The voice on the other end.
Dave Bittner: Hello, everyone, and welcome to N2K CyberWire's "Hacking Humans" podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner. And joining me is Joe Carrigan. Hey, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: And our N2K colleague and host of the "T-Minus Space Daily" podcast, Maria Vermazis. Maria.
Maria Varmazis: Hi, Dave, and hi, Joe.
Dave Bittner: We've got some good stories to share this week. We got any follow-up first, Joe? What do we got?
Joe Carrigan: We don't have any follow-up. Nothing new about the chickens.
Dave Bittner: Uh-huh. [laughter]
Joe Carrigan: We're just maintaining. But I do have an interesting thing. I almost put this in my story.
Dave Bittner: Yeah.
Joe Carrigan: But and I guess I'm going to do kind of a short story today. So maybe this will be -- I'll do the first story, then I'll do another story later on. But anyway, this actually happened to me. I was sitting in my office, doing what Dave does best, minding my own business. And my phone rings, and it's the old house phone that now rings on my cell phone, thanks to an app.
Dave Bittner: Okay.
Joe Carrigan: And I answer the phone. And I debated answering as Mabel Johnson. [laughter] But I didn't do that. I just answered it. And this very gruff guy says, "Joe Carrigan." I'm like, "Yes. This is Joe." And he goes -- he then says, "This is Deputy So-And-So." I can't remember. He gave me a name. And he said, "Badge number this from the Sheriff's County." Or no, he didn't say deputy. He said Sergeant. "Sergeant So-And-So from the Carroll County Sheriff's Department, Badge number this." So I get out my notebook, right, and I write down Carroll County Sheriff's Department. I go, let me get your name again. And he goes, you know, he tells me his name and then his badge number. And I'm like, okay, the last name again. He goes, "Do you got it this time?" I mean, you're really getting frustrated with me. I'm like, "Look, I'm just writing this stuff down, all right?"
Dave Bittner: Yeah.
Joe Carrigan: And I said, "I got it. Let me read it back to you. Make sure I got it right." And, you know, and he's getting frustrated with me. And he goes, "Yeah, I'm calling about a missed jury duty." And he says, "We sent this to your address." And he reads out an address that is not correct, but is a past address.
Dave Bittner: Okay.
Joe Carrigan: Right? So his information is a little outdated. And he says, you missed a summons to a grand jury.
Dave Bittner: Ooh.
Joe Carrigan: And I'm like, "Oh, okay."
Dave Bittner: Grand jury?
Joe Carrigan: "That's interesting." Right, yeah, grand jury.
Dave Bittner: Wow.
Joe Carrigan: Grand jury summons.
Maria Varmazis: That sounds so grand.
Joe Carrigan: I said, "Look, Sergeant, I'm sure that you're well aware that there are lots of scams like this that go around where people get scammed out of money. So I'm going to look up the number to the Carroll County Sheriff's Department. And I'm going to call that number, and I'm sure that when I put that, you know, when I tell them I need to talk to Sergeant So-And-So, they're going to transfer me right to you, right?"
Dave Bittner: Yeah.
Joe Carrigan: And he immediately said, "You know, this is a scam." He had a couple extra expletives.
Dave Bittner: [laughter] Oh, really? He owned up.
Joe Carrigan: Yeah, he said. "This is a scam."
Maria Varmazis: Wow.
Joe Carrigan: "Get off my phone," and he hung up. "Get off my phone." Like I called him.
Dave Bittner: Well, yeah. [laughter]
Maria Varmazis: Wow.
Joe Carrigan: So the interesting thing about this is that I do this all the time, right? I talk about this all the time on this show. And I think about social engineering all the time. When this guy called me, he called me from, I don't know where he was calling from, but he spoke with an American accent.
Dave Bittner: Yeah.
Joe Carrigan: And he spoke very forcefully and authoritatively. And even though I knew it was a scam, there was still that little thing in the back of my mind.
Dave Bittner: Yeah.
Joe Carrigan: It was that I got nervous about it.
Dave Bittner: Right.
Joe Carrigan: The adrenaline fired off.
Dave Bittner: You don't want to get in trouble.
Joe Carrigan: Right. Exactly. I still experience physiological response to this call, right? It was -- I mean, I knew it was a scam. I totally knew it was a scam. But because this guy was, you know, telling me he's an authority figure. And I think I actually kind of relaxed once I started asking for his name. Because if you're on the phone with law enforcement and you ask for their name, they're going to let you write it down.
Dave Bittner: Right. [laughter]
Joe Carrigan: Right? They're not going to get -- they're not going to get irritated with you making sure that you got the correct spelling and right badge number. And this guy did. So that was kind of relaxing. I'm like this all chalks up to a scam. But I powered through the "I'm going to call you back" part. And it was not as easy as I thought it would be.
Maria Varmazis: Yeah. Do you think of yourself as someone who normally responds to authority? You know what I mean? Like, you know, some people go, oh, authority, if someone tries to bring it down on me, I am a contrarian. And I obviously go, no, F you.
Dave Bittner: [laughter] I'm sorry. Wait, Maria. Joe, a contrarian? [laughter]
Joe Carrigan: Yeah.
