Graduation day grifts
Dave Bittner: Hello, everyone, and welcome to the "Hacking Humans" podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner and joining me is Joe Carrigan. Hey, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: And our N2K colleague, Maria Varmazis, Maria.
Maria Varmazis: Hi, Dave, and hi, Joe.
Dave Bittner: We've got some good stories to share this week, but first, let's get into some follow-up here. Joe, what do we got?
Joe Carrigan: So, Ben wrote in, and he was following up on my story from a couple weeks ago about the rental scam.
Dave Bittner: Okay.
Joe Carrigan: He says, "Hi, folks, a long-time listener still loving the show," which is great.
Dave Bittner: Oh, okay. Thank you, Ben.
Joe Carrigan: "Following on Joe's rent-to-own story, where he -- when you asked" -- we all asked, why would a scammer go to the extent of getting the key combination and follow-up and so on? In other words, what happened was, initially, the scammer told the would-be tenant, the scammed tenant, just break the lockbox off the house, and you have my permission --
Dave Bittner: Right.
Joe Carrigan: -- but then he engaged with the property company to make it look like a showing. The property company sent the combo to the lockbox, and they opened up the house and moved in. The next day, they showed up, the property company showed up, and said, hey, you guys can't be here.
Dave Bittner: Right.
Joe Carrigan: It was -- they were a victim of a scam. Our question was, why do they go through all the trouble? Why not just take the money and run? Ben says that he was actually yelling in traffic, hoping that we would answer it, hoping that we'd hear it, and of course, we didn't, Ben. I'm sorry. You've got to yell louder, buddy.
Dave Bittner: Yeah.
Joe Carrigan: Ben makes a very good point here. He says, "Assuming no one shows up to claim their property, that family would have stayed in there for a month or maybe two or three or more. Each month means rent money is coming in." In other words, investing five minutes, the scammer, to get the lockbox code, has the potential of having repeat income, which I think is a brilliant observation.
Dave Bittner: So the people who got --
Maria Varmazis: Passive income for a scammer.
Joe Carrigan: Right.
Dave Bittner: So the people who got scammed and moved into the house, if they go unnoticed, they're going to keep paying rent to the scammer --
Joe Carrigan: Right.
Dave Bittner: -- up until the moment the actual owners of the house realize someone's squatted in their house?
Joe Carrigan: Yes.
Dave Bittner: Interesting.
Joe Carrigan: Yeah. and I think that's a good observation and probably the exact motivation.
Dave Bittner: Yeah,
Joe Carrigan: Because you know what scammers want -- more money.
Dave Bittner: You know, my grandfather --
Maria Varmazis: I have that in common with them.
Dave Bittner: My grandfather bought a piece of land one time that had a house on it and there were some squatters living in the house when he bought the land. He made a deal with them that they could stay as long as they helped clear the land. The land was totally overgrown. In fact, when he bought the land, there was a barn on the land that he did not know that was there until months after he --
Joe Carrigan: Really?
Dave Bittner: Yeah --
Joe Carrigan: Wow.
Dave Bittner: -- it was so overgrown.
Joe Carrigan: Wow.
Dave Bittner: Then and there was a -- it was a family, you know, a man, woman, and a child, and they were, like, squatting in this little house. Then one day they were gone. They moved on, so -- but up until that, they were pleasant and helped and worked around, and then they were just gone, and that's the way it went.
Joe Carrigan: Huh, weird.
Dave Bittner: Yeah. Yeah.
Joe Carrigan: I mean, probably not weird, probably fairly common, you know, weird to me.
Dave Bittner: Yeah, well, you just never know.
Joe Carrigan: Yeah.
Dave Bittner: All right. We've got another bit of follow-up here, Joe.
Joe Carrigan: Yes. This this one comes from Sue. If you recall, this is a chicken update --
Maria Varmazis: Oh, okay.
Dave Bittner: I just want to preface this by saying, listeners, we hear you. We know there are some of you who are enthusiastic about our chicken updates and there are others who are not, so we're going to go through this quickly.
Joe Carrigan: Okay. I was having a problem with the chickens not going into the coop at night. They're sitting on top of an old run inside.
Dave Bittner: Right.
Joe Carrigan: Sue says, "Why do chickens roost up high? They're programmed to perch high because they're trying to evade ground predators." "Chooks," as she calls them, because she's Australian, "typically do not fly direct to their perch. Instead, they tend to make small hops from one branch up to another to achieve the elevation. They will fly if frightened or if they know they can achieve better food by flying over a fence. I've also seen them fly to keep up with the flock, like one chicken suddenly realizes she's alone and she will fly across the yard to get with the other chickens."
Dave Bittner: Okay.
