The friendly skies aren’t friendly.
Dave Bittner: Hello, everyone and welcome to the "Hacking Humans" podcast where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner and joining me is Joe Carrigan. Hey, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: And our N2K colleague Maria Varmazis. Maria!
Maria Varmazis: Hi, Dave and hi Joe.
Dave Bittner: We've got some good stories to share this week, but first let's get into our follow-up here. We've got a lovely kind note from someone named Don who wrote in and said, "Hello, I'm a fan of your podcast and may have a story you might be interested in. I lived in Japan for 15 years and studied on martial art there." It's a little on the nose, don't you think?
Joe Carrigan: Yes.
Dave Bittner: "I now live in Colorado and have a website for my dojo with my email address I use for dojo business on the site. That is probably how these got sent to me. I checked my spam folder this morning and found two emails claiming to be from the Japan pension system. I did pay into it and will get a small payout in a few years, but they of course use the email I used for dojo business and not the one I use with my in-laws in Japan. As I said, two emails for-but from different addresses; one seems almost certainly from China. The headers and such are the same as the legit pension system. Of course, they're saying there's a problem that needs to be dealt with right now or there will be dire consequences. There is a link claiming to go to PayPal in both. I, not being Maria, did not click on it."
Maria Varmazis: Good job! Good job.
Dave Bittner: "But I am certain it does not go to the actual PayPal login and my credentials will be used in seconds after I punch them in wherever the links go. Despite being from two different email accounts, both list a fee of about 26,000 yen, fairly small potatoes." Anybody know what that is in real money?
Maria Varmazis: Twenty-six bucks, or 260 bucks or 26 bucks, one of those two.
Joe Carrigan: I think it's 260 bucks.
Maria Varmazis: Yeah. Yeah.
Joe Carrigan: Ten to one I think.
Dave Bittner: Alright.
Maria Varmazis: Yeah.
Dave Bittner: Don says, "I've shared these photos with groups devoted to Bujinkan."
Maria Varmazis: Bujinkan. Bujinkan.
Dave Bittner: Okay. He says, "It's sometimes called 'boozikan' after all the drinking that they do after training."
Maria Varmazis: [inaudible 00:02:18].
Dave Bittner: "That I suppose other groups linked to any martial arts organization with headquarters in Japan will be targeted in the future if not already. You may note"-oh, he included some screenshots. "You may note I did crop them so you won't be able to make fun of how much battery life I have left." [ Laughter ]
Maria Varmazis: He's paying attention.
Dave Bittner: Don-yeah, [multiple speakers] that's a dedicated listener. "Thank you for the work you do and the way you make it fun. Since Maria's joined, I've noticed just how much better the interactions have gone."
Maria Varmazis: Oh!
Dave Bittner: Joe and I both agree.
Joe Carrigan: Yeah, 100%.
Maria Varmazis: You [inaudible 00:02:55].
Dave Bittner: You lived in Japan for a while didn't you Maria?
Maria Varmazis: Yeah, a little bit. It was my-Japanese was my minor in college, so oh my gosh, yeah.
Dave Bittner: Oh, okay very good.
Maria Varmazis: Yep.
Dave Bittner: Don says, "When one of you three is absent, it just isn't as great. Please keep up the work and say hello to the chickens for me." Alright, well thank you Don.
Joe Carrigan: Yeah.
Dave Bittner: That's a very.
Joe Carrigan: Very nice letter.
Dave Bittner: Very nice kind note and sounds like you've got things under control there.
Joe Carrigan: I will tell the chickens that Don says, hi.
Dave Bittner: Alright, we're going to take a quick break to hear from our sponsors and when we come back we will dive into our stories. [ Music ] And we are back. Joe, you have the honors this week. You want to start things off for us?
Joe Carrigan: Last week I bummed everybody out with my horrible story about the woman who lost-was now-and her family were now homeless.
Dave Bittner: Um-hmm.
Joe Carrigan: So, I figured this week I would come in with two stories, I have two short ones, but they both have happy endings.
Maria Varmazis: Ah!
Joe Carrigan: And the first one comes from our friend, Mallory Sofastaii, a friend of the show.
Dave Bittner: Yeah.
Joe Carrigan: Right up the road in Baltimore. And this is a story about a guy, Matthew Middleton [assumed spelling]. And it says, "He almost fell for it." Somebody calls him out of the blue and says, "Here's some life-changing information. My name is Dave Clark and you have won the Reader's Digest and Publisher Clearinghouse Sweepstakes." And he said, "Dave" says, he said "I was a winner of 9.4 million dollars and a brand new Mercedes-Benz."
Dave Bittner: Wow!
Joe Carrigan: So, he was suspicious at first, Matthew Middleton. And he-but the caller reminded him he had entered the sweepstakes online, which I think is an interesting angle. Right? Because we always say, "Hey, did you buy a lottery ticket?" "No." "Then you didn't win the lottery."
Dave Bittner: Right.
Joe Carrigan: "Did you enter a sweepstakes?" "No." "Then you didn't enter the sweepstakes." So, here's how they're getting around that. They're saying that you entered the sweepstakes online. Do you remember everything you've ever done online Dave?
Dave Bittner: I don't know.
Joe Carrigan: If I said it was three months ago you entered the sweepstakes and now you've won.
Dave Bittner: Yeah.
Joe Carrigan: I wouldn't be able to pull that out of my memory.
Dave Bittner: No. I don't remember what I did ten minutes ago.
Joe Carrigan: Right.
Maria Varmazis: Who are you people?
Joe Carrigan: Right.
Dave Bittner: What am I doing here?
Maria Varmazis: Why am I here?
