DeepFake it till you make it.
Dave Bittner: Hello, everyone, and welcome to the "Hacking Humans" podcast where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner and joining me is Joe Carrigan. Hey, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: And our N2K colleague Maria Varmazis. Maria.
Maria Varmazis: Hi, Dave, and hi, Joe.
Joe Carrigan: Welcome back, Maria.
Maria Varmazis: Thank you. Thank you.
Dave Bittner: Yes. Yes. Good to have you back. Well, we've got some good stories to share this week, but first we have a little bit of follow up here. What do we got, Joe?
Joe Carrigan: Yeah. I got two links about the same story. One is from "USA Today" and the other one's from Semafor. And this is about the United States and China cooperating for a bust of about 276 people.
Maria Varmazis: Sorry. Can you back up? U.S and China were cooperating?
Joe Carrigan: Yes. Yes.
Maria Varmazis: Wow.
Joe Carrigan: This was they were busting some people who are participating in pig butchering scams. That includes like 8 people here in the U.S in Southern California who are probably lucky that they got arrested in Southern California and not China because earlier this year China executed 11 people for doing this.
Dave Bittner: Wow.
Maria Varmazis: The U.S is taking notes.
Joe Carrigan: Right.
Dave Bittner: Right. All right. Well, I mean it's good to hear there's some crackdowns happening. Maybe international pressure will be enough.
Joe Carrigan: Yep. Hope so.
Dave Bittner: I'd love to see this fall in to some sort of international norms where we just don't accept these things.
Joe Carrigan: Right. Yeah.
Dave Bittner: Feels like we're a ways off from that.
Joe Carrigan: It doesn't matter how different you are. Like I don't want to say politically because that implies like different sides of the same kind of system, but like how far away you are governmentally from somebody else. We all agree that these guys are just terrible, terrible people.
Maria Varmazis: The worst. Yeah.
Joe Carrigan: Yeah. And I think, you know, hey, we got something in common here. Why don't we leverage that and work to put a stop to this and try to make the world a better place? Because these guys really mess up people's lives.
Dave Bittner: Yeah. For sure. For sure.
Maria Varmazis: Yes. They do.
Dave Bittner: Let's get to this week's stories. Maria, welcome back. You have the honors this week. What do you got for us?
Maria Varmazis: Right in to it. Well, I -- not to brag, but I was in Paris for a week. It was really lovely.
Dave Bittner and Joe Carrigan: Huh huh huh.
Maria Varmazis: Yeah. And yep. Obligatory. And it was --
Joe Carrigan: Why is that -- it's universal too.
Maria Varmazis: You know what? I have a - my kid when we told her where we were going and she was eight she did the "Huh huh huh" thing too. I was like, "Where did you even pick that up from? I don't even understand." But even she knew that one.
Joe Carrigan: I have a great huh huh story.
Dave Bittner: Okay.
Joe Carrigan: Because --
Maria Varmazis: You can't leave me hanging.
Joe Carrigan: Okay. So we were -- I was talking to somebody who was from Canadi -- Canada.
Maria Varmazis: Canadia.
Dave Bittner: From Canadia.
Joe Carrigan: Right. I teased this woman mercilessly calling her country Canadia all the time.
Dave Bittner: Okay.
Joe Carrigan: And she said -
Maria Varmazis: [inaudible 00:03:08] loved that though.
Joe Carrigan: Yeah. So she did not. We don't speak any more. So but not because I teased her about Canada. Anyway the -- she made a big point of saying, "Well, in Canada you have to have both English and French on the front of every package and on the back of every package has to be bilingual."
Maria Varmazis: Yep.
Joe Carrigan: And I pick up this it was a Simpsons themed bag and it had Krusty the clown on the front of it and he's going, "Hey. Hey." Right? And I said, "Why doesn't it say huh huh on here?" Right? And she looks at me and goes, "You idiot. They're spelled exactly the same."
Dave Bittner: Okay.
Joe Carrigan: There's my -- there we go. Off the rails already. Sorry, Maria. I'm glad you're back from Paris.
Maria Varmazis: No. I mean I wouldn't normally have mentioned that, but the reason I bring it up is I wanted to brag. No. That was it.
Dave Bittner: Fair enough.
Maria Varmazis: Yeah. Yeah. I'm from the Boston area. So when -- it's an area that a lot of people in France know of its existence. So when it came up in conversation like where I'm from and all that kind of thing the first out of a lot of people's mouths, especially now, is, "Oh, you guys are going to be hosting some of the World Cup matches." Because it's coming up in June and July.
Joe Carrigan: Hold on. Hold on. Hold on. Let's clarify which World Cup.
Maria Varmazis: The football world -- the World Cup. The World Cup.
Joe Carrigan: No. That is not the World Cup. The World Cup happens next year.
Dave Bittner: Oh, Maria. Maria, you had to -- you had to --
Maria Varmazis: All right. Well, there's like 3 billion people on my side [inaudible 00:04:40].
Dave Bittner: You had to go there.