Joe Carrigan: That's when you're free ranging. "Have you put an object near the coop which the chicks can utilize as a steppingstone to get on the roof of" -- actually, it's not the coop, it's a run, a little run inside the big run. "If the answer is no to this question, you will need to clip their wings. This reduces their flying ability and reduces their wing size temporarily." Sue was kind enough to send along pictures of exactly how to do this in the email you forwarded to me, Dave, so we have -- they don't necessarily fly up to this thing, they are capable of going from the ground directly to the roof of this little run and sitting there. The top of the run is higher than the door to the coop, so I think my next step here is, actually, the next step is -- my wife is not happy with the design -- with the way the coop is -- and the run have turned out. She says it does not look bougie enough for her.
Dave Bittner: Oh.
Joe Carrigan: Well, hu-hu-haugh.
Dave Bittner: Yes.
Maria Varmazis: Bougie chicken run, okay.
Joe Carrigan: She does want a bougie chicken habitat, so we're going to begin working, retooling it and working on it, and one of the things we're going to do is put swings in there for them, but I'm going to try to put them away from the door to the coop.
Dave Bittner: Okay.
Maria Varmazis: You -- swings?
Joe Carrigan: Oh, chickens love swings, yeah.
Dave Bittner: She's building a little chicken Taj Mahal.
Joe Carrigan: Right. It's really just a 2 x 4 and a couple of ropes, Maria. It's nothing fancy.
Maria Varmazis: Okay.
Joe Carrigan: Chickens are pretty easy to impress.
Maria Varmazis: Same, but yeah, I also like swings, so I guess I'm just a chicken.
Joe Carrigan: Yeah, yeah.
Maria Varmazis: Okay. All right. We have a lot in common.
Joe Carrigan: Yeah, so thank you, Sue. I'm also probably just going to take this run out, this little run out soon.
Dave Bittner: Now are you starting over with your new bougie coop or are you going to just update/upgrade the one you have?
Joe Carrigan: I'm going to upgrade the run that I have, probably leave most of it in place. The roof is not -- it doesn't look great.
Dave Bittner: Oh, I see.
Joe Carrigan: It's going to have to come off and we're going to -- my wife and I, tonight we're actually sitting down, we've been meaning to do this for like a week. We're going to sit down, and we're going to draw out what we want.
Dave Bittner: Yeah.
Joe Carrigan: My wife is -- really wants me to just go out and spend. She found a good-looking coop for about $1,800 and she says, "You should just buy this. It meets your needs, and you'll save all the time." I'm like, yeah, but then I still have to do the roof again.
Dave Bittner: Yeah.
Joe Carrigan: She's like, oh, yes, you have to redo the roof.
Dave Bittner: And you are a notorious tightwad.
Joe Carrigan: I am a notorious tightwad, and I'm also pretty handy, you know, so I could build a coop.
Dave Bittner: Well, what does she think about your handy -- I mean, obviously, she's not, you know --
Joe Carrigan: She doesn't like the --
Dave Bittner: She doesn't like version one.
Joe Carrigan: Right. Well, it came out --
Dave Bittner: It's the beta.
Joe Carrigan: -- exactly as I thought it would, and I was like, hey, that looks pretty good. She's, like, no, it doesn't.
Maria Varmazis: "It came out exactly like I thought it would" feels like damned by fate praise right there. [Laughter]
Joe Carrigan: Right, like Homer Simpson's car.
Dave Bittner: Right. [ Laughter ] All right.
Maria Varmazis: It's a structure made of 2 x 4s. What else do you possibly want?
Joe Carrigan: Right, that's exactly right.
Dave Bittner: All right. You know, maybe you get -- maybe you get ChatGPT to design your new chicken coop.
Joe Carrigan: Yep, I --
Dave Bittner: You just put in your specifications, and your wife can just keep saying, "No, bougier. No, bougier."
Joe Carrigan: You joke, Dave, but that is exactly what she has done just with Gemini instead of ChatGPT. She has done that. She was, "What would this look like if Joe painted this? I mean, I don't paint it, period. I don't do paint. I'm not a painter. You're the painter. I'm not the painter.
Dave Bittner: So, yeah, so the question is, ultimately, is your own efforts going to exceed the $1,800 that you would spend on the store-bought pre-fab?
Maria Varmazis: Indubitably.
Joe Carrigan: Yeah, and actually, I'm only looking at the delta of, you know, would my efforts exceed the delta between the material cost and the $1,800?
Dave Bittner: Right.
Joe Carrigan: There's probably going to be like $600 in materials.
Maria Varmazis: The labor is free.
Joe Carrigan: Right, the labor is free.
Maria Varmazis: Or worthless, depending on how you want to look at it.
Joe Carrigan: That's right. [ Music ]
Dave Bittner: All right. Tell you what. Let's take a quick break to hear from our sponsors. When we come back, we will dive into our stories. Stick around. [ Music ] And we are back. Maria, why don't you kick things off for us here today? What do you got?
Maria Varmazis: Oh, yeah, so let's take a page from our "Scammer Liturgical Calendar." Let's flip back through. As of the time of this recording, we are in the thick of college graduation season.
Dave Bittner: Yes.
Maria Varmazis: So yes, commencements a-go-go.
Joe Carrigan: My daughter just graduated a couple of weeks ago.
