Scams that steal more than money.
[ Music ]
Dave Bittner: Hello everyone, and welcome to N2K CyberWire's "Hacking Humans" podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner, and joining me is Joe Carrigan. Hey Joe.
Joe Carrigan: Hi Dave.
Dave Bittner: And our N2K colleague and host of the "T-Minus Space Daily" podcast, Maria Varmazis. Maria.
Maria Varmazis: Hi Dave, and hi Joe.
Dave Bittner: We've got some good stories to share this week. Why don't we jump right in here. I'm going to lead things off for us with a question for both of you.
Joe Carrigan: Okay.
Maria Varmazis: Mm hmm, okay.
Dave Bittner: Have either of you ever done any modeling, [laughter]?
Joe Carrigan: [Laughter].
Maria Varmazis: [Laughter].
Joe Carrigan: Yes, [laughter].
Maria Varmazis: Do tell.
Joe Carrigan: I've done modeling, [laughter], I've done modeling for slouchy fat guy clothes.
Dave Bittner: [Laughter].
Maria Varmazis: [Laughter].
Joe Carrigan: No, I've never done any modeling, Dave.
Dave Bittner: [Laughter].
Maria Varmazis: So Costco's got your number, is that my understanding, [laughter]?
Joe Carrigan: [Laughter].
Dave Bittner: [Laughter].
Maria Varmazis: We love Kirkland in my house, I'm just saying.
Joe Carrigan: I have - I was looking for my Kirkland jacket this morning, couldn't find it.
Dave Bittner: Uh huh, yeah.
Maria Varmazis: [Laughter].
Joe Carrigan: It was a little cold out.
Dave Bittner: Yeah.
Joe Carrigan: So I put on my CyberWire jacket.
Dave Bittner: Okay. Maria?
Maria Varmazis: It will shock you hear, I have never modeled in my life. I know, it's very hard to believe. I know
Joe Carrigan: That does shock me.
Dave Bittner: [Laughter].
Maria Varmazis: What, [laughter]? Thanks.
Dave Bittner: Well, I have done some modeling, [laughter].
Maria Varmazis: Okay.
Joe Carrigan: I'm sure you have.
Maria Varmazis: Yeah, actually, yes. I feel like you told -- this is one of your two truths and a lie thing. Yeah, yep.
Dave Bittner: Yeah. No, when I was a child.
Joe Carrigan: Oh, that's right. You were in a -
Dave Bittner: I did modeling, and I did some TV commercials. I did, you know, did a lot of theater and things like that. But I did some modeling for clothing, in some catalogues and local clothing stores, and things like that.
Maria Varmazis: Aw.
Joe Carrigan: Were you ever in the JC Penney's catalogue?
Dave Bittner: No.
Joe Carrigan: Or the Sears catalogue?
Dave Bittner: I don't think so. I don't think I was.
Joe Carrigan: The big show, as they call it?
Dave Bittner: It's hard to remember, and back then it was a lot harder to gather things up that you did, because you know, they didn't - they were ethereal.
Joe Carrigan: Right.
Dave Bittner: You do a modeling job, and it would be posted in some Roy Rogers restaurant in Connecticut, and you'd never get a job - you know, a copy of it or anything like that.
Joe Carrigan: [Laughter], right.
Dave Bittner: It just didn't work that way, so I do have a few things.
Maria Varmazis: I've been to that Roy Rogers, [laughter].
Dave Bittner: Yeah, I -
Joe Carrigan: Roy Rogers with Dave Bittner on the wall. I need to find it.
Dave Bittner: Yeah. Yeah, I have one. And well, anyway, I don't want to - actually, I could go down a story rathole.
Maria Varmazis: [Laughter].
Dave Bittner: I'm not going to do that. I did that last week with the strip poker story.
Maria Varmazis: Oh, come on. Oh, come on.
Joe Carrigan: It was a good show.
Maria Varmazis: [Laughter], it was a good one.
Dave Bittner: We've had enough of that. But my scam this week comes from the BBC, from the beebs.
Joe Carrigan: [Laughter].
Dave Bittner: And this is about modeling scams, which is not a new thing.
Maria Varmazis: No, not in the slightest.
Dave Bittner: There have been lots of modeling scams, but the modeling scam folks have shifted gears a little bit, and now they're targeting seniors.
Maria Varmazis: Huh. Okay, yeah, well.
Dave Bittner: So Joe, your day may come yet.
Joe Carrigan: Yeah, [laughter].
Maria Varmazis: [Laughter].
Joe Carrigan: When I get model scammed, I'm probably not going to actually get legitimately asked to model.
Dave Bittner: [Laughter], so this story follows a couple of senior citizens. We've got a 79-year-old young lady named Judy Corker, which is a very British name if there ever were one, [laughter].
Joe Carrigan: Yes.
Maria Varmazis: [Laughter].
Dave Bittner: And 73-year-old Roland Parker, who fell for a modeling scheme that was aimed at older adults, and what happened was there were social media platforms. I'll let you have three guesses which platform you think it was on.
Maria Varmazis: Hmm.
Joe Carrigan: Hold on, hold on.
Maria Varmazis: Wait, so 73-year and 79. Or how old?
Dave Bittner: 79 and 73, respectively.
Maria Varmazis: They've got to be on TikTok.
Dave Bittner: [Laughter].
Joe Carrigan: So yeah, I was going to say, Maria, do you want to say Facebook, or do you want me to say Facebook, [laughter]?
Maria Varmazis: [Laughter].
Dave Bittner: Yeah.
Maria Varmazis: Zuck's ears are burning, right?
Dave Bittner: Yeah. So there were ads that were claiming that there was a shortage of mature models.
Joe Carrigan: Mm hmm.
Dave Bittner: And inviting people to apply. And so, they thought to themselves, well, why not? And so they applied to be models, and of course they were greeted enthusiastically. Oh my gosh, yes, you are - the search is over.