Joe Carrigan: 3 billion people can very well be wrong.
Maria Varmazis: All right. Okay. Well, the thing that everyone else knows as the World Cup 2026, the one that FIFA puts on --
Joe Carrigan: FIFA. Okay. Yeah.
Maria Varmazis: Yes. The FIFA one. The matches are happening across Mexico, Canada, and the United States. And seven of them I believe are happening here in the Boston area where I'm recording from. And it's extremely expensive. I don't think the World Cup, the World Cup, has ever been cheap, but what we call in the U.S soccer has -- is usually considered a sport that is a little more working class. So usually match prices are on the lower side. However this World Cup seems to be defying all expectations for how expensive things are. And I know around where I live there have been people sort of desperate to find deals and ways to make it not so painfully expensive. And this is apparently a rather universal experience for a lot of people trying to make it to World Cup matches this year to the point that there are now scam watch notices being put out by various organizations including the FTC saying this is becoming a serious problem. Now I don't think any World Cup has ever been immune from this sort of thing, but we -- I think again this specific one given that we are in a perfect storm of flight prices are extraordinarily expensive due to the war in Iran and the Strait of Hormuz dramas. And we also the United States especially is a very expensive place nowadays. So places to stay, tickets, transit is extremely expensive. So we've got a lot of people who are looking for the cheapest way possible to get to places that just aren't cheap. And they're getting ripped off. So I wanted us to just put out a little notice, a little bit of a conglomeration of a couple different posts that I found about this. The first one is actually from Proofpoint and this is not about price scams, but this is actually about email impersonations related to the World Cup that are leading to people getting scammed. And they put out a study, Proofpoint did, that apparently 36% of World Cup related domains like the sponsors and partners, people who are officially affiliated, they're not fully protected against email impersonation because they don't have the strongest DMARC settings allocated. So, Joe, can you walk us through the DMARC setting thing?
Joe Carrigan: Oh. Off the top of my head, no. But I have to look this up every single time, but DMARC is a it's a DNS based security system that provides some kind of attestation that you're actually talking to the right server.
Maria Varmazis: Right.
Joe Carrigan: And I don't remember exactly how the inner workings are, but it's like one of the things we like to say, table stakes now. If you don't have your DMARC records defined you are really behind the curve on this.
Maria Varmazis: Yeah. So yeah. I think the gist of that is probably good enough for what we're talking about here. The -- getting in to the stats from what Proofpoint studied I think a lot of them have DMARC defined in some way, but only 64% of them are using the strongest setting which is reject. So the other 36% still may allow spoofed emails to reach inboxes. So that means that people, bad guys who are impersonating a legitimate brand like an airline or a hotel or some other FIFA sponsor, can appear completely real when it lands in someone's inbox. So they can impersonate a legitimate brand. So not helping in this situation.
Joe Carrigan: Right.
Maria Varmazis: Calling it table stakes feels like a good way of doing that. It's like this feels like something that they should be able to easily tamp down, but 36% is a lot higher than I would have liked to see. So that's not great. So the warning is for people who are interested in trying to attend a World Cup match if somehow don't have tickets already or are looking for a deal is to be especially cautious even from people who are official partners. There are -- there is potential for things to be spoofed effectively and you could get really burned. And again these tickets are not going to be cheap so you could be out a lot of money. So please be careful there. There's another story that just came from Reuters about World Cup 2026 scams and they cited this nonprofit called The Noble. I've never heard of these guys. But this is I guess they research this sort of thing and they said they have already tracked nearly 30,000 suspicious transactions tied to the World Cup. And it hasn't even happened yet. So yeah. And they're seeing a lot of these scams actually organized by global or state linked networks. So there is human trafficking involved in this, as you might imagine. The kind of pig butchering scam call centers are probably also getting involved in this sort of thing. They're able to exploit people who speak different native languages to increase the efficacy of these scams. So as always please be careful. Don't fall for anything that seems too good to be true or it has a level of urgency to it. And I think that be really careful about deals that seem too good to be true is especially important given again people are looking for deals with this expensive event. I really don't think deals are to be found unfortunately. So it's I'm just thinking of things even here in the Boston area where the train ticket to the stadium from downtown Boston one way I think is $80. And it's just like that's the official.
Dave Bittner: Holy smokes.
Maria Varmazis: And it's like it's a really short train ride, but it's 80 bucks. And I think to park there directly is 120. It's just nuts. There's no way -- it's highway robbery. It's totally highway robbery. And it's just insane. So and yeah.
Joe Carrigan: Who's charging 80 bucks for a train ticket?
Maria Varmazis: Our Massachusetts Bay Transit Authority, the official like --
Joe Carrigan: So they're getting in on these scams.
Maria Varmazis: They are 100% extorting people because they can. Yes. And --
Joe Carrigan: Jeez. Europeans like trains. Let's jack up the price of our trains. And then no European who does this will ever ask an American again, "Why don't you guys have a train system?"