Maria Varmazis: Well, congratulations. That's a wonderful, a wonderful milestone.
Joe Carrigan: She is now a Charger, just like I am. She graduated from Capital Technology University.
Dave Bittner: Okay.
Maria Varmazis: Okay. I thought you meant like she was charging phones. I was confused. Oh, that's -- okay. You meant like a horse.
Dave Bittner: Trying to breach a wall or a moat.
Joe Carrigan: Well, I'm a big fan of CTU, but the Charger is a play on words because it is a big -- I mean, it is a hardcore engineering school, and their colors are black and red representing the colors of the poles of the electronic power supply.
Dave Bittner: Sure.
Maria Varmazis: Yeah.
Joe Carrigan: Right? They started off as a radio repair school for the Navy, and they have bloomed into a full-blown technical college. They have remote classes. I cannot -- you know, I -- I'm an alumni, so I'm a big fan of the school, but it's really a good school.
Dave Bittner: All right.
Maria Varmazis: Right, so and then, is there a team of people who dress in green who are very well-grounded?
Joe Carrigan: No, but that's funny. [ Laughter ]
Maria Varmazis: Thank you. Thank you. [ Laughter ]
Joe Carrigan: That's really good. [ Laughter ]
Dave Bittner: I mean, there's an opportunity if they ever build frat houses, right?
Joe Carrigan: Right.
Dave Bittner: Just imagine, like, the rivalries.
Maria Varmazis: Or maybe it's just going to be a copper wire --
Dave Bittner: Yeah, the rivalries, the hot, the cold, the neutral.
Joe Carrigan: Right.
Dave Bittner: Yeah.
Maria Varmazis: Sorry. I had to go for it. Glad I did. Okay, so --
Dave Bittner: All right. Moving on. Go ahead, Maria, so your story.
Maria Varmazis: So, yes, Scammer Liturgical Calendar Season for college grads, and there are classic scams that go after these newly minted young adults who are now, you know, like baby deer wandering out on their wobbly legs into the world and going, blink, blink. "Wow, what is all this?"
Joe Carrigan: Right. They're about to have their spirits crushed.
Maria Varmazis: Yes. The real world's about to get real gross, and so there are three scams that tend to rear their ugly heads, especially towards this time of year and targeting young adults who are, it's worth reminding, no less susceptible to scams than any other group. So yes, it's always worth mentioning that. The first one, this is very pertinent to us, the United States, are student loan scams, because we make our students pay out the nose for school. Victims will receive a call, email, or text claiming that they qualify for loan forgiveness, lower monthly payments on their student loans, or full-on debt relief programs. As you might imagine, the goal of all these kinds of things is to get financial information out of the victim, Social Security numbers, banking info, and of course, a fee that they will try to levy, an upfront processing fee. There are some interesting, and I say "interesting" in a bad way, interesting flavors of this scam that can also be an unpaid tuition scam where it doesn't just target the student, but also, potentially, their family members, so maybe not even a person who is on the hook for the loan, but just someone who just gets a call saying that the degree for the young adult in question will be revoked immediately if payment isn't received right the heck now for the tuition that was unpaid. So can you imagine, like you just went to your niece's or nephew's or the graduation ceremony and then, like, a week later you get a call saying you must repay the tuition that they didn't pay or now they have no degree. I mean, that's crazy.
Dave Bittner: I had something like that happen for real.
Maria Varmazis: What?
Dave Bittner: Yeah.
Maria Varmazis: Like, a scam or actually unpaid tuition?
Dave Bittner: No, no, it wasn't unpaid tuition, but it was -- so so I went to a state school and a four-year college for my bachelor's degree, which is the only degree I have. Before you go in for your final semester, they bring you in to review and make sure that you're on track and that everything's as it should be and that you're going to graduate on time. So I went through all that, finished up my final semester, walked across the stage, and they handed me a poster because they don't actually hand you the diploma. They send that to you later, I suspect after they verify that all the payments have been made, right?
Maria Varmazis: Yeah.
Dave Bittner: I do all that. I'm back home. I'm looking for work, and I get a letter that says, hey, we don't think you fulfilled your requirements for your degree. Please come in.
Maria Varmazis: But you got a letter?
Dave Bittner: Got a letter --
Maria Varmazis: You got a letter. You didn't get a phone call?
Joe Carrigan: And they told you to come to the university?
Dave Bittner: Told me to come to the university, so I called and made an appointment and I went. Of course, I'm both annoyed and nervous because I don't want to have to go through another semester or whatever. You know, I'm just --
Maria Varmazis: You're done with school at that point.
Dave Bittner: I am so done with school.
Maria Varmazis: So done, yeah, yep.
Dave Bittner: I was so ready to move on.
Joe Carrigan: So done, you've never gone back.
Dave Bittner: That's right, so I go down there and I meet with the person, and a very nice woman says, well, what about this credit here? This credit doesn't go to that, and I said, well, I didn't -- wasn't using it for that. I was using it for this. I was using this for that, and she said, "Oh, that makes sense. Okay. We're good. Thank you." That was it, sent me back home.
