My relationship status is “compromised.”
Dave Bittner: Hello, everyone. And welcome to the "Hacking Humans" podcast where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner and joining me is Joe Carrigan. Hey, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: And our N2K colleague Maria Varmazis. Maria.
Maria Varmazis: Hi, Dave, and hi, Joe.
Dave Bittner: We've got some good stories to share this week, but first let's get some follow up. Joe, what do you got?
Joe Carrigan: Well, it's a stupid chicken story.
Maria Varmazis: [Laughs] next I have --
Joe Carrigan: Some stupid chickens.
Dave Bittner: Oh. Is there any other kind?
Joe Carrigan: Yeah. That's a good question. Nobody has ever accused a chicken of being smart in some -- so, you know, I bought this coop and then I got the coop had a little run on the front of it and that run does not meet the needs of the chickens. It would be inhumane to keep them in something that small. So I built a new run, but I thought the coop was adequate. Well, about this time last week I started going outside. I go out every night to check on them, make sure they all got in. The door didn't close and leave them outside. And they're all just sitting on the roof of the old run that sits inside so that they have something to run around and get away from each other from. Right? So they're just sitting there. They're not going inside. So I had to go out there and manually put them all back inside the coop. The upside of this is that it does give me a few minutes to practice Sue's technique.
Dave Bittner: Holding the rooster.
Joe Carrigan: Holding the rooster.
Dave Bittner: Invert the rooster.
Joe Carrigan: I don't --
Dave Bittner: Not a euphemism.
Joe Carrigan: Yeah. I don't have to invert him anymore. I can. I pick him up when he's, you know, at night. And I hold him and tell him he's a good rooster and I put him in first because I want the hens to follow him because he's the leader.
Dave Bittner: Sure.
Joe Carrigan: Right? So but he is not going in and because of that the rest of the hens are not going in. Now I think it's because my coop might be too small.
Dave Bittner: Okay.
Joe Carrigan: So I'm also working on a ventilation solution, but I think what I'm going to be doing is just getting a new coop.
Dave Bittner: And so it begins.
Joe Carrigan: Right. So now I'm in for like another X number of dollars. I mean I see coops online that you can buy. They're like $1,500. You know, I don't know if I want to spend that much money on a coop when I can build a coop for probably $400.
Dave Bittner: Okay.
Joe Carrigan: But --
Dave Bittner: How crafty do you consider yourself?
Joe Carrigan: I built the run with no problem.
Dave Bittner: Okay. Good.
Joe Carrigan: Not with no problem, but I mean I did it.
Dave Bittner: You still have all of your fingers.
Maria Varmazis: I don't believe you.
Joe Carrigan: I did break my ankle while doing it.
Dave Bittner: Oh, that's right. See?
Maria Varmazis: Your broke your ankle while doing that?
Joe Carrigan: I have this old injury from college. I'd like to tell you it was a football injury or some --
Dave Bittner: The old pogo stick accident.
Joe Carrigan: Right. It was an old pogo stick accident.
Maria Varmazis: What were you doing with that pogo stick?
Joe Carrigan: It did involve some heavy metal and it did involve somebody that was like 6 foot 8 and weighed 500 pounds. The guy was huge.
Maria Varmazis: So the mosh pit is what I'm understanding.
Joe Carrigan: Yes. Yes. The mosh pit that I had in my living room.
Dave Bittner: Very nice.
Joe Carrigan: Anyway, that has resulted -- that injury has resulted in like a tear drop shape of bone at the end of my tibia that kind of hangs in to the, you know -- the natural working of your ankle. You know, like your ankle can move side to side. Well, if my ankle moves too far side to side it will snap this piece of bone off. Now this piece of bone is useless. All it does is hurt.
Dave Bittner: So any who.
Joe Carrigan: Yeah. So anyway I did hurt myself. So now I've got to -- so I may just wind up buying the thing so I don't have to tell Maria another horrific story.
Dave Bittner: Yeah.
Maria Varmazis: I'm imagining you breaking your ankle making a chicken run and I'm thinking you just tried to run on the chicken run. And --
Joe Carrigan: No.
Dave Bittner: Maybe we can take up a collection for you, Joe, so that --
Joe Carrigan: It was a -- it was the most old man of injuries. I did this standing up. Because you know.
Maria Varmazis: Not sneezing or getting off the couch a little too fast.
Joe Carrigan: Just standing up. It was terrible.
Maria Varmazis: Turning your neck just so. I'm laughing because I've done all of those things. So it's fine. It's fine.
Dave Bittner: Here's what crossed my mind. Maybe is it possible or have you checked that the chickens don't want to go inside the chicken coop because there's something in there?
Joe Carrigan: Oh yeah. There's nothing in there.
Dave Bittner: Well, did you check? I mean do you stick your head in there like --
Joe Carrigan: I do. In fact last night and for the past two nights there's --
Maria Varmazis: Oh god. There's a Joe in there.
Joe Carrigan: There's one -- there's one chicken that -- Dotty. Dotty is the smart chicken apparently because for the last two nights when I go out there and open the door Dotty's inside.
Dave Bittner: Okay.
Joe Carrigan: She's just sitting there in one of the nesting boxes, you know, sleeping. And it's nice. Get a little solitude in here. But yeah. The other ones are not going in. I put some roosting bars in there recently and they -- it takes up more space than I thought it would. I think I just need to build a bigger coop.
Dave Bittner: What happens if you don't put them in there? Don't they eventually go in or --
Joe Carrigan: No. The door closes at 9:30 right now.
Dave Bittner: Oh. I see.
