The evolving face of AI deepfakes.

Dave Bittner: Hello, everyone, and welcome to "Hacking Humans," where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner, and joining me is Joe Carrigan. Hey, Joe.

 

Joe Carrigan: Hi, Dave.

 

Dave Bittner: And our N2K colleague, Maria Varmazis. Maria.

 

Maria Varmazis: Hi, Dave, and hi, Joe.

 

Dave Bittner: We've got some interesting stories to share this week, but first, let's get into our follow-up. Joe?

 

Joe Carrigan: You know what we haven't talked about in a while, Dave? Maria? [Chicken cluck] Yay, Maria gets it [laughter].

 

Dave Bittner: Yeah. All right.

 

Joe Carrigan: I've got a little bit of a chicken update.

 

Dave Bittner: Yeah.

 

Joe Carrigan: So, you know, I'm building the run, or I built like the square part of the run.

 

Dave Bittner: Okay.

 

Joe Carrigan: I still have yet to build the roof, which I'm going to be working on this coming weekend.

 

Dave Bittner: Okay.

 

Joe Carrigan: But in the course of doing that, I took this, what was the old run, that was in the new run with them. Because the old run was very small. That's why I built the new one.

 

Dave Bittner: Okay.

 

Joe Carrigan: And I took it out and put a new feeder in, my brother recommended. Because he used to have chickens. Now he just has ducks. But I said, you know, these chickens are making a mess with this chick feeder. I still have like a little chick feeder for them. And he said, well, I just put, you know, a big bowl on the ground. So I got a big bowl, put it on the ground. And one of my idiot chickens, it was Dottie.

 

Dave Bittner: Oh, Dottie.

 

Joe Carrigan: It's always Dottie that does this.

 

Dave Bittner: Okay [laughter].

 

Maria Varmazis: That troublemaker Dottie.

 

Joe Carrigan: Yeah. And she just gets in there and acts like it's a chicken bath and starts rolling around in the chicken feed, scattering it to the four winds. And, you know, now I'm getting chicken feed all over the place and I don't want that. So I'm going to come up with a new solution for that. Also, another one of my chickens, this is Speckleface. I named them, by the way, based on some features they had when they were chicks.

 

Dave Bittner: Okay.

 

Joe Carrigan: So Speckleface had a speckled face when she was a chick. Now she doesn't so much have that. But she is getting pecked, it looks like, on her back and is like missing a lot of feathers. And yesterday she had a little skin.

 

Maria Varmazis: She's getting bullied.

 

Joe Carrigan: Yeah, she's getting bullied. She's the smallest of the chickens. So I put that run, that old run, back in there, because I think they were just kind of bored. And you know, once I put that old run back in there, and they started hopping up on it. I put a couple perches in there as well, just for the time being until I can get more permanent solutions built up for it. But it's, you know, it's going well, but I am encountering a couple of difficulties. But now I'm getting like on average about four eggs a day, which is pretty good.

 

Dave Bittner: Wow, that's pretty good.

 

Joe Carrigan: So yeah, I get a dozen every three days.

 

Dave Bittner: So is the chicken hutch.

 

Joe Carrigan: The coop.

 

Dave Bittner: The coop, thank you. Rabbits live in hutches, chickens live in coops [laughter]. Is it like a habit trail where it's going to keep expanding in different directions? And soon, you know, your whole backyard is going to be a giant chicken coop mall?

 

Joe Carrigan: Yes, my wife has already suggested I build one of those little wire tunnels, you know, that lets them run around and keeps them safe from hawks and things like that. I don't know that I'm going to go through all that. I am going to probably add onto the run. Because I designed it so that it could be added onto easily.

 

Dave Bittner: Yeah.

 

Joe Carrigan: So I can just build two more walls. Take the front wall off, put the two other walls back on, and then put the front wall back on.

 

Dave Bittner: I think you should give them an observation tower.

 

Maria Varmazis: I think you should give them hamster tubes so they can do -- like pneumatic tubes for chickens kind of situation.

 

Joe Carrigan: That's exactly kind of the thing that my wife wants me to build is like a little.

 

Dave Bittner: Like a Habitrail.

 

Joe Carrigan: Like a Habitrail for chickens.

 

Maria Varmazis: Yeah. And then have like an Augustus Gloop experience [laughter]. I want to see that. I want to see a chicken like slowly -- that would be very fun.

 

Joe Carrigan: That was one of the things that terrified me the most about that movie was the Augustus Gloop situation.

 

Dave Bittner: Really? The bad pressure in that tube?

 

Joe Carrigan: Yeah, and him sitting in there. I don't know why that always bugged me, but it did.

 

Dave Bittner: Okay.

 

Maria Varmazis: And that's when you found out you had claustrophobia [laughter].

 

Joe Carrigan: I am less comfortable in closed spaces than I am like sitting on top of a teetering ladder. I don't really have a fear of heights, but I am not really comfortable in closed spaces. But, you know, I could get an MRI. I don't think I'd have a problem with that. But anytime I have to shove myself into something -- like I'll never go spelunking. That's just not going to be a Joe thing.

 

Dave Bittner: Cave scuba diving [laughter].

 

Joe Carrigan: Right, yeah. I might, you know, I've always wanted to get scuba certified and you, like open water, but I'm not going into any cave.

 

Dave Bittner: Right.

 

Maria Varmazis: No, I mean, that's practically guaranteed death it's so dangerous, it really is.

 

Joe Carrigan: It's how everybody dies when you hear about them dying in a scuba accident. He went into this cave. Oh, I see. Yes, he did something incredibly stupid.

