“Pause Verify Report: Spot the Fake” – A Message from Comptroller McNamara Marking Cybersecurity Awareness Month
To our colleagues across the Commonwealth of Massachusetts:
Each October, Cybersecurity Awareness Month reminds us to remain vigilant against those who seek to defraud the Commonwealth, compromise our systems, or steal sensitive information. But cybersecurity is not a once-a-year exercise. Protecting the Commonwealth requires strong internal controls and a security mindset every day.
Never has this been more important than right now.
The Commonwealth is adopting new artificial intelligence tools that can make public service more efficient and empower public servants to process data, respond to constituents, and organize reports like never before. However, all tools are double-edged swords, and as we grow more agile, so too do those who wish to defraud or steal public funds or information.
Spot the fake
Financially motivated fraudsters are using AI to operate faster and at greater scale. They have the ability to create increasingly authentic-looking emails, documents, images, video, and voices – using publicly available information to appear legitimate. What looks and sounds real may not be real.
That is why this Cybersecurity Awareness Month, we challenge Commonwealth employees to Spot the Fake.
It is difficult to determine what is authentic and what is AI-generated. Consider instead what you are being asked to do. If you receive something unexpected or unusually urgent, this should raise a red flag. Also – if it involves money, banking information, credentials, sensitive information, or a change to established procedures, or if you are being asked to bypass a normal control – these warning signs should raise your suspicions.
When something does not add up: Pause Verify Report.
- Pause before acting on an unexpected, unusual, or urgent request.
- Verify independently, particularly when money, sensitive information, credentials, or changes to established information or processes are involved.
- Report suspicious activity promptly so it can be investigated and others can be protected.
Use AI thoughtfully
The Executive Office of Technology Services and Security continues to provide thoughtful leadership as the Commonwealth embraces artificial intelligence—advancing cutting-edge capabilities while maintaining a strong focus on cybersecurity, responsible use, and the protection of the Commonwealth’s data and systems. Each of us remains on the critical front line of defense and this focus is more important than ever.
Use only authorized tools that have been vetted against risks. Even when using an approved system, consider the sensitivity of the information going in, and always review what comes out before relying on it for official Commonwealth business. AI can help us work more efficiently, but it does not replace human judgment, established internal controls, or our responsibility to verify our work.
The Office of the Comptroller continues to provide training, guidance, and resources on our CTR Cyber Awareness Training page to help Commonwealth departments reinforce cybersecurity and internal controls throughout the year. We look forward to working with you to be able to Spot the Fake, and protect Commonwealth systems, information, and finances.
Comptroller William McNamara