Maria Varmazis: To be fair, driving to the stadium is a million times worse than taking the train in this specific area. It's the worst experience possible. So but there's no cheap way to get there, and it just stinks. So yeah. At the same time I think if you're going to the World Cup you sort of expect it to be extraordinarily expensive, but just please be careful.
Joe Carrigan: If I could be serious about the World Cup for a second, but no.
Dave Bittner: I'm sorry, Joe. Which World Cup?
Joe Carrigan: The FIFA World Cup. I saw a marketplace ad for someone selling two tickets to a game, one of the games this summer. $2,100 for both tickets.
Maria Varmazis: It's a deal.
Joe Carrigan: And --
Maria Varmazis: No. It's not a deal.
Joe Carrigan: Well, these are category one club section tickets. I don't know what that means for the stadium. I'm not -- I don't know where these tickets are take -- or where this game is taking place, what the stadium's like. You know, is that Gillette Stadium in - is Gillette Stadium in Boston?
Maria Varmazis: No. Gillette Stadium is an hour south of Boston proper. It is in a town that -- sorry. I could go on a tear about this. I'll just stop. It's in Foxborough. It's a tiny little town with like a one lane road in and out that just cannot handle the sheer amount of cars that go through. If you try to get out of a game at Gillette you're going to be stuck in like two hours of traffic. I've been in it. I hate it. It sucks. So yes.
Joe Carrigan: I have been to two American football games, professional American football games. And both times I left with the same experience or the same impression. This is just better on TV.
Maria Varmazis: Yeah. Yeah.
Joe Carrigan: It's -- now soccer, you know, what the rest of the world calls football, I don't know. That might be good. And because I've never been to a soccer game either, but I -- and unfortunately I've also never been to a rugby game. But maybe when the World Cup for rugby comes to the United States in 2031 I can go.
Maria Varmazis: Oh. I see. Yeah.
Joe Carrigan: The real world cup, the rugby World Cup, is next year. In Australia though so I'm going to be watching my matches like at 2 o clock in the morning.
Maria Varmazis: Don't even know what to add to that. Yeah. Yeah. I mean a lot of football stadiums, what we call soccer again, like they're usually in downtowns of cities so you can just walk. That's just not the case for the United States at least. So.
Joe Carrigan: Yeah. Like in Dublin the Aviva is like right in the middle of things and you can just get there.
Maria Varmazis: Yeah. No. It's not like that here.
Dave Bittner: My wife is a big European football fan and I blame -- not blame. I credit Ted Lasso for it.
Maria Varmazis: Yep.
Dave Bittner: But so we watch a lot of games. And I enjoy it and it's one of those things with everything. The more you watch it, the more you understand it. And so you start to see the nuance of the game which is at first foreign to you, but then you know now I can see plays unfolding and things which I never was able to do originally. But to your point about the stadiums or I believe they call them the pitches --
Joe Carrigan: The pitch is actually the field they play on.
Maria Varmazis: Oh my god.
Dave Bittner: Anyway the -- Alana was saying that if we had soccer teams aligned with the populations in our country the way that they do in England that our hometown of Columbia, Maryland in Howard County Maryland which has 300,000 people would likely have 2 professional soccer teams.
Maria Varmazis: Wow. Yeah. I can see that. Yeah. I'm a fan of our regional team the New England Revolutions, but I can go to only one match a year because I just hate going to Gillette that much. It's just like that's all I will do to myself. I really enjoy going. It's a really fun time. I take my kid. We go with friends. It's a nice day. But just Gillette stinks. I hate it so.
Joe Carrigan: What's the D.C team? Old Glory? No. That's the rugby team.
Dave Bittner: D.C United?
Joe Carrigan: D.C United. D.C United. Yeah. That's the soccer team.
Dave Bittner: Yeah. All right. Well, any suggestions here, Maria, for people to best protect themselves here?
Maria Varmazis: Yeah. Well, definitely only buy tickets from official sources. So I mean tickets went out a couple months ago and of course now the resell market is huge. So remember that the tickets are only valid through like the FIFA app. So be really careful about that. But things that have a sense of urgency to them, but are trying to pressure you in to buying something, you know, be very careful. And even if that email appears legitimate just keep in mind that stuff can get spoofed. So just be very careful what you click.
Dave Bittner: It's so hard. It's a shame.
Maria Varmazis: It really is. It really is.
Dave Bittner: I just want to go see a soccer game and --
Joe Carrigan: This is why we can't have anything nice.
Maria Varmazis: I know. I know it's a bummer.
Dave Bittner: It's expensive and hard to trust. So yeah.
Maria Varmazis: 2026.
Dave Bittner: Woo hoo. All right. Well, we will have a link to those stories in our show notes. My story this week is information coming from the FTC, good old Federal Trade Commission. There's a story from the folks at Tech Crunch. And the FTC just put out a report saying that in 2025 consumers in the USA lost $2.1 billion to social media scams. Yeah.
Joe Carrigan: That's a lot of money.
Dave Bittner: They said social media scams have increased eight fold and exceeded losses from any other scam contact method. Nearly 30% of scam victims say the fraud started on social media.