 

Dave Bittner: Yeah.

 

Joe Carrigan: Speaking of incredibly stupid, somebody -- and the only reason I'm saying incredibly stupid is because I think this is actually pretty smart and fun. But somebody has finally come up with another good use for AI.

 

Dave Bittner: Yeah?

 

Joe Carrigan: This is a tool from kagi.com.

 

Maria Varmazis: I'm a big fan and I pay for their service.

 

Joe Carrigan: Oh, do you?

 

Maria Varmazis: I do. I have the Kagi paid search and everything. I'm very happy that I've done that.

 

Joe Carrigan: Okay, well, they have a translate service. And my son sent me this link this morning for translating to LinkedIn lingo, which I think is hilarious [laughter].

 

Dave Bittner: I feel this piggybacks on the thing Maria had last time. What was the subreddit?

 

Maria Varmazis: LinkedIn Lunatics.

 

Dave Bittner: LinkedIn Lunatics, right?

 

Maria Varmazis: Big fan.

 

Joe Carrigan: On my web browser right now, I have this tool open. We'll put a link in the Show Notes. But what I've typed in English is -- rest assured, I do not feel this way about my manager. I'm pretty confident in my management change. So if anybody's listening, don't take this to mean anything. But I just put this in, "my idiot manager came up with the dumbest idea I have ever heard." And that's all I put in. LinkedIn speak is, "I'm incredibly grateful for the opportunity to lean into some truly disruptive, out-of-the-box thinking from my leadership today. It's a powerful reminder that embracing unconventional perspectives is key to fostering a growth mindset and driving innovation in a fast-paced environment."

 

Maria Varmazis: Geez.

 

Dave Bittner: Yeah.

 

Joe Carrigan: That sounds like it came right off LinkedIn.

 

Dave Bittner: Yeah.

 

Joe Carrigan: I was griping on last week's podcast about how much I despise LinkedIn now. It's, you know, called it Facebook in a suit and everything. And I am convinced that there are people out there who are just doing this kind of thing and using generative AI. So maybe I'll start doing this kind of stuff.

 

Maria Varmazis: Oh yeah. I think it's just AI talking to each other. You've got AI making the posts and then AI in the comments. And I don't know if people are actually in the loop anymore.

 

Joe Carrigan: Which could very well be.

 

Maria Varmazis: Yeah, I doubt it. But some people also use LinkedIn kind of like Facebook. And I find that also very confusing.

 

Joe Carrigan: Yeah.

 

Maria Varmazis: It doesn't fit my mental model of how you're supposed to use LinkedIn to use it for a lot of personal updates. I get very confused by that.

 

Joe Carrigan: I see so much political stuff on LinkedIn, and I'm like what are you doing; why are you doing that?

 

Maria Varmazis: Yeah, that's just -- again, does not fit my mental model of what LinkedIn is for.

 

Dave Bittner: I have been avoiding LinkedIn for probably about a year now [laughter].

 

Maria Varmazis: It's for the best. It's for the best.

 

Dave Bittner: I just don't like it. And a big part of it is this sort of style of communication, this inauthentic style of communication, I guess. And everybody who contacts me or reaches out -- well, that's not fair. Many of the people who reach out -- because many of the people who reach out to me on LinkedIn are in good faith, just want to connect, and that's fine. But enough people reach out to me on on there who just want something from me.

 

Joe Carrigan: Yeah.

 

Dave Bittner: That just feels one directional.

 

Maria Varmazis: Yeah. I also have to say for people who post daily on LinkedIn, I definitely look askance at that. You're posting that much on LinkedIn. I'm like, what's going on there? So yeah.

 

Dave Bittner: So we have another -- we will share that link in the Show Notes, so do check that out because it is great fun.

 

Joe Carrigan: Let me just tell you about my past three interactions on LinkedIn.

 

Maria Varmazis: We're still on this? Okay.

 

Joe Carrigan: Yeah, I'm sorry. Because I opened LinkedIn, I was getting ready to go here. And before we move on to that, this one is, "Hi, I noticed you have a podcast and wanted to see if you were looking for new guests." And another one is, "Hey, do you want to come to my conference that I'm hosting in Reston?" I'm like, "No, I'm busy." And another one is, this is the most recent one, "As a career ownership coach with the entrepreneurial source I got" -- it's just somebody selling career coaching services.

 

Maria Varmazis: Yeah.

 

Joe Carrigan: That's the last three interactions. Then the one before that is a vapid, "Hey, congratulations on your 10-year anniversary at the CyberWire.

 

Dave Bittner: Yeah.

 

Joe Carrigan: Right? I've been doing this for 10 years, which was kind of -- and you know what I did? I just clicked the automatic "thank you," and it just like, "thanks." And then this guy's first name is a middle initial. And he replied with the automatic, "you're welcome."

 

Dave Bittner: There you go.

 

Maria Varmazis: That was a very high value, yeah.

 

Joe Carrigan: Empty conversation.

 

Maria Varmazis: Yeah. So, great. Yeah. It's just like dropping your business card in a fishbowl. Like what, you know, I don't know.

 

Joe Carrigan: Yeah, I'm sorry. I had to talk about how much I -- I'm very close to just deleting my account on this platform.

 

Dave Bittner: Yeah. So there's another use of AI that was shared around on our CyberWire Slack channels over the past week or so. And this is from a group called "Civ AI, Civic AI Security Program." They have an automated phishing platform. So basically you put in some celebrity's name and it automatically generates a phishing email for them.