Maria Varmazis: This could have been an email or a phone call back then.
Dave Bittner: Right.
Maria Varmazis: Wow.
Joe Carrigan: I have a friend who had a very similar experience at another school. He went in to apply for graduation and they were -- they said, you need one more class to graduate. He's like, no, my advisor tells me -- and the guy grabs the student handbook and, like, the back -- the spine of the book is broken to one page and he just flops it open to that page and there's one sentence highlighted on it and he slides it across to my buddy and the sentence says, "Ultimately, the student is responsible for assuring he has met all graduation requirements." '
Maria Varmazis: Oh, no.
Joe Carrigan: He was, like, I have to go for one more semester for one class, and he was furious.
Maria Varmazis: Oh, that sucks. That really sucks.
Dave Bittner: All right. Back on track, Maria.
Maria Varmazis: Yeah, no, I'm enjoying hearing these stories. Yeah, but, all right, Dave, you got a phone call, and that's pretty crucial that -- no, you got a letter, right?
Dave Bittner: Got a letter, yep, yep, yep.
Maria Varmazis: You got a letter, and that's pretty crucial because that is the way one should expect to get this kind of communication. Even nowadays, as we've often said, you do not trust an inbound phone call about any of this kind of thing. All these scams have that urgency and, you know, that terrible threat in one of these cases about you won't have your degree anymore. We're going to revoke it. I mean, that's pretty terrible, pretty awful threats right there, so those are all classic scam tactics. Definitely hang up if you get a call like this, and if you're genuinely worried about it, you can reach out to the school. I'm sure they will happily take more of your money if it's being offered.
Joe Carrigan: Right.
Maria Varmazis: So, yeah, and similar situation with legitimate loan servicers are going to contact you through official channels. Again, that's usually the mail, and something I didn't know because I didn't apply for federal loans when I was in college way back when is that a lot of them do not require repayment to begin until six months after you graduate. If you're getting a call like a week after you graduate, most likely that's definitely -- I mean, as we've been saying, don't trust an inbound, but you -- apparently, there's a bit of a grace period there. So yeah, didn't -- I did not know that because it's been a long time for me. I might have known that back when I was in college, but I've certainly forgotten that information.
Joe Carrigan: Yep.
Maria Varmazis: Anyway, so those are our student loan and tuition scams. A second one affects new college grads, especially because they're looking for jobs, so fake job scams are abound right now, and they've -- they haven't gone away. There's just even more of them, especially right now, targeting people who are entering the job market for entry-level jobs. A lot of listings will be absolutely too good to be true. High-paying remote jobs for entry level positions requiring what they describe as little experience, which is the definition of an entry level job in theory, but also like with flexible schedules and amazing bennies, and if you actually try to go for this kind of job, the interview will be suspiciously short, although if this is your first time entering the job market, you might not know what a short interview seems like. They'll offer you a job on the spot and all they need is just a little bit of banking information or even an upfront payment to, you know, get your equipment going or something you've got to pay for up there. Of course, that is the scam, and if you've never been through the process of getting a job before, you might not be able to spot that right away. They're definitely banking on your inexperience there, and then there's a twofer version of this scam where sometimes in addition to asking victims to pay up front for some sort of equipment, they'll also give you a bad check, and they'll ask you to send back the extra. It's a check cashing scheme on top of everything else, which is like, well, they're just piling the schemes upon schemes upon schemes on these poor young adults who just may not know what's going on. Then a third scam that we see all the time, but again, it's going to hit young people especially hard right now, are rental scams. In highly competitive hot rental markets year round, this is always a problem, but it's especially tough if you've just graduated and you're going, I need a place to live or I just got a job across the country and I just need a place to live at while I'm getting settled, you can't exactly scout the market before you get there. People are trying to get a rental remotely and they're, you know, looking at these rentals with these great prices and the photos look totally legit and -- because they are. The criminals are reposting legit property listings and reposting them at like stupid low prices. Then the way the scam works is the victim is told you've got to send a upfront first month last month deposit or some other thing before you can see the property. Then that deposit never makes its way back to you because the whole thing is a scam. These are just -- these scams are always around, but they tend to get especially worse right around now, and it just, the scammers know that this is an exciting but very stressful time of life for young adults. They have a lot of inexperience and a lot of enthusiasm. So, you know, they're going for it, but they don't necessarily have the life skills and experience yet to know that some of this stuff is a scam. So yeah, so just remember --
Dave Bittner: It's easy to get caught up in the excitement, right?
Joe Carrigan: Yeah, it is.
Maria Varmazis: Yeah.
Dave Bittner: You're just -- you're ready to start your life. You've got -- you know, you're done with school and here it's time for the next phase. Let's go.
Maria Varmazis: Let's frickin' go, yeah, exactly, so just -- it is always good to remember, although no one wants to be nagged at that age, or any age, that as a young person, you're not immune to scams. You know, maybe you run some stuff by a person with a little more life experience if you're not sure but always be wary. Be wary and be careful.