Joe Carrigan: And then moved to another platform.
Dave Bittner: Guess which social media platform was number one for scams?
Maria Varmazis: No. It couldn't be. Facebook? Facebook?
Joe Carrigan: It came back with an accent.
Dave Bittner: The book of the face. Yes. It is Facebook had the highest reported losses followed by WhatsApp and Instagram.
Maria Varmazis: All owned by Meta.
Joe Carrigan: All three of them are owned by Meta.
Maria Varmazis: Wow. Amazing. Totally didn't see that coming.
Joe Carrigan: How are they making so much money?
Dave Bittner: What a crazy random happenstance.
Maria Varmazis: So strange.
Dave Bittner: They said that shopping scams were the most common type, often involving ads for discounted goods that led to fake or unfamiliar websites. I'll just chime in here and say that one of the patterns that I've sensed on Facebook with things that are for sale is that when someone has an ad on Facebook for whatever it is, their sneakers, their pop up tent, they're, you know, whatever, the first comment is always glowing. Always.
Joe Carrigan: The first comment on the ad?
Dave Bittner: Yeah. The first comment on the ad. So I don't know. It seems universal. I don't know how they game it to make it so. But no matter what it is it seems -- my -- and maybe I'm just, you know, reinforcing my own biases here, but it's always, "Great product. Love it. So glad I bought it." It's never, "This product is not what it says it is." You know, it's --
Joe Carrigan: I've been very good at ignoring ads and just like scrolling past them. And I'm wondering if this is just part of the ad. Like when you buy the ad if the comment's part of the ad.
Maria Varmazis: Oh. It's got to be because my favorite thing is when you see the post and it says it's got like 90 comments and then only 2 will show up and the rest are hidden.
Joe Carrigan: Right. Right. Right.
Maria Varmazis: It's like okay. Yeah. Got you.
Dave Bittner: Yeah. Right. Well, and if you're Facebook it's in your - it's in your best interest to let your advertisers edit the comments.
Joe Carrigan: Yeah.
Dave Bittner: Right.
Joe Carrigan: Or control which ones are on top.
Dave Bittner: Yeah. Exactly. Exactly.
Joe Carrigan: And scam advertisers I 100% guarantee you have bought farms out there that just come in and comment, "This is the greatest product since sliced bread."
Dave Bittner: Yeah. Yeah. Getting back to the report from the FTC, they say that investment scams caused $1.1 billion in losses. So more than half.
Joe Carrigan: Yeah. More than half. That's impressive.
Dave Bittner: They say frequently using fake advisors, group chats, or testimonials to build trust. We've covered those countless times here.
Joe Carrigan: Testimonials I mean I don't know how I feel about this because I don't want to put my money anywhere that I've never heard of before. Right? And I don't care how many people tell me that, you know, "Come to Bob's bank. He's got really good interest rates." I'm like I don't know who that is.
Maria Varmazis: I don't know who you are. I don't [inaudible 00:19:44] my house. Yeah. I mean. Yeah. I mean they're all on the take as far as we know.
Joe Carrigan: I have a series of important questions.
Maria Varmazis: Yeah.
Joe Carrigan: Right. You know, but I mean so testimonials for a financial institution from some stranger don't do me any good. I -- you know, I will use testimonials from people I know. Where do you keep the majority of your money? And what do you do with it? You know. If I want to have a financial discussion about this. And, you know, that's how I wound up, you know, where I keep a lot of my retirement savings now because all the jobs I've had over my career have most of them have had 401Ks. I've rolled those in to an IRA. So, you know, it's important for me to trust that place.
Maria Varmazis: Yeah.
Dave Bittner: Sure.
Maria Varmazis: Yeah.
Joe Carrigan: So I'm not just taking some guy's word off the internet. Oh, this is a great place to put your retirement stuff.
Maria Varmazis: Well, I was reading something just the other day that said I think gen Z and gen alpha are the most likely to do -- like believe influencer marketing. So I -- the -- because it's sort of just part of their -- I mean gen alpha's still quite young, but you know gen Z are full -- all fully adults now. And it's been part of their, you know, ecosystem from the get go. Yeah. So but at the same time they're all -- gen Z's also super smart and they understand that literally every influencer's being paid. So I do wonder how it all shakes out. But yeah.
Dave Bittner: Huh. That is interesting. They're so different from us.
Joe Carrigan: Almost another species.
Dave Bittner: Yeah.
Joe Carrigan: These crazy kids today. Come on, Dave. Join in my old man rant.
Dave Bittner: It's like the weight of the world has not yet crushed their spirit. Give it time. Their time will come.
Joe Carrigan: I think gen Z is probably one of the most weight of the world crushed generations we've seen in a long time.
Maria Varmazis: I was just thinking that. I was going to say they've been through it. Be nice to gen Z. Yeah.
Dave Bittner: That's true. Well, they don't have homes. That's why. They don't have homes to protect them from having their spirits crushed. We have homes.
Joe Carrigan: Yeah. My spirit's still crushed.