 

Maria Varmazis: Right. It can also, fictional characters, it can do, which I had a lot of fun with that.

 

Dave Bittner: Right. So I'm just going to put in Yoda.

 

Joe Carrigan: Oh, it's going to do Boba Fett.

 

Dave Bittner: Okay.

 

Joe Carrigan: But no, do Yoda, that's fine.

 

Dave Bittner: All right, we'll do Yoda. So it's looking up Yoda. Oh, that's interesting. Look, it gave us Frank Oz.

 

Joe Carrigan: That's no good.

 

Maria Varmazis: We know you have a choice in podcasts and you probably should make a different one.

 

Dave Bittner: Okay. All right. Well, so, okay, this is -- so I put in Darth Vader and it came back with Anakin Skywalker. So we can go with that.

 

Maria Varmazis: Spoilers, Dave.

 

Joe Carrigan: You're close enough.

 

Maria Varmazis: Jeez.

 

Dave Bittner: [Laughter] Right. So basically what this does is it goes to Wikipedia, looks up the person, so it finds out everything it can about them. And then you ask it to write the phishing email, and it generates the phishing email. So this one says, "Dear Master Skywalker, I'm reaching out from the Coruscant Refugee Resettlement Initiative. Our records indicate you might have connections to former Jedi support networks. We're currently documenting displaced Force-sensitive individuals and tracking potential relocation assistance for those impacted by recent imperial actions. Given your unique position and historical involvement with the Jedi Order, we believe you could provide critical background information about survivors who might need emergency assistance. Our team has preliminary data suggesting several at-risk individuals in the outer rim will require immediate support. We would appreciate any confidential information you can share regarding known Jedi survivors or their potential whereabouts. Your discretion is paramount as imperial monitoring remains aggressive."

 

Joe Carrigan: This sounds like something a Sith Lord would say [laughter].

 

Maria Varmazis: I had so much fun with this link, Dave. I was using it on so many fictional characters, like Paul Atreides from Dune. It was just so funny to see what the AI came back with personal vulnerabilities or attack strategies on Paul Atreides. And then seeing that eventually the phishing emails sort of lead you to try and hack Paul Atreides' LinkedIn account.

 

Joe Carrigan: I got tons of spice, Muad 'Dib.

 

Maria Varmazis: Yeah, the spice must flow. Just, I had fun. I was sending this link around to a lot of friends. And I can actually see this one being something that people will engage with who don't normally think about this stuff. It's a really useful teaching tool. I'm a big fan of this.

 

Dave Bittner: It really is.

 

Joe Carrigan: And it goes on to do an entire platform kind of thing. Like you can -- it'll show you what the landing page for the site you're linking to looks like.

 

Dave Bittner: Yeah.

 

Joe Carrigan: It's amazing. I'm sorry, Maria, I cut you off.

 

Maria Varmazis: No, it's okay. If you hit -- and some of the -- some of the -- as you scroll down, there's an option where it has the initial phishing email. Sometimes you can hit the reply button and actually it'll go back and forth with you to try and lure you in as this character. It's really quite interesting. I've sent this to a lot of people who are not normally interested in any of this kind of thing, and they've also been having fun with it. And that feels like a hook, a really good one. So yeah.

 

Dave Bittner: I think it's a great way to get people accustomed to what to look for.

 

Joe Carrigan: Yeah, it is.

 

Dave Bittner: Yeah. All right, again, we'll have a link to that in the Show Notes. We will be right back after these messages. Let's get to our stories here. Maria, you want to start things off for us?

 

Maria Varmazis: Sure. So yeah, it's AI related. Surprise [laughter]! My story comes from Wired this week, and it's an update to a long-standing story that we've covered a lot about, basically pig butchering scams that are based in Southeast Asia and slavery going on there. There is a new job listing that's been going out in the last year or so for what they're calling "AI face models." And these AI face models are actually working and I believe actually getting paid at these call centers, potentially also enslaved or at least unable to leave the compounds for their contracting stints. But the way that Wired was able to dig into this one was they were looking at a bunch of Telegram channels where job postings, and again, these are legit job postings, where these job postings were listed for AI face models. And they actually saw people responding to the job postings. So a lot of these models are based in Asia, Central Asia. And one example of a job respondent was a 24-year-old woman from Uzbekistan. And she posted a video highlighting her language skills and on-camera presence. And she was seeking work through these job postings to do live video calls where her face would be altered using AI to match a fake identity. So we've been watching deep fakes evolve with great interest. I know I have over the last few years. And I think we all know now that face swapping has gotten to the point where it can happen very easily in real time, pretty convincingly. Not that long ago, it was glitchy, but now it's scarily solid. And actually I was just watching something earlier today about not just face swapping, but full body swapping is even getting pretty convincing where.

 

Joe Carrigan: Really?

 

Maria Varmazis: Yeah. Or even if you're using AI to swap you out as a totally different person, like say Taylor Swift or something, you interacting with the clothing you're wearing would actually convincingly have your avatar also doing the same. So if you've got a shirt, a collared shirt on, you can manipulate your shirt and your AI avatar wearing something different, will also manipulate their shirt in a convincing way. It was wild. But that's still a little slow and requires a lot of heavy lifting computationally, whereas face swapping is pretty easy comparatively. So if you hire a young model with like a nice body, I suppose, all you need to do is have the face swapped out and you can deploy this at scale. And especially if that person can speak the language that you're trying to target people with, convincingly, you don't need to do a voice swap either. They can just use their voice, use their body, and just swap their face out at will. So the job listings that Wired was uncovering through Telegram, they're real, and they're for short stint contracts, usually about six months or so. The promises made by these job offers are questionable, but they do say that you do get paid a lot. Some job applicants are asking for things like $7,000-a-month salaries, which is -- I don't know if that was just someone going pie in the sky, or they're saying this is a normal competitive salary for this kind of work. So that's pretty wild.