Maria Varmazis: I want to hear you -- I'm baiting him a little bit, Dave. I want to hear him say it. I want to hear him say it.
Joe Carrigan: I tend to be very contrarian.
Maria Varmazis: No.
Joe Carrigan: And especially with like elected officials, like I have -- like I have very little patience for anything with them. But when I'm dealing with law enforcement, these are people who carry guns and can kill you and get away with it. So it's a different discussion. So the thing you have to remember about law enforcement is when you're dealing with law enforcement, they're not, you know, they're the tip of the spear of the legal system. They are not going to judge you. They are not going to prosecute you. They are not going to do any of that. That is all other people's jobs. Their job is to enforce the law and stop you if you're committing a crime. And then if you are being charged with a crime, they're also in charge of arresting you. And I'm sure there's other stuff they do as well.
Dave Bittner: Yeah.
Joe Carrigan: But that's not the point at which I become the contrarian, when I'm talking with the big tough guy with the gun, right? That's when I just say, you know what? I'm not talking to anybody. I want to talk to my attorney. Or I say, you know what? I'm going to call you back on the sheriff's line, and I'm going to ask to be transferred to you. Interestingly enough, I did actually call the Carroll County Sheriff's. And I told him who I was. And I said, you know, I gave him my name, and I said what I do, you know, with this podcast. And I said, "I just got a phone call from somebody impersonating you guys with a jury duty scam. And he's like, "You didn't send him any money, did you?" [laughter] I'm like, "No, I didn't send him any money." Heck no. I'm retired and sent him all my Bitcoin.
Dave Bittner: Is there an implied "bonehead" at the end of that sentence?
Joe Carrigan: Yeah. You didn't send him any money, did you, bonehead? [laughter] I said, "No." And I gave him the phone number that he called me from --
Dave Bittner: Oh, that's good.
Joe Carrigan: -- and the information that he provided. And I said -- He put me on hold. I think he looked me up. And he said, "Hey, I really appreciate what you're doing. I think the podcast is great."
Dave Bittner: Oh, that's nice.
Joe Carrigan: So that's good.
Maria Varmazis: That's good.
Joe Carrigan: Yeah. So I let the Carroll County Sheriff's Department know this guy is going around impersonating them. And I don't even think that sheriff departments have sergeants, do they? They have deputies, and they have sheriffs.
Dave Bittner: Oh, I have no idea.
Joe Carrigan: Right.
Dave Bittner: I have no idea. But I think one thing I'll note here is that we've heard about these scams where -- this exact scam -- where the person will be impersonating a real sheriff.
Joe Carrigan: A real police officer, a real sheriff. Right.
Dave Bittner: So they'll give you a real name and a real badge number.
Maria Varmazis: Yeah. How are you going to check?
Dave Bittner: Well, but --
Maria Varmazis: Let me look you up in my database, you know.
Dave Bittner: But if you Google them -- If you go, let me just quick look this person up with the name and sheriff, they'll pop up.
Joe Carrigan: Right.
Dave Bittner: So that's what makes it so important to make that call back, to not believe that it's them.
Joe Carrigan: Right. Because they can do that research just like you can.
Dave Bittner: Right.
Joe Carrigan: They have Google as well.
Dave Bittner: Yeah.
Joe Carrigan: [whispering] Everybody does. [laughter]
Dave Bittner: All right. Well, I'm glad you didn't get scammed.
Joe Carrigan: I didn't. It was just no fun to deal with.
Dave Bittner: Yeah.
Joe Carrigan: No, not at all. But I really wanted to accentuate the, you know, the fact, I talk about this all the time in this show. Talk about this with other people. Talk about this with my parents, and my family members, my friends. But when it came down to it, there was still a physiological response.
Dave Bittner: Sure.
Maria Varmazis: Yeah. Yep.
Dave Bittner: Yeah. I think I would experience the same.
Joe Carrigan: Yep.
Dave Bittner: We're all human. [ Music ] All right. Well, let's get to some stories here. I'm going to start things off. I actually have two stories here because they're both kind of short. The first one comes from the folks at -- is it -- Maria, do you know if it's tek-nah-doo or tek-nay-doo? Any opinion there?
Maria Varmazis: I don't.
Joe Carrigan: It's the tek-nay-dō. Going back to last week.
Maria Varmazis: Is it from Tamil Nadu? Or is it -- I don't know.
Dave Bittner: Tek-nah-doo. I'm going to go with nah-doo, N-A-D-U. Anyway, their cybersecurity team was writing about a phishing scam that's targeting Apple Pay users using both voice and email. And because they're using voice, you know what that means, Joe?
Joe Carrigan: [whispering] It's phishing.
Dave Bittner: It's phishing. [laughter] [ Multiple speakers ]
Maria Varmazis: Did you have to whisper that?
Joe Carrigan: Yeah, because I don't like saying it. And if somebody missed the word, it's not an important word. Disregarding --
Maria Varmazis: Joe's ASMR.
Dave Bittner: He feels shame when he has to utter it out loud.
Joe Carrigan: Yes.
Maria Varmazis: Oh, and by the way, it's tek-nah-doo, like as in Tamil Nadu.