Joe Carrigan: Which is probably the latest I'll have to set it around here because by that time they should be in the coop, but they're not. You know, I get my head lamp on because I have those rechargeable LED head lamps. They're great. And I look out and I see a bunch of eyes shine of these little feathered idiots sitting on top of this, perching on top of this thing. Looking at me like, "Hey, what's that? Is that Joe? I wonder if he has treats."
Dave Bittner: Joe yeah. That's all right.
Joe Carrigan: So for the past week and a half I've been just going out there and putting them back in to the coop.
Dave Bittner: Sue, if you're listening.
Joe Carrigan: Yeah. I think I just need a bigger coop. I can't complain.
Dave Bittner: I'm saying if Sue who is clearly an experienced chicken raiser --
Joe Carrigan: Chicken farmer.
Dave Bittner: Chicken farmer.
Joe Carrigan: Made yeah.
Dave Bittner: Right. Like perhaps, you know, they have a solution to this much like they had for the rooster. So maybe there's something just a little bit of wisdom that you need to know how to condition your chickens to automatically go in the coop on their own.
Joe Carrigan: I could do that. I could probably also go to some Facebook group, but god. You go to the Facebook group and you ask a question and it just spirals out of control almost instantaneously.
Dave Bittner: Yeah. All right. I tell you what. Let's take a quick break to hear from our sponsors and when we come back we will get in to our stories. [ Music ] And we are back. I'm going to kick things off for us this week and I am going to talk about sugar baby scams.
Joe Carrigan: What is a sugar baby scam? Are those those little candies that come like the same thing? From the same company as sugar daddies?
Dave Bittner: Yeah. Yeah. Yeah. You know, there was a Broadway show called "Sugar Babies" back in around 1980. I actually saw it. It was Mickey Rooney was starring in it.
Maria Varmazis: Wow. That's a name I haven't heard in a while.
Dave Bittner: Kind of a vaudeville sort of kind of thing. It was fun. My favorite -- well, not my favorite, but a thing I remember from the show "Sugar Babies" was Mickey Rooney told a joke to Ann Miller who was also in the show. So it was, you know, old timey people. He said, "Ann, what's the difference between mashed potatoes and pea soup?"
Maria Varmazis: Sorry. Your impression of Mickey Rooney is oddly spot on. That's sorry. I was not expecting that.
Joe Carrigan: I didn't know how good that was because I've not really spent a lot of time watching Mickey Rooney.
Dave Bittner: Yeah. So what's the difference between mashed potatoes and pea soup? And she says, "I don't know, Andy." Or Mickey. "What is the difference between -- " Andy Rooney. That would be a very different show.
Maria Varmazis: The eyebrow quotient just went sky high.
Dave Bittner: "Ann, what's the difference between -- " She says, "I don't know, Mickey. What is the difference between mashed potatoes and pea soup?" And he says, "Anybody can mash potatoes."
Maria Varmazis: Gross. Gross, but funny. And I'm also going to tell my kid that one tonight. She's going to love it.
Dave Bittner: All right. So --
Joe Carrigan: That's pretty good. I'm going to use that one.
Maria Varmazis: That is pretty good.
Dave Bittner: Good joke.
Maria Varmazis: Quick question. Clarifying question. Are sugar babies the same thing as jelly babies?
Joe Carrigan: No. Sugar babies are caramel. But you ever seen a sugar daddy? It's like a big caramel candy bar on a stick.
Dave Bittner: So many mixed things here.
Maria Varmazis: I don't know how to answer that question, to be honest with you.
Dave Bittner: Remember when you were in college and you needed the money.
Maria Varmazis: This is not that kind of show. I thought we weren't getting in to that. All right. Okay. So not jelly babies because I'm thinking "Doctor Who."
Dave Bittner: No. There is a -- so Joe's correct. There is a sugar baby candy that's kind of a chewy caramel thing on a stick. Right? It's on a little -- one of those awful paper -- white paper sticks, I believe. There's also -- what else? Oh. Sugar glider. That's what I'm thinking of.
Maria Varmazis: I made the mistake of just Googling this real quick and I regret everything. Okay. That was so dumb. What am I new to the internet? Okay. Close that tab immediately.
Joe Carrigan: I just closed the probably the same tab you just closed.
Maria Varmazis: Oh my god. Okay. Yep. Okay. I'm just going to take your word for it.
Joe Carrigan: You have to follow that up with candies. And --
Dave Bittner: Yeah. Very important to add that word. So this is from the folks at Panda Security which is not -- this is a subgroup of the people who work at the national zoo. It's a in 2025 Americans lost $929 million in relationship and romance fraud. And one of the examples of that are sugar baby scams. So sugar baby scams are a type of romance scam where someone pretends to offer financial support, gifts, or a monthly allowance in exchange for companionship. That's the offer. Of course the money never comes. So instead -- walk -- let's walk through this.
Joe Carrigan: Okay.
Dave Bittner: Together. Okay. So let's say Joe you're online, you know, going around. Let's make this even better. You're on a dating site.
Joe Carrigan: Something terrible has happened to my wife.
Dave Bittner: Something that would never happen.
Joe Carrigan: Right.
Dave Bittner: But just bear with me here.
Joe Carrigan: Okay.
Dave Bittner: You're on a dating site and suddenly you get a message from a beautiful woman half your age.
Joe Carrigan: Right. Already I'm suspicious.
Dave Bittner: Right. Right. And she claims to be a wealthy professional who wants a simple arrangement. In exchange for emotional support from you and your good conversation she is going to send you money.