Joe Carrigan: Right.
Dave Bittner: This is not my beautiful house.
Joe Carrigan: Oh, yeah once. That's a good one. And the caller told him the prize money would be delivered in cash and sent videos and photos he claimed to be of them counting Middleton's money, right?
Dave Bittner: Oh.
Joe Carrigan: So, he just got some random videos off some line of, you know, money going through money counters.
Dave Bittner: Right.
Joe Carrigan: You know?
Dave Bittner: Stock footage and a lot of other things.
Joe Carrigan: Yeah.
Dave Bittner: Yeah.
Joe Carrigan: Then came of course the catch, he said the only thing is you need to pay a document fee of 500 dollars via an Apple gift card.
Dave Bittner: Aw, yes.
Joe Carrigan: Right. And that's when Middleton went "Ding! There's my red flag!"
Dave Bittner: Right.
Maria Varmazis: We need a red flag sound.
Joe Carrigan: Right.
Dave Bittner: That's true. I'll have to ask the audio guys, what would a red flag sound-I mean, I could hear a like a flag flapping in the wind.
Maria Varmazis: Yeah.
Joe Carrigan: Yeah.
Dave Bittner: But a red flag more like a little [background sound]. Like the-what about that sound from Family Feud, you know, the aaah?!
Joe Carrigan: The strike sound. That's pretty good.
Dave Bittner: Yeah. That would be a good one.
Joe Carrigan: That would be good.
Dave Bittner: Alright, we'll work on that.
Joe Carrigan: Big red X.
Dave Bittner: Yeah, yeah.
Joe Carrigan: So, Matt Middleton does something very smart here. He says, "Let me contact Mallory."
Dave Bittner: Aw-ha.
Joe Carrigan: Meaning Mallory Sofastaii at WM-W-what is it?
Dave Bittner: WMAR.
Joe Carrigan: WMAR.
Dave Bittner: Yeah.
Joe Carrigan: I almost said WMAL, but that's in D.C.
Dave Bittner: Yeah.
Joe Carrigan: Also featured in "The Day the Earth Stood Still" by the way. Should go back and watch that movie, there's somebody with a WMAL microphone sitting on the desk.
Dave Bittner: Great story.
Joe Carrigan: Yeah. Anyway, called Mallory. Mallory of course says, "Yeah, it is a scam." You are not so-Mallory-the thing I like about this story is that, Mr. Middleton thought it was a scam, reached out to somebody he knew who was an expert, Mallory Sofastaii.
Dave Bittner: Um-hmm.
Joe Carrigan: And Mallory was like, "Oh, absolutely that was a scam." And is very grateful.
Dave Bittner: Yeah.
Joe Carrigan: So, that's over-interesting in this story is the guy was persistent about it. The guy was very persistent and almost had him believing it at the end of the story. But once he asked for the Apple gift card, he was-he was-that's when the red flag went up. Now, if you remember a couple of week ago, I talked about how somebody tried to scam me calling me from the "Carroll County Sheriff Department," again, with quotes around the Carroll County Sheriff Department.
Dave Bittner: Yes.
Joe Carrigan: And I said, "Oh, well let me get your-let me get your name and your badge number, and I'm going to call the Carroll County Sheriff's Department back and they're going to route me right to you, right? Then we can discuss this matter," because this is an inbound call and I don't really trust it. I know a lot of scams go like this.
Dave Bittner: Um-hmm.
Joe Carrigan: The guy was-the guy was really aggressive and it was not as easy as I would have thought to do this.
Dave Bittner: Umm.
Joe Carrigan: Right? You know, I always thought, "Oh, yeah another scam. Ha-ha." But the way these guys call you on the phone, they get you not thinking about it, right?
Dave Bittner: Yeah, off-kilter.
Joe Carrigan: Right. And one of the things Mallory asked in this article is, "Did you let yourself imagine what you would be doing with that money when you got it?"
Dave Bittner: Oh.
Joe Carrigan: And he's like, "I did imagine that."
Maria Varmazis: Yeah, aw.
Joe Carrigan: So, I mean, Dave imagine if you had 9 million dollars.
Dave Bittner: Oh, only 9?
Joe Carrigan: Yeah.
Dave Bittner: Uh, you downgrade for me.
Joe Carrigan: Right.
Dave Bittner: Oh, I'm kidding of course.
Joe Carrigan: Yes.
Dave Bittner: Yes, I would-there are many things I could fantasize about with things I would use 9 million dollars for.
Joe Carrigan: Right.
Dave Bittner: For sure.
Joe Carrigan: Yeah, exactly.
Dave Bittner: Yeah.
Joe Carrigan: So, thank you Mallory and thank you Mr. Middleton for sharing your story. My next story comes from the Los Angeles Times and this person is-has elected to remain anonymous, the victim here. But, let me tell you what happens. He first gets a suspicious text message and then he gets another communication that was a returned phone call and a plea to call him immediately. And this by the evenings end, this is a senior citizen in Ventura, California who eventually hands over 25,000 dollars to somebody who has said, "We've locked your account, your bank account. Your bank account has been associated with distribution of CSAM in Canada," right? "You need to take 25,000 dollars in cash and meet somebody at a location. Here's the code word," right? They do all this stuff. And he does that and then a little while later he starts thinking, "That might have been a scam." So, he calls the police and the police are there interviewing him, right? And this is where the story gets good.
Dave Bittner: Okay.
Joe Carrigan: What do we say about criminals on this show all the time with these social engineering attacks? So, the hit you once, what are they going to do?
Dave Bittner: Oh, they're going to come back for more.
Joe Carrigan: They're going to come back for more.
Maria Varmazis: Oh, yeah.