Joe Carrigan: Indeed.
Dave Bittner: All right. Well, we will have links to that story in the show notes. Joe, you're up next. What do you got for us this week?
Joe Carrigan: Dave, I have a glimmer of hope. That's what I have. [ Laughter ] But mind you, it's just a glimmer.
Maria Varmazis: That's not allowed. [ Laughter ]
Joe Carrigan: This comes from WRAL out of Raleigh, North Carolina, and it's actually an AP story put together by Erika Kinetz and Juliet Linderman, and it is talking about the Joint Economic Committee out of the US legislative branch of government. When it's joint, it comes from both houses of Congress.
Dave Bittner: Okay.
Joe Carrigan: There's representatives and senators on here, and they are talking about the level of tech scams that go on. Here is a statement that was released from Representative David Schweikert and Maggie Hassan. They are -- Schweikert is a Republican from Arizona, a representative, and Senator Hassan is from -- is a Democrat from New Hampshire. Customers need to be able to trust the calls and texts they receive from their doctor's office or their child's school, for example, are authentic. Scam communications, however, are increasingly difficult to distinguish from legitimate messages and too much of the burden is falling on customers, so they have wrote a detailed request to AT&T, Verizon, and T-Mobile, so they're trying to get more information. They're seeking information on these companies' efforts to collect data, monitor for scams and cybercrime, and take action against bad actors, right? Nothing's really happening right now, but this could be the beginning of something. Their scrutiny, they say, comes from a lot of concern in Washington after the explosion of scams targeting US citizens. They are also looking at not just the telecoms, but they're also looking at like Starlink satellite services, online dating sites, artificial intelligence companies, data brokers, and a range of federal agencies, and they're asking them about their roles and responsibilities and responses to cybercrimes. Back in 2019, the Congress passed, and the President signed into law, the TRACED Act, which, obviously, came from the Department of Acronyms because TRACED is all capitalized and I don't know what TRACED means. It gave the -- Congress and the FCC, the Federal Communications Commission, require large carriers now to implement some kind of authenticity behind caller ID and also make it easier for law enforcement to identify bad actors. However, despite passing what I'm sure is a great law that adequately addresses the problem -- okay, that was a little bit of sarcasm. It's still a problem.
Dave Bittner: Wait for laughter.
Joe Carrigan: Well, I was waiting for laughter. [ Laughter ] Crickets. Wireless providers last year or in 2024, rather, blocked 25 -- or 55 billion scam and robotext calls. They were able to flag or block 45 billion scam calls per year, according to an industry group that follows this kind of stuff, but unwanted messages are still able to break through. In fact, YouMail, I've talked about YouMail before, they said that Americans received more than 50 billion, with a B, robocalls in 2025, and another company called RoboKiller, which works on spam messages, text messages, said that those messages have reached peaks of 19 billion a month. How many people are in the United States? We said this last week, 350 million, so this is, like, two orders of magnitude larger than that. There are some people out there getting more than 100 of these every month.
Maria Varmazis: I'm probably one of those. Honestly, I get so many. It's ridiculous. I have RoboKiller, just I had to get one of these damn apps and pay for it. It's just -- it's just it's unreal, and yeah, I'm looking at the $55 billion -- 55 billion spam blocked, and that's only half. [Laughter] Looking at what you just said here, that, you know, we received 50 billion calls, but they blocked 55 billion, so we're blocking half of them --
Joe Carrigan: Right.
Maria Varmazis: -- which does not seem like even close to enough.
Joe Carrigan: Right, and I think that YouMail number of 50 billion in 2025 is just from their customers. That's just the calls that Robo- -- that YouMail blocked in in 2025, so that -- I don't have YouMail. Dave, do you have YouMail?
Dave Bittner: No.
Joe Carrigan: Maria, do you have YouMail?
Maria Varmazis: I do not.
Joe Carrigan: Okay. That's a small -- safe to say that's a small section of the American economy that has YouMail, which looks like it might be worth it, and they blocked 50 billion robocalls. So yeah, this is not going as well as it had hoped. Now, I just looked at my spam and blocked messages, and going back, I received one yesterday, one on the 11th, one back in March. Claim my free box -- ooo, DVD box set. What's this about? I'm not going to look at it.
Maria Varmazis: Yeah --
Joe Carrigan: Yeah, too late.
Maria Varmazis: Potential spam, potential spam, potential spam, yeah, I'm looking at mine. It's a similar situation.
Joe Carrigan: Of course, here's one of my favorite parts in this article. Some telecoms see this as a profit opportunity, right? Charging premium -- charging for premium blocking services. Hey, wouldn't it suck if this thing just led you getting scammed all the time? Why don't you give us 10 bucks a month and we'll stop that from happening? It'd be a shame. That's a nice phone you got there. It'd be a shame if something happened to it.
Maria Varmazis: I mean, I'm one of those suckers who's paying for a service like that just because I can't deal with it. I just cannot deal with the volume of crap that I keep getting at my phone. It just drives me nuts.