 

Joe Carrigan: I know you're going to make a bunch of money scamming people with my face. I want a cut.

 

Maria Varmazis: Yeah, seriously. The job demands are also -- the scammers are pretty upfront about what's going to be asked of these models, where long overnight shifts, sometimes over 100 to 150 video calls a day. And often their passports are taken for, quote, "visa and work permit management." But as we often have talked about on this show, it really just keeps the person captive. But there have been a number of stories that have covered working as an AI or call center model. And apparently these people do bounce around from call center to call center. So it doesn't seem like they're actually being held indefinitely right now, maybe they will be, I don't know. But it seems like there's a real job market for this. And people are living in parts of Southeast Asia and doing this kind of job and looking for this kind of work. So it is known, they're calling themselves AI call center models or AI face models. And they're going to rely on scripts. They're going to be in a big old room with a whole bunch of other AI face models doing the scamming. And these interactions are going to be extremely real time because the models speak the target language. In some cases, it's a dialect of Chinese, or it's going to be Russian or English. And all that's different is their faces swapped in and out with AI, which is again, trivial nowadays. So the takeaway for all of us and for the people that we know is that if you're going to be saying, hey, I need a video call with you to make sure that you're a real person, that's not something you can depend on anymore. This is being deployed at scale to scam people and convince them that the scam is real. So yeah, good times.

 

Joe Carrigan: Yeah.

 

Dave Bittner: [Laughter] I was talking to someone in the past couple of weeks who was dealing with a deep fake scammer who was using video. And the way they were able to determine that is that they asked the scammer to turn completely around in their chair to do like a 360 spin, and also to pass their hand in front of their face, because evidently the software can have trouble with that. And the person on the other side refused to do either of those things. So they cut it off.

 

Maria Varmazis: Can I tell you the video I saw just this morning, though, they were able to stand up on their chair, turn around, everything, and it worked just fine.

 

Dave Bittner: Wow, okay.

 

Joe Carrigan: That's not going to work much longer.

 

Maria Varmazis: It's not going to work. Yeah, it was quick. I was like, yep, they figured that one out already. So yeah, I was thinking of something like that too. And I'm like, surely we've got some bonafide ways, you know, and a few weeks later, nope, they figured that one out.

 

Dave Bittner: Can I share the other takeaway for me from this?

 

Maria Varmazis: Sure. Yes, please.

 

Dave Bittner: It is completely selfish. So you put in this picture of this AI call center model.

 

Maria Varmazis: I did.

 

Dave Bittner: Little resume kind of thing. It lists her name, height, weight. But her hair color and eye color are both listed as chocolate [laughter]. I'm going to start using that.

 

Joe Carrigan: That's good for your hair color, Dave.

 

Dave Bittner: Yeah, right? Like what color?

 

Maria Varmazis: That's your takeaway, Dave?

 

Dave Bittner: Yeah.

 

Maria Varmazis: All right.

 

Dave Bittner: What color are your eyes? Chocolate.

 

Joe Carrigan: Chocolate. Delicious chocolate.

 

Dave Bittner: They're not mud brown. They're deep chocolate.

 

Maria Varmazis: Not chestnut.

 

Joe Carrigan: Chestnut, that's another good one.

 

Dave Bittner: No, no. Chocolate, I have chocolate. Although chocolate hair doesn't sound.

 

Joe Carrigan: No.

 

Dave Bittner: It sounds kind of.

 

Maria Varmazis: Chocolate hair.

 

Joe Carrigan: I'm going to go with powdered sugar for my hair color.

 

Maria Varmazis: Whatever gets you through the day, man.

 

Joe Carrigan: Right.

 

Maria Varmazis: You know?

 

Dave Bittner: All right, speaking of getting through the day, let's move on. Joe, what do you got for us this week?

 

Joe Carrigan: Dave, my story comes from INTERPOL and they have released their 2026 Global Financial Fraud Threat Assessment, Second Edition. And you know, everybody knows what INTERPOL is, but they're like an international police organization. They have like 150-some member nations. The United States is a member of INTERPOL. And what their -- this report is pretty long. We can't go into all of it. But what I do want to cover is some of the key takeaways that were listed in an article on INTERPOL website and also in the report itself. And the first key finding they have is that law enforcement authorities are collaborating more effectively against financial fraud. So that's really the goal of INTERPOL is collaboration among law enforcement organizations. So they're starting to.

 

Maria Varmazis: The goal of INTERPOL.

 

Joe Carrigan: The goal of the INTERPOL goal, yeah. So it doesn't really, at least not in my cursory reading of this report, talk about how effective that is. So maybe they don't have metrics on that yet, but I imagine this will only get better over time. I'm hopeful, I'm hopeful this will only get better over time.

 

Dave Bittner: Yeah.

 

Joe Carrigan: The next key takeaway is the significant global and human -- financial and human cost to the financial fraud. And this was shocking to me. Global losses related to financial fraud in 2025 alone have been estimated at $442 billion, that is the estimate. I don't know if that is just going off of reporting, but if it is just going off of reporting, that is a low estimate. Do you remember years ago, Dave, we had somebody write in and say the total cost is over a trillion dollars a year?

 

Dave Bittner: Yeah.