Dave Bittner: Yeah.
Joe Carrigan: This guy [multiple speakers] had no problem getting 25,000 dollars together, so.
Dave Bittner: Right.
Joe Carrigan: Let's hit him up for 50,000 dollars.
Dave Bittner: Yeah.
Joe Carrigan: They call just as the-as the victim is sitting down with the police to discuss it. They call him and they say, "Hey, it's us again. Now we need 50,000 dollars to keep you from going to prison."
Dave Bittner: Uh-huh.
Joe Carrigan: Right? And the cops go, "Oh, awesome. Where would you like us to meet you?"
Dave Bittner: How often does this happen?
Joe Carrigan: Right. This almost never happens, right?
Dave Bittner: Right, right.
Joe Carrigan: So, they said, "Act like you're going to give them 50 grand and Ventura Police arrested two of them, a man and a woman. The woman was the one making the contact with them, and soon as the cops showed up, she tried to run but they caught her. And then the man, they caught him too and they got the original 25,000 dollars back from them. Both of these people have now pleaded guilty to elder abuse, which.
Dave Bittner: Okay.
Joe Carrigan: I don't think-I think-what do you, I think fraud might be more of a-maybe, I don't know. Maybe if elder abuse has a bigger, or a bigger sentence.
Dave Bittner: Yeah, I don't know. I mean.
Joe Carrigan: Higher sentence than [multiple speakers]?
Dave Bittner: Who knows with the police, I'm sure did you know what they thought was best going to get them a conviction perhaps?
Maria Varmazis: Yep, yep, yep, yep.
Joe Carrigan: Yep.
Maria Varmazis: I would hope so.
Dave Bittner: Yeah.
Joe Carrigan: So, they're-yeah no, they both pled guilty and the guy got his money back which is great. I'm very happy to see that.
Dave Bittner: Yeah. I mean, one of the things as you were describing the story that I was wondering was, would the people at the drop site, the people who were there to collect the 50,000 dollars, the 25,000 dollars, might they have just been money mules?
Joe Carrigan: They might have been.
Dave Bittner: Because we hear that pretty common too, like they'll just send a currier.
Joe Carrigan: Right.
Dave Bittner: You know, so that-this police situation doesn't happen or I mean at least I guess, makes it harder?
Joe Carrigan: Yeah. That is-that's an excellent question. But apparently in this case, no.
Dave Bittner: Yeah.
Joe Carrigan: These were the guys running the scam. And I mean, as indicated by the fact that they got that 25,000 dollars back from one of them.
Dave Bittner: That's great. You know, this reminds me, this is not my story today, but it reminds me of something I saw just earlier today in our local community Joe, where somebody in one of the like Facebook Marketplace groups, was selling a laptop and someone contacted them. They agreed on a price, agreed to meet in a public place. They met, you know, everything felt safe. The person who was buying the laptop counted out all of the cash, put it in an envelope, handed the envelope to the person, person handed him the laptop. They went their separate ways. The person with the laptop opened the envelope and was it was full of just paper scraps. So, the person who was buying the laptop had used some kind of sleight of hand to make it appear as though they were handing them the envelope full of cash, but it was actually not full of cash.
Joe Carrigan: Really?!
Dave Bittner: Yeah.
Joe Carrigan: Like a magic trick.
Dave Bittner: Exactly. Exactly.
Maria Varmazis: That takes some actual skill.
Joe Carrigan: Yeah.
Dave Bittner: Right. Right.
Maria Varmazis: I'm almost impressed.
Dave Bittner: Yeah.
Joe Carrigan: I'm almost impressed, exactly.
Dave Bittner: Yeah.
Joe Carrigan: The sentence I was going to say, I am almost impressed. If it weren't for the fact that you were cheating somebody out of a laptop, I would be impressed.
Dave Bittner: Yeah. I always wondered like if you're a really good sleight of hand magician, does that mean that you never have to pay for a candy bar?
Joe Carrigan: That's an excellent question. I've only ever learned sleight of hand for card tricks.
Dave Bittner: Yeah.
Joe Carrigan: So.
Dave Bittner: Yeah.
Joe Carrigan: So, I did dabble a little bit in magic when I was in college.
Dave Bittner: Uh-huh.
Joe Carrigan: Did not impress the ladies like I thought it would.
Maria Varmazis: Joe, I hate to say it, but the moment you said you dabbled in magic, the thought that came to mind was that is not a surprise. That's [laughter].
Dave Bittner: Yeah.
Maria Varmazis: Yep.
Dave Bittner: Okay, everybody. Listen, we're going to pause the party here for a second while Joe.
Joe Carrigan: Show [inaudible 00:14:01] the magnificent.
Maria Varmazis: Oh, no!
Dave Bittner: Nice cape Joe.
Joe Carrigan: Yeah, you like the top hat too? Yeah?
Dave Bittner: Right. Except you don't have a rabbit. You have a chicken.
Joe Carrigan: Yes. Watch me pull a chicken out of my hat.
Dave Bittner: Right, yeah.
Maria Varmazis: Which chicken?
Joe Carrigan: No. It's going to be snuggle bug every time.
Maria Varmazis: No, and see you got the answer right there.
Joe Carrigan: Right, right.
Maria Varmazis: Yep. You thought about it.
Dave Bittner: Snuggle bug, this is a chicken who plays along.
Joe Carrigan: Yeah.
Dave Bittner: Right?
Joe Carrigan: My favorite thing is if you can do a card trick with any deck of cards.
Dave Bittner: Um-hmm.