Dave Bittner: Okay, thank you. Thank you very much.
Maria Varmazis: Yeah, just checked that.
Dave Bittner: So what this does is they send you an email that looks to all the world like it comes from Apple. And it says that there is a transaction that's been blocked and that they need you to call a support number to unblock the transaction or to check out the transaction, verify the transaction, whatever. And so you get this email that looks like it came from Apple. Looks legit. I'm looking at a picture of it here. Looks legit to me. You know, has the design sensibilities of Apple. And when you call, now it's no longer phishing. You're on the line with them, so it's a voice thing. And then the folks on the other line pretend to be Apple support. And they're looking to get your Apple ID credentials and verification codes and financial data by impersonating Apple support staff.
Maria Varmazis: Fun times.
Dave Bittner: Yeah. So this article says, be careful who these things come from. The return address on these emails don't come from an Apple domain. So that's a red flag. But they also say what we say all the time, that Apple is not going to do this. [laughter] You know, they're not going to email you and ask you to call them.
Joe Carrigan: Right.
Dave Bittner: The last thing in the world a big tech company wants you to do is call them.
Joe Carrigan: Right. Right. They want you to give them your money and go away.
Dave Bittner: Right.
Maria Varmazis: Don't make me hire someone to have to talk to you.
Dave Bittner: Right. Right.
Maria Varmazis: Mm-hm.
Dave Bittner: So this is a quickie. We'll have a link to that in the show notes. The real thing I wanted to highlight here, I was looking around actually for our catch of the day for today because we had someone who was in the studio earlier this week, who I was chatting with, and they said that they particularly like scams that come out of Australia because of my spot-on Australian accent that is imperceptible from the real thing.
Joe Carrigan: That's right.
Dave Bittner: It's as if I actually grew up there.
Joe Carrigan: Yes. [laughter] We tell him that so he keeps doing it. [laughter]
Dave Bittner: Yeah.
Maria Varmazis: I felt a whole bunch of people just full-body cringe.
Dave Bittner: Right. No. People just pulled into the median and drove their cars into trees. But in doing my search, I came across a website from the AFP, the Australian Federal Police, I believe it is.
Joe Carrigan: Fire Apartment? [laughter]
Dave Bittner: No, it's not Fire Apartment. Fire Apartment. [with Australian accent] The Australian Fire Apartment, mate. No. But this is an excellent page, we'll have a link to it in the show notes, about romance scams. And this page was just published a few days ago. But it has videos about romance scams. But it runs through a lot of the things that go with romance scams. And it's just really well laid out. This is a page I would send to friends and family, right? The information on here is excellent. It's easy to follow and really lays it all out and helps you figure out how to fight this sort of thing. For example, they have a section, How Do Romance Scams Work?
Joe Carrigan: This is brilliant, by the way. I just read it.
Dave Bittner: Yeah.
Joe Carrigan: It's so concise and so beautiful.
Dave Bittner: Right. Exactly. They say, "Knowing the pattern makes scams easier to spot." They say, "While every scam is different, romance scams often follow a familiar pattern. There's contact, trust building, excuses, a crisis or opportunity, money requests, and then they disappear or repeat." And they flesh out each one of those. But then they have advice for protecting yourself from this sort of thing. They say, "Don't move the chat to another platform."
Maria Varmazis: Yep, never go to a second location.
Dave Bittner: That's right. "Verify the person. Ask to video call or meet in person. Never send money or share accounts. Watch out for romance scam tactics," and they mention things like love bombing, emotional manipulation, and pressure tactics. And "Talk to someone you trust." Talk to your friends, your family, people around you, because as we've mentioned here many, many times, they try to isolate you.
Joe Carrigan: Right.
Maria Varmazis: Yeah. Or they try to find people who are already very isolated, and that makes it harder.
Dave Bittner: Right.
Maria Varmazis: Especially the love bombing. I think people who are already very lonely and vulnerable, how could you not love being love bombed? It feels so soothing.
Dave Bittner: It does.
Joe Carrigan: Yeah.
Maria Varmazis: Yeah.
Dave Bittner: It does.
Joe Carrigan: There are a couple of comments I have on this. Verify the person: They say, "Reverse image search. Check the social media presence. Contact legitimate organization or the person directly." The last part is good, but if the romance scammer is impersonating somebody, you're going to find them in these reverse image searches. And they're going to show up with the name of the person that you think they are.
Maria Varmazis: Yeah. Or if they're trying to -- if they're being a brand new person that they've generated with AI, you're never going to find anything of them.
Joe Carrigan: That's correct.
Maria Varmazis: There's a lot of that going on now, too, so --
Joe Carrigan: It's a good way to eliminate somebody as a scam, but them passing this wicket does not mean it's not a scam. It's kind of an awkward way of saying this is helpful to eliminate people, but it doesn't confirm that you're dealing with a scammer.
Dave Bittner: Yeah, no, it's a sum of many, many different signals that you should keep track of. But I guess the big picture thing here is that I was struck with how fantastic this web page is when it comes to romance scams.
Maria Varmazis: Yes.
