Allyson, 24, blev måltavla för AI-driven sexutpressning

Chris Cline was sitting by a hotel pool with his wife last month before attending an American Farm Bureau Federation conference in New Orleans when he got a text from an unknown number.

Someone with a California area code had created a group chat that included his wife, Jeanne, son-in-law, Jordan Parmley, and Jordan’s parents. “All the Cline family and the Parmley family I have something to show y’all,” the sender wrote. “Let me add more family.”

The sender then added Chris’s 16-year-old son. “About to start guys,” the mystery sender wrote.

Chris typed, “Who is this?”

“Block the number Chris,” Jordan wrote in the group chat.

Before Chris could block it, the sender attached a photo plucked from the public Facebook account of his 24-year-old daughter, Allyson. It was a picture of Allyson and Jordan riding in a golf cart. Next, the sender posted a photo of what appeared to be Allyson engaging in a sexual act.

The family members blocked the number, but there was confusion about what was happening. Chris, who handles public relations for the Missouri Farm Bureau, and counts an identity-theft monitoring and prevention firm among his clients, gathered that the texts were leading to a demand for money to prevent the further release of ostensibly AI-generated images.

Allyson and Jordan were watching a TV show in their home in Park Hills, Mo., when the messages came through.

Jordan says he was immediately suspicious. Then he saw the image. “We don’t take photos like that because we know how insecure phones can be, and we’re not like that anyway,” says Jordan, who works remotely for a power company.

“My heart dropped in my stomach,” says Allyson, a medical receptionist. “I felt like my identity had been ripped from me.”

Months earlier, Chris had helped his identity-theft client pitch stories about sextortion, which involves using the threat of sharing pornographic images—real or fake—to extract money from victims. Teenage boys have lately been a key target of sextortion schemes. Now, he was living it.

Scammers are finding new targets, and AI is making it easier.

“This is all automated,” says Michael Scheumack, chief innovation and marketing officer at IdentityIQ, the firm Chris represents. “It’s not someone sitting there researching people, they’re using AI to scrape social-media accounts and publicly available images.”

Allyson felt deeply embarrassed that her family, including her husband’s parents, saw the convincing-looking image.

“My in-laws called us immediately and asked what this was,” Allyson says. “We walked them through how to get rid of the photo and how to mark the message as spam and report it.”

The family wondered whether a wedding e-vite Jordan had responded to that day could have been connected. Scams in which criminals send fake electronic invitations to steal email credentials are a growing problem. But Allyson says she and Jordan confirmed that the invitation was issued by their friends, and wasn’t a spoof.

Cybersecurity experts say what happened to this family could happen to anyone.

One of the family members or someone they all know might have had a compromised email account that was used to obtain their phone numbers. The scammer could also have used information publicly available on the internet.

In either scenario, AI was likely employed to gather and analyze information on the family members and how they are related, says Steve Grobman, chief technology officer at cybersecurity software company McAfee.

“If you take over someone’s email account that has contacts, you have all the information you need,” Grobman says, “emails, phone numbers and hints from messages of how people are related.”

In the past, scammers would have manually combed through social-media profiles and other online data to piece together details about potential targets and obtain contact information. Now, someone with a powerful computer and an open-weight AI model —a publicly released AI model that is free to download and run—can execute large-scale scams.

“Bad actors are not using the AI services consumers use, like Gemini, ChatGPT or Claude, which would have the ability to observe what they’re doing and stop them,” Grobman says. “They’re most likely using models that are running on dedicated machines.”

Similarly, creating fake pornographic images of people could be as simple as using one of numerous clothes-removal programs on the internet, he says.

However it happened, being the subject of AI-generated nudes has repercussions that go beyond the initial embarrassment.

“I’m not sure where that image went,” Allyson says. “My fear is that this could resurface and blow up more than it already has.”

Unless you are a high-value target with millions in bitcoin or a huge public following, you might not consider yourself a target. That doesn’t mean we shouldn’t all follow these simple steps to protect ourselves:

Set your accounts to private. It is hard to eliminate every photo of you on the internet, but don’t make it easy for criminals to get photos from your social-media accounts. Make your Facebook and Instagram accounts private and only accept follow requests from people you know. After the group-chat situation, that is what Allyson did.

Manage your passwords and authentication. Use strong, unique passwords for every email, financial and social-media account. Go to the security settings and turn on two-factor authentication for all services, too. If you’re the victim of a sextortion scam or other type of cyber fraud, change your passwords immediately.

Disconnect from online sessions. Scheumack recommends going into the security settings of your email and social-media accounts, checking which devices are signed in and ending any suspicious or unknown sessions. If criminals are logged in, they can continue accessing an account for a while after you change its password.

Don’t pay. If you receive demands for money in a sextortion scenario, cybersecurity experts advise not paying. Instead, block the scammer and report the phone number or social-media username to the FBI’s Internet Crime Complaint Center.

“If you don’t pay, will they send the photo? Possibly,” Grobman says. “If you do pay, will it guarantee they won’t? Not necessarily.”