Joe Carrigan: You know, they are of course all these gimmicked out cards that you can-that you can get and there is-I have a bunch of these tricks I was like, "Oh, these are pretty cool." But they're all pretty, you know, if you think about them for half a second, it's some of them are good, but most of them are kind of lame.
Dave Bittner: Yeah.
Joe Carrigan: But, the card-the thing you can do with any card deck, I mean I'll tell you, I was doing this story for, or this trick for one of the kids in our friend group.
Dave Bittner: Um-hmm.
Joe Carrigan: And like halfway through the trick it-you're supposed to make it look like you've messed up and this kid is like, "Do you need me to show you how to do the card trick?" Right? And I'm like "Yeah, maybe. Hold on, let me try something else."
Dave Bittner: Oh, no.
Joe Carrigan: Right? And that's actually part of the trick. You know.
Dave Bittner: Yeah.
Joe Carrigan: What's going on.
Dave Bittner: Okay.
Joe Carrigan: And then at the end, when I've shown like a bunch of different cards and I slide his card across and I say, "But this!" And I had like 4 clubs, "That's your card right?" And he looks at me like shocked and he turns it over and there it is. And he's like, "How did that even get there?!" It's really good trick. It's the only one I know right now.
Dave Bittner: Okay. Well, you can practice it for the chickens.
Joe Carrigan: Yes.
Maria Varmazis: They'll be very impressed.
Dave Bittner: Yeah.
Maria Varmazis: Yeah.
Dave Bittner: Alright, we will have a link to both of Joe's stories in the show notes. My story actually comes from the Wall Street Journal and this is about a man who got caught up in a travel scam, and it ended up costing him over 12,000 dollars.
Maria Varmazis: Ooh.
Dave Bittner: So, it was a nice little cautionary tale. So, this is a man named David Calder who is a retired engineer, happens to be from our great state of Maryland. And he says he's a seasoned traveler. He's visited over 30 countries and he got caught up in a scam that started when he got what looked like a routine flight change email from Lufthansa-did I say that right? Luftansa?
Maria Varmazis: Lufthansa.
Joe Carrigan: Lufthansa.
Dave Bittner: Lufthansa. Lufthansa.
Joe Carrigan: Luf-thansa.
Dave Bittner: Yeah.
Maria Varmazis: Lufthansa.
Dave Bittner: So, the airline said that he had missed a connection to Budapest and he needed to rebook. And he couldn't get the link to work, so he did what lots of people do, he Googled the airline's customer service number.
Joe Carrigan: Um-hmm.
Dave Bittner: And he called them.
Joe Carrigan: Right.
Dave Bittner: And the person who answered sounded legit, they had his confirmation number, they found alternate flights on partner airlines. But they told him that he needed to pay more than 12,000 dollars upfront for the changes and there would be a refund coming later.
Maria Varmazis: Wow. Damn.
Dave Bittner: So.
Maria Varmazis: I think I'm walking home. I'm-12,000 dollars?
Joe Carrigan: Right, 12 grand.
Dave Bittner: Yeah.
Maria Varmazis: No way. I'll swim across the ocean. That's crazy.
Joe Carrigan: Right.
Dave Bittner: Right.
Joe Carrigan: I can take a cruise for that much money.
Dave Bittner: Well, he approved the charge and the scam unraveled the next day after additional fraudulent airline tickets appeared on his credit card.
Joe Carrigan: Um-hmm.
Dave Bittner: Only later did Lufthansa confirm the rebooking had been made through a third-party agency, not the airline itself. So, it sound.
Joe Carrigan: Weird.
Dave Bittner: Yeah, so it sounds to me like this could have-it seems to me like this was somebody who had access to the travel booking system.
Joe Carrigan: Right.
Dave Bittner: Which is not a very high bar.
Joe Carrigan: Yeah.
Dave Bittner: I know someone who used to run a travel agency and.
Maria Varmazis: Oh, remember those?
Dave Bittner: Yeah. Yeah.
Maria Varmazis: Yeah.
Dave Bittner: Not anymore. But you used to run a travel, you know, and they could print tickets right there in the office and they have-they could do all kinds of things. So, anyway the warning here is that, you know, a travel scam it doesn't look sloppy or obvious. Everything looked right to this person.
Maria Varmazis: Hmm.
Dave Bittner: And.
Joe Carrigan: How did he get the scammer's number from Google? Was that a fraudulent ad or?
Dave Bittner: Correct. Yes.
Joe Carrigan: Okay. Alright.
Maria Varmazis: Yeah.
Dave Bittner: So, he did a-he probably did a search for Lufthansa Customer Service.
Joe Carrigan: Um-hmm.
Dave Bittner: And an ad popped up with the phone number which he dialed.
Joe Carrigan: Right.
Dave Bittner: Which was a scam ad that connected him to the people pretending to be Lufthansa.
Joe Carrigan: Right.
Dave Bittner: But it seems like whoever they were somehow they had access to the travel system. They were able to do some things and then, but then they did a lot more than that [multiple speakers]. They had his credit card.
Maria Varmazis: Yeah.
Dave Bittner: Information.
Joe Carrigan: Wow!
Dave Bittner: And in the end, he says that this caused him months of disputes, police reports, and frustration with his bank. He says, "Never trust the first customer service number you find in a search result."
Joe Carrigan: Yep.
Dave Bittner: Go directly through the airline's app or official.
Maria Varmazis: Yeah.
Dave Bittner: Website every single time.
Maria Varmazis: Yep.
Dave Bittner: I, you know, I hadn't really thought about the app. That's.
Joe Carrigan: Right.
Dave Bittner: A good idea.
Joe Carrigan: Right.
Maria Varmazis: Yeah. I had resisted doing the app thing, because I hate that everything requires an app now.
