Alleged AI-Driven Phishing Scam Impersonates Maine Town Official to Falsely Request $22,500

An alleged AI-generated phishing email targeted a resident of Gray, Maine, falsely claiming to be from the town’s planning department. The alleged email, bearing a fake signature and official-looking letterhead, requested $22,500 for a zoning board meeting. Town officials have reportedly warned residents of increasing risks posed by AI-enabled scams, emphasizing that the town does not accept electronic payments and urging vigilance against similar fraudulent emails.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves the use of AI to generate a highly realistic phishing email to impersonate a public official and attempt to defraud a specific individual of $22,500.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was initiated by human scammers who intentionally used an AI text generator to create a fraudulent phishing email to deceive the victim.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3: Limited Risk. The incident involves AI-generated text content used to impersonate a public official, which falls under transparency obligations for AI-generated content.

AI system and alleged parties

• AI system: None named
• AI purpose: Writing Assistant; Text Style Replication
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Unknown scammers
• Alleged harmed parties: Town of Gray Maine officials, Steven Souchek, Residents of Gray Maine, General public, Doug Webster

Harm severity

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly exposed: 1

Potential causes

Management

• No Proactive Security Warning: The town did not warn applicants about potential phishing before the meeting.
• Lack of Secure Comm Channels: Management relied on standard email without secure portals for applicants.

Technology

• Generative AI Text Synthesis: AI synthesized highly realistic and persuasive phishing email copy.
• Digital Asset Forgery: AI-assisted tools easily copied official town letterhead and signatures.

Data Inputs

• Public Meeting Advertisements: Publicly posted zoning board details provided context for the spear-phishing.
• Public Directory Information: Names and titles of town officials were harvested from public websites.

Human Factors

• Trust in Public Authorities: Victims naturally trust emails appearing to come from local government.

Process and Methods

• Lack of Email Authentication: The town lacked email authentication protocols like DMARC to prevent spoofing.
• No Secure Payment Verification: No established protocol existed for residents to verify financial requests.

Regulatory Environment

• Anonymity of Generative AI: Lack of traceability in AI tools makes finding perpetrators very difficult.
• Limited Local Cyber Enforcement: Local law enforcement lacks resources to track sophisticated AI scams.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly details the phishing attempt, the specific amount requested ($22,500), the parties involved, and the confirmation by town officials that the email was AI-generated. There is no ambiguity about the outcome or the method used.
• Ambiguities identified: The specific AI model used to generate the email is not identified.
• Alternative interpretations: None. The event is clearly a targeted phishing scam using AI-generated text.

An isolated incident where scammers used generative AI to draft a highly realistic phishing email impersonating local municipal officials in Gray, Maine, to solicit a 22,500 dollar wire transfer. No financial loss occurred, and the national security impact is negligible to minor, representing an evolved cybercrime capability rather than a threat to national security.

• Overall national security impact: Minor
• Response level: Moderate
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The immediate localized incident has been resolved with no financial loss, but AI-enabled phishing represents an ongoing strategic concern.
• Autonomy: Human-controlled. The AI system was used strictly as a writing tool by human scammers who directed the creation and distribution of the email.
• Novelty: Evolved capability. Represents an evolved capability of traditional social engineering, using generative AI to create highly realistic and customized fraudulent communications.

Impact by dimension

• Physical security: Negligible. No threat to physical systems, critical infrastructure, or human safety occurred during this localized email phishing attempt.
• Information security: Negligible. No intelligence compromise, state-sponsored information warfare, or systematic disinformation campaigns were indicated.
• Sovereignty: Minor. The incident involved the impersonation of local municipal officials and forged signatures, but the impact was minor and managed through standard local communication procedures.
• Economic security: Negligible. The incident involved an attempted fraud of 22,500 dollars targeting a single individual, presenting no threat to national economic or technological security.
• Societal stability: Negligible. No threat to social cohesion, civil liberties, or population safety was present in this isolated financial scam.