Joe Carrigan: Okay. I'm in.
Maria Varmazis: What could possibly go wrong?
Dave Bittner: Right. Right.
Joe Carrigan: Here's my Bitcoin address.
Dave Bittner: Yeah. So a lot of times what will happen is they will send you a DM promising you easy money for conversation or online companionship. And then they'll demonstrate proof of payment. So they'll try to prove that they're real. They'll either send you a check through email or they'll transfer money using like Zelle or Cash App or one of those. And the payment appears real at first, but usually it's sent from either a stolen account or the check is fake. And then the scammer asks you to send part of that money back as a sign of good faith.
Joe Carrigan: Right. So this is very similar to the floating -- the check floating scams.
Dave Bittner: Pretty much exactly the same just with a little helping of sexual titillation. Right?
Joe Carrigan: Right. The sprinkling of romance scams we're in.
Dave Bittner: Right. Exactly.
Maria Varmazis: Somehow even more implausible than the previous versions.
Joe Carrigan: Right like the fake job offers where you have to go out and buy your own equipment.
Dave Bittner: Right. So this -- so let's -- for example, this person who's contacted you, Joe, they send you $200 via Zelle and they say, "Hey, just so that we're good with each other just send me $50 back using a gift card." Right? Go to the store. Buy a $50 gift card. This is just how we can demonstrate that we trust each other.
Joe Carrigan: Right.
Dave Bittner: So you go to the store. You get the $50 gift card.
Joe Carrigan: Well, I say hold on. We're going to do this in a couple of days. Right? I mean we're going to do the -- I need to make sure this transaction totally clears before I go buying any gift cards and giving you any money back. So let's just wait a couple days. Thanks for the $200. I immediately withdraw, close all my bank accounts, and walk away.
Dave Bittner: Okay.
Joe Carrigan: I'm kidding.
Maria Varmazis: Yeah. I was going to say closing your bank account. If you -- I mean the pope just tried doing that and he didn't have much luck.
Dave Bittner: That's right. That's right.
Joe Carrigan: I missed that story.
Maria Varmazis: That's always easy and quick. Yeah.
Dave Bittner: The pope tried to call his bank and they hung up on him because they figured it was a joke.
Maria Varmazis: And to be fair they did their -- they were doing their job. Like they can't win. Right?
Joe Carrigan: Right. Whenever I want to do a pope impression I want to put an Italian accent on, but I can't do that anymore because the pope has an American accent.
Dave Bittner: A Chicago accent.
Joe Carrigan: I want to log in to my bank.
Dave Bittner: You want to do like Father Guido Sarducci.
Joe Carrigan: Right. Exactly. That's where I go.
Maria Varmazis: Pizza parlor.
Dave Bittner: Yeah.
Maria Varmazis: We're going to get so many angry emails. I'm sorry.
Dave Bittner: So eventually what happens is the original payment that they sent you, so in this case the $200, gets flagged as fraud.
Joe Carrigan: Right.
Dave Bittner: It gets reversed. So it gets sucked out of the system. So it gets sucked out of your account, Joe. You're out the $50 gift card money that you sent back.
Joe Carrigan: Yep.
Dave Bittner: And that's how it goes.
Joe Carrigan: That's then there I am sad that I've lost $50.
Dave Bittner: That's right.
Joe Carrigan: And that I don't have $200.
Dave Bittner: That's right.
Joe Carrigan: And that this woman really didn't want me for my companionship.
Dave Bittner: That's right.
Joe Carrigan: My heart is broken.
Dave Bittner: Yes. So it's insult and injury.
Joe Carrigan: Yes.
Dave Bittner: Yeah.
Maria Varmazis: But to quote a great philosopher of our time, Joe, your heart will go on.
Dave Bittner: [Laughs] that's right. So they have some tips here to --
Maria Varmazis: He didn't get the reference.
Joe Carrigan: Nope. My heart. That's the "Titanic" theme.
Dave Bittner: Yeah. Yeah. I'm just picturing you and Lisa at the bow of the Titanic. Except it's your arms that are spread wide, Joe. And --
Joe Carrigan: She is not picking my fat butt up. That's just not happening.
Dave Bittner: So they have some tips here. They say avoid unsolicited communication. If a stranger contacts you out of nowhere offering money that's a sign.
Joe Carrigan: Yeah. People generally don't do that.
Maria Varmazis: Oh my god. Generally no.
Dave Bittner: Flattering messages. Of course if it's too good to be true they say look for clearly fake photos, requests for personal information, particularly if they ask for things like banking details or ID photos or passwords.
Joe Carrigan: Yes.
Dave Bittner: Trying to get you on to a different site. We always talk about that one.
Joe Carrigan: Trust me. What's the password to your bank account?
Dave Bittner: Right.
Maria Varmazis: Yeah. I mean -- I mean we would laugh and walk away in real life if this was face to face, but when you're in that tunnel vision when you're online --
Joe Carrigan: Yeah. Especially when you're getting hit with a romance scam. These things become very difficult to think your way out of.
Maria Varmazis: Yeah. The blinders are really strong. It's quite amazing how that works.
Dave Bittner: Yeah. So again I think the bottom line here is we'll have a link to this story in the show notes and I think this is one of those good ones to send around to your friends and family, particularly perhaps the older folks in your life who would be more likely targeted by something like this. So send it around. Ask people to read it and hopefully you'll help inoculate them against this particular scam.