Joe Carrigan: Yeah.
Maria Varmazis: Like I really, really hate it, but I will say, for airline travel, that is genuinely the best way to book or rebook, or get any customer service, like it-they want you to use the app first and I'm a convert now.
Dave Bittner: Okay.
Maria Varmazis: But yeah, I really didn't want to though. It just was like, Oh! I want my everything printed on paper. I don't want to deal with my phone, but genuinely the app is the way to go.
Dave Bittner: Yeah.
Joe Carrigan: When you fly domestically, Maria, what's your airline of choice?
Maria Varmazis: It depends on where I'm going to. It used to be JetBlue.
Joe Carrigan: Okay.
Maria Varmazis: Nowadays, it's a tossup between United and Delta.
Joe Carrigan: Okay.
Maria Varmazis: But again, I'm in the north east, so I don't have access to like a lot of the other-like Southwest barely exists up here.
Dave Bittner: Right.
Maria Varmazis: And I know a lot of people love Southwest, so.
Joe Carrigan: Yeah, BWI is a big Southwest airport, so.
Dave Bittner: Yeah.
Maria Varmazis: Yeah.
Joe Carrigan: I use a lot of Southwest.
Dave Bittner: Me too.
Joe Carrigan: Every time I see a plane flying over my house, Southwest.
Dave Bittner: Yeah. It's true.
Maria Varmazis: Yeah.
Dave Bittner: Alright, so obviously the lesson here as David Calder said, just be careful that when you make a phone call or try to get in touch with, in this case, an airline but really anybody that you're doing business with, you cannot trust what pops up in a Google search or a basically an online search. We've said over and over again, they are so commonly being gamed these days.
Joe Carrigan: Yeah.
Dave Bittner: You need to have a direct connection with them.
Joe Carrigan: I mean, we've talked before about American Express and using them as a credit card especially for travel, because it's generally more accepted for travel.
Dave Bittner: Right.
Joe Carrigan: Right? So, you know, and when you call and you say, "Hey, this was a scam and I got scammed out of 12 ground." They'll go, "Oh, okay."
Dave Bittner: Right.
Joe Carrigan: I'd like to know if this would have worked. I'd like to know what kind of credit card he used and.
Dave Bittner: Yeah.
Joe Carrigan: You know, what kind of evidence he had to present.
Dave Bittner: Yeah.
Joe Carrigan: Also, I wonder if there is some liability here on Google's part?
Dave Bittner: Yeah, you know, I was thinking the same thing. Like and I was wondering like, suppose I'm a billboard company, right, I sell billboards along the side of the road and somebody comes along and puts up an ad for a scam airline.
Joe Carrigan: Right.
Dave Bittner: Or, you know, puts up an ad for a real airline but with a scam number or a scam website, or whatever.
Joe Carrigan: Yeah.
Dave Bittner: As the billboard provider, am I in any way liable? Obviously, you know, billboard providers don't have Section 230 of the Communications Decency Act.
Joe Carrigan: Right.
Dave Bittner: Gives platform providers a lot of leeway.
Joe Carrigan: Yes.
Dave Bittner: But, yeah it's an interesting question.
Joe Carrigan: Yeah.
Maria Varmazis: What kind of due diligence [multiple speakers] they do?
Dave Bittner: Are we headed in that direction where.
Maria Varmazis: Yeah.
Dave Bittner: We could see some liability from, because it sure seems like they're not doing much.
Joe Carrigan: Right.
Dave Bittner: You know, they'll still tell you they're doing a lot and they'll float these huge numbers about all of the millions and millions of scams and fraud that they eliminate on the platforms, and I'm sure all of that's true.
Joe Carrigan: Yeah.
Dave Bittner: But, the fact that this still happens all the time means that they're not being very effective.
Joe Carrigan: It's like when you're talking population numbers, right? Like, you know, America has the most automotive deaths per-no, they say "America has the most automotive deaths in the world." The only the only one that has more than us is China, right?
Dave Bittner: Yeah.
Joe Carrigan: Well, okay that's because China has a billion people and America has 300 million people and nobody else and you're not looking at 400-what?
Maria Varmazis: We're-right, well over 400 million now.
Joe Carrigan: Are we now?
Maria Varmazis: Oh, yeah.
Dave Bittner: Oh, really?
Joe Carrigan: I'm going to have to look that up.
Maria Varmazis: Oh, yeah.
Joe Carrigan: Because I hadn't heard that.
Maria Varmazis: Let me double-check that, but U.S.
Dave Bittner: I was going to say, what popped into my mind was 330.
Joe Carrigan: Yeah. I was going to say 360.
Dave Bittner: Okay, well.
Joe Carrigan: Maria, [multiple speakers].
Maria Varmazis: Oh, am I bad. Sorry, I'm wrong, it's 350.
Joe Carrigan: Aw!
Maria Varmazis: I heard 400.
Joe Carrigan: I [laughter]. If you're rounding to the most significant digit, you're correct.
Dave Bittner: Tell you what; let's take a quick break to hear from our show sponsor. We'll be right back after this message. [ Music ] And we are back. Maria, it's your turn. What do you got for us?
Maria Varmazis: So, there is a scam going around that in my neck of the woods, and I'm sure it's going around a lot of necks of woods. This one is.
Joe Carrigan: Necks of woods?
Maria Varmazis: Necks of woods. This one is a.
Joe Carrigan: I want to thank you for properly pluralizing that.
Maria Varmazis: You were plugging attorneys general. Yes.
Joe Carrigan: Yes.
