PrivacySignal
Enforcement

LLM-Based Social Engineering Scams

Schneier on Security · · International · Enforcement

OpenAI identified and disrupted a Cambodia-based group using ChatGPT to run coordinated social engineering scams, including romance fraud, fake cryptocurrency investment schemes, and impersonation of law enforcement. The operation ran multiple scam types simultaneously, often combining tactics to build victim trust before introducing financial fraud.

Why this matters: This is what scam-as-a-service looks like when it gets an AI upgrade. Building a convincing romantic persona used to take time and skill. Now it scales. One operator can run dozens of fake relationships, fake cops, and fake investment advisors at once, with the language polished and the lies consistent. The people targeted are not careless — they are worn down by patient, well-crafted manipulation. The real issue is that the same tools sold as productivity software are being used to defraud ordinary people out of real money, and the burden of spotting the fake falls entirely on the victim.

Who should care: Lawyers · Privacy officers · Compliance · General readers · AI governance · Policy

This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.

Analysis

All analysis →

Weekly Editorial Analysis from Experts and Editors

Deep Signal · Part I of III

The Algorithm Said So

Federal rulemakers are deciding what to do when artificial intelligence produces the kind of conclusion that once required an expert. They disagree about how to regulate it. They also disagree about whether the problem has arrived.

· 10 min read Read →

Related stories

Enforcement
IAPP · · International

Washington's attorney general reflects on state's privacy legislation and enforcement

Washington State's attorney general has spoken publicly about the state's consumer privacy law and how it is being enforced. The remarks offer a look at how one of the more active state-level privacy offices views its own record and priorities.

Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy

#enforcement#state-privacy#privacy Read original →
Enforcement
EDPB · · EU

Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing

Italy's data protection authority fined BBVA's Italian branch over 5.5 million euros after the bank continued direct marketing to a customer who had formally objected to it. The decision cites violations of GDPR principles covering data processing, transparency, the right to object, and controller accountability.

Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy

#enforcement#gdpr#regulation#privacy Read original →
Enforcement
EDPB · · EU

Italian DPA fines security company EUR 39 000 for violations concerning employees’ data

Italy's data protection authority fined security firm La Patria S.p.A. €39,000 following an employee complaint. The violations involved failures to provide transparent privacy information and blocking workers from accessing their own personal data.

Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy

#enforcement#gdpr#privacy Read original →
Enforcement
EDPB · · EU

Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data

Italy's data protection authority fined IQVIA Solutions Italy €7 million following a finding that the company processed patients' health data without a lawful basis. The decision cited violations across multiple GDPR provisions, including rules on sensitive data, transparency, data protection by design, and impact assessments.

Who should care: Lawyers · Privacy officers · Compliance · Healthcare professionals · AI governance · General readers · Policy

#enforcement#healthcare#gdpr#privacy Read original →
Enforcement
EDPB · · EU

Italian DPA fines Emirates EUR 180 000 for infringements concerning passengers’ health data

Italy's data protection authority fined Emirates €180,000 following an investigation into how the airline handled passengers' health data. The ruling cited violations of GDPR principles on lawful processing, transparent communication, and disclosure obligations at the point of data collection.

Who should care: Lawyers · Privacy officers · Compliance · Healthcare professionals · AI governance · General readers · Policy

#enforcement#healthcare#gdpr#regulation#privacy Read original →
Enforcement
The Record · · International

ASOS: Hackers tricked way into employee account before sending rogue push notification

ASOS confirmed a breach in which attackers used social engineering to access an employee account, then sent unauthorized push notifications. The incident exposed some customer personal information, including names and contact details, along with non-personal account data.

Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy

#enforcement#privacy Read original →