Joe Carrigan: Yeah, but you're paying for it from RoboKiller, right?
Maria Varmazis: Yeah.
Joe Carrigan: I mean, that's a third-party company. These telecoms are actually doing this. I mean, you're the main infrastructure where the problem exists. This is not --
Maria Varmazis: Me personally?
Joe Carrigan: No, no, not you, telecoms.
Maria Varmazis: [Laughing] Oh, okay, gotcha, gotcha.
Joe Carrigan: This is your infrastructure. This is your problem. Don't charge me to make it my problem because what are you going to do? You're probably just going to turn around and buy subscriptions for $5 a month from someone like RoboKiller and tell me, go install the RoboKiller app. Well, I'd rather just give $10 a month to RoboKiller than pay my carrier again. That just makes me angry. This is from a consumer advocate, Eden Iscil, who is a Senior Policy Manager at the National Consumer League. "Companies will not go far enough until they actually feel some type of liability," which I agree with 100%. "Some financial incentive really pushes them to go as far as they can to protect consumers," so if we make them liable for something, is what this is saying, then they'll start paying attention and go, okay, maybe we won't charge a premium fee for this. We'll just go ahead and start implementing the technology that can block this, these kind of messages.
Dave Bittner: Yeah, a couple of things. I, too, paid for RoboKiller for several years and was a satisfied customer. There came a point where the built-in capabilities of my iPhone got good enough that I let my RoboKiller subscription lapse. I've been happy with that so far, but I can concur with Maria that it was a good product while I was using it. It did what it said it was going to do, and for me at that time, it was totally worth it.
Joe Carrigan: Right.
Dave Bittner: Yeah, yep.
Joe Carrigan: I'm pretty impressed with the Google solution. I get notified that I'm getting a potential spam call, and maybe it's from my carrier. I don't know, but the text messages, I just had to go looking for my text message, the scam, the spam, scam spam text messages. I don't get very many of them, it seems, but when I do get them, they go right there. I don't see them.
Dave Bittner: The only other thing I'll add that I think is important, because we talked about this legislation over on the CyberWire a few days ago, probably a week ago or so, and one of the potential outcomes of this is that it could make it so that burner phones are illegal in the US.
Maria Varmazis: Right, yep, because it's basically a know-your-customer kind of thing.
Joe Carrigan: Yep.
Dave Bittner: So you might not be able to just go buy a burner phone, and not everyone's okay with that --
Joe Carrigan: Yeah, I'm not okay with that.
Dave Bittner: -- because there are situations where you want to be anonymous and still be able to use a phone.
Maria Varmazis: Right. Oh, absolutely, yeah, domestic violence victims, this is a big deal for them.
Dave Bittner: Exactly. Exactly.
Maria Varmazis: Yep.
Dave Bittner: That's some of the pushback against this bill, so hopefully, they'll figure out a way to meet in the middle, and maybe everybody will still get what they need. But, yeah, no question that this spam thing just doesn't seem to matter. They always seem to find a way around it, so maybe someday we'll see some teeth.
Joe Carrigan: Yeah, maybe.
Dave Bittner: Yeah.
Joe Carrigan: That's why I said, "a glimmer of hope."
Dave Bittner: Right, right.
Joe Carrigan: I'm not telling anybody here to get your hopes up.
Dave Bittner: Yeah, we've been through this before.
Maria Varmazis: Yeah, we've been burned. Yeah, and that's depressing. We can't just fix this?
Dave Bittner: We will have a link to this story in the show notes. Let's take a quick break here to hear from our sponsor. We'll be right back after this message. [ Music ] All right. We are back, and my story this week, this comes from the folks over at BleepingComputer, and that's some good news here, I think, and Joe, I will defer to you for some of the details as our resident Android user --
Joe Carrigan: Okay.
Dave Bittner: -- but it looks like there's some nice features coming in an upcoming version of Android that's going to expand banking scam call and privacy protections.
Joe Carrigan: Ah!
Dave Bittner: Yeah.
Maria Varmazis: Wow.
Dave Bittner: All right. Right. So --
Maria Varmazis: Nice, Android, yeah.
Dave Bittner: -- they're putting some stuff -- a couple of things caught my eye here. They're putting capabilities into the operating system for banking apps to include a database of their actual phone numbers that the incoming calls can be checked against. For example, let's say you have First National Bank app on your phone. If a call comes in from First -- you know, saying that they're from First National Bank, the phone software on your phone that takes the calls can check with the bank software on your phone to say, is this actually your phone number, to know whether it's legit or not.
Joe Carrigan: That's pretty good.
Dave Bittner: Yeah.
Maria Varmazis: Wow.
Dave Bittner: Like, a step in the right direction, so another thing that they're adding is kind of a verification for apps to be able to access the accessibility settings on Android, because that's been a longtime, kind of, work around for the bad guys to be able to do stuff on Android phones. They could take advantage of some of the legit accessibility functionality and use that for bad things, like being able to put a screen up that hides whatever's behind it.