Maria Varmazis: You're welcome. Up here in Massachusetts in Springfield, Mass., WWLP at story via Emma McCorkindale, thank you Emma about a story coming from the Springfield Police Department of a potential scam call relating to a fake safety kit being marketed at parents of young children through a local elementary school. And I was just like, okay as a parent of a child in elementary school, I was very interested in this story. So, let me just start with first what the scam is. There is a mailer going out to parents of a local elementary school up here in Mass. that's got the school name right at the top of the mailer. So, it seems to be official and affiliated with the school. And either in the mailer or as a subsequent follow-up from this mailer, it's asking for the child's full name, address, birthdate, Social Security number, fingerprints, physical description, emergency contact, clear photographs, medical information, as well as any information about disabilities or mental illnesses. And the idea with this "Safety Kit" is that it's a service offering to help you collect all that really important information about your kid and hold on to it for you, so should every parent's worst nightmare occur and your child goes missing, the idea is that this information is already gathered for you, so it's handy in one spot and can be given to law enforcement quickly, because you will probably be too distraught to go around and gather that information yourself in those crucial moments when your kid has gone missing.
Joe Carrigan: Yes. Yes.
Maria Varmazis: And wow! And this even a free service. Isn't this wonderful?
Joe Carrigan: A free service?
Maria Varmazis: A free service that just wants literally all the information about your kid.
Joe Carrigan: To steal your child's identity or just trying to abduct them.
Maria Varmazis: Yeah. And there are also versions of this ploy going around that also encourage the use of an app-based version of this free service. Well, in addition to all that information I just mentioned, they'll also take your kid's biometrics like their fingerprints.
Dave Bittner: Oh, no.
Maria Varmazis: I know, I know. And so, you'll have it all in one handy spot. So, there is some tiny-tiny fine print on the bottom of this mailer that says that "this is actually a service provided by a life insurance company." And so, if you start reading about this mailer and similar ones over the years, apparently before the kit supposedly arrives, and I don't know if it actually ever does, there's apparently a Zoom call that you are setup to join and where they will introduce the kit to you and how you use it in case your kid goes missing. But also gosh, when you're thinking about it, funerals are really expensive aren't they?
Dave Bittner: Oh, man.
Maria Varmazis: Man if one you parents just dropped dead, who would provide for your child especially if they're missing I guess. Man, wouldn't life insurance just make so much sense, so if we could just get your banking and routing numbers to set that up, that would be super easy-peasy, so.
Dave Bittner: Wow.
Maria Varmazis: Yeah.
Joe Carrigan: It's an upsell for life insurance for the parents?
Maria Varmazis: Yeah.
Joe Carrigan: Uh!
Maria Varmazis: And funeral coverage and all that kind of stuff. So, this has been going on-so yeah, okay first so let-don't do this.
Joe Carrigan: Right.
Maria Varmazis: Do not-do not do this! Do not hand that information about your kid over to anybody. I don't care what mailer is coming home with your kids, do not do that. So, yeah that is-if you only remember one thing, don't.
Joe Carrigan: Right.
Dave Bittner: Well, let me just interrupt, because I remember when my kids were in elementary and middle school, there was a thing that was part of them getting their school pictures.
Maria Varmazis: Oh, I was going to get to that.
Dave Bittner: Okay, sorry.
Maria Varmazis: That's a different thing. No, no. I actually was going to mention that, because I have that here on my desk. I have my daughter's.
Dave Bittner: Okay.
Maria Varmazis: I'm a big fan of that. That's a different thing.
Dave Bittner: Proceed.
Maria Varmazis: Yeah, yeah I'm glad you know about that, because that is a different thing, but related. This specific scam I was very curious about this. So, I did a little sleuthing on the Internet. And I was seeing stories about this going back to 2019. A lot of them, the same life insurance company doing this flavor of scam and, of course, they say it's not a scam that it's a legitimate service that.
Joe Carrigan: Right.
Maria Varmazis: They're providing, okay whatever.
Joe Carrigan: Sure.
Maria Varmazis: Yeah. Sometimes they use door-to-door tactics. Sometimes they will often say that they are affiliated with local or state police and the police will go out their way to say, "No, they are not!" So, that is definitely not a thing. But in a lot of cases there is a mailer that actually goes home with the kids from school, because presumably someone presented this to a busy administrator and the administrator was like, "Well, who doesn't like child safety? So, yes we should send this to all the parents."
Joe Carrigan: Right.
Maria Varmazis: And they're not aware that this is putting it generously, lead generation for an insurance company.
Joe Carrigan: Right.
Maria Varmazis: And not actually a thing to keep your kids safe.
Dave Bittner: Yeah.
Maria Varmazis: And as I was looking into this scam, and again, there are videos and posts about this going back many, many years about it and people going, "I got scammed and this sucks. Don't let it happen to you." I saw a lot of astroturfed comments defending this and I'm pretty sure they were from the scamming company in question. One of them on a YouTube channel from a local news outlet reporting on this scam said, "The program is a national campaign at no cost to protect our children. How can you consider this a scam being called to get registered? I could understand if they're calling informing that there's a fee and asking for credit card information, but don't ruin something that's trying to do good especially for our youths."
Dave Bittner: Oh.
Joe Carrigan: Sounds like it came right out of the marketing department.
Maria Varmazis: I [laughter] something like. Yeah, it's totally legit because they're not asking for your credit card, right?
Joe Carrigan: Right.
Maria Varmazis: I mean.
Joe Carrigan: Just want your kid's information.
Dave Bittner: And a blood sample.
Maria Varmazis: All of your kid's info, but not your credit cards and that's what makes it legit. Oh, the gall-the absolute gall. Yeah, so if you feel and your family is a risk profile or in your world that this is a kid that you genuinely want to have together and your hands should the worst happen, you can do this yourself.