 

Joe Carrigan: And I was dubious of that. And I actually had a conversation with the guy and he laid it all out for me in terms of not just financial losses, but also in like recovery costs and things of that nature. And it was believable. Here we are now looking at financial losses close to half a trillion dollars.

 

Dave Bittner: Yeah.

 

Joe Carrigan: So this has grown so big. It's such a huge problem.

 

Dave Bittner: Yeah.

 

Joe Carrigan: And one of the things that is leading to that is the global spread of scam centers, which is another key takeaway. You know, initially these scam centers were kind of a regional phenomenon. You'd have them in India. I don't know that they had actually scam call centers in like Nigeria, in parts of Africa, but, you know, those guys mostly operated off of cell phones, or still do operate off of cell phones. But now this is a global threat with centers discovered across multiple regions. And of course, these centers engage hundreds of thousands of people. And as we've talked about already today, many of them are forced to perpetrate these online frauds. To date, victims from nearly 80 countries have been trafficked into online scam centers with no continent left untouched. And they actually had data that was showing that people from the United States and Mexico have been trafficked. So that's American citizens, Mexican citizens, which you wouldn't really expect. But guess what? It's happening.

 

Dave Bittner: Yeah.

 

Joe Carrigan: The United States is a huge fraud market for these guys. Why not kidnap a couple of -- some American English speaking people and help make your fraud more efficient?

 

Dave Bittner: Yeah.

 

Joe Carrigan: Speaking of making your fraud more efficient, and we've already talked about this as well, there's an AI angle in this story as well. Fraud has been increasingly enabled by these artificial intelligence tools. And this study says, or this document says that the AI enhanced fraud is 4.5 times more profitable than traditional methods. So it really helps these guys scale up. This is a problem from an economic standpoint, because this really makes this career attractive. You know, if you were in one of these countries and you were doing okay and you weren't looking to go into the fraud business because you had a pretty good job, now it is 4.5 times more profitable. So if you were making -- if you look at a scammer and go, that guy's making $20,000 a year, he's probably now making closer to $100,000 a year, which is remarkable. More bad news here [laughter].

 

Maria Varmazis: Great, it's a great episode today, everybody. It's great.

 

Joe Carrigan: Criminal networks are cooperating globally, and they are sharing expertise and technology. And something this report doesn't say but I can guarantee is the truth, they're also sharing data. You know, when they find a target, they're selling that data and letting other criminals, criminal organizations, have a crack at whoever they've already targeted.

 

Dave Bittner: Yeah.

 

Joe Carrigan: And then the last key takeaway here is there is an interesting nexus between financial fraud and terrorist financing across the African region, which they -- I did read a little bit about this. They're finding these guys are using cryptocurrency scams to finance their operations. Because once you -- with cryptocurrency, you can move money internationally very quickly, and then you can sell it and get your hands on some money to go out and buy some AKs. That's the AK-47.

 

Maria Varmazis: Thanks for that [laughter]. Yeah. Okay. It wasn't clear. Yeah. What other AK would we be referring to?

 

Joe Carrigan: There are, there's like an AK-53 and I think there's a new one.

 

Maria Varmazis: You know, ask a stupid question.

 

Dave Bittner: Yeah. See, you had to go there, didn't you, Maria?

 

Maria Varmazis: I had to, yeah.

 

Joe Carrigan: AK-47, very reliable weapon.

 

Maria Varmazis: Classic for a reason.

 

Joe Carrigan: Yeah, it's classic for a reason, that's right. So, yeah, we'll put a link in the Show Notes to the article that has a link at the bottom of the page for the full report. I would encourage everybody to go out and read it. I mean, if you're -- if you keep falling asleep, this will keep you up at night.

 

Dave Bittner: Okay [laughter].

 

Joe Carrigan: It's the opposite of something to read to go to sleep.

 

Dave Bittner: If you don't have enough anxiety in your life, this is the report for you.

 

Maria Varmazis: Are you one of the few people really relaxed nowadays who just have nothing on their mind?

 

Dave Bittner: If only I had more stress in my life. If only.

 

Maria Varmazis: Current events are just so relaxing.

 

Dave Bittner: I'm cruising through this world with just too much happiness. What could I read that would put me on edge?

 

Maria Varmazis: The joy scrolling is just getting to be too much.

 

Joe Carrigan: Right. This new INTERPOL report on global financial crime.

 

Dave Bittner: There you go. I'll tell you what, let's take a quick break here to hear from our show's sponsor. We will be right back after these messages. And we are back. It's my turn. So I have a story from the folks over at Bleeping Computer.

 

Joe Carrigan: I love that website name.

 

Dave Bittner: Yeah. They did a nice story, rundown, summary of the refund fraud economy, where that stands, and some of the various types of refund or refund frauds -- say that five times fast -- that are out there and why it matters. So they start off at the outset by saying that refund fraud used to be just petty crimes. It was more opportunistic where someone would take advantage of a store's return policies. You could buy something, claim it's broken, get your money back. You know, I've seen in movies where people would just walk into a store, pull something off the shelf, go up to the service counter and say, I'd like to return this.

 

Joe Carrigan: Right.

 

Dave Bittner: Do you have a receipt? No, no, it was a gift. And they walk out of there with cash or store credit or whatever. But this points out that refund fraud has really evolved into something that is much more organized. It is a underground marketplace. The techniques are packaged, priced, and sold. So they dug into some research here where they were looking into some of these fraud-focused online communities. And they found millions of posts advertising what they call "refund methods." So these don't require malware. We're not talking about zero days. It's just taking advantage of the rules.