Joe Carrigan: Yeah. This reminds me of something I saw on TV back in the '80s. It was a -- I can't remember what the context was, but there was a reporter, man on the street reporter, with a camera man watching him. He goes, "I'm just going to try to give away $20 right now." He just starts asking people, "Hey, can I give you this $20 bill?" And like universally everybody's like, "No. Get away from me."
Dave Bittner: Right. Right. Yeah. That's like when you're walking through the mall and the people at the carts say, "Hey, can I ask you a question?" Like no.
Joe Carrigan: No.
Maria Varmazis: No. You may not. Yeah.
Joe Carrigan: You can take two steps back and be silent. Thank you. That's what you can do.
Dave Bittner: Right.
Maria Varmazis: Yeah, but I've been -- so when I was on vacation recently I was thinking about historically that there have been romance scams through correspondences that go back hundreds of years that we have documentation of. I'm thinking of the necklace scandal that helped bring down the reign of Louis the Sixteenth and Marie Antoinette. Like that was a whole thing. Look in to it. Seriously. We could do a whole episode on that. But it's just like before there was social media people were getting fooled with ladies of the night who looked like the queen and letters that were supposed to be from her and they bought lots of expensive jewelry. And, you know, anyway it's a whole rabbit hole. It's really fascinating.
Joe Carrigan: That is -- that is I will have to look in to that.
Maria Varmazis: You will be amazed at the parallels to how the scams still work today with this one. It's actually like just put it back in time. A romance scam. It's amazing how much things really haven't changed.
Dave Bittner: Everybody still just wants to be loved.
Joe Carrigan: Yep.
Dave Bittner: All right. Well, like I said, we'll have a link to that story in the show notes. Maria, what do you got for us this week?
Maria Varmazis: Okay. So I'm not getting in to Marie Antoinette and Louis the Sixteenth. Some other episode. Happy to get in to it some other time.
Joe Carrigan: That story has a happy ending. Right?
Dave Bittner: [Laughs] depends on who you are.
Maria Varmazis: I mean France seems to be doing okay now. So yeah. I would say yeah. Inevitably yes. So my story is actually about not France, but a place that is often confused for France, and that place would be Detroit.
Dave Bittner: [Laughs] yeah. Sure. You get off the plane. You look around. Wait a minute.
Maria Varmazis: Or Detoit. No. Detoit. So this story is from Click on Detroit from reporter Lauren Kostiuk and the headline is awesome. It's called "Hacked, Robbed, Then Banned: Canton Township Business Owners' Meta AI Nightmare." Now.
Dave Bittner: Duh, duh, duh.
Maria Varmazis: Now of course it's Meta and we love to pile on Meta and blah, blah. But the hook for this story that I was especially drawn in by was that this is actually about a small business owner and Joe, as we've established, I found you on Facebook.
Joe Carrigan: Yeah.
Maria Varmazis: So I know you're on there.
Joe Carrigan: Yeah. That was me, by the way. I accepted your friend request.
Maria Varmazis: I saw it. Thank you.
Joe Carrigan: Not an impersonator. I have to go in and check my -- check my settings because I don't think you should have been -- my impression was you should not have been able to find me.
Maria Varmazis: I shouldn't have. And yet. Anyway you and I know. And, Dave, you're on Facebook too. A lot of small business owners their entire business is done through Facebook, especially town and village and small city Facebook groups and such. So if you've built your business and you're networking through Facebook and something happens to your Facebook account that is a catastrophic event. So that's sort of what this story hinges on is a little wrinkle on an account take over that is actually again really, really awful if you're a small business owner. So the hero of our story is a gentleman named Jason Keilman who has spent 26 years dispensing hearing aids and he runs a mobile practice in Michigan where he visits patients in their homes and he recently turned to Facebook ads to grow his business. This is not unusual. A lot of small business owners do stuff like this. And he says that his Facebook business account was recently hacked twice in four days. The attackers logged in from different states. They stole nearly $1,000 in ad funding from his account. And then they triggered a permanent ban of his Facebook business account. So after Jason reported the fraudulent charges and suddenly lost access to his account he went through the only means he had to try and appeal this permanent ban that for some reason had hit his account which would be Meta's or Facebook's AI chat bot. There's no human being. There's no phone number you can call. There's no way he can talk to a person.
Joe Carrigan: Talk about this is a new level of nightmare for screaming in to the void.
Maria Varmazis: Oh sure. Yeah. No. It is. It's he --
Joe Carrigan: The only thing you have to do is talk to our AI thing which is probably just set to say no. No. No.
Maria Varmazis: Yeah. It's just a big wall and you're going to scream at it. Exactly that. And he was told to, "Okay. I can help you. I'm a very friendly AI chat bot to get your account back. You just need to finish our ID verification process" where, you know, you probably upload a selfie of yourself, like a video selfie, and then your government ID, and they verify that you are who you say you are. He goes through that process and pretty much instantly the judgment comes down through Meta's AI moderation system that says, "We are never going to give you your Facebook business account back, and also you've been accused of child sexual exploitation violations. So that is why you are perma banned."
Dave Bittner: Right. And now -- and that ban is now associated with your actual government ID.
Maria Varmazis: And your business.
Joe Carrigan: Yeah. This sounds like a lawsuit waiting to happen.
Maria Varmazis: Yeah. So he's, as you might understand -- obviously he didn't do what he's been accused of. Just to be clear. And he's understandably this is an existential crisis for him and his business. So he pays out of pocket in addition to the money he's already lost from the attackers for this thing called Meta verified which is that $15 check you can get that you see some people have. To try and actually get a human being to review all this. So again let's just pause and say the only way to get a human being maybe is to pay for it. That really does not sit right with me at all. But they come back, Meta, whether it's a human being or not. I'm not entirely sure. But Meta comes back and says, "No. Your case is closed. Thank you for your money, but there is no recourse here." So there is thankfully a happier ending to this. I'll get to this.