Dave Bittner: So I highly recommend that everybody, if you have friends, family, loved ones, whoever you think might be subject to this sort of thing, we'll have a link in the show notes, I absolutely recommend this one get sent around. It's one of the best I've ever seen
Joe Carrigan: I recommend everybody scroll to the bottom of the page, where they have all the different like insignias or shields of all of the different police departments. And the Northern Territory Police insignia has a kangaroo with a crown over its head. [laughter]
Dave Bittner: Of course it does.
Maria Varmazis: Noticing the important things here, Joe.
Joe Carrigan: Beautiful. I love this, Tasmania police -- I don't know if that -- That looks like a lion. They really missed an opportunity to go with the Tasmanian devil.
Dave Bittner: Well, the Australian Criminal Intelligence Commission has a kangaroo and an emu.
Joe Carrigan: Yes.
Dave Bittner: So that's pretty good.
Joe Carrigan: I believe the emu must be on a lot of government documentation as part of the armistice when Australia lost the Great Emu War.
Dave Bittner: Yeah. [laughter]
Joe Carrigan: Yeah. I found out about the Great Emu War when my son was doing a paper on The Great Gatsby. And I start typing into Google "the great," and it comes up as Emu War. I'm like, what?
Dave Bittner: You were like, oh, shiny object.
Joe Carrigan: Right. [laughter]
Dave Bittner: I know what I'm doing for the next hour. I look it up.
Maria Varmazis: Rabbit hole, ahoy.
Joe Carrigan: Right. You should look that up. It's an interesting story.
Dave Bittner: No, it is.
Joe Carrigan: Yeah, Australia went to war with emus and lost.
Dave Bittner: Yeah.
Maria Varmazis: Didn't they all say that with rabbits? [ Multiple speakers ] Yeah.
Dave Bittner: And Australia -- Well, I mean, look. We all know Australia is the continent that most wants to kill you.
Joe Carrigan: Right.
Dave Bittner: And they have, what are they, the cassowaries? The dinosaur birds.
Joe Carrigan: Yeah, the -- were terrifying, you know.
Maria Varmazis: Yeah. Oh, look at this South Australia police insignia. It's got the magpie, the one that will swoop and just get you. Yeah, the one that will just harass the heck out of you. So I just love that that's -- [laughter]
Dave Bittner: Pluck your eyes out.
Joe Carrigan: Yeah, there's actually a Bluey episode about that.
Dave Bittner: Oh, really?
Maria Varmazis: Joe, why do you know that?
Joe Carrigan: I have kids in my house that watch Bluey.
Maria Varmazis: Oh, my -- Because that's exactly what I was thinking of was the Bluey episode. [laughter] I have a little kid in my house. Oh, my gosh.
Joe Carrigan: I have little kids in my house all the time. And I'll tell you --
Maria Varmazis: That's so funny.
Joe Carrigan: Bluey is one of the best kid shows to watch because it's one of those shows that you can watch and then your kids can watch and enjoy, and you can watch. And it's awesome, actually. It's well written, well done, well-acted.
Dave Bittner: Yeah. Something for everyone.
Joe Carrigan: Yes.
Dave Bittner: All right. Well, we will have a link to this story in the show notes. As I said before, I can't recommend this highly enough.
Joe Carrigan: Yeah. Good job, Australia.
Dave Bittner: The Australians did a great job with this one. So please do check it out. All right. That's what I've got this week. Joe, what do you got for us?
Joe Carrigan: Dave, I have a story coming from the U.S. Department of Justice. It's a press release that came out on February 10th, and it said -- the headline is "Former bank employee found guilty of targeting elderly victims in identity theft and fraud scheme." So there is a guy who was an employee of a bank that doesn't get named. His name is Yue Cao.
Dave Bittner: Okay.
Joe Carrigan: Or, Yü Kau.
Maria Varmazis: Tsau.
Joe Carrigan: Tsau.
Maria Varmazis: Tsau, yeah.
Joe Carrigan: This person, Cao, has been found guilty on ten counts of bank fraud, four counts of aggravated identity theft. I think that's when you steal someone's identity and do something else to them as well. I think that's what's called an aggravating factor. I don't know. You know who we should have on the show for that is Ben.
Dave Bittner: Ben. [laughter]
Joe Carrigan: Ben Yelin.
Dave Bittner: Or your office mate, Michelle.
Joe Carrigan: Right, yeah. Or Michelle. Yeah. And one count of money laundering. And apparently, from 2022 to 2023, he used his access as a quantitative analyst at a bank to spot fraud, so he was working in the bank's fraud department as a quantitative analyst, to take about a million dollars from victims, about 100 victims. So that's like $10,000 a victim.
Dave Bittner: Right.
Joe Carrigan: So maybe he found like 100 victims that had large bank accounts and said they won't miss $10,000.
Dave Bittner: Yeah.
Joe Carrigan: And he wired it out. What he did was he went out, and he set up all these other bank accounts in their name so that he could transfer money to it using an offshore email service. And then he would put it into his own brokerage accounts from those other accounts. And he would then take that money and invest in options, which is, you know, in other words, he's trying to -- Options are kind of a risky investment.
Dave Bittner: Okay.
Joe Carrigan: When you buy an option, you stand a very good chance of losing 100% of your investment. So you know how you can mitigate that?