 

Joe Carrigan: Exploiting the system.

 

Dave Bittner: Yeah, customer service policies, return guarantees, and payment dispute systems. So I thought it'd be fun to go through a few of these. One of them is called "refund without return," pretty self-explanatory. That's where someone convinces a retailer to issue the refund without ever sending the product back.

 

Joe Carrigan: Yeah, I've gotten this from Amazon a couple of times. Like I bought a little handheld vacuum cleaner for like 10 bucks and it just did not hold a charge. So I asked for a refund on it and they were like, yeah, just throw it away.

 

Dave Bittner: Yeah [laughter].

 

Joe Carrigan: I mean, I get to keep a crappy -- from the honest guy's standpoint, right? I get to keep a crappy, a vacuum cleaner. It's actually still in my car. I haven't thrown it away. It doesn't work, so it's useless. But I should probably -- when I clean my car, I'll throw it away. But my wife gets this frequently when she complains about stuff. And I saw somebody the other day at work, they said they got the wrong flavor of Bubly, the seltzer water.

 

Dave Bittner: Yeah.

 

Maria Varmazis: Bubly.

 

Joe Carrigan: Yeah, Bubly. And Amazon said, keep it, we'll send you the right one.

 

Maria Varmazis: Yeah, it's just not worth the cost, yeah.

 

Joe Carrigan: Yeah. So I get where this is coming from, the no retail. They're exploiting that and making money on it.

 

Dave Bittner: Right. And they say also sometimes people will claim that the item never arrived or that it showed up damaged. And then customer service will either send you another one or issue a refund, that sort of thing. And this works with companies that prioritize speed and customer satisfaction. So the refund gets issued. Next up is chargeback fraud. We've talked about this before. This is when the buyer goes to their bank or their payment provider, basically their credit card company, and they dispute the purchase. They say, I didn't authorize this. And so the bank pulls the money from the retailer. And for the retailer, they often put a fee on top. And so the fraudster gets to keep the product and they get their money back.

 

Joe Carrigan: Right. And the retailer loses more than the cost of sending it to them.

 

Dave Bittner: Correct. It's really hard on the retailer. Especially small, if you're a small mom and mom shop or an Etsy store or something like that, this sort of thing can be devastating.

 

Maria Varmazis: I've known people whose entire livelihoods, usually as a small seller on places like Etsy, have gotten completely decimated by all these kinds of scams. Yeah, small businesses really bear the brunt of this. And even just the protective measures that people have to put in place to try and prevent this kind of thing from happening can often add to shipping costs and that kind of thing. And that eats into their profits, and that can kill your business. It's really awful.

 

Dave Bittner: Yeah. Another tactic they call "goods swapping," which is instead of returning the original item, they send back either something cheaper or maybe counterfeit or even broken. And to the rushed returns department, it looks legitimate, but it's too late. I got in trouble once for this when I worked at RadioShack when I was in college. It was right after the Christmas season when everybody's really busy and people are returning things. And somebody returned a, by my recollection, a wireless microphone kit. And I just took it back, you know, it was in the box and we were busy and I didn't check very carefully. And inside was just, you know, it looked like this wireless mic kit had been dragged through a river. It was just so weird [laughter].

 

Maria Varmazis: It might just have been.

 

Dave Bittner: Yeah, I mean, it was just awful. And so for a little while, I wasn't allowed to return things. My manager was like, yeah, you stay over there. There's one called the "empty box trick." This is when a package gets shipped back but there's nothing in the box.

 

Joe Carrigan: Yeah. I worked at Best Buy and they had a phrase for this, they would call it "rocks in the box," where people would literally -- they had the cellophane sealers back at the house. They'd go out, they'd buy whatever they wanted, they'd get rocks that weighed about the same amount, and they'd put it in the box, seal it up, and bring it back with the receipt and get the money back.

 

Dave Bittner: Oh, I see. And so it's because it's sealed, they don't want to unseal it because they feel like they can resell it.

 

Joe Carrigan: They can resell it.

 

Dave Bittner: And then you and I come along, buy the thing, get home, we're excited to open it, and it's a box of rocks.

 

Joe Carrigan: Right.

 

Maria Varmazis: It's a brick.

 

Dave Bittner: I'm trying to think if that's ever happened to me. Have I ever opened something that?

 

Maria Varmazis: I've gotten that once before.

 

Dave Bittner: Have you?

 

Maria Varmazis: Yeah, I have. It was literally like a brick. It was so aggravating. Yeah, this is -- I think usually when you're dealing with electronics, that's more of a risk. So yeah, you got to be careful on that one. It's so aggravating. But only once, but once was enough.

 

Dave Bittner: Yeah, I guess I've heard of this one happening a lot with iPhones. Because I guess they're small enough, it's just a -- and they're valuable enough.

 

Maria Varmazis: Yeah. I know -- there's a micro center near-ish to me. Do you guys have micro centers? Is that a national?

 

Joe Carrigan: Yes, we do.

 

Maria Varmazis: Okay. And I know that that one tends to get hit a lot with shoplifters. And I think they also have to be really careful about the dumpster. Because people will often go through for the packaging and try and use that to resell or put bricks and stuff. Like it's a pretty nasty problem. So yeah. Sorry, I'm chuckling because it's just ridiculous. I'm like I'm amazed at how creative people can be. And you know, everyone's just trying to get ahead, but it's also just ridiculous.