Joe Carrigan: Right.
Dave Bittner: That's part of accessibility functionality, and it has good use for people who need it, but the bad guys take advantage of it. What it seems like Google's trying to do here is make it so that you actually have to prove it, that you are worthy of having access to the accessibility functionality, so I thought that was interesting.
Joe Carrigan: That seems like a good plan. I don't know how this works under the hood, but yeah.
Dave Bittner: Yeah, and then, then they're doing -- say they're doing a better job with device unlocking and they're going to allow you to lock your phone with biometric authentication if you mark your phone as being lost. Instead of just needing a passcode or a pin to unlock the device, you can set it so that you actually need your biometrics to unlock it. That way, if somebody steals your phone and runs off to some faraway nation with it, it's no good to them. It's basically bricked unless they have your -- unless they cut off one of your fingers.
Joe Carrigan: Right.
Maria Varmazis: Well, then you've got bigger problems.
Dave Bittner: Right, exactly, the phone is the least of your problems. There's some other stuff they're adding here. They're putting, you know, post quantum cryptography for security and things like that. They're disabling 2G, so the old cell phone technology.
Joe Carrigan: That's good. That'll keep you out of stingray devices.
Dave Bittner: Right, fairly well, 2G, yeah, yeah.
Maria Varmazis: But there are also some places where it's literally the only connectivity you can get.
Dave Bittner: Right.
Maria Varmazis: All right. Well -- all right. The security is worth it, though. I get it.
Dave Bittner: Yeah, and they also said they're reducing the number of pin password guessing attempts that they allow, and then, they're increasing the delay between failed attempts, so just a bunch of little things to slow you down if you're a bad person trying to affect someone's phone. The main one that really caught my eye here was the stuff trying to, you know, go against the scammers with the banking apps. I think that's a -- yeah, that's an innovation that I think is quite smart.
Maria Varmazis: That is interesting.
Joe Carrigan: Yes.
Dave Bittner: We'll see how that rolls out, if it actually works, and, you know, maybe some of the other phone providers will do the same.
Joe Carrigan: Here's hoping.
Maria Varmazis: As often happens, Android will do it first and then later, the iPhone will try it out.
Joe Carrigan: That's right. That's right and pretend like it came from their own --
Maria Varmazis: That it was their idea. That's right.
Joe Carrigan: We have this great idea.
Maria Varmazis: That no one else has tried and we put a little "i" in front of it, so it's ours.
Dave Bittner: That's right. Put an "i" in front of it, and we charge twice as much and welcome. Welcome to Planet Macintosh.
Joe Carrigan: Yes.
Dave Bittner: All right. Well, I will have a link to that story in the show notes. If you are an Android user, it's a good article to check out because it lists all the things you can look forward to in the upcoming version of Android, and some are pretty good. I think it looks like a solid list of security updates.
Joe Carrigan: Good.
Dave Bittner: All right. Joe, Maria, it is time for our Catch of the Day. ( SOUNDBITE OF REELING IN FISHING LINE ) [ Music ]
Joe Carrigan: Dave, our Catch of the Day comes from Michael who sent this one in. It's a traffic violation scam, and I have to point out, Michael, 62% battery life. [ Laughter ]
Dave Bittner: There's no shame in 62% battery life.
Joe Carrigan: That's fine. That's good.
Dave Bittner: Anything above half, right?
Joe Carrigan: Yeah.
Maria Varmazis: Is it 100% or bust with you? I mean, what's the --
Joe Carrigan: No. No. Mine -- what's mine right now? Let's see. Mine's at 76, so --
Maria Varmazis: How dare you, sir? [ Laughter ]
Joe Carrigan: Michael also has his clock set to military time, which I do as well.
Maria Varmazis: Yep. Oh, okay. Well, also, the phone number the scam is coming from what area -- what country code is that?
Joe Carrigan: We're going to get there. You're reading ahead, Maria.
Maria Varmazis: Okay. Oh, sorry. Sorry, because I don't recognize that one. That's an interesting one.
Joe Carrigan: Yeah, I've got an interesting bit of background on this because I actually did some research on this one today.
Dave Bittner: All right. Well, shall I read it then?
Joe Carrigan: Yes, you should read it.
Dave Bittner: All right. It goes like this: "California Supreme Court. Traffic violation. Reminder. Officer: Linda Chen. Judge: Samuel Ross. Clerk: Stephanie Davis. Hearing scheduled May 5th, 2026, at 9:40 a.m. Your attendance is required to resolve outstanding traffic violations. Missing the hearing will result in a bench warrant, license suspension, and your vehicle being impounded with wage garnishment and asset forfeiture to follow. Pay online immediately at ca.gov-bfk.help.dmv. This notice is past due. Reply why to confirm receipt or pay now to avoid further legal issues."
Maria Varmazis: Wow.
Joe Carrigan: So that's -- it's obviously -- I mean, I don't think the California Supreme Court has time to deal with traffic violations.