Joe Carrigan: Yep.
Maria Varmazis: And work directly with your local law enforcement to put this together, but this is 100% a DIY situation. There is no service you should be using for this.
Joe Carrigan: Correct.
Maria Varmazis: Because nobody should be having that information about your kid.
Joe Carrigan: I guarantee you they sell this information as soon as they get it.
Maria Varmazis: I think that is even generous, like I don't even want to know what they would do with it aside selling.
Joe Carrigan: Right, yeah.
Maria Varmazis: Like I think there's nothing good.
Dave Bittner: [Multiple speakers] Social Security number that has, you know.
Maria Varmazis: From a child?
Dave Bittner: No credit.
Maria Varmazis: Wow!
Dave Bittner: Yeah.
Joe Carrigan: Yeah.
Maria Varmazis: Yeah.
Dave Bittner: They can do all kinds of things.
Maria Varmazis: Cha-ching.
Dave Bittner: Right.
Maria Varmazis: Yeah, so the end note I want to mention Dave was the thing that you were talking about, which is a legitimate thing that I'm a big fan of. With my kids' yearly school photo there is a card that comes with it every year that I really appreciate. I'm not going to name the company name, because I feel like that's probably unnecessary. But all it does it has a clear photo of my kid that I can use to hand to law enforcement and then it reminds you to immediately call 9-1-1 and how to get in touch with the National Center for Missing and Exploited Children whom they have officially have partnered with and I did check that that is the case on both sides. So, it's an official partnership and it's on the up and up. And that is it. They're not asking for your money. They're not asking for your kid's Social.
Joe Carrigan: Right.
Dave Bittner: Yeah.
Maria Varmazis: It's literally "get in touch with your local law enforcement immediately. Reach out to the National Center for Missing and Exploited Children" and go from there, like that's it.
Joe Carrigan: Yeah. Time is of the essence.
Maria Varmazis: Yes. Yeah, so you don't want a third-party in the middle of that.
Joe Carrigan: I have a story about this, similar to this, my dad actually did put these together for my brother and myself when we were kids.
Maria Varmazis: Oh, did he?!
Joe Carrigan: Yeah, he actually took us down to the police station and has us fingerprinted.
Maria Varmazis: Yeah.
Joe Carrigan: And you know, he looked at us and said, "Probably should get some experience with this before they" [laughter]. "these two [inaudible 00:31:09] become adults. They should at least know what the fingerprinting at the police station is like."
Dave Bittner: Yeah.
Joe Carrigan: Never had to be fingerprinted by law enforcement after that, you know, never. But they gave him back the fingerprint cards and he had those. He may still have them. I don't know.
Maria Varmazis: Yeah.
Joe Carrigan: But, the funny story about this, is as my brother and I are walking into the police station, we see a bunch-it's like the police put out a public service announcement said, "Hey, come on get your kids fingerprinted. We'll give you the fingerprints you get and keep them on file. And that way if you kid goes missing we can-we'll ask for the fingerprints."
Dave Bittner: Right.
Maria Varmazis: Yeah.Yeah.
Joe Carrigan: But the-important was, you kept the fingerprints. You were responsible.
Maria Varmazis: Yes.
Joe Carrigan: For keeping them.
Maria Varmazis: Yep.
Joe Carrigan: Now, this is in Montgomery County, just one county south of here, and we're walking down the steps of the police station and I kind of nudge my brother and I go "Hey, come on with me." And there's like.
Maria Varmazis: Let's go rob a bank.
Joe Carrigan: No.
Maria Varmazis: No, okay.
Joe Carrigan: There's like 5 kids walking up and I go, "Oh, my fingers hurt so bad!" And my dad-and my brother starts doing the same thing, "Oh!" And my dad on the steps of the police station slaps back of both of us in the back of the head [laughter].
Dave Bittner: Oh, my gosh.
Joe Carrigan: He's like, "Knock that off!"
Maria Varmazis: Yeah.
Dave Bittner: Yeah.
Maria Varmazis: Yeah. It-listen, I glad your dad did that.
Joe Carrigan: Right.
Maria Varmazis: He felt that was an important thing to do and, again, that's the way to approach it if this is something you want to have done.
Joe Carrigan: Yeah, absolutely.
Maria Varmazis: Go to your local police and do it. Don't go through some other party.
Joe Carrigan: Yeah.
Dave Bittner: Yeah.
Joe Carrigan: And ignore any, you know, jackass kids coming out telling it hurt. It does not hurt.
Dave Bittner: We had those pictures, the ones from the school photo we would put on our refrigerator, you know, with magnets. And then one day I got a passport photo. So, I put my photo up next to the kids.
Maria Varmazis: He's [inaudible 00:32:54] missing.
Dave Bittner: Right. But my wife was like, "Why did you put your picture on the refrigerator next to the kids?" And I said, "In case I go missing."
Maria Varmazis: To remember me by!
Dave Bittner: Right. I said "so you can just hand it to the police and they'll know who to look for."
Joe Carrigan: Right.
Maria Varmazis: Yeah.
Dave Bittner: She-I don't know. She didn't think that was funny.
Joe Carrigan: Na.
Maria Varmazis: Well, I mean it's that or they're going to use a terrible picture of you from Facebook, so.
Joe Carrigan: Right.
Dave Bittner: Right.
Joe Carrigan: Maybe with a chicken on your shoulder.
Dave Bittner: That's true.
Maria Varmazis: But to be fair Joe, if you went missing you probably would have a chicken with you, I mean.
Joe Carrigan: Yeah, a good chance.
Maria Varmazis: Yeah.