Dave Bittner: All right. Back to the FTC. Enough of me being an elitist jerk.
Maria Varmazis: I'm crying in millennial over here [inaudible 00:21:55] my friends at home. Anyway.
Dave Bittner: Yep. Yep. Back to the FTC. They of course they touch on romance scams which often begin on social platforms. And then, as Joe said, move to another platform.
Joe Carrigan: Move to another platform. Right.
Dave Bittner: Yeah. And so the scammers are exploiting people's personal profiles and then requesting money or even moving on to fake investments. So the FTC they have some recommendations. They say limit your profile visibility. I don't know about you guys. I've done that with my Facebook profile.
Joe Carrigan: Oh yeah. Nobody can find me.
Dave Bittner: Yeah. Mine's only visible to friends.
Joe Carrigan: I don't get very many friend requests anymore. And that's just fine with me.
Dave Bittner: Yeah.
Maria Varmazis: I'm going to take that as a challenge and find you right now on Facebook. Hang on a second.
Joe Carrigan: You might be able to find me. I don't know. See if you can find me.
Maria Varmazis: Let me see if I can find you.
Dave Bittner: The FTC says avoid investment advice from online contacts and be sure to research sellers before purchasing. I would go a step further than that and say if you find some --
Maria Varmazis: Joe, that was not hard.
Joe Carrigan: Did you find me?
Maria Varmazis: There's a picture of you with a chicken on your shoulder. That's [laughs].
Dave Bittner: Not only did she find you. You should be ashamed of yourself. [ Laughter ]
Joe Carrigan: I actually think friends of friends can't find me. So maybe that's the setting I have. So is Dave a friend?
Maria Varmazis: I'm not friends with Dave on Facebook yet. Yet.
Joe Carrigan: Huh. And we don't have any mutual friends?
Maria Varmazis: Nope.
Dave Bittner: Really? Okay.
Maria Varmazis: Lock this down, Joe. Just saying.
Joe Carrigan: I'm very angry at Mark right now.
Maria Varmazis: That or I found your impersonator. So either way we made a good discovery today.
Joe Carrigan: It could be an impersonator. Send me a friend request and I don't have any Facebook -- way to get Facebook here at --
Dave Bittner: Might be a while.
Joe Carrigan: Yeah. Send that Joe Carrigan a Facebook request, a friend request. And if I respond I'll send you a direct message on Facebook tonight.
Maria Varmazis: You've got it.
Joe Carrigan: But it won't be until like 10 o'clock [inaudible 00:23:57].
Maria Varmazis: Sorry, Dave.
Dave Bittner: Anyway the FTC. I would take the FTC's advice one step further and say if there's something that strikes your fancy that you see coming by when you're scrolling through Facebook or wherever don't buy it directly on that platform.
Joe Carrigan: Right.
Dave Bittner: Go visit the company directly. Even going to Amazon's better than buying it directly on Facebook. You're less likely to be scammed and, you know --
Joe Carrigan: Pick your tech oligarchs carefully.
Dave Bittner: That's right. That's right.
Maria Varmazis: 2026.
Dave Bittner: Which one hurts the least?
Joe Carrigan: Right.
Dave Bittner: Yeah.
Maria Varmazis: Oh my god.
Joe Carrigan: Bezos or Zuckerberg.
Dave Bittner: Resignation. Just pure resignation.
Maria Varmazis: And then you can throw Musk in there. You know, it's just [groans]. Great. Great times. Great times.
Dave Bittner: Throw them all the way to Mars. All right. I'll tell you what. Let's take a quick break here to hear from our show sponsor. We will be right back after this message. [ Music ] And we are back. Joe, you're up. What do you got for us?
Joe Carrigan: Dave, I have two stories, but they're around the same topic and they both come from gadgetreview.com.
Dave Bittner: Okay.
Joe Carrigan: Which is a website. Actually initially found the second story on a different site, but found that the source was Gadget Review. But the first one is from -- the headline is "Taylor Swift Deep Fakes are Fooling Tik Tok Users in to Phishing Scams." Now here's one that wouldn't work on me.
Dave Bittner: Me neither.
Joe Carrigan: Right. However --
Dave Bittner: Maria?
Maria Varmazis: No. It wouldn't work on me.
Joe Carrigan: No.
Dave Bittner: How about your daughter? Is she a Swiftie?
Maria Varmazis: Not anymore.
Dave Bittner: Oh.
Maria Varmazis: I know. Not anymore.
Joe Carrigan: How old is she?
Dave Bittner: Interesting.
Joe Carrigan: Seven?
Maria Varmazis: It's funny you asked. She turned nine years old today.
Joe Carrigan: Nine years old and she's out of the Taylor Swift market. Interesting.
Dave Bittner: Okay. Interesting.
Maria Varmazis: It's actually her birthday.
Dave Bittner: Oh. Why do you whisper? Is she not aware of this?
Maria Varmazis: No. She's very aware of it, Dave. Very aware.
Dave Bittner: You just don't want her to know that you're aware of it.