Dave Bittner: Use other people's money. [laughter]
Joe Carrigan: Use other people's money. That's exactly right.
Dave Bittner: Right. Right.
Maria Varmazis: Strange trick. Okay.
Dave Bittner: Using other people's money for high risk --
Joe Carrigan: Right. [ Multiple speakers ]
Maria Varmazis: Why didn't I think of that?
Joe Carrigan: I said $1 million. It's actually $2 million.
Maria Varmazis: Wow.
Joe Carrigan: Big difference. So the people he targeted were people that ranged in age from 90 to 103 years of age.
Dave Bittner: Wow.
Joe Carrigan: So he really targeted older people. People -- I don't know. I mean, my thinking on this --
Maria Varmazis: They're old. If you're in your 90s or more, you're old.
Joe Carrigan: These are nonagenarians, centenarians. I mean, that's pretty old. He's not targeting people in their 70s or 80s. He's going for people older than that.
Maria Varmazis: They're living ancestors at that point.
Joe Carrigan: Right. Yeah. And I'm wondering if he's -- I'm wondering why he selected this. What made that happen? And I don't know how you -- I don't think there's anything you can do to defend yourself against this as a general person. And I think the bank might be liable for these transfers because this was their employee committing fraudulent acts.
Dave Bittner: Yeah.
Maria Varmazis: Yeah, I would hope so.
Dave Bittner: The thing that caught my eye reading through this article, Joe, is that he set up online banking for these people who did not have online banking.
Joe Carrigan: Right. Yeah, they don't use online banking. I don't know any 90-year-olds that use online banking.
Dave Bittner: Exactly.
Joe Carrigan: Right.
Dave Bittner: And what this reminds me of is when my father was 90, one of the things we did together was went to the bank and established an online bank account. Or I guess the better way to say it is enroll him in his bank's online services.
Joe Carrigan: Right.
Dave Bittner: For the exclusive purpose of me being able to get alerts.
Joe Carrigan: Right.
Maria Varmazis: Yeah. Yep.
Dave Bittner: You know, so if somebody transferred more than X number of dollars, you could set whatever you wanted your threshold to be, I would get pinged.
Joe Carrigan: Right.
Dave Bittner: So it was just sort of a backup kind of thing. But had we not been interested in that, my father never would have had an online account. [laughter]
Joe Carrigan: Right. And even if you had set that up, with this guy, being an insider, he would have been able to see what those alerts were, maybe.
Dave Bittner: Could be.
Joe Carrigan: And then he could have come in under the alerts and wired the money out.
Dave Bittner: Well, yes, but I think in this case, it seems like he was targeting people who had no online presence.
Joe Carrigan: Right, yeah.
Dave Bittner: Which made his work a lot easier, and I guess probably made it easier to fly below the actual bank's security methods.
Joe Carrigan: Yes.
Dave Bittner: I'd love to know how, ultimately, he got caught.
Joe Carrigan: This article doesn't say how he got caught. That would be an interesting follow-up. I don't know, Dave. I really don't know.
Maria Varmazis: I want to imagine there's a world in which someone in their internal fraud investigation was going, hmm, all of a sudden these people who are really, really old all at once are signing up for online banking. That's going to set off some sort of flag somewhere.
Joe Carrigan: Maybe.
Maria Varmazis: Some sort of policy. That's weird. I would love to think that that's it.
Joe Carrigan: That could have been it.
Maria Varmazis: Yeah.
Joe Carrigan: There's another story on this from Fox 8 News out of Cleveland. And that story has -- the quote says, "Court records show that Cao, who was fully a remote employee of the bank and was arrested in Chicago in May of 2024." So he did not work physically at the bank. So there's nobody there sitting there looking over his shoulder. He is remote, and he is, you know, defrauding the bank's customers. They were all over the region. They were not all just Ohio residents, even though this bank was in Ohio. They had people in New York and other states as well. Anyway, they caught him.
Dave Bittner: Yeah, good. [laughter]
Joe Carrigan: He hasn't been sentenced yet, but he's looking at a minimum of two years and a maximum of up to 30 years.
Dave Bittner: Okay.
Maria Varmazis: And he's 36, so that's pretty much prime time of his life.
Joe Carrigan: Yeah, by the time he gets out of here, he's only going to be like, you know, 30 years away from getting scammed like this himself, right?
Maria Varmazis: [laughter] Jesus Christ.
Dave Bittner: Oh, it's a special kind of evil to go after the elderly. Yeah, it is. That's despicable.
Joe Carrigan: I agree, 100%.
Dave Bittner: Yeah.
Joe Carrigan: I hope he gets the full 30 years.
Dave Bittner: All right, well, we will have a link to that story in the show notes here. I'll tell you what. Let's take a quick break to hear from our show sponsor. We'll be right back after this. [ Music ] And we are back. Maria, you're up. What do you got for us?