Joe Carrigan: Right, [laughter].
Dave Bittner: You are exactly -
Joe Carrigan: You are exactly what we're looking for.
Maria Varmazis: You're gorgeous, [laughter].
Dave Bittner: Right, right. Exactly.
Maria Varmazis: Yeah.
Dave Bittner: And so, what they were invited to do was to go have some professional-looking photoshoots, but they had to pay upfront for their portfolio images. And they were charged ahead of time, between 200 and 300 pounds for these portfolio images. Now, I don't know what that is in real money, but it's a lot, [laughter].
Joe Carrigan: Right.
Dave Bittner: So the problem is, they would show up at the photography studio, and the photography studio had no idea what they were doing there. So there was a legit photography studio. The scammers would say, we need you to pay in advance to have these photos taken. Here's the studio where you're going to go. You're going to show up at this time.
Joe Carrigan: Yeah.
Dave Bittner: So imagine you're the victim, and you're saying alright, well I can google the studio. Look, there it is. Well, that's a real studio.
Joe Carrigan: Right.
Dave Bittner: So this must be legit. And they show up at the studio, and the person running the studio is like, I have no idea why you're here. No, we're not booked, and no money was given to me, so you've been scammed.
Joe Carrigan: Mm hmm.
Dave Bittner: So the gentleman, Roland Parker, he lost about 1000 pounds through using PayPal's friends and family payment.
Joe Carrigan: Which is, you can't get that back.
Dave Bittner: That's what this story points out.
Joe Carrigan: Right.
Maria Varmazis: Yeah, yep.
Dave Bittner: So Judy got her money back because she used PayPal's goods and services option.
Maria Varmazis: Hmm.
Dave Bittner: So do either of you have any insight here on what the - I'm not familiar with this.
Joe Carrigan: So yeah, so there's two different ways you can send money.
Maria Varmazis: It's a toggle.
Joe Carrigan: Yeah, it's a toggle on PayPal. You send money via friends and family?
Dave Bittner: Yep.
Joe Carrigan: That is not business-oriented. Allegedly it's not supposed to be business-oriented. It's supposed to be like hey, I need 50 bucks, can you send this to me on PayPal? Sure, here you go.
Dave Bittner: Right.
Joe Carrigan: And then the other one is, I'm going to pay for a service online, and in that one, the merchant will pay fees to collect that money.
Maria Varmazis: Yes, yep.
Dave Bittner: Oh, I see.
Joe Carrigan: So if you send them 500 bucks, they'll get, like, $470.
Dave Bittner: Yeah.
Maria Varmazis: Yeah, and then so a lot of small businesses will tell you, please don't use that option. Please use friends and family instead, so none of us pay fees.
Joe Carrigan: Right.
Maria Varmazis: So, yeah.
Joe Carrigan: But that's probably against the PayPal terms of use.
Maria Varmazis: Oh, 100% it is, but that's, [laughter].
Dave Bittner: [Laughter].
Maria Varmazis: Thank you legal, yes it is, 100% it is.
Joe Carrigan: Right, [laughter].
Dave Bittner: [Laughter].
Maria Varmazis: Right.
Joe Carrigan: But here's the drawback. When you send using the I'm paying a merchant thing, you get purchaser protections, like a credit card, very similar to a credit card.
Dave Bittner: Hmm, right.
Joe Carrigan: When you send to friends and family, you don't get that protection. That money is gone.
Dave Bittner: Uh huh.
Joe Carrigan: So, and that's why there are no fees, because you're not -
Dave Bittner: Oh, I see.
Joe Carrigan: Or rather, I should say, that's why there are fees on the other one.
Dave Bittner: Yeah.
Joe Carrigan: Because you're paying - I just realized I may have gotten scammed on something.
Dave Bittner: [Laughter], oh no.
Joe Carrigan: Because I'm sitting here thinking about -
Dave Bittner: Real time -
Joe Carrigan: Real time scam [overtalking].
Maria Varmazis: [Laughter], did you really?
Joe Carrigan: I got to talk to my wife. Yeah, I did, because my wife bought something online, and we paid with PayPal.
Dave Bittner: Yeah.
Joe Carrigan: And it hasn't arrived yet.
Dave Bittner: Oh.
Maria Varmazis: Oh dang.
Joe Carrigan: I'm thinking, wait a minute, I just remembered the last time we used PayPal was to pay for that thing, and I haven't seen it yet.
Maria Varmazis: Is it coming from overseas though, with the shipping?
Joe Carrigan: I don't know where it's coming from.
Maria Varmazis: Yeah, hmm.
Joe Carrigan: So we're going to try to get that money back.
Maria Varmazis: Oh goodness.
Joe Carrigan: Anyway, that was why I started, like, sounding like I was having a stroke, [laughter].
Dave Bittner: [Laughter].
Joe Carrigan: Something just came into my head, and I'm like wait a minute.
Maria Varmazis: The lightbulb went off, yeah, wow.
Joe Carrigan: So yeah, if you pay like you're paying a merchant, when a merchant says, hey, just send it friends and family, you tell them no.
Dave Bittner: Ah.
Joe Carrigan: No, I'm sending it with the merchant thing, because I want my protections.
Maria Varmazis: Yeah, well.
Dave Bittner: Okay. So that could be a red flag.
Joe Carrigan: Right.
Dave Bittner: If a merchant asks you to use the friends and family payment.
Joe Carrigan: Absolutely.
Maria Varmazis: Yeah. A lot of them do.
Dave Bittner: It's your risk, not theirs.
Joe Carrigan: Correct.
Maria Varmazis: Yeah, a lot of them do.
Dave Bittner: Interesting.
Maria Varmazis: Hmm.