Maria Varmazis: I don't know why I whispered it.
Dave Bittner: Yeah. She's going to come bursting in the room with a bunch of balloons and confetti.
Maria Varmazis: She's supposed to be in school. However yeah.
Dave Bittner: Exactly. Like "Ferris Bueller's Day Off."
Joe Carrigan: Now I have to roll this back in.
Maria Varmazis: [inaudible 00:26:24] with a nine year old.
Joe Carrigan: Which is really weird for me to have to do.
Dave Bittner: All right. Go ahead, Joe.
Joe Carrigan: Happy birthday to your daughter, Maria.
Maria Varmazis: Thank you very much.
Joe Carrigan: This Gadget Review article says that scrolling through Tik Tok just became more dangerous than you think which I don't know. I already think it's pretty dangerous. I know that there's tons of scams out there. But and our listeners probably know this too, but AI generated deep fakes of Taylor Swift and maybe one that would work on me Rhianna are --
Maria Varmazis: Rhi Rhi?
Joe Carrigan: Are flooding the platform. I love Rhianna. I don't know what it is about -- her music has always just been like every time I hear a song from here like this is a good song. I like it.
Maria Varmazis: Well, Joe, you are full of surprises. I would never have clocked you for a Rhi Rhi fan. That's amazing.
Joe Carrigan: Right. Yeah. Slayer and Rhianna. Both.
Maria Varmazis: You contain multitudes. There we go.
Joe Carrigan: I have range. Right. I also love Bach, by the way. One of my favorites. So, you know, this thing is talking about celebrity cons and it looks like these scams are really just to get access to your accounts, you know stealing passwords or maybe stealing your personal information. There's a quote in here that says YouTube recently removed 1,000 AI scam ads. 1,000 that were using fake celebrity endorsements. You know, like those Keanu Reeves endorsements.
Dave Bittner: Yeah.
Joe Carrigan: But not before they'd accumulated 200 million views. So hey there goes the horse. You better close the barn door. So, you know, they're saying in this article that AI detection systems are struggling to maintain, keep up with the sophistication of the generation algorithms. And speaking of generation this also this story also came from Gadget Review. And this I think was originally started in "Wired," if I'm not mistaken. But the access I have to it is from Gadget Review and it says "MAGA Influencer Emily Hart Exposed as Indian Man." And this is a -- Emily Hart is a beautiful young woman, but she is completely synthetic. She does not exist. And this is coming from an Indian medical student named Sam with air quotes around it. And according to this article he used Gemini, Google's Gemini, to come up with this whole idea of scamming people. And he was -- he started a -- some kind of social media influencer account somewhere. So Sam asked Gemini how to maximize this influencer's reach and the chat bot reportedly said to him, "We should target conservative audiences because they have higher disposable income and show more loyalty than generic [inaudible 00:29:21]."
Dave Bittner: So the AI was happy to help.
Joe Carrigan: Right.
Dave Bittner: In this scam.
Joe Carrigan: Yes.
Maria Varmazis: I'm helping. That's so nice. Thanks, AI.
Joe Carrigan: Now Google -- Google disputes that Gemini would have said such a thing.
Dave Bittner: Of course.
Joe Carrigan: Right. I buy it.
Dave Bittner: Yeah.
Joe Carrigan: But shortly after starting to post these things going after MAGA conservatives as a cheat code is what the article says Emily Hart gained over 10,000 followers in one month. And Sam spent just like 30 to 50 minutes daily creating content. And this thing says that Emily Hart resembles Jennifer Lawrence. I looked up a picture of Jennifer Lawrence. I think the AI character doesn't look anything else like Jennifer Lawrence. But they're using all kinds of catch phrases, conservative catch phrases, to rope in people. And then Sam monetized this AI personality through a platform called Fanvue. Are either of you familiar with Fanvue? Fanvue?
Maria Varmazis: I am not. No.
Joe Carrigan: I did not go to Fanvue because I'm afraid it's something like Only Fans. It sounds like something. And I --
Maria Varmazis: That would have been my guess as well.
Joe Carrigan: Right. And he sold AI generated content partly working with X's Grok AI. He also served MAGA themed t-shirts and also provided some income. And it made him a few thousand dollars a month. So by scamming standards he's not killing it. Right? He's not walking away. And he's not actually -- you know, he's not -- well, I guess he's lying to people, but I mean it's I guess the only thing that he's not producing that's real is just AI generated content that he's selling to people that people think that they're getting some kind of interaction. But I don't know how different that is from following Kim Kardashian. Right?
Dave Bittner: So he's providing entertainment.
Joe Carrigan: Right.
Dave Bittner: Yeah.
Joe Carrigan: Yeah because people that's been the whole argument with the influencer culture. Right? Is that this is -- this feels like a two way communication street, but it isn't. It's just one way. Right? Kim Kardashian doesn't know what you said and if you messaged her and somebody replied to you that's just some contractor in some other part of the world that works dirt cheap that sends back a text to you.
Dave Bittner: Right.