Maria Varmazis: Well, I guess, today's episode is, the theme is like elder abuse, which mm-hm. [laughter] Because my story is not so much a news story. It's just something for a recommendation for our listeners to read. It's an article by Nancy Rommelmann, published on RealClearInvestigations. And the title of it is "Caring for Mom is an Education in Scams and Fraud." And so this is Nancy recounting what she is going through, actively caring for her mother, who is 84 and has memory troubles, and the scams and fraud that she regularly encounters as her mother's part-time caregiver. And some of these are, besides just scams and fraud that we talk about on the show, where it, you know, involves people calling up her mother and her mother sometimes falling for, you know, a very convincing scammer. And in other cases, it's much more immediate and in person. And these are just as dark, if not darker. And I just -- I read this piece with so much sympathy. And also -- Well, at the end of it, I was going, what on Earth can we do to help people like Nancy who are really trying to stave off all these people taking advantage of her mother?
Dave Bittner: Yeah.
Maria Varmazis: So I'll run through some of what this piece goes through. But really, this is a piece worth reading. So I really want to encourage our listeners to do that. So Nancy, at the beginning of the story, discovers that her mom, again, who is 84, has an unpaid IRS bill stuffed in a drawer that was forgotten about. And her mother's accountant, longtime trusted accountant, says, oh, don't worry, I'll take care of it. And what this accountant, who I think has been working with Nancy's mom for decades, does is have Nancy's mom sign a blank check. And then $25,000 is gone from Nancy's mom's account, that he pays to himself. And he works at a trusted, prestigious accounting firm. He's known Nancy's mom for a long time. She had trusted him for decades. And there were other scams like this where basically people figured she's 84 and has memory problems. I don't think she'll notice if she loses 25K here or there. There's this paragraph that is at the beginning of the story where Nancy writes, "In the six years since I've taken my mother's finances in hand, I have dealt with dozens of schemes meant to bilk the elderly, including phone scammers who promised my mother she had won a Mercedes, home health aides who inflated their hours, people forging my mother's signature, and a relative who had her sign over her car." There were other instances. There was one after Nancy's mother's husband, so, I guess, Nancy's father passes away. Nancy's mom is convinced to sign away $200,000 in farm equipment that their family had owned. Just please sign this. Don't worry about it. We don't have enough time to explain to you why we're asking you to sign this. It's for your own good. And there goes $200,000 worth of farm equipment to other people. So the piece really deftly weaves in statistics about that the FBI has been tracking about how elder fraud is skyrocketing. Apparently, average losses, at least in 2024, started at $20,000 per incident. But they can go much higher, as we know. And the through line through a lot of this was, and the experts that Nancy spoke to, was about how loneliness, and we've talked about this a lot, loneliness just compounds a lot of the problems. You have a toxic mix of people who are lonely and people who have memory issues, and they become, unfortunately, easy prey for people with terrible intentions. So Nancy's recommendation is something that we've often said as well, is that if you are taking care of elderly parents or think you might be sometime in the future, get involved in helping out with finances earlier than you think you need to. Often, by the time you need to jump in and start managing this, it can be a little either too late, or you have a lot of larger emotional or cognitive barriers you have to deal with, like shame and embarrassment.
Dave Bittner: Right.
Maria Varmazis: You know, or people not wanting to tell you what's going on because, you know, they're embarrassed that maybe they've gotten taken, and they know that they have. So don't wait until decline is obvious. Don't wait until the problems are already building up. Try to get in front of it as best that you can because people are really unscrupulous. And I really feel for Nancy in this piece. I really, really do. So it's a -- it's a great read. I know it's like not a very uplifting thing to talk about, but it is actually a really great read. And I hope a lot of people read it because it shines a bright light on this problem.
Dave Bittner: It reminds me of some things I've dealt with in my own life. And I think most of us, as we go through life, are probably going to have one or two of these things pop up along the way.
Maria Varmazis: Yeah.
Dave Bittner: And one thing that hits me here is that, particularly when you're talking about cognitive issues, sometimes it only -- you only realize it when looking in the rearview mirror.
Joe Carrigan: Right.
Maria Varmazis: Yes.
Dave Bittner: Oh, that was cognitive stuff. You know, my mother had about a three-year decline, you know, before she passed. But only looking back did I think and go, oh, that was, you know, that silly thing she said to me, or that odd off thing she said to me about money, or, you know, okay, that was probably this. That was probably the beginning.
Joe Carrigan: Right.
Dave Bittner: But I didn't realize it at the time, you know. So it was easy for me to dismiss that and just say, oh, Mom, you know, come on now. I don't think that's what's happening.
Maria Varmazis: Being eccentric in her dotage. Yeah.
Dave Bittner: Right. Exactly. Exactly. I mean, in this case, well, they're both gone, so I can tell stories about them.
Joe Carrigan: Right. [laughter]
Dave Bittner: My mother was concerned -- Now, let me just set the stage here. Listeners probably already know this. My parents were together for over 70 years. Okay? [laughter]
Maria Varmazis: Wow. Wow. Wow.
Dave Bittner: Right? So --
Joe Carrigan: Your father is invested.
Dave Bittner: [laughter] Yeah. They were together.
Maria Varmazis: Sunk cost fallacy? Is that what you're getting at, Joe?
Joe Carrigan: No, no, no. I'm saying he's in from a long haul.
Maria Varmazis: Okay.
Dave Bittner: No marriage is perfect, and, of course, theirs was not. But they did have, I think it's fair to say, they had a relationship for the ages, and they were together for 70 years, right?
