Artists Could be Target in AI Scams

As the Arts Council takes cybersecurity very seriously, we could not figure out how a scammer could have access to the emails of our artist members. Upon research, we learned that all of the artists who got the email had one thing in common, they were all listed on our website (First Name, Last Name) as members of the organizations.

There are no emails attached to these names, so how could an attacker get access to the emails of the artists on that list? The answer is AI.



Scammers have become increasingly sophisticated in their tactics, asking the AI to take all the names from a list (like our website) and prompt it with information about the geographic location to scrape the web and collect artist's email addresses.

Although this particular attack was obviously a scam (our Board Chair asking for gift cards), this may not be the case for long. AI tools have the potential to create specific and compelling outreach tactics that can be very targeted to a particular demographic.

Another example that Steph has personally recieved was less nefarious, but shockingly sophisticated in its approach. Being an artist herself, she has a profile on a website called Creative Ground, which is a public artist directory managed by the New England Foundation for the Arts (NEFA), a federally funded regional arts service organization.

At first it seemed like it may be a legitimate email, but there were a couple things that made her pause. First, the subject line that included the phrase "polite warm outreach". The second was a reference to a mural titled "Technicolor FUNK". Steph does not name my murals, so this made her very curious...

To solve the mystery, she turned to Claude to try and figure out what was going on. Claude confirmed, "Yes, this email was almost certainly generated or heavily assisted by an AI outreach tool. - Polite warm outreach!" is a directive telling the tool what register to write in. When that bleeds through into the actual subject, it is a strong sign the message came out of an automated personalization tool." 

The answer to the "Technicolor FUNK" mystery was even more interesting. According to Claude, "Technicolor FUNK" is not on your murals page anywhere. So that name was not read off your site, because there is nothing there to read. It was invented. "Technicolor FUNK" is exactly the kind of evocative, plausible-sounding title an AI will confabulate when it is told to write a warm personalized compliment about a colorful, maximalist mural and has no actual title to work with."

-

Although this email was relatively harmless (just an artist trying to get others to engage with his platform), the implications of what this technology can do raises a major RED FLAG. Imagine the extreme level of sophistication that attackers may develop to try and scam artists by posing as legitimate buyers interested in their artwork.

It also raises the question of how arts organizations will need to handle the public sharing of artist data, especially when most artists want to get their name out there. In the case of Creative Ground, there are currently 25,119 profiles, about 9600 of those belong to individual artists. Most include artists names, email addresses, phone numbers (often artist's personal cell numbers), and websites.. all publicly listed.

With the rise of AI, I believe we need to begin a serious conversation about what needs to be done now to prevent a potential looming "Scampocalypse" and protect our creatives from being taken advantage of by increasingly sophisticated attacks. I am in the process of contacting NEFA now to alert them to this concern.