Joe Carrigan: Not anybody you know. And it's not the person you think you're talking to. So this all came out when "Wired" posted an investigation. Instagram removed Emily Hart's account in February for fraudulent activity with Facebook following only after the investigation went public. So that's interesting that Instagram, a Meta property, removes it in February, but when the ball drops Facebook goes, "Oh. We better get on this." I mean it seems like they still have some kind of -- some kind of back end differences I guess.
Maria Varmazis: Yeah. I mean like medical scams abound and those just keep going. But this, this is priority? Okay.
Joe Carrigan: Yeah. Right. That's a good point, you know.
Dave Bittner: Well, I mean I wonder too like what's the difference between someone adopting a persona, let's just say an influencer persona --
Joe Carrigan: Right.
Dave Bittner: That is very different from who they are in their day to day life.
Joe Carrigan: Right.
Dave Bittner: Versus spinning up an AI generated persona that's completely different. Is one inherently less ethical than the other? Discuss.
Joe Carrigan: I don't know. I don't particularly find either one of these things ethical. But I mean if you're going for a social media persona I don't know that people are capable yet of understanding that that's an act like seeing someone on TV is an act.
Dave Bittner: Yeah.
Joe Carrigan: Right? Like I play the bad guy on TV, but I'm really not mean. Right? Or, you know, whereas I play the hot attractive young woman who is attracted to you, but I'm really not attractive to you and in this case I'm really not a hot attractive young woman. Right?
Dave Bittner: Yeah.
Joe Carrigan: I mean I don't know.
Maria Varmazis: Soundbite for this episode. I just [inaudible 00:33:46].
Joe Carrigan: I'm really not --
Dave Bittner: Joe Carrigan says quote "I'm not a hot attractive young woman."
Joe Carrigan: There has never been a more true statement. That is as true as it gets.
Maria Varmazis: Oh my god.
Joe Carrigan: None of those three things, hot, attractive, or young, apply to me.
Maria Varmazis: Or woman presumably.
Joe Carrigan: Or woman. Yeah. Yeah. Sorry.
Dave Bittner: Is there something you want to --
Maria Varmazis: Hey, this is that kind of episode. It's a very special episode. Okay.
Joe Carrigan: Feeling kind of --
Dave Bittner: So I think put the MAGA part of this aside.
Joe Carrigan: Right. Yeah. I mean that's not the important part.
Dave Bittner: No.
Joe Carrigan: The important part -- well, I mean there is a portion of this and it's not unique to MAGA I don't think. I had this discussion with Michelle. She was like, "There's research that says people on the right are more susceptible to this." I think that might be because generally people on the right are older. I don't know. I haven't delved in to that report, and I just don't have time, that article. I just haven't had time to go through it. But this is not something that's unique to any single political party, any single religion, any single belief system or status or whatever. There's something out there that will exploit you. It's there. Don't let whatever tribe you identify with lead you so far in to the weeds of that tribe that you're willing to or that you're capable of falling for this kind of a scam. You know, it's --
Dave Bittner: Yeah. This person was exploiting trust.
Joe Carrigan: Right.
Dave Bittner: That yeah he was using, you know, in group language and iconography and all those kinds of things.
Joe Carrigan: Absolutely.
Dave Bittner: With this particular group to gain trust. And was successful. Basically had a part time job doing it.
Joe Carrigan: Yeah. It was able to fund him going to medical school with it. I mean that's the kind of money he's making.
Dave Bittner: Yeah.
Joe Carrigan: So yeah. I mean I just it just --
Dave Bittner: The question is should this be illegal.
Joe Carrigan: That's a good question. I don't know. It's certainly against the terms of services because the platforms shut it down.
Dave Bittner: Right.
Joe Carrigan: But only after --
Dave Bittner: If he's said at the outset that this was AI generated for entertainment only --
Joe Carrigan: Right.
Dave Bittner: Then what happens? I don't know.
Joe Carrigan: Yeah. I don't know. That's a good question. Is it then AI generate -- or is it then against terms of services?
Dave Bittner: Yeah.
Joe Carrigan: Who knows?
Dave Bittner: Interesting. All right. Well, we will have a link to those stories in the show notes. Joe, Maria, it is time for our Catch of the Day. [ Soundbite of Reeling in Fishing Line ] [ Music ]
Joe Carrigan: Dave, our Catch of the Day comes from my daughter.
Dave Bittner: All right. Terrific.
Joe Carrigan: This is a text message that she received. You will notice that she has cropped out all the information on top that like tells --
Dave Bittner: She's a good girl.
Joe Carrigan: Yes.
Dave Bittner: She is her father's daughter.
Joe Carrigan: She's my -- she is.
Maria Varmazis: How charged was the battery though?
Dave Bittner: I'm going to say we don't even know. We can't tell.
Joe Carrigan: Can't tell if she's on WiFi, can't tell if she's --
Dave Bittner: She's just protecting her dad from undue anxiety.
Joe Carrigan: And I didn't even have to crop this image. This is the image she sent me.
Dave Bittner: Okay.