Dave Bittner: So they have a couple of tips here to help protect yourself. I think these are pretty straightforward. They say never pay upfront for work. Verify the agencies. Use secure payment methods. Avoid rushed decisions.
Joe Carrigan: Mm hmm.
Dave Bittner: And report fraud if it does happen to you.
Maria Varmazis: Yep.
Joe Carrigan: They say report it to Action Fraud, which is the UK's fraud reporting tool.
Dave Bittner: Right, right.
Maria Varmazis: Yep.
Joe Carrigan: We would say, report it to.
Maria Varmazis: Good luck, [laughter].
Joe Carrigan: I-C-3.
Dave Bittner: Yeah.
Maria Varmazis: Report it to, hmm? Yeah, [laughter].
Dave Bittner: Yeah.
Maria Varmazis: Yeah, this scam has existed. I remember when I, in the 90s, when I turned 16, my friends and I all around the same age were basically joking that we would all get this postcard in the mail. And this was real, like, as soon as you hit 16 years old as a girl, you would get this postcard saying, you want to be a model? And it was the same idea. Your parents would pay upfront, and of course it was a guarantee, you could totally get picked up by Ford or some major agency. It was always a scam. So my friends and I would look forward to who would get the scam postcard next. This is the 90s, we knew about this, [laughter].
Joe Carrigan: Right.
Dave Bittner: Yeah, yeah.
Maria Varmazis: So, it's -
Joe Carrigan: I would have told my daughter, this doesn't say, do you want to be a model? This says, do you want to get kidnapped, and sent overseas, and never heard from again? That's what it sounds like to me.
Dave Bittner: Oh.
Maria Varmazis: Well, it was just a scam. That version of the scam that my friends and I all would receive was the, you're paying somebody to take your picture for an exorbitant amount of money. You're never going to become a model for every reason you can imagine.
Joe Carrigan: Right.
Maria Varmazis: It was just a rip-off, but people always did fall for it.
Joe Carrigan: Well, that's why you got postcards.
Dave Bittner: Yeah.
Maria Varmazis: Yeah, of course, they had a marketing budget, [laughter].
Joe Carrigan: Because it worked. Right.
Maria Varmazis: This wasn't cheap. Yeah.
Dave Bittner: Yeah.
Maria Varmazis: I'm amazed this scam is still around, to be honest, but I guess it works.
Dave Bittner: Yeah, [laughter]. One time -
Maria Varmazis: Oh no, Dave's got a story.
Joe Carrigan: Here's the story.
Dave Bittner: This is different.
Maria Varmazis: Here it is, [laughter].
Dave Bittner: It's a different story, but it's, [sigh], it's a story of its time that is, in retrospect, horrible, but also hilarious.
Joe Carrigan: [Laughter].
Maria Varmazis: Okay, [laughter].
Joe Carrigan: Those are my favorite. Hey, you know what, Dave? Tragedy plus time equals comedy.
Dave Bittner: There you go, [laughter].
Maria Varmazis: [Laughter].
Dave Bittner: So my mom gets a call from this producer who had hired me to do lots of things, and you have to remember that, you know, back then you had your landline telephone in the home.
Joe Carrigan: Mm hmm.
Dave Bittner: And that was it. You know, [laughter], there was no texting. There were no mobile phones. So my mom gets a call from this producer, who's just a piece of work. He's like, you know, this guy, right, straight out of New York.
Joe Carrigan: Right.
Dave Bittner: You know, and he's like, listen, I got this job.
Joe Carrigan: [Laughter], you can almost see him pumping his arms, with the cigar in one hand.
Dave Bittner: Right, exactly.
Joe Carrigan: Right.
Dave Bittner: You know, balding, combovers, you know.
Joe Carrigan: [Laughter], plaid jacket.
Dave Bittner: He's like, look, I got this job I think young David would be perfect for. It's for muscular dystrophy.
Joe Carrigan: [Laughter].
Maria Varmazis: He -
Dave Bittner: My mom is like, my son doesn't have - I know, I know. But he can look sad.
Maria Varmazis: [Laughter], what?
Dave Bittner: Here's what we do, we bring him in, we put him in the braces, we have the little crutches, he makes a sad face, everybody wins.
Joe Carrigan: Is that what he said, [laughter]?
Dave Bittner: Yeah. My mom was like, okay.
Joe Carrigan: Okay?
Dave Bittner: Yeah. My mom was like, okay. So, you know, we get scheduled and everything. She's like, David, you can make a sad face, right? I'm like, of course. Yeah, look at this. Aw, oh.
Maria Varmazis: Poor Dave.
Dave Bittner: So yeah, here it is. Oh, look at that bottom lip.
Joe Carrigan: Because people with muscular dystrophy are always sad.
Dave Bittner: Well, so there's that, right?
Maria Varmazis: [Laughter].
Dave Bittner: Right. There's the complete drainage of joy in any moment of their lives. So, like the day before this shoot is supposed to happen, we get a call from the producer. He's like, ah, look. Who would have thought? They want an actual kid who has MS, [laughter], or MD, you know?
Joe Carrigan: MD, right?
Dave Bittner: Ah, well, oh well. Maybe next time. Sorry.
Joe Carrigan: [Laughter]. Jerry Lewis called, and he's really upset.
Maria Varmazis: [Laughter].
Dave Bittner: Easy come, easy go. You know, again, in retrospect, probably best that it did not happen.
Joe Carrigan: Absolutely.
Dave Bittner: [Laughter].
Joe Carrigan: Dave, one thing that would not be good for you today is to have one of those pictures surface.
Dave Bittner: Right.
Joe Carrigan: Right?
Dave Bittner: Yeah. Exactly, exactly. Alright, that's my story this week, [laughter].
Maria Varmazis: [Laughter].
Dave Bittner: We will be right back after this message from our show sponsors. [ Music ] Joe, what do you got for us?
Joe Carrigan: Dave, my story comes from ABC News and Jay O'Brien.
