Never gonna give you up, never gonna take this call.

Dave Bittner: Hello, everyone, and welcome to the "Hacking Humans" podcast, where each week we look behind the social engineering scams, the phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner and joining me is Joe Carrigan. Hey, Joe.

Joe Carrigan: Hi, Dave.

Dave Bittner: And our N2K colleague and host of the "T-Minus" space cyber briefing, Maria Varmazis, Maria.

Maria Varmazis: Hi, Dave, and hi, Joe.

Dave Bittner: We've got some good stories to share this week, but first, let's get to our follow-up. Joe, what do we got?

Joe Carrigan: Dave, Ignacio wrote in with some hints for iPhone users. Since I am not an iPhone user, I'm going to let you read this one.

Dave Bittner: Okay. He writes in and says, "Just listened to your latest Hacking Humans podcast, and it's always very entertaining and informative." Well, thank you. "Just wanted to provide a suggestion to deal with unsolicited callers. The following is a GSM exploit designed specifically for iOS devices because they are all the same and the steps would apply to all. It does work on Androids, but since they are different versions of the OS and the manufacturer's models, the only consistent option is the screen will display an arrow," blah, blah, blah, blah, blah, blah. All right. Here's the non-malicious version of the GSM exploit. Most users have three options for incoming calls. Answer the call, silence or miss the call, and it'll be sent to voicemail, or reject the call and it goes directly to voicemail. This exploit modifies the default reject option to divert the call to any number you may choose. For iOS devices, you need to disable live voicemail in order for the exploit to work. Once that's disabled, all you need to do is open your phone app and dial the GSM code for "if busy." It's "star, star, 6, 7, star," the destination number, and your device will display the confirmation screen. For a free and fun option, I tell my friends to use 248-434-5508, the Rickroll hotline. [ Laughter ] Okay, it just got a lot more fun.

Joe Carrigan: Yes, I want to call that right now.

Dave Bittner: The user can select whatever number they want. In addition, I use the jollyrogertelephone.com option, and that's just hilarious. The only issue is if you receive an incoming call when you're dialing out, the incoming call will go to the diverted number.

Maria Varmazis: Okay. Hang on a second -- [ Laughter ] [ Music ]

Dave Bittner: I hear it.

Joe Carrigan: You were faster on the fingers than I was.

Maria Varmazis: Indeed, that is a Rickroll number. Okay.

Dave Bittner: All right. "One click on the lock to silence the call and send it to voicemail, two clicks to divert the call." I like it. "Hope this helps your listeners who want to deploy this and have some fun with unsolicited calls." He'll be presenting this call divert option at BSides SATX. Where's SATX?

Joe Carrigan: I don't know.

Dave Bittner: I don't know either. "and BSides RGV this month. Huge fan of the podcast." Well, thank you, Ignacio. Is it Ignacio or Ignacio?

Joe Carrigan: Ignacio.

Dave Bittner: Ignacio?

Joe Carrigan: Yeah.

Dave Bittner: Either one?

Joe Carrigan: I don't know.

Dave Bittner: [Laughter] Well, we said them both, so hopefully, one of them is right. All right. Well, thanks for sending that in. I may give that a try myself. A couple of questions I had before we dug into our stories here today, and Joe, this one's for you.

Joe Carrigan: Okay.

Dave Bittner: "What if you started a podcast where you outlined all of the challenges of raising chickens? What would you call it?"

Joe Carrigan: What would I call it? I'd probably stick with our "Chicken Chat."

Dave Bittner: No, no. Maria, do you have any idea where I'm going with this?

Maria Varmazis: Pick a little, talk a little, pick a little.

Dave Bittner: No, no, you're both way off.

Maria Varmazis: Okay.

Joe Carrigan: Does it involve the word "Joe?"

Dave Bittner: It does, yes. Yes, it does. Yes, it does. Yes. Yes.

Joe Carrigan: "Joe's Chicks?"

Dave Bittner: No, no, no, no, no. All right. I was thinking of a podcast called "Wings Joe Hates."

Joe Carrigan: Ah, "Wings Joe Hates."

Maria Varmazis: Oh, okay.

Joe Carrigan: That's a good one.

Maria Varmazis: I was going in a totally different direction.

Dave Bittner: Yeah. All right. Anyway, Joe, I came across a video. It came upon my YouTube feed, recently, that I thought may be of interest to you. I put a link here in the show notes. This is a guy who used some of this magical cooling paint. Are you familiar with this stuff?

Maria Varmazis: Magical?

Joe Carrigan: I am not.

Dave Bittner: This is -- there is a paint that by some strange happenstance accident of physics --

Joe Carrigan: Thermodynamic black magic, we'll call it.

Dave Bittner: Yes, it sends heat into space, and it actually does this. There's a band of energy that our atmosphere is transparent to. It's kind of like, you know, like, things that are fluorescent are basically taking light and converting it? They're taking the, like, the ultraviolet and converting it into visible light.

Joe Carrigan: Yes.

Dave Bittner: Like, that's what this paint does. It takes regular light, converts it into the bandwidth that can be sent out into space, and it does that. By doing that, it cools things. It's cooler than being in the shade when this paint is in full sunlight.

Joe Carrigan: Really?

Dave Bittner: Yeah.

Maria Varmazis: Wow.

Dave Bittner: This guy uses it on his chicken coop, among other things. He also creates a suit out of it.

Joe Carrigan: I was going to say, it sounds like something I'd paint my clothes with.

Dave Bittner: Right. Right. [Laughter] The paint is very expensive, but I have seen other YouTube videos where people make it themselves. You can homebrew. I don't think there's anything terribly exotic about the materials that go into this particular paint. I was just thinking about you and your chickens and how you keep them comfortable on a hot day like it is here today in Maryland.

Joe Carrigan: Yes.

Dave Bittner: That maybe something like this on your coop would help you have comfy birds.

Joe Carrigan: I might do something like this. I'll take a look at this video. I can't watch it right now because we're recording a podcast, but I'm very interested in it.

Dave Bittner: I appreciate that. All right. Well, I'll have a link to both the video, and also, the company that makes the paint. We'll put those in the show notes.

Maria Varmazis: Oh, I was curious about this too. We