 

Dave Bittner: Right. And the last one they list here they just call "policy manipulation." And that's where they look at the fine print of the return policies and they just play off of the system. So they figure out how many times you can report a missing delivery or how warranties are handled or what it takes to get customer service to escalate a case, basically, you know, gaming the system.

 

Maria Varmazis: Min-maxing it [laughter].

 

Dave Bittner: Right, yeah. And then they just follow the same script over and over again up until the point that they can't. So, you know, I guess this is one of those things of not letting the perfect get in the way of the good, where you're always going to have a certain amount of people -- and it's like shoplifting. There's always going to be a certain amount of loss or shrinkage, and that's just a part of doing business. But I guess what's problematic is so much of our commerce is done being shipped because of things like Amazon, all these online purchases. It's added this whole not face-to-face aspect of this.

 

Joe Carrigan: Right.

 

Dave Bittner: Makes it easier.

 

Joe Carrigan: There's a couple of ways that companies have gotten around this. Like if you think of Costco, you have to pay a membership fee to be a member. And then once you're a member, the service is really good. You can pretty much return anything at Costco. But if they find out you're being fraudulent, they just revoke your membership and you can't go into the store anymore. And then that's how they keep their costs low is because they keep their inventory shrink down. And you can't even get in there without a membership card. And now they're scanning you at the door. Have you noticed that?

 

Dave Bittner: No, I haven't been to Costco in a while.

 

Maria Varmazis: They don't just have the guy who gives you the nod?

 

Joe Carrigan: No, no. I have to scan my card when I go in there.

 

Dave Bittner: Are you sure it's not just you, Joe?

 

Maria Varmazis: I was going to say, I'm not sure I've seen that.

 

Joe Carrigan: Scan that guy's card.

 

Dave Bittner: This guy looks shifty to me.

 

Joe Carrigan: Right.

 

Dave Bittner: I'm sorry, sir. You're going to have to. Oh, no, you madam, please come right in. You, sir.

 

Maria Varmazis: I get the wave and nod. Joe gets the scanner.

 

Joe Carrigan: That's right.

 

Maria Varmazis: When they start doing cavity searches, Joe, you know something's up, okay?

 

Joe Carrigan: You still get the wave and the nod, Maria?

 

Maria Varmazis: I do.

 

Joe Carrigan: So I'm wondering if it's only, that they only implement that at places where they have they've had issues.

 

Dave Bittner: Or maybe it's just you.

 

Maria Varmazis: I was going to say, it could just be you.

 

Dave Bittner: Hey, next time before you walk in, Joe, just hang out at the entrance and see if anybody else is getting the nod.

 

Joe Carrigan: No, everybody's getting the -- everybody's scanning. Everybody's scanning as they walk in. It's a little thing and it comes up with your picture there. So you can't share a membership anymore.

 

Dave Bittner: All right. Well, maybe you shop at a Costco in a bad part of town.

 

Joe Carrigan: It's in Columbia, Dave.

 

Maria Varmazis: Yeah, I was going to say it's a pretty nice town. Not being able to share a Costco membership feels very un-American to me. I'm putting my foot down. Come on.

 

Joe Carrigan: Yeah, my son and I are on the same membership, so we each have a card.

 

Dave Bittner: Yeah, yeah. This article says that, in 2024, retailers processed about $685 billion in returns. And of that, they estimated over $100 billion was fraudulent.

 

Joe Carrigan: Wow, that's like 15%.

 

Dave Bittner: Yeah.

 

Maria Varmazis: That's a lot of money.

 

Dave Bittner: Yeah. So be on the lookout. These are -- you know, if somebody sends you a box of rocks [laughter].

 

Maria Varmazis: Right. It can happen to you because it happened to me.

 

Dave Bittner: Yeah. All right. Well, we will have a link to that story in the Show Notes. Joe, Maria, it is time to move on to our Catch of the Day. [ Music ]

 

Joe Carrigan: Dave, our Catch of the Day comes from the Scambait subreddit. The title of this one is "Jessica, sometimes I just can't be bothered with these idiots." Actually, I guess it's "Jessica, sometimes I just can't be bothered with these idiots."

 

Dave Bittner: That's right. Yeah, the implication is that Jessica is the idiot, I think.

 

Joe Carrigan: Right, yeah.

 

Dave Bittner: So I think what I'd like to do here is have Maria be Jessica.

 

Joe Carrigan: All right.

 

Dave Bittner: And Joe, you be responding to Jessica.

 

Joe Carrigan: Okay.

 

Dave Bittner: And I think part of what makes this one so entertaining as I read it is the cadence and perhaps acceleration of it.

 

Joe Carrigan: Okay.

 

Maria Varmazis: Which side is which? I'm looking through these.

 

Dave Bittner: It starts out with Jessica.

 

Maria Varmazis: Oh, that's all Jessica?

 

Dave Bittner: Yeah.

 

Joe Carrigan: Right.

 

Maria Varmazis: Oh, man.

 

Joe Carrigan: I don't have any reading to do to the bottom of the first slide.

 

Dave Bittner: Take a deep breath, Maria.

 

Maria Varmazis: Do you want me to go through this fast? You want me to just like speed run it?

 

Dave Bittner: Yeah, yeah.

 

Maria Varmazis: Okay. Hi, how are you doing? Are you there? Do you still remember me? Are you there? I lost my phone. That's why I have not been able to reach you since all these days. Why are you not writing my message without replying me? Are you there? Hi, I don't know why you don't want to reply me. We always talk on TikTok. I don't know why you're not replying me again.

 

Joe Carrigan: I have no idea who you are, but the reason I wasn't replying is because you were messaging me at 3 AM.