Joe Carrigan: Okay. Good.
Maria Varmazis: But yeah. I don't want to just say like that's the end of the story. There's actually an epilogue to this. But in the meantime the thing about this story that also made me really -- just gave me some pause was the idea that after the attackers kind of got what they wanted out of him, which was the money that they stole, they essentially salted the earth behind them by apparently they actually had legitimately uploaded CSAM using his account to trigger that ban.
Joe Carrigan: Really?
Maria Varmazis: Yes. It was done on purpose so he would not be able to recover his account. So they know, the attackers know, that AI moderation is being used on Meta accounts far and wide.
Joe Carrigan: Right.
Maria Varmazis: So if they upload legitimate CSAM which is horrendous that obviously it's going to trigger the automated moderation systems and there's no way that anyone's going to be able to get their account back. So it's yeah. Literally salting the earth. Burn it down behind you. Just awful. So in this case Jason says, you know, he had reputation damage which was way worse than the $1,000 that he was out. His business depends on Facebook advertising because again small town America especially, what other recourse do people have? Like what? Your local newspaper? Where are you going to have --
Dave Bittner: Right. Right.
Maria Varmazis: Where are you going to advertise? It's Facebook. That permanent moderation label does carry a serious stigma. People are just going to -- I mean I don't know what that looks like, but there's a stigma there. And again he can't really get through to a human being to get eyes on this or at least not through any normal means that anyone could do. There was no phone number for him to call. There's no person that he could easily reach. And the appeals process basically just said, "No. You're awful for doing CSAM. We don't want you back." So thankfully thanks to local news in his case putting a highlight on this the happier ending for Jason is he was able to get a lot of his money back through his bank and he also had to actually appeal to his local legislator. And he had to bring in essentially the government to try and work with Meta to hear out his case. So he had to kind of go up the chain for his Facebook account to get someone to actually look in to this which is nuts to me that you just -- you can't just get a customer service person to just look at this. So he's not completely out, but the amount of work he's had to try and do just to get somebody to look at this and just see what has clearly gone on is just insane to me. So when this local news story in the Detroit area started reporting on this they found a number of businesses saying they've been encountering a similar salt the earth kind of attack for their Facebook business accounts. So especially for small businesses that are so dependent on Meta nowadays which are most of them, I would say, the take away is to treat your social media account like a key business infrastructure because it is. Like a bank account. So of course strong unique passwords. Please use a password manager. They're really great. But also get multi factor authentication up and running if you don't already. Maybe have back up administrative accounts in case one of them gets locked out. So just don't have, you know, all your eggs in one basket. But there was also some advice about not using your company's main payment card for also paying for ads on Facebook. Sort of assume that your Facebook account may actually get compromised. So don't have it attached to something that draws money from your main business account. Maybe have a low limit payment card just for ad platforms like Meta.
Dave Bittner: Yeah. I can -- I can reinforce that.
Maria Varmazis: Isn't that awful though just to be like, "Yeah. Just assume that something bad's going to happen and make sure they don't have the keys to the kingdom."
Dave Bittner: Well, I had a -- the reverse thing happened to me where I was trying to promote an event that was coming up for a nonprofit that I volunteer with. And so as part of that I was helping them post, you know post ads for this fundraiser. And we thought, oh, let's spend a little money and so I made the huge mistake of using my personal credit card to try to pay for some ads. Now you'd think this is the thing that Facebook wants you to most do. Right? And Facebook just started hammering my card with inquiries and payments to the point where my bank shut the card down.
Maria Varmazis: Wow.
Dave Bittner: Yeah.
Maria Varmazis: Wow.
Dave Bittner: So I called the bank and they were like, "Yeah. You've got to come in." So.
Maria Varmazis: You ain't the pope. You've got to be here.
Dave Bittner: Right. Yeah. Exactly. So I saw -- so went to the bank, proved I was me, you know, and we got it up and running again, but it was like okay well I'm never doing that again. You know, I'm going to get some, I don't know, burner card or something to use on Facebook because yeah. Sorry, Maria. I didn't mean to hijack your story there.
Maria Varmazis: No. It's I never would have thought that that would be necessary. I think for all of its problems given how big Meta is I would never have thought that that kind of treat it like it's essentially -- like you've got to put it in this walled garden. You've got to treat it like it is going to scam you. That's just so surreal to me that that is the best option for something like that. Like I just --
Dave Bittner: It is a bad neighborhood. Right? It's like going to 1970s Times Square.
Maria Varmazis: Yeah. Roll up your windows. Lock your car doors. And don't really fully stop at an intersection. Just roll through.
Dave Bittner: Yeah.
Maria Varmazis: And if someone starts walking close you speed off.
Dave Bittner: Put money in your shoe.
Maria Varmazis: It's just I just can't believe, and yet this is the situation we are in with Meta with businesses in this case anyway. The good thing is that Jason also to help himself out smartly documented absolutely everything that he was going through. So again he went through his state legislator to try and get eyes on this with Meta. And I want to correct something I said earlier. He has access back to his personal Facebook account. His business account is still locked as of time of this recording. So I just wanted to double check that I said, "Wait. Did he get everything back? No. His Facebook personal account is back, but his business account is still inaccessible." Again for something that he did not do which is just awful. So work with your bank or card issuer. Certainly file a report with local police if this happens to you. Potentially you can report it also to the FBI, but apparently when Meta's not paying attention you have to go up the chain with your legislators and trying to get someone to pay attention to you. I cannot believe this.