Maria Varmazis: That's amazing. Yeah.
Dave Bittner: And there was a point where my mother called me up because she was very upset because she was convinced that my father was giving all of their money to the waitresses at Golden Corral. [ Laughter ]
Maria Varmazis: Pretty specific.
Joe Carrigan: I did not think that sentence was going to Golden Corral. [ Laughter ]
Dave Bittner: Now, I am sure that my father -- Now, there's more to the story because my father, in his later years, went to Golden Corral pretty much every Saturday to the point where he pretty much had like a velvet rope tied to his booth. [laughter]
Joe Carrigan: So he'd go to the Velvet Rope Ollie's and he'd go to the Velvet Rope Golden Corral.
Dave Bittner: Exactly.
Maria Varmazis: Wait, the Velvet Rope Ollie's? Are we talking about the discount store Ollie's?
Dave Bittner: Yes. Yes.
Maria Varmazis: Okay, just making sure I understand. Okay. The guy with the teeth. Yep.
Dave Bittner: My father was a high roller at Ollie's as well.
Maria Varmazis: Okay, all right.
Joe Carrigan: He got special access.
Dave Bittner: But they had, you know, people -- he dealt with the same waitresses pretty much every week. My father was a big tipper. He's very personable. So, you know, he had relationships with these ladies, and my mom wasn't having it. [ Laughter ]
Joe Carrigan: Let me -- Did your mom ever wait tables?
Dave Bittner: No, not that I know, no.
Joe Carrigan: Yeah, because I tend to be a big tipper as well. You know, like my minimum tip is 20%. And it goes up from there. And my wife has waited tables. I've worked in the restaurant industry as well, but they never -- everybody had the good sense not to make me a waiter.
Dave Bittner: Put you out in front, direct contact with customers? [laughter]
Joe Carrigan: You just cook the pizza, Joe.
Maria Varmazis: Some people are back of house.
Joe Carrigan: We'll keep you back here in the kitchen.
Maria Varmazis: Some people are front of house.
Joe Carrigan: You go to scullery. That's where I really actually --
Maria Varmazis: Scullery. [laughter] You were a scullery maid, is what you're saying.
Joe Carrigan: Yeah. I was a steward, I guess, is what they -- the guy that runs scullery. But one of the things my wife always hated was people that were like -- She would endeavor to give everybody the greatest tips. And she would -- she hated it when people gave her crappy tips, hated it. So when I give big tips, she's like yeah, that's good.
Dave Bittner: [laughter] Yeah, I agree. I think if you can, if you have the means and someone has provided you a good service, why not?
Joe Carrigan: I'm going to tell another story. I have a friend, actually, it's one of my daughter's friends, but I've always liked this kid. She's a great kid. I mean -- kid -- she's now almost 30. But when she was in college, she was working as a waitress over at one of the Rams Head places.
Dave Bittner: Yeah.
Joe Carrigan: And she started noticing that she was getting bigger tips when she wore red lipstick. So she's like -- She's actually a scientist. So she says, okay, well, maybe this is anecdotal. And so she starts tracking her tips based on whether or not she's receiving, you know, wearing lipstick or not. And she found that she got like 20% more tips on average when she wore red lipstick.
Dave Bittner: Yeah. I think this is the whole business model behind Hooters.
Joe Carrigan: Yeah. Yeah.
Dave Bittner: Don't you think?
Joe Carrigan: When was the last time you saw a Hooters?
Dave Bittner: I think there's still one in Ocean City.
Joe Carrigan: Oh, that makes sense.
Dave Bittner: Yeah. [ Laughter ] I think. I don't know.
Joe Carrigan: I know you love that city, Dave, but I hate it.
Dave Bittner: I know. That's all right. Ocean City is a dump, but it's my dump.
Joe Carrigan: Right.
Dave Bittner: And so I have great affection for it. Yes, I have waited tables when I was in college, and it's a hard job. It's absolutely a hard job.
Joe Carrigan: It is.
Dave Bittner: All right. Well, we will have a link to this story in the show notes. And, Joe, Maria, it is time for our catch of the day. [Soundbite of reeling in fishing line] [ Music ]
Joe Carrigan: Dave, as you mentioned earlier, our catch of the day comes from the Australian Federal Police, and this is another example of a scam.
Dave Bittner: That's right.
Joe Carrigan: And this one is kind of near and dear to my heart, Dave.
Dave Bittner: [laughter] Okay. So this comes from the Australian tax office. And it's to you.
Joe Carrigan: Right. To you.
Maria Varmazis: You.
Joe Carrigan: Right.
Maria Varmazis: The email address is just you.
Joe Carrigan: The email address is literally just y-o-u. That is going to bounce back and fail. You are in the bcc of this email.
Dave Bittner: I see.
Joe Carrigan: Yep.
Dave Bittner: All right.
Joe Carrigan: That's how this works, technically.
