees, elected officials, businesses, and community groups. AI automates the collection and redistribution of public and leaked information. Exposing an individual’s sensitive information (home addresses, family details, routines, contact information) or “Doxing” is a common form of harassment and intimidation.

“For government entities, the main risk is not rogue super intelligence—it is ordinary fraud, disinformation, harassment and cybercrime attacks made more convincing and automated.”

Phishing is used to create targeted messages to facilitate theft, fraud, and ransomware. Personalized messages can be mass-produced, matching an individual’s style and voice, using local context. AI has made phishing more convincing by eliminating the “red flags” that people use to detect it, like bad grammar and generic content.

Malware is used to modify code, create malicious scripts, or automate testing of stolen credentials. AI can be used to make malware development and deployment faster and easier for lower-skilled attackers. Self-altering malware can adapt and evade detection by generating and rewriting itself with a unique signature for every execution. AI can also be used to scan for zero-day vulnerabilities and dynamically create code to exploit a specific system before a solution is available.

The Increased Danger of Weaponized AI  

Weaponized AI increases harm by improving five capabilities at once: scale, personalization, speed, credibility, and language reach. Together, they let bad actors target more people with more convincing content in less time.

AI gives attackers several advantages that make fraud campaigns more difficult to detect and contain. The scale of these attacks is difficult to match with traditional methods, allowing bad actors to generate thousands of tailored messages, social posts, fake reviews, or scam calls with very little effort. A single campaign can target every employee in a department or every customer of a local business.

Personalization makes those attacks more convincing. AI can incorporate names, job roles, vendors, current projects, public meetings, procurement notices, social posts and other available details into a scam. A phishing email, for example, can appear to relate to a real contract, permit or invoice, making it harder for the recipient to recognize it as fraudulent.

Attackers can also move at unprecedented speed with AI. They can create, revise, translate and deploy code or content in seconds, allowing them to modify an attack as soon as defense systems detect and block it. A fake emergency notice can also be customized and distributed before official communications are issued.

The credibility of AI-generated content removes many of the warning signs people have traditionally relied on. AI can produce polished grammar, proper formatting, realistic documents, cloned voices, synthetic images and deepfake video. It can imitate official terminology and communication styles closely enough that a staff member may receive what appears to be an authentic request from a director, vendor, IT technician or county department.

Language is no longer much of a barrier either. AI can make scams multilingual and locally relevant, translating and adapting content while adjusting wording, tone and cultural references. Attackers can generate messages in multiple languages using local terminology, allowing a scam to reach English- and Spanish-speaking residents with communications that feel specific to their community.

Building the Core Defense against Weaponized AI

Mitigate weaponized-AI risks by strengthening identity verification, technical controls, staff readiness, and incident response. The main objective is to ensure that a realistic email, voice, video, document, or social-media post cannot, by itself, cause a high-impact adverse action.

For requests involving money, credentials, sensitive information, public alerts, or exceptions to policy, require independent verification, secure systems of record, trusted contact channels, documented approvals, and strong authentication. Create an AI acceptable-use and risk-management standard and ensure that training emphasizes behavior, not just awareness.