Joe Carrigan: "Can I grab the chicken before you kidnap me?"
Dave Bittner: You wouldn't starve to death.
Joe Carrigan: Right.
Dave Bittner: I'm thinking eggs.
Joe Carrigan: Right.
Dave Bittner: Eggs.
Joe Carrigan: Eggs.
Dave Bittner: Eggs. Alright, we will have a link to that story in the show notes. Joe, Maria it is time for our Catch of the Day. [ Music ]
Joe Carrigan: Dave, our Catch of the Day comes from another subreddit, r/scammers and it begins.
Maria Varmazis: Oh, no!
Joe Carrigan: This-I love the.
Maria Varmazis: Oh, my god.
Joe Carrigan: Title of this. I'm going to read it.
Maria Varmazis: Oh, wow!
Joe Carrigan: "Hearken Brotheren! Behold how I did smite a worker of iniquity with the Word, and brought him unto great wrath.
Maria Varmazis: Amen!
Dave Bittner: Alright, so I'll tell you what. I'll be the scammer reaching out here in the grey and Joe since you seem to be enthused about this.
Joe Carrigan: Aw yes, I love the way this guy writes.
Dave Bittner: You can be the person in blue.
Joe Carrigan: Okay.
Dave Bittner: Alright? It goes-well, so it begins here. Hello, Dear Friend. How are you doing today? I pray this message meets you well.
Joe Carrigan: "Peace be onto thee stranger. What tidings does thou bring me on this day which the Lord have made?"
Dave Bittner: Amen! I bring great news. You have been selected randomly by the Global Relief Foundation to receive a blessing grant of 50,000 dollars. Kindly reply yes to claim your funds.
Maria Varmazis: Oh.
Joe Carrigan: "Verily, verily I say unto thee! The love of money is the root of all evil. Lay not up for yourselves treasure upon earth, wheremoth and rust could doth corrupt and where thieves break in and steal."
Dave Bittner: Sir, I do not understand. This really is a blessing from God. You just need to pay a small clearance fee of 50 dollars so the delivery agent can bring the cash to your door. Are you ready?
Joe Carrigan: What profits a man if he gain 50,000 dollars yet lose his soul to the delivery agent? Get thee behind me. What is it, something of.
Dave Bittner: Worker of an.
Maria Varmazis: Worker, yeah.
Joe Carrigan: Worker of iniquity!
Dave Bittner: What are you talking about? Who is iniquity? Sir, listen to me this is not a joke. Go to Walgreens right now and buy a 50 dollar Apple gift card and send me the picture of back.
Joe Carrigan: "Thou speakest as one of the foolish woman speaketh." Yes, son.
Maria Varmazis: What's with the sexism in this?! [ Multiple speakers ] What is going on?
Joe Carrigan: Shall I journey to the merchants to buy deceitful wears? Nay, my feet shall not walk in the counsel of the ungodly nor stand in the way of the Apple store.
Dave Bittner: Are you crazy? Stop talking like Shakespeare and listen. Do you want the 50,000 dollars or not? Just go get the card.
Maria Varmazis: It's King James you heathen, anyway.
Joe Carrigan: Yes. Jeez.
Maria Varmazis: Jeez.
Joe Carrigan: Not know your mediaeval literature? "He that hath ears to hear, let him hear. Thy tongue frame with deceit like a sharp razor." Wow unto thee for thou aren't wade in the balances and are found wanting of gift cards.
Dave Bittner: Listen to me you idiot. I'm trying to help you here. I have the money right here. Stop wasting my time and send the code.
Joe Carrigan: Thou are a stiff necked and rebellious generation, a wicked man, hardeneth. The face, the Lord shall smite thee with a madness and blindness and a frozen WhatsApp account.
Dave Bittner: Okay, FU man. You're crazy in the head. Burn in hell.
Joe Carrigan: "Yea, thou I walk through the valley of the shadow of death," I will fear no scammer. For thy rod and clearance fees comfort me not. "Depart from me, ye cursed, into the everlasting fire, prepared for the devil" and his telemarketers. I like that one.
Dave Bittner: Wow. End scene.
Joe Carrigan: That was from Matthew Chapter 25 isn't it?
Dave Bittner: I'll take your word for it.
Maria Varmazis: He's the [inaudible 00:37:46] the reader.
Joe Carrigan: Chapter and verse.
Dave Bittner: Alright, well yeah. I mean, that's a good way to deal with a scammer, just.
Joe Carrigan: Yes. I.
Dave Bittner: Hear them out.
Joe Carrigan: I think that I may-I may do this next time rather than getting Navel Johnson on the phone, they may get this character that I just created now.
Dave Bittner: Just, I love how exasperated the scammer was getting.
Joe Carrigan: Right?
Dave Bittner: Do we really have to go through this just-go get the gift card. Come on. Like, I don't want to do this dance with your right now. I'm sitting here in this bullpen. I got make a 100 calls an hour.
Joe Carrigan: Right.
Dave Bittner: You're ruining my average.
Maria Varmazis: Fire and brimstone, foghorn and leghorn going on there. It was just.
Joe Carrigan: Fire and brimstone, foghorn and leghorn.
Dave Bittner: Yeah. Alright, well that is our Catch of the Day and of course we'd love to hear from you if there's something you would like us to consider for the show. Please email us, it's hackinghumans@n2k.com. [ Music ] And that is our show brought to you by N2K CyberWire. We'd love to know what think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben, we're mixed by Elliott Peltzman and Tre Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe Carrigan!
Maria Varmazis: And I'm Maria Varmazis.
Dave Bittner: Thanks for listening. This idiot. [ Music ]