 

Maria Varmazis: I am so sorry.

 

Joe Carrigan: I don't think you were. And I don't use TikTok.

 

Maria Varmazis: I mean Facebook.

 

Joe Carrigan: I don't use Facebook either.

 

Maria Varmazis: I'm driving, that's why. Instagram.

 

Joe Carrigan: You shouldn't drive and text, it's dangerous. I don't have, I have no followers on Instagram.

 

Maria Varmazis: Yes, thank, I am going to park now. You followed me on Instagram. We are able to talk. I will have showed you tonight because I lost my phone.

 

Joe Carrigan: No, I didn't. I don't follow anyone on Instagram.

 

Maria Varmazis: I even have your picture on my former phones.

 

Joe Carrigan: I don't think you do, since I haven't posted any pictures on Instagram.

 

Maria Varmazis: I followed you on Instagram. You did not follow me. I followed you in a message, you then, and you reply me.

 

Joe Carrigan: No one follows me on Instagram.

 

Maria Varmazis: I wish I have my phone with me. I will have showed you our chatting.

 

Joe Carrigan: Because I don't use Instagram.

 

Maria Varmazis: Before I lost my phone, we have been talking since last two months, I think.

 

Joe Carrigan: I don't think so. I don't talk to anyone besides my family.

 

Maria Varmazis: I am sure of what I'm talking. It's because you don't remember me again, and I understand.

 

Joe Carrigan: I don't remember you because I don't know you.

 

Maria Varmazis: I'm looking for a way to log in my Instagram, but I can't remember the password again. I will have showed you our chatting. How was your night?

 

Joe Carrigan: Good luck, since I don't use Instagram. I don't use social media. We aren't allowed to here.

 

Maria Varmazis: Really?

 

Joe Carrigan: Yep.

 

Maria Varmazis: If you don't use social media, how did I get your number?

 

Joe Carrigan: Exactly. How did you get my number?

 

Maria Varmazis: You gave it to me.

 

Joe Carrigan: No, I didn't. I'm 16 and don't give my number out to anyone.

 

Maria Varmazis: The day you gave it to me in the evening, I lost my phone. Can I see a picture of you?

 

Joe Carrigan: I have never given my number out. No, I don't know who you are.

 

Maria Varmazis: If you don't remember me again, no problem.

 

Joe Carrigan: LOL. I have never spoken to you before in my life.

 

Maria Varmazis: Can I see a picture of you so I can know if I'm right or wrong?

 

Joe Carrigan: No, I told you I'm 16. I don't share pictures.

 

Maria Varmazis: I can't believe it, you are not 16 years old. The man that gave me this number is a mature man, not a small boy.

 

Joe Carrigan: Well, believe whatever you want because it wasn't me that gave you this number. I've only had this number for less than a week.

 

Maria Varmazis: Okay, no problem.

 

Joe Carrigan: Yep, goodbye.

 

Maria Varmazis: Okay, are you not from Australia?

 

Joe Carrigan: I'm not telling you where I'm from. I don't talk to strangers.

 

Maria Varmazis: Okay, I know you're lying, but there's no problem.

 

Joe Carrigan: Whatever, go away. I don't talk to strangers. You know nothing about me. I've had this number less than a week, and it's only so I can talk to my dad. So don't pretend you know me.

 

Maria Varmazis: I know you, I am not pretend.

 

Joe Carrigan: You don't know me.

 

Maria Varmazis: I know you.

 

Joe Carrigan: Nope. Sorry. You don't know me.

 

Maria Varmazis: I know you.

 

Joe Carrigan: Whatever.

 

Maria Varmazis: You are pretending you don't know me. Maybe because of your wife, she's with you.

 

Joe Carrigan: What? LMAO. I'm at school right now. My friends are getting a laugh out of this. Why don't you send me some pictures [laughter]? They'll get a bigger laugh out of that.

 

Maria Varmazis: Are you kidding me?

 

Joe Carrigan: LLMAO.

 

Maria Varmazis: Oh.

 

Joe Carrigan: Go for it.

 

Maria Varmazis: This keeps going.

 

Joe Carrigan: Yeah.

 

Dave Bittner: Well, we can wrap it up there.

 

Joe Carrigan: It starts dragging down into the gutter there. Good read, though.

 

Dave Bittner: Yeah.

 

Maria Varmazis: Wow, this goes on a long time.

 

Joe Carrigan: I mean, this person is insistent, aren't they? I mean, they just keep pounding this person, trying to get them to send them a picture.

 

Dave Bittner: Yeah, I don't know which of these peop -- I mean, they're both, it seems like both of these people are a bit of a menace.

 

Joe Carrigan: I don't know. The 16-year-old might actually just be a 16-year-old who, you know, what 16-year-old boy isn't a menace?

 

Dave Bittner: That's true. Has all the time in the world. Isn't paying attention in class. Just, well, what else am I going to do today?

 

Maria Varmazis: What's Bobby Drop Tables doing in calculus? Well, he's engaging with a bot, I guess, and really enjoying himself, I'm not sure.

 

Dave Bittner: Yeah, absolutely. All right, well, we'll have a link to that in the Show Notes. And if there is something you'd like us to consider for the show, please email us. It's hackinghumans@n2k.com. And that is our show, brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the Show Notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliott Peltzman and Tre Hester. Peter Kilpe is our publisher. I'm Dave Bittner.

 

Joe Carrigan: I'm Joe Carrigan.

 

Maria Varmazis: And I'm Maria Varmazis.

 

Dave Bittner: Thanks for listening. [ Music ]