Dave Bittner: Hmm.
Joe Carrigan: And Lucien Bruggeman. Anyway, they had a story that the headline is, "Bitcoin ATMs increasingly used by scammers to target victims, critics say." And the sub-headline is like one of the quotes from the FBI in this story.
Dave Bittner: Yeah.
Joe Carrigan: And that is that, in 2024, nearly $250 million were scammed out of people using Bitcoin ATMs.
Dave Bittner: Huh.
Joe Carrigan: So, I'm going to go ahead, and as we always say, that number is probably low, because there are crimes that don't get reported.
Dave Bittner: Let me pause you just for one second here, Joe.
Joe Carrigan: Sure.
Dave Bittner: And ask you and Maria.
Joe Carrigan: Yep.
Dave Bittner: Have either of you ever used a Bitcoin ATM? Maria?
Maria Varmazis: No, I have not.
Joe Carrigan: Yes, I have.
Dave Bittner: [Laughter], of course you have.
Joe Carrigan: I'm going to get into it at the end of this story, or towards the end of this story.
Maria Varmazis: [Laughter], that feels like important context for this. Okay, yes.
Dave Bittner: It is. Yeah, I mean, there's one right up the street from where we're recording today.
Joe Carrigan: Right.
Dave Bittner: There's like a gas station convenience store, and as you walk in, there's a Bitcoin ATM.
Joe Carrigan: Is it a Royal Farms?
Dave Bittner: Yes, yeah.
Joe Carrigan: Because Royal Farms has Bitcoin ATMs everywhere.
Dave Bittner: Okay, hmm.
Joe Carrigan: Or every time I walk in there, and I'm like, I got $10, I could buy some Bitcoin.
Maria Varmazis: [Laughter].
Joe Carrigan: But I'll tell you why I don't do that anymore.
Dave Bittner: Alright.
Joe Carrigan: And so, the crypto in particular has been, and these ATMs in particular, rather, have been the number one way that scammers are trying to get access to people's money. This is, according to Amy Nofziger. Nofziger, that's a tough name to say. Nofziger. Dave, she's a friend of yours and mine. She's the director of fraud and victim support at the AARP.
Dave Bittner: Ah, [laughter].
Joe Carrigan: And apparently Maria, who got her first AARP letter at 29.
Maria Varmazis: No, when I was 29. Yep.
Joe Carrigan: Right.
Maria Varmazis: Really not great.
Joe Carrigan: But anyway, last month, the Washington D.C. Attorney General's office sued Athena Bitcoin, which is one of the Bitcoin ATM machine purveyors, one of the larger ones, saying that they are pocketing hundreds of thousands of dollars in undisclosed fees, and on the backs of scam victims.
Dave Bittner: Hmm.
Joe Carrigan: So this lawsuit claims that 93% of transactions on Athena's devices in the District were the product of outright fraud, and the median age of victims was 71 years old. So we've all seen these scams, and there's a story in this story.
Dave Bittner: Yeah.
Joe Carrigan: About a woman who is being scammed out of money as, you know, and it's got a good ending, so I'm going to get to that in a minute. But you know, she was pumping money into a Bitcoin ATM. Brenna Bird is the attorney general in Iowa, and she filed a similar lawsuit earlier this year against two major players, Bitcoin Depot, which makes a lot of sense, right? Bitcoin Depot?
Dave Bittner: [Laughter].
Joe Carrigan: You're going to piggyback off other, you know, Dome Depot, Home Depot.
Dave Bittner: Sure.
Joe Carrigan: And the other one was CoinFlip, which is a pretty good name, I would think, for a digital currency thing.
Dave Bittner: Mm hmm.
Joe Carrigan: And she accused them of being a silent partner to many of these scammers, preying on Iowans, taking a cut of each scam, with its excessive and deceptive Bitcoin ATM fees.
Dave Bittner: Hmm.
Joe Carrigan: Now, Bitcoin Depot and CoinFlip have both denied the claims in court, and in statements to ABC News, Bitcoin Depot says the vast majority of our transactions are legitimate.
Maria Varmazis: [Laughter].
Joe Carrigan: That they are one of the few operators in the Bitcoin ATM space to proactively require ID, even for the smallest transactions, and that customers receive up to four scam warnings before completing purchase.
Dave Bittner: Hmm.
Joe Carrigan: Okay, I get that. And that's good. I don't know if these lawsuits are going to do anything about this.
Dave Bittner: Hmm.
Joe Carrigan: I think the fees are really high. In fact, I'll say they're so high that I'm a little bit suspect, because originally I was thinking to myself, you know, when I was doing this story, I was like, these businesses, or these Bitcoin ATMs offer a legitimate need. I've even used this service in the past. But then I think back to the one time I used a Bitcoin ATM.
Dave Bittner: Yeah.
Joe Carrigan: I put $5 in, and they were like, oh, which cryptocurrency would you like? And I'm like, I know if I buy $5 of Bitcoin, I'm going to be waiting days for that to show up in my wallet, because that's not a transaction that does a lot, gets a lot of attention on the blockchain, in the pool. I'm going down to the weeds here. So I went with a different coin. I went with Litecoin. And I put it directly into my noncustodial wallet that was on my phone. And I put in $5 into the ATM, and I got $3.50 in Litecoin out.
Dave Bittner: Hmm.
Joe Carrigan: That went into my wallet. $3.50. I looked it up, I still have that Litecoin. It's now worth about $6.
Dave Bittner: Oh.
Joe Carrigan: Oh.
Dave Bittner: [Laughter].
Joe Carrigan: But in order for me to recoup my $1.50 in fees, or more importantly, 30% in fees.
Dave Bittner: Yeah.
Joe Carrigan: It took me probably four or five years to get that.
Dave Bittner: Yeah.
Joe Carrigan: To get that back out, in Litecoin price changes. And by the way, I'm not advocating anybody invest any money in any cryptocurrency, and I'm certainly not telling you to invest in it at a Bitcoin ATM.
Dave Bittner: [Laughter], right.
Joe Carrigan: Because, my question about this is, I keep most of my cryptocurrency on an exchange. When I buy cryptocurrency or sell cryptocurrency on that exchange, my fee is less than 1%. It's very small.
Dave Bittner: Yeah.
Joe Carrigan: And that exchange has to make some money. These Bitcoin ATM operators also have to make some money too, but they don't need to make 30%. I can also, on the exchange, pay a flat fee and get free trades, which would be great, if I was an active Bitcoin or cryptocurrency trader, which I'm not.
Dave Bittner: Hmm.
Joe Carrigan: You know, I have some standing sell orders for when the cryptocurrency goes through the roof, and you know, I cash out. But these high fees seem to me that there may be no legitimate business purpose behind these ATMs.
Dave Bittner: Hmm.
Joe Carrigan: So the model of somebody walking up, pumping $10 or $50 into a Bitcoin ATM, so they could get the $7 or what, $40 worth of Bitcoin or cryptocurrency? It doesn't seem like it works. Because I could just as easily wire that money to that exchange, buy the cryptocurrency on the exchange, and for free, transfer it to my noncustodial wallet, and be walking around with it on my phone.
Dave Bittner: Mm hmm.
Joe Carrigan: It's entirely possible for me to do this at a much lower cost. These Bitcoin ATMs don't have - they're not completely anonymous. Like which one was it? Bit Depot was saying, hey, we require a photo of the ID of the person using the ATM, and we also, when I used it, they required my phone number and had me enter a verification message sent to my phone number via text.
Dave Bittner: Hmm.
Joe Carrigan: So, I had to cough up some personally identifiable information to use this thing.
Dave Bittner: Right.
Joe Carrigan: So, they're not anonymous. They're not offering anonymity as a service. It seems to me like they're, and this is me and only me and my speculation, that the majority of the purpose of these things is helping people commit scams or helping people launder money. Like, I'm a drug dealer and I've got to get a bunch of money into the system. I'll just go pump this drug money into a Bitcoin ATM. And then I'll have a different problem. A different money laundering problem. But one that's much more manageable.
Dave Bittner: Yeah.
Joe Carrigan: In, in, and I'm not walking around with a big stack of cash. I've got my money cryptographically secured, all the other things. And it only cost me 20 to 30%. So, I'm not saying that, that, that these companies intentionally do this, but I'm saying that this is an artefact of, of this system that's set up.
Dave Bittner: Mm hmm.
Joe Carrigan: So, this article also quotes a man named Adam Zarazinski, who is the CEO of Inca Digital, which is a cryptocurrency forensic, forensic firm. And he was asked, do you think these companies know that in large part, their ATMs are being used for scams? And he said, they either know it or they're turning a blind eye.
Dave Bittner: Yeah.
Joe Carrigan: So, I mean, if you're turning a blind eye to it, doesn't that mean you kind of know it?
Dave Bittner: Well, yes.
Joe Carrigan: Right. [Laughter] So, the story, the personal story in here is Fran Bates, who is I think 71, in June of 2024 was actively getting scammed out of money. She was in the process of feeding $23,000 into one of these, one of these machines. Because some scammer called her and said, that the, that you know, your bank is in the process of being virtually robbed. You need to get your money safe now. Go buy some bitcoin and send it to me. I'll keep it safe. But somebody named Mindy Jordan, who was another customer at the gas station, noticed Ms. Bates shoving the money into the Bitcoin ATM, and walked over and said, hey what are you doing? And Ms. Jordan called the police. Now, why did Ms. Jordan know that this was a scam? Because she had also been victimized by something like this. So, she immediately recognized this was a scam. Fortunately, you know, I'm very happy Mindy Jordan was there to stop this from happening. When the cop got there he, he stopped everything from happening. And the woman was able to get her money back. Because she actually hadn't sent a cryptocurrency to the bad guy yet.
Dave Bittner: Mm hmm.
Joe Carrigan: She had, she had bought the cryptocurrency on the ATM, but she was able to get most of that money back.
Dave Bittner: Wow. So, what do we suppose the solution here is? I mean, well first of all, is this a result of the lack of regulation in the Bitcoin arena?
Joe Carrigan: One of the things about cryptocurrencies is that they are naturally resistant to regulation.
Dave Bittner: Yeah.
Joe Carrigan: That's kind of why they were started, right.
Dave Bittner: Right.
Joe Carrigan: So, if there is no central banking authority behind like, Bitcoin or Ethereum, or Ether, or whatever. So, they are designed to be protected against regulations. So, yeah.
Dave Bittner: Yeah. But the device is sitting in a retail store.
Joe Carrigan: Correct.
Dave Bittner: So, it's plausible for me to think that the FTC, for example, could say hey, no more Bitcoin ATMs. Bitcoin ATMs are only going to be in banks.
Joe Carrigan: Some, some jurisdictions, the story does mention that some jurisdictions have just straight up outlawed cryptocurrency ATMs.
Dave Bittner: Hmm. Okay.
Joe Carrigan: So, you could do that. The other thing we can do, as citizens, vigilant acting human citizens, is if we see somebody who you think shouldn't be using a Bitcoin ATM. [laughter]
Dave Bittner: Mm hmm.
Joe Carrigan: You know what I mean?
Dave Bittner: Yeah.
Maria Varmazis: Mm hmm.
Joe Carrigan: Someone who looks like me, [laughter] putting $5 in. Somebody said, hey what are you doing? I'm just buying a little bit of cryptocurrency for myself, some spending crypto.
Dave Bittner: But isn't that the thing? I mean, anyone is seriously invested in crypto....
Joe Carrigan: Yeah. They don't use these ATMs.
Dave Bittner: Right.
Maria Varmazis: Yeah.
Joe Carrigan: Absolutely not.
Maria Varmazis: So, I didn't want to say it, but my attitude is nobody should be using these things. So, once we're going there.
Joe Carrigan: Yeah. I mean that's kind of what, my point is, that there's no reason to pay a 30, a $30, a 30% fee on these things.
Dave Bittner: Mm hmm.
Maria Varmazis: Yeah. Every Bitcoin ATM I have seen, where I live anyway, is in the seediest, nastiest place. So, like, nothing about it engenders confidence that this is a good idea. I'm not saying crypto in general, I'm saying the Bitcoin ATMs, just to be clear. And I'm just, it just seems like they're made to prey on people. I just, I'm sure there are people who use them for good reasons, but they, it just, it's like a red alert, do not touch, as far as I'm concerned. Like, it's a hot stove. Don't go near it.
Joe Carrigan: Right.
Dave Bittner: Yeah. Yeah. No, I've never used one. It remind, well so, another question I have Joe, which I don't know if you'll have the answer to this or not, but is it actually a percentage, or is it kind of like a regular ATM where...
Joe Carrigan: It's a flat fee?
Dave Bittner: You can go... yeah, it's a flat fee. So, you know, if you withdraw $20 and it charges you 3 bucks, it's a higher percentage than if you withdrew $200 and it was still 3 bucks.
Joe Carrigan: Right. Yeah. That's, that's a good, good question. I don't know the answer to that.
Dave Bittner: Yeah.
Joe Carrigan: I think it's a fee plus a percent, right.
Dave Bittner: Yeah. That makes sense.
Joe Carrigan: Yeah.
Dave Bittner: But then they're going to take everything they can because...
Joe Carrigan: Right.
Dave Bittner: They're unregulated.
Joe Carrigan: Yep.
Maria Varmazis: And the transactions are probably small, overall.
Dave Bittner: Yeah.
Joe Carrigan: Well, except for these really big ones.
Maria Varmazis: Well, [laughter]
Joe Carrigan: Like, like....
Dave Bittner: [inaudible 00:25:42] so, this seems...
Maria Varmazis: Wow.
Dave Bittner: Wow, that's just the kind of insights we count on you to...
Joe Carrigan: Right.
Dave Bittner: to have, Joe.
Maria Varmazis: [Laughter]
Joe Carrigan: What I mean when I say that, is the scam victims, you know, this woman was pumping $20,000 into an ATM.
Dave Bittner: Yeah.
Joe Carrigan: That's a big transaction.
Dave Bittner: Yeah.
Joe Carrigan: There's another, other legislation in here that's been proposed, to cap the, cap the amount of money. That would at least limit the damages. The problem with that is, if you're capping it, it's going to be a daily cap. All that means is that these scammers just keep calling back. And they, it won't stop them because $300 is still $300.
Dave Bittner: Yeah.
Joe Carrigan: They'll take that, right. Whatever the cap is. But yeah, you could, you could mitigate the amount of money that people lose, or at least the rate at which they lose it. And maybe provide the opportunity for someone else to jump into the, into the, the scam system there and break it up, and execute on the kill chain somehow.
Dave Bittner: Yeah. Well, I, I continue to wonder how long is it going to take, or will it ever happen that the global financial system says, enough. You know, with the, just the amount of scamming that is enabled by cryptocurrency, it is, it is the, the weapon of choice.
Joe Carrigan: Yeah. All they'll do, all they'll be able to do is take the, take the, the average person's ability to use it away. Because you can't stop somebody from using cryptocurrency. Like, you know, if I hear that's coming, I'm putting all my stuff in a noncustodial wallet. And I'm having it at my house, or somebody, someplace else. Maybe I won't keep it at my house. Maybe I'll keep the key somewhere so that nobody comes and gets my crypto. I don't know. Maybe I'm getting a little too paranoid about this.
Maria Varmazis: [Laughter]
Dave Bittner: Yeah but, I mean, wouldn't it be the same as like, when, when one day confederate money stopped being worth anything? If the global financial system says, we're doing away with this, and it no longer has any value.
Joe Carrigan: It no longer has any value to them. You're right. It would collapse the value of a lot of these cryptocurrencies. Correct.
Dave Bittner: Yeah. Yeah.
Joe Carrigan: Yep.
Dave Bittner: Yeah.
Joe Carrigan: But it wouldn't make them worthless. People would still be trying. Cause you remember when Bitcoin started? When it was like 25 cents a Bitcoin?
Maria Varmazis: Yes.
Dave Bittner: I've still got some valuable Beanie Babies, Joe.
Joe Carrigan: Yeah.
Dave Bittner: [Laughter]
Joe Carrigan: I mean, there were no exchanges there.
Dave Bittner: Alright. Let's take a quick break here. We will be right back after this message from our show's sponsors. [ Music ] And we are back. Maria, you are up. What do you got for us this week?
Maria Varmazis: I have a story that, kind of icky, but it's, it's one that our listeners should know about.
Dave Bittner: Yeah.
Maria Varmazis: It's, comes from our friends at Bitdefender Labs. And they're tracking a new scam going through WhatsApp.
Dave Bittner: I'm going to...
Maria Varmazis: Yes?
Dave Bittner: I'm going to interrupt and say this. We, from time to time we have to talk about these icky scams. It's better to talk about them and put them out there, and let people know about them than to ignore them.
Maria Varmazis: Of course. Yes.
Dave Bittner: Right.
Maria Varmazis: And that, that is, that is definitely one of the goals of the show, is to let people know about that.
Dave Bittner: So, you're taking one for the team this week, Maria. Thanks.
Maria Varmazis: [Laughter] You're welcome?
Dave Bittner: Yeah.
Maria Varmazis: I, I was, I was admittedly kind of fascinated by this one because of where it's localized. So, for once, even though we're all, the three of us are based in the states, this is not a scam that is hitting the United States at large just yet. Because it's a WhatsApp scam, and it's not used as widely here in the states. This is actually largely in central and eastern Europe right now. So, this specific scam, Bitdefender is calling the vote for my child scam. And apparently, it's spreading fast across all of Europe, but especially central and eastern Europe. So, the, this WhatsApp scam, it tricks users into handing over their verification codes. And then by doing that, they will lose control of their WhatsApp account. And the scam that gets them is a voting contest for a child who is either a dancer or a gymnast and has entered a contest. So, Bitdefender, in tracking this scam, said there were 177 fraudulent domains over 150, over 550 unique URLs that are linked to this campaign. And they are mostly, like almost half of them, are targeting users in Poland. And the rest are in Romania and Germany, largely. And there are some smaller clusters targeting users in Spain, the United Kingdom, a few in the US. So, it is making its way here, and also Kazakhstan. So, Bitdefender has some screenshots of this, this, this scam. And I, it just, it gave me the ick when I looked at it. Cause the pictures of these largely little girls, are just like, it just gives me, yeah they creep me out. I don't know if they're real photos or not, but they're in like gymnastics or dance poses. It's a little, it's just icky. And the message comes across on WhatsApp from a friend, supposedly, saying they're helping a friend of a friend's child try to win a scholarship or a competition. So, just vote for them, and they've got a better chance. And these scams are all over social media. And actually, they're not always scams. Sometimes there are actual voting campaigns. Hey, my, my coworker's daughter is trying to get a scholarship to a dance camp that's really pricey. If you, if she wins this contest, they'll be able to pay for it. It's, it's great. Like, I see these all the time and I presume they're legit. I don't vote in them, but I do assume they're legit. But yeah, the idea is that if you're trying to help somebody out, do them a solid by voting for their, their adorable kid. And look at them in that very cute costume. Then you hand over your WhatsApp account. Which is not great, because a lot of businesses, especially in eastern Europe, rely on WhatsApp to do their jobs.
Dave Bittner: Mm hmm.
Maria Varmazis: So, the scam works this way. You get that message saying, please vote for a friend of a friend's kid. And here's the contest page. The page goes to a very realistic phishing voting site, with lots of vote buttons. And again, it is localized. So, none of this is from what I can see in the Bitdefender post, none of this is in English. So, for many people that's like the red alert, if it's an English page. If it's a Polish campaign, it is written in Polish. So, it is fully localized. So, that may get some people feeling like it might be a little more trustworthy. And again, the photos on these, on these give me the ick. And then to cast a vote for the child, who may or may not even be real, I doubt they're real, you are asked to enter your phone number, and your WhatsApp verification code. So, I presume this is your WhatsApp phone number specifically. And once entered, the attackers then use that code. Cause you're giving over the keys to your WhatsApp kingdom. And then they can hijack your WhatsApp account. And then the scam proliferates cause they hijack your WhatsApp account and they start sending those messages out to your contacts. So, they will often resend that fake contest link to your contacts. And then they will escalate it into money, fraud. Asking money, under, it may be urgent pretenses. And the amount of money asked for is usually what we would consider maybe on the smaller side, maybe up to 400 euros. But if you can broadcast this out, that's a lot of money that they can make pretty quickly. And a lot of people are falling victim to this one, mainly because it is being spammed by your contacts, from a hijacked WhatsApp account. So, until somebody tells you hey don't trust that message cause my WhatsApp got hijacked, you might think this is legit.
Joe Carrigan: Right.
Dave Bittner: Yeah.
Maria Varmazis: Especially if you're maybe an older person, apparently that's sort of the idea. Like, seniors who are trying to look out for their grandkids, or their friend's grandkids. They might think, well, what's the harm in helping out, you know, my neighbor's grandkid or something by voting for them. And you know, they look so adorable. And you know, they deserve to go to that dance contest, and all that kind of stuff. So, the familiar names engender trust, and maybe folks are not as familiar with these scam tactics. And again, in my opinion, if they're seeing stuff that's written in their localized language, they may be more likely to trust that this is real and not fake. So, it is a good time to remind people that you definitely never want to share your WhatsApp verification codes ever, ever, ever. Not even with friends or family.
Dave Bittner: Correct.
Maria Varmazis: And if you can figure out how to enable two-step verification in WhatsApp, or if you can get someone to help you with that, you definitely want to. Yeah. So, this, this, this scam is nasty. It's gross. I don't like it.
Joe Carrigan: Yeah. I was looking at some of the pictures here, and you're right.
Maria Varmazis: Icky.
Joe Carrigan: They're just, ugh.
Maria Varmazis: They are icky. They're icky. I, I, I don't know how else to put that. Like it's just, it's icky. So, just, yeah. And my thing with WhatsApp is, in the states we don't tend to use it as much, so it's not really, these kind of scams for us kind of go like, what's the big deal. But when you're in other parts of the world, that is the way of contacting people for business. Like, you don't see phone numbers posted, you will see specifically, here's my WhatsApp contact info. And that is, that stands in for what we would consider like a website or an email, people will say just contact me through WhatsApp. So, if you lose your access to that, it really is, it's pretty, pretty big deal, so.
Dave Bittner: So, what's the end game?
Maria Varmazis: To, to, they make money. They, they, they scam people. They take over accounts. And by doing that, they then scam people out for money. They say, hey, you know, maybe this kid specifically needs money to go to that camp. Can you send some?
Dave Bittner: Okay.
Maria Varmazis: Or they, they now have that, yeah, so.
Joe Carrigan: Once they get access to the account.
Dave Bittner: Right. Then they start begging.
Maria Varmazis: Yeah.
Dave Bittner: And that's where you're talking about the small amounts.