Dave Bittner: And it has the seal of the Australian Government again with the kangaroo and the emu. [laughter] And it goes like this: [with Australian accent] "We've been informed that you're currently in possession of cryptocurrency held in a non-KYC decentralized wallet, commonly referred to as a cold wallet. Please note that all digital asset holdings are required to be declared in accordance with our compliance and reporting obligations. As of today, our records indicate that no such declaration has been made by you. You are required to disclose full details of these holdings immediately. Failure to declare this information may constitute a breach of applicable regulations and could result in further investigation and potential legal action, including prosecution. Please call us now to declare these holdings to avoid further action."
Maria Varmazis: You got a little Brooklyn in there, Dave. [laughter]
Dave Bittner: You know, yeah, I was thinking also I was drifting into Michael Caine. [laughter]
Maria Varmazis: Yeah. "Do not go gently into that good night."
Dave Bittner: No.
Joe Carrigan: Are you talking about from the end of Dirty Rotten Scoundrels?
Dave Bittner: Yeah.
Maria Varmazis: There you go.
Dave Bittner: The Muppets --
Joe Carrigan: The Muppet Christmas Carol.
Maria Varmazis: The Muppet Christmas Carol.
Dave Bittner: Whatever, you know.
Joe Carrigan: Best Muppet movie ever.
Dave Bittner: Yeah, you can't go wrong with Michael Caine, you know.
Joe Carrigan: No, you cannot.
Dave Bittner: He's one of the best.
Joe Carrigan: Yes.
Dave Bittner: So, yes.
Maria Varmazis: Famously not Australian, though.
Dave Bittner: Not Australian.
Joe Carrigan: Yep.
Dave Bittner: As am not I.
Joe Carrigan: Yes.
Maria Varmazis: I would never have known, Dave.
Dave Bittner: I know. I know.
Joe Carrigan: So, as the crypto bro of the channel or of the podcast here, I have some real issues, some red flags that would take anybody knowledgeable about crypto, and they would throw this email away immediately.
Dave Bittner: Okay.
Joe Carrigan: So there is a -- they said, "We have been informed that you are currently in possession of cryptocurrency held in a non-KYC, decentralized wallet commonly referred to as a cold wallet."
Dave Bittner: Okay.
Joe Carrigan: That is essentially gibberish, from a cryptocurrency standpoint. A non-KYC decentralized wallet -- I've never heard of what a decentralized wallet is.
Maria Varmazis: Joe, I have some news for you. That's gibberish to those of us who don't know crypto.
Joe Carrigan: No. I mean, but this is just word salad.
Dave Bittner: Well, KYC is know your customer.
Joe Carrigan: Know your customer, right.
Dave Bittner: Yeah.
Joe Carrigan: Decentralized wallet -- I've never heard of a decentralized -- I've heard of decentralized exchanges, where they don't have KYC on them. But a decentralized wallet? No, you have to have the wallet. That's where you keep your private keys.
Dave Bittner: Okay.
Joe Carrigan: And that's the only thing that's in your wallet. The coins, the tokens, are actually out on the blockchain.
Dave Bittner: Cold wallet is a thing, though, right?
Joe Carrigan: Commonly referred to as a cold wallet, and that is not what a cold wallet is. A cold wallet is a wallet that is physically isolated from the internet. So it's like a hardware wallet. They used to have hardware wallets. I think they still sell them.
Maria Varmazis: They still sell them, right?
Joe Carrigan: You unplug that thing from a computer, bam, that's a cold wallet because there's no access to it.
Dave Bittner: It's the one that guy's been looking for in the landfill for the past 10 years?
Joe Carrigan: No, that was not a cold wallet because that was on his hard drive, so it was accessible.
Dave Bittner: Well, when he unplugged it, it became a cold wallet.
Joe Carrigan: I guess you're right. Yeah, I think he gave up the search for that. I feel really bad for that guy.
Dave Bittner: Yeah, sure. All right. Anything else in here, Joe, that stuck out to you?
Joe Carrigan: I don't know how they would ever find out if you had a like wallet that you had like in your possession, like just an individual wallet, how they would ever find out that you had cryptocurrency on it.
Maria Varmazis: Isn't that entirely the point that you're not supposed to ever have a way of someone finding out, right?
Joe Carrigan: That is the point. However, there are analytics you can run once you start moving cryptocurrencies. Particularly around the public blockchains like Bitcoin and Ethereum, if somebody can associate an action with you, they can associate everything with you from -- at least from certain addresses that I know of. I don't know. But, you know, they can see where it's going and who signed the transactions to send the money out, and they can verify that. That's all public information.
Dave Bittner: Yeah.
Joe Carrigan: But, yeah.
Dave Bittner: My understanding is they've gotten -- they've got some really sophisticated tools to trace this stuff these days.
Joe Carrigan: But if, you know, they don't know if a random Bitcoin address is owned by someone in Australia. They have no way of knowing that.
Dave Bittner: Hmm. Okay. All right. Well, that is our catch of the day. And, of course, we would love to hear from you. If there's something you'd like us to consider, you can email us. It's hackinghumans@n2k.com. A little tip of the hat to a friend of the show, Hazel, for inspiring me to go try to find something Australian. [laughter] [ Music ] All right. That is "Hacking Humans" brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliot Peltzman and Trey Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe Carrigan.
Maria Varmazis: And I'm Maria Varmazis.
Dave Bittner: Thanks for listening. [ Music ]