Dave Bittner: Oh, that's a good point.
Joe Carrigan: Right? That's number one.
Dave Bittner: Right?
Maria Varmazis: A reminder to "violate traffic." I like that one, and that it's a traffic violation reminder, just in case you forgot.
Joe Carrigan: Right.
Maria Varmazis: Also, that your traffic violations are outstanding. They're truly outstanding.
Joe Carrigan: Right.
Maria Varmazis: I'm just -- I'm just making fun of the language for no reason. I'm just --
Joe Carrigan: Yes. Back to your point, Maria, about the -- oh, Michael says he was neither dumb enough nor -- he's curious, but not dumb enough or smart enough to click the link.
Maria Varmazis: Oh, click the link. No, don't, don't, don't, don't, don't do that.
Joe Carrigan: Michael notes this nice note. He says, "The Moroccans are now tied in with the California DMV."
Dave Bittner: Oh.
Joe Carrigan: So, Maria, to answer your question, that country code is Morocco.
Maria Varmazis: Wow.
Joe Carrigan: However --
Maria Varmazis: A little be a ways from California.
Joe Carrigan: -- but here's the thing. When I looked at it, I thought -- I saw Michael's comment. I'm like, wait, isn't that the area code for LA, 212?
Maria Varmazis: No, that's New York.
Joe Carrigan: It is New York. It's Manhattan. Right, I got my wires crossed. I knew they were very close together, but no, it's 213 for LA, so it's very close to the LA area code, and maybe somebody makes the same mistake I did, but the weirdness of this telephone number with the spaces in it, you know, it's the code for Morocco, then a space, then a number, then a space, then it's just two-digit numbers for the rest of the way. That's the way Moroccan phone numbers are laid out, so if you Google Moroccan phone number format, you will see it says "+212," and then it says "Y, space, XX," and then it has four more pairs of Xs. So yeah, this is definitely coming out of Morocco, or at least the phone number is a Moroccan phone number.
Dave Bittner: This is interesting because I don't know that I ever made the connection or the possibility of a country code that would coincide with an area code, with a US area code.
Joe Carrigan: Right.
Dave Bittner: That's pretty clever.
Joe Carrigan: Yes. Yes, and maybe that's why these scammers have chosen this area code, or this country code, is because it does overlap with a very large area of, well, Manhattan, yeah.
Dave Bittner: Yeah, a prominent area code.
Joe Carrigan: Right, but if you are someone like me who goes, isn't that the California area code, and, you know, you make that mistake, you go, oh, I bet this looks like it might be legit. It's just another thing that might lend credence to it.
Dave Bittner: You know what kind of error that is, Joe?
Joe Carrigan: What kind of error is it?
Dave Bittner: Off by one.
Joe Carrigan: Off by one.
Maria Varmazis: Off by one, it's a very prominent and well-known area code. It's sort of like 90210. It's just, for Americans, it's a number that we sort of know is a real place. I may or may not use that area code all the time, or Zip Code, rather, when I'm trying to unsubscribe to things. I just change it to 90210 and it works real well, so, yeah.
Joe Carrigan: Yeah, because of California's Privacy Law.
Maria Varmazis: That's right. Every time I want to do a one-click unsubscribe to something, or from a service that doesn't let me do it, I just, I suddenly move to Malibu and everything's fine.
Dave Bittner: Oh, right, right.
Maria Varmazis: It works a treat.
Dave Bittner: Yeah, interesting that, to pay this, you're going to a.help domain? That's a new one. I did not know there were.help domains.
Joe Carrigan: Yeah, a couple years ago, they approved a bunch of different top-level domains that are now just --
Maria Varmazis: "Scamalicious."
Joe Carrigan: Yeah, "Scamalicious," because now you can make the scam world blow up into all these different newly registered TLDs, top-level domains, that you can then just go out and -- like, you can now go out and you can register, like -- I don't know. Maybe Microsoft's already done this, but you could get Microsoft.help.
Dave Bittner: Yeah.
Joe Carrigan: So --
Dave Bittner: Well, Maria, what happens when you click through on this?
Joe Carrigan: Right.
Maria Varmazis: I'll get back to you guys next week. How about that, and if for some reason, my computer won't work --
Dave Bittner: Maria's microphone goes dead.
Maria Varmazis: I know.
Dave Bittner: Right, right.
Maria Varmazis: Like, what's going on? Why does none of my machinery work now? It's great.
Dave Bittner: Where'd everybody go? Yeah. All right. Well, that is our Catch of the Day, and thanks to Michael for sending that in. Of course, we would love to hear from you. If there's something you'd like us to consider for the show, please email us. It's hackinghumans@n2k.com. [ Music ] That is our show, brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast ap. Please also fill out the survey in the show notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our Executive Producer is Jennifer Eiben. We're mixed by Elliott Peltzman and Tré Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe Carrigan.
Maria Varmazis: And I'm Maria Varmazis.
Dave Bittner: Thanks for listening. [ Music ]