Maria Varmazis: Yeah. They're, the, Bitdefender says it's only about 400 euros per request. Which is, it can be a lot of money, depending on where you're at. But you know, a lot of times we think of tens of thousands of dollars on some of these scams, and 400 euros sounds like small potatoes. But if you're able to get a lot of people to donate 400 euros...
Joe Carrigan: Yeah.
Maria Varmazis: That adds up fast.
Dave Bittner: Yeah. You know what this reminds me of? That, that grinds my gears. [ Laughter ] Is the scams that you'll see for pets that need to be adopted.
Joe Carrigan: Oh yeah.
Dave Bittner: In other words, it's similar buttons that they're trying to push here. Oh, look how cute. Oh, I, you know, I want to help. I want to be helpful. Everybody wants to be helpful.
Joe Carrigan: Right.
Dave Bittner: And what bugs me about this, is that I do love cute little animals, and I would love to help them. And now, when I see a cute little animal thing on Facebook, the first thing I think of is oh, it's probably a scam.
Joe Carrigan: Right.
Maria Varmazis: Yeah.
Dave Bittner: And that makes me sad. Because I like cute animals. And I would love to be able to help them. And I don't want to associate cute animals who need help with scams. But here we are.
Joe Carrigan: Well, we gave the internet to too many people, Dave.
Dave Bittner: [Laughter]
Maria Varmazis: Give it back to DARPA. We're done here.
Dave Bittner: That's right. That's right. You need an edu email address, from now on, to, or to use the internet. So be it. Alright. Well, we will have a link to that story in the show notes. Joe, Maria, it is time for our Catch of the Day. [ Music ]
Joe Carrigan: Dave, our Catch of the Day comes from the scam subreddit. And it comes from a very important person, a VIP, if you will.
Dave Bittner: [Laughter]
Joe Carrigan: Whose initials are B.O.
Dave Bittner: Yeah. Yeah. Oh, this is from Barack Obama.
Joe Carrigan: Former President, Barack Obama.
Dave Bittner: Former President.
Maria Varmazis: Not body odor? Okay.
Joe Carrigan: Right.
Dave Bittner: [Laughter] Former President Barack Obama. Oh gosh, I really don't do a Barack Obama. I'll try to get his rhythms right.
Joe Carrigan: I do a really good Bill Clinton. But I do not do a good Barack Obama.
Dave Bittner: Okay. So, it goes, it goes like this. Hi, I found your details on Google, and I've looked at your website and realized your website is in a great design. But your website's ranking could be much better. Where your keywords come up in the search on Google, and other search engines, as they should. I can place your website on the first page of Google, Yahoo, Bing, and all the search engines. We can help get it to the first page. May I share a price list or quote with a proposal? Thanks and regards, Barack. >> Joe Carrigan:That was pretty good.
Maria Varmazis: That was really good, Dave.
Dave Bittner: No? Not bad?
Joe Carrigan: Yeah. Pretty good on the cadence. The voice, but you have, in order to do that you have to be a really good impressionist, but.
Dave Bittner: Yes.
Joe Carrigan: And Barack Obama is one of the harder ones to impersonate, I think.
Dave Bittner: I think that's true.
Joe Carrigan: Yeah.
Dave Bittner: Yeah. So, what do we got going on? First of all, Barack Obama is doing website, or...
Maria Varmazis: He's doing SEO.
Joe Carrigan: He's got much more important things to do here than this.
Dave Bittner: [Laughter]
Maria Varmazis: Good on you, Barack. It's a little side hustle for the former President, you know.
Dave Bittner: He's a helper.
Joe Carrigan: Right.
Dave Bittner: [Laughter] Yeah. How would you fall for this?
Maria Varmazis: How many of these emails do we get a day, Dave, at N2K? I think I get like 10 for T-Minus. These, hey we can help you with your SEO things.
Dave Bittner: Oh yeah. That's true.
Maria Varmazis: Yeah, we get a bajillion of these.
Dave Bittner: Yeah. That's true. Yeah. And they usually start off with hey, I hate to bother you. You got a minute? You know, like they're trying to, they're trying to like...
Joe Carrigan: It's like that agent from New York, right.
Maria Varmazis: Yeah.
Joe Carrigan: The guy, hey I hate to bother you. You got a minute? Let me talk to you.
Dave Bittner: Right. Right. It's like forced, I don't know, affability or something.
Joe Carrigan: Yeah. It's, it's like...
Maria Varmazis: Unearned familiarity.
Joe Carrigan: It's like they're walking up to a crowd, and they're starting to talk.
Dave Bittner: Right.
Joe Carrigan: But they're sending you an email.
Dave Bittner: Right.
Joe Carrigan: And they're wasting your time.
Dave Bittner: Right.
Maria Varmazis: Yeah.
Dave Bittner: It's like somebody walking up to you and going, hey, hey, blue shirt! Hey, I like blue shirts!
Joe Carrigan: [Laughter] Right.
Maria Varmazis: [Laughter]
Dave Bittner: We're practically friends! Yeah. Right.
Maria Varmazis: Your website stinks. Your podcast stinks. Nobody knows you. Nobody likes you. But I can help you with that.
Dave Bittner: Yes.
Maria Varmazis: Yeah, you won me over. Absolutely.
Dave Bittner: As the former leader of the free world, I can help get your webpage to, first... Oh, my gosh. Alright. Well, look. We would love to hear from you, if there's something you'd like us to consider for our Catch of the Day. You can email us. It's hackinghumans@n2k.com. [ Music ] And that is Hacking Humans, brought to you by N2K's CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cyber security. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey and the show notes, or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our Execute Producer is Jennifer Eiben. We're mixed by Elliot Peltzman and Trey Hester. Peter Kilpe is our Publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe Carrigan.
Maria Varmazis: And I'm Maria Varmazis.
Dave Bittner: Thanks for listening. [ Music ]