Dave Bittner: I wonder -- I wonder if he was in Europe could he invoke GDPR. And if so, boy, it's a shame we don't have GDPR. Right? Or any meaningful privacy legislature. Right.
Maria Varmazis: Or anything.
Dave Bittner: There's no federal privacy legislation. So.
Maria Varmazis: Essentially you have to prostrate yourself at the foot of your state senators or something and hope that one of them cares enough to help you which is just how is that the state of things. It's just awful.
Dave Bittner: Yeah. I know. I've said it before. I'll say it again. Companies like Facebook, they no longer operate at a human scale. And so you are just churn to them and if something like this pops up you're not worth their time. Your little local business is not worth their time. So they just send you on your way and wish you well. And that's tragic.
Maria Varmazis: Yeah. Act appropriately, small businesses. So treat that like the radioactive situation that it is, I guess.
Dave Bittner: I mean it's a shame because, you know, you say don't put all your eggs in one basket, but there's no other basket.
Maria Varmazis: No. It's true.
Dave Bittner: No. Like so all right. Well, we will have a link to that story in the show notes. Let's take a quick break here to hear from our show sponsor. We will be right back after this. [ Music ] And we are back. Joe, you're up. What do you got for us this week?
Joe Carrigan: Dave, my story comes from Regina Mobley at WAVY which is in Newport News, Virginia.
Dave Bittner: The wave.
Joe Carrigan: The wavy. Wave. Yes.
Dave Bittner: Wavy. It sounds like - definitely sounds like a beachy radio station.
Joe Carrigan: Yeah like one of the ones you listen to in Ocean City when you're down there.
Dave Bittner: Right. Exactly. You're tuned to 107 the Wave.
Joe Carrigan: Right.
Dave Bittner: And there's a sound effect. Yeah.
Joe Carrigan: All right. Well, this is not a happy story.
Maria Varmazis: I was going to say I'm on the beach right now flying a kite. All right. No? Okay. I'm not there anymore.
Joe Carrigan: They talk about this woman named Christine. I'm going to just refer to her as Christine. Her full name is in the article. But she has a growing family. Four dogs. Three kids. And a fiance. And they're looking for a new house. So she goes on to Facebook Marketplace which is a mistake because it's all essentially scams on there. That's not true. I buy things on Facebook Marketplace from time to time, but I always do cash in person. Right?
Maria Varmazis: Yeah. It -- people selling -- like I was looking for a bench earlier today. I mean I don't think those are scams on Facebook, but you know I'll find out when I show up.
Joe Carrigan: Yeah. But when you put something on Facebook even if it's free you get a whole mess of just crap, you know. And it's just a terrible experience all around. Anyway this person identified themselves as a landlord, this guy Steve Arthur Junior. And that is probably a compromised account. So this is probably not the real guy's name. The initial connection was a red flag because Christine said the very first time he calls he FaceTimes. And she didn't answer because she thought it was weird, but Arthur then says, "Hey, this is a rent to own property." Right? Which is I don't know. That already sounds kind of scammy to me. I mean even when people are doing rent to own I mean have you ever heard of that where it ends up with the person owning the house?
Dave Bittner: No. I mean mostly what happens is you have a rental with an option to buy.
Joe Carrigan: Right. And sometimes they say they're going to take some of the money and put it in to escrow for a down payment.
Dave Bittner: Correct.
Joe Carrigan: Yeah.
Dave Bittner: Correct.
Joe Carrigan: I have never seen that.
Dave Bittner: But not in this market.
Joe Carrigan: Right.
Maria Varmazis: Yeah. I haven't. That always to me was told like a hey that's not really real. I mean I would love to know if that actually has ever happened, but I've never heard of that being a thing.
Dave Bittner: Yeah. It has. See my father was a career Realtor and so we -- I do remember that being a real thing, but I also could very well be remembering back to the 1980s. You know, when interest rates were at 18%. So people were doing whatever they could do. So yeah. So I think you're both right.
Joe Carrigan: So Arthur says, "This is a rent to own property. And to secure the deal I need the first month's rent" which is approximately $1,350, "And I need a security deposit of also $1,350." So the family wires Arthur $1,400 and gets to work on getting the rest of the money together. And then Arthur says, "You guys are cleared to move in." And they say, "Great. How do we get in to the house?" And Arthur says, "I hereby give you permission to break the lock box and take the key out of the house." To open the house up. Go ahead and move in.
Dave Bittner: We can send you a free crowbar.
Joe Carrigan: Right.