Joe Carrigan: So it's a text message. You want to read it, Dave?
Dave Bittner: Sure. It says, "Hi, Kala [assumed spelling]. I'm Priscilla, a PR consultant at Pathos Communications. Our SAC 2026 coverage is putting a spotlight on self propagating software supply chain attacks and risky auto updating pipelines. As an embedded CNO engineer at Acme Engineering working close to [inaudible 00:37:25] research and reverse engineering, you're a credible operator voice on what defenders should actually do at the firmware and build system layer. We are pay on results and I think we could land you in Business Insider. Open to a quick chat?"
Joe Carrigan: She did not respond to this text.
Dave Bittner: Yeah. Good for her.
Joe Carrigan: Yeah. But I have received like in the past couple of months two Linked In things that were kind of similar to this, including one this morning where somebody's like, "Hey, I'm looking for super connectors." And I'm like, "Yeah. What do you mean by super connector? What are you doing? Why are you doing this?" And I think this is probably just part of some opening scam to just --
Dave Bittner: Wait. Wait. Wait. Is super connector a social thing of an electronics thing?
Joe Carrigan: I don't know. I think it -- the way -- in context it sounded like a social thing.
Dave Bittner: Okay.
Maria Varmazis: Kind of a diode.
Dave Bittner: Right. Exactly. I was thinking, you know, room temperature super connectors. Yeah.
Joe Carrigan: Right.
Maria Varmazis: No. You know what's interesting? I was just Googling Pathos Communications and apparently the first word that comes up afterwards is scam. Apparently this is --
Dave Bittner: There you go.
Maria Varmazis: Yeah. Apparently these are known.
Dave Bittner: I edited out the name in my read, but they did have the name of her employer accurately in the thing here.
Joe Carrigan: They sure did.
Dave Bittner: So could they have scraped that from Linked In?
Joe Carrigan: They -- you know, I'm going to -- I'm going to tell another story about this that happened to me this week. I got an email from a recruiter who had a bunch of information about me and I, you know -- like I do when I want to torment a recruiter, I wrote this guy back and said, because this job was not a good fit -- I said, "No. I'm not in the market right now. But tell me where did you get my information?" And to my surprise the guy wrote me back and said, "Hey, this came from X job board from 2024." I'm like I immediately replied to him. I said, "Hey, thanks for the transparency." This guy is not a scammer. He's actually real. And then he said, "You would not believe the number of scam resumes we get and the number of horror stories I've heard from people I'm trying to recruit about scam recruiters." And I'm like, "Well, we talk about this all the time on my podcast, but so yes I would believe this." I actually said podcast I cohost. So both of you don't get mad that I claimed ownership of the podcast.
Maria Varmazis: That's all right.
Joe Carrigan: So, you know -- so I'm going to, you know -- this guy I think is a real person. I'm going to have a phone call with him I think some time in the next week or so because there are a number of young engineers that I know that are looking for work. And it's kind of hard to find right now.
Maria Varmazis: Yeah. And so much AI slop just clogging up the pipelines in all directions.
Joe Carrigan: Getting through it. I mean AI has done nothing but make the job search thing terrible.
Dave Bittner: Yeah.
Joe Carrigan: Absolutely terrible.
Dave Bittner: It is kind of the tip of the sphere I think for the spy versus spy AI versus AI where people are using AI to try to get past the AI that's filtering you out.
Joe Carrigan: Right. I mean and here's the thing. You can't -- as an HR company or anybody that has to receive resumes you can't not do that or else you just get tons of AI resumes.
Dave Bittner: Right.
Joe Carrigan: Right? And --
Dave Bittner: Right. And these days you've got to worry about -- in tech you've got to worry about North Korean workers and all kinds of things that you never had to worry about before.
Joe Carrigan: Yeah. Absolutely.
Maria Varmazis: Yeah. There was an alumni group for former coworkers of a former employer of ours that we all post in and there's a jobs board where people post, you know, "Hey, I'm hiring at my new company" or whatever. And there was something that was posted there recently saying the moment that they posted a job rec they got over 1,000 applications that were all AI slop which is just like how -- you just can't. How do you deal with that? So it's bad out there.
Dave Bittner: So what is the societal tax for having that be the current reality?
Joe Carrigan: Massive unemployment.
Maria Varmazis: Yeah.
Joe Carrigan: That's the societal tax.
Dave Bittner: Right. I mean it's just an anchor. It's a drag on people's ability to hire and that has real world effects.
Joe Carrigan: Yep.
Maria Varmazis: Yep. Sure does.
Dave Bittner: All right. Well, we would love to hear from you. If there's something you'd like us to consider for our Catch of the Day and you're not one of Joe's offspring, please email us. It's hackinghumans@n2k.com.
Joe Carrigan: I wonder if my son's going to send one in now. [ Music ]
Dave Bittner: And that's "Hacking Humans" brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliott Peltzman and Tre Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe Carrigan.
Maria Varmazis: I'm Maria Varmazis.
Dave Bittner: Thanks for listening. [ Music ]