Maria Varmazis: Yeah. Just throw that rock through the window. Don't worry about it. Like --
Joe Carrigan: So the fiance goes, "We're not doing that." Right? So then the legitimate property management company, Atlantic Coast Realty, sends her an email with the code on it to open the lock box. And we're going to get to how that happened here in a minute. So they go and they open the lock box and they actually move in to the house. And the next morning when they wake up they wake up to people knocking on the door and they're like, "You can't. What are you doing?" And they're like, "The renter told -- or the owner told us we could move in. This is a rent to own property." And they're like, "No. Did you sign a lease? You can't be here. You have to go." So they are now homeless. They had to get a U-Haul to get all their stuff out of the other place. It's still in there. They're living in a shed, reportedly living in a shed which is horrific. But Atlantic Coast Realty said -- you know, responded to this news article and this is their statement. I'll just read it and that's going to go swimmingly I'm sure. "We are deeply saddened by the perspective -- that a prospective tenant appears to have been the victim of an online rental scam involving unauthorized third parties. The individual scheduled a property viewing through tenant tuner -- through the Tenant Turner platform at our property." And it has the address. "As part of the showing process prospective tenants are provided written instructions warning them not to send money to third parties and advising them to independently verify any payment requests before transmitting funds. Unfortunately it appears a bad actor manipulated the prospective tenant in to sending the payments via Bitcoin and Cash App to unauthorized individuals unrelated to our office." So they also go on to say, "We never take Bitcoin or Cash App and we fully sympathize with the victims here." So this is what happened. This guy after they said, "No. We're not breaking the lock box open moving in. That's ridiculous." This guy goes, "Oh. Okay. Let me see if I can find a work around." And he just calls the department, the rental company, and says, "Hey, I want to go in and look at the house. Can you send me -- send me a code for -- or send a code to me?" And then gives them Christine's email address so Christine gets the email address and the property management company and gets instructions on how to open the lock box. So here's my question on this. Why go through all that trouble once you have the money? Once you have the money why do you go through the trouble of telling people, "Yeah. Sure. Break the lock box." Or if they -- why not just ghost them at that point?
Maria Varmazis: Because crime is fun.
Joe Carrigan: I mean but what is the game here on this now?
Dave Bittner: Maybe time. The only thing he got was time. That if -- so let's say they moved in and it was a week before anybody noticed.
Joe Carrigan: Right.
Dave Bittner: Right? Which is plausible.
Joe Carrigan: Yes.
Dave Bittner: That buys the bad guy --
Joe Carrigan: Time to get the money out.
Dave Bittner: Yeah. Time to whatever, get out of dodge, launder it, whatever. Cover their tracks.
Maria Varmazis: Yeah. Plus if they get arrested for breaking in to a place like they're not going to be able to go after him if they're in jail.
Joe Carrigan: Right. Yeah. So I don't think this guy is probably local. He's probably international because he just compromised a Facebook account, looked around a geographical area, found some ways to exploit something, you know put it all together because everything you need to do this scam is on the internet. And then had this family wire him or send him, including some in Bitcoin. They're never getting that back. You know, first off the FBI's not going after $1,400 in Bitcoin which is, you know -- if you lose a big amount of Bitcoin they might help you, but $1,400 no. They're not going to do that.
Maria Varmazis: What's the cut off? 10K?
Joe Carrigan: I don't know. I think it's hundreds of thousands. That's a good question.
Dave Bittner: I don't know. Next time I'm talking to somebody from the FBI I'll ask them.
Maria Varmazis: Yeah. I'm curious. What is the point at which they then need to get involved and below that it's small potatoes? Because that's -- how is that determination made?
Joe Carrigan: Yeah. It's all a matter of resource allocation. They don't have an infinite amount of resources. They can't go after every single small case. And the thing is the criminals know that. Right? So they, you know -- they scale up their small scale operations by keeping -- by instead of doing one big heist they do hundreds of little heists.
Maria Varmazis: Yes. Distributed compute on that.
Joe Carrigan: Right. Exactly.
Dave Bittner: Yeah. Nuisance. It's a nuisance.
Joe Carrigan: Right.
Dave Bittner: So what's the advice here, Joe?
Joe Carrigan: Never send money to anybody for anything with Cash App or -- that'd be fun. Never say anything. That's just terrible advice. But number one. Legitimate services like property managers and rental agreements are not going to -- not going to ask for money in Bitcoin. I have heard stories of people who pay their rent via Venmo. I know somebody that does that. And but they signed the lease. You know, you can't take custody of a property until you sign a lease. So that's another red flag that should have gone up. It doesn't seem like these folks signed a lease. Maybe they did. Maybe that's just not reported on in here, you know, because you can just go out and get a generic lease agreement online and --
Dave Bittner: Right. Send them a PDF.
Joe Carrigan: Yeah. Send them a PDF. Say, "Sign this and send it back. We're all good. Go ahead. Break the lock box and move in."
Dave Bittner: Right.
Joe Carrigan: So.
Maria Varmazis: If they don't -- if he or she is the landlord and they don't walk up with a key and open the door for you and show you around, I don't know. I wouldn't.
Dave Bittner: Right. No. That's a really good point.
Maria Varmazis: I recognize there are times you can't, but really you need to have someone actually walk you around in it as much as possible.
Dave Bittner: Right. Right. I would even say if you're meeting someone at a place like this to ask to see their ID before they show you around.
Joe Carrigan: Yeah. Make sure you don't wind up in the basement of that rental property in pickle jars or something.
Dave Bittner: Yeah. It is -- it has happened. All right. Well, so I guess they're out of the -- what is it? $2,600 or so?
Joe Carrigan: Well, I think they only lost like $1,400.
Dave Bittner: Okay.
Joe Carrigan: So I mean, but still they don't have a place to live. That's more importantly. They moved out of their old place. Right? So they can't go back. Where do they go? Yeah. Terrible.
Dave Bittner: No. It is terrible. And just the emotional toll as well. All right. Well, we will have a link to that story in our show notes and of course we would love to hear from you if there's something you'd like us to consider for the show. Please email us. It's hackinghumans@n2k.com. All right. Joe, Maria, it is time for our Catch of the Day. [ Soundbite of Reeling in Fishing Line ] [ Music ]
Joe Carrigan: Dave, our Catch of the Day comes from one of our favorites, the scam bait subreddit, r/scambait. Oh.
Maria Varmazis: I see this one involves a Bostonian. Can I please be the Bostonian?
Dave Bittner: Yes. You may. I was counting on it.
Maria Varmazis: Yeah.
Dave Bittner: All right. So --
Maria Varmazis: Let me drop my S.
Dave Bittner: I will be the -- I'll be the scammer and Maria you can be the not so hapless victim. It starts out like this. I'll be in Boston for an investment meeting. How about sailing out of Boston Harbor for a bit?
Maria Varmazis: Sure. We can take my boat.
Dave Bittner: That sounds so interesting. However I probably won't get there until next month. So, Amanda, will you have time then?
Maria Varmazis: This isn't Amanda. It's Jake.
Dave Bittner: That's terrible. It seems I mixed up the numbers. I always thought it was my friend Amanda's number. I'm so sorry, Jake. It sounds like you sail quite often. Do you mainly go out to sea for fishing or just to relax?
Maria Varmazis: Mostly just to relax. It's an 80 foot boat. That's a yacht, FYI. That is a yacht.
Joe Carrigan: Yeah. That's bigger than Bezos' boat or one of his yachts.
Maria Varmazis: No. No. It's not bigger than Bezos, but it's a -- it's a respectable --
Dave Bittner: Yacht.
Maria Varmazis: Yeah.
Dave Bittner: It sounds like your previous job cost you the means to enjoy life. I also go to sea to enjoy life. My boat is currently docked in San Francisco Bay, but I haven't been there in a long time. Since you go out to sea so often I'm sure you have many places to recommend. As for your invitation, if we become friends I wouldn't mind taking a ride on your boat.
Maria Varmazis: Well, that sounds wonderful. My boat just got out of dry dock. I'm upgrading the electrical on my boat. Going to cost me 500K. Full entertainment system. New LED lighting. And the latest sup dog components.
Dave Bittner: It's really great.
Joe Carrigan: The latest sup dog components.
Dave Bittner: Just wait for it, Joe.
Maria Varmazis: Wait for it, Joe.
Joe Carrigan: I know where this is going.
Dave Bittner: It's really great. Although I lost Amanda's number, I met a kind, polite, and enthusiastic Bostonian. [ Laughter ]
Joe Carrigan: So rare.
Maria Varmazis: [Laughs]. I'm back.
Dave Bittner: Perhaps we could exchange contact information later to stay in touch. I'd like to ask you for some travel advice about Boston. It sounds like you love your boat. My boats are all managed by my personal assistants so it sounds like you're definitely a captain. By the way, I misspelled a word earlier because my native language is Mandarin. What I'm trying to say is that your previous job seems to have provided you with enough financial resources to enjoy life now.
Joe Carrigan: Ah. So see he's going back and correcting something he said earlier which didn't make sense.
Dave Bittner: A little nonsensical. Yeah.
Joe Carrigan: Yep.
Maria Varmazis: Sure. Tell me about your boat. Do you have it equipped with sup dog?
Dave Bittner: What is this? I've never heard of it before.
Maria Varmazis: What? What's what?
Dave Bittner: I don't know much about yachts. I just bought one for business purposes. I also occasionally go out to sea by myself. Going to sea is one of my many hobbies. Sup dog. What is this?
Maria Varmazis: Not much. What's up with you?
Joe Carrigan: There it is.
Maria Varmazis: We have an equivalent sup dog.
Dave Bittner: I recently traveled to Phoenix and just got back to L.A.
Joe Carrigan: Totally misses the joke.
Dave Bittner: Yeah. By the way from our brief conversation I feel that we are about the same age. I'm 43 years old this year. If you don't mind me asking, how old are you? And that's where it ends.
Joe Carrigan: That's the end of it. That guy just stuck it out for the sup dog.
Dave Bittner: No. It's good.
Joe Carrigan: I actually got one of my coworkers with that once. I won't name them because I don't want to shame them, but I walked over to his cubicle and I said, "Does it smell like up dog over here?" And he goes, "What's up dog?" And I'm like, "Nothing. What's up with you?" And as soon as I did it you saw his face go, "Oh no." And I tried to get him the next day with hopping on. I said I saw a hopping on out here. What's a hopping on? Nothing. What's a hopping on with you?
Dave Bittner: Well, as a bofa victim I have a great empathy for your coworker, Joe.
Joe Carrigan: Yes. We're still friends.
Maria Varmazis: That's what we call a call back.
Joe Carrigan: We're still friends.
Dave Bittner: You're no longer I was going to say roommates. Office mates with Michelle. Right?
Joe Carrigan: No. We are not.
Dave Bittner: Okay. Was that at her request?
Joe Carrigan: No. No. It was not. Neither one of us asked for that.
Dave Bittner: Okay. Or maybe was it like the elementary school teacher who thought it best to separate the two of you?
Joe Carrigan: Could have been.
Dave Bittner: Just too much laughter coming out of that office.
Joe Carrigan: There was -- well, now there's a lot of talking coming out of my office because now there's two doctors in my office and I'm the only guy without a doctorate degree.
Dave Bittner: Oh. I see. So they talk down to you all the time.
Joe Carrigan: No. Actually these guys are great. I like them.
Dave Bittner: Good. All right. Well, that is our Catch of the Day. We will have a link to that as well in the show notes. [ Music ] And that is "Hacking Humans" brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliott Peltzman and Tre Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe Carrigan.
Maria Varmazis: And I'm Maria sup dog Varmazis.
Joe Carrigan: You do sup dog, but you wouldn't do bofa with me.
Maria Varmazis: I draw the line at bofa.
Joe Carrigan: Okay.
Dave Bittner: You're bofa my friends. Thanks for listening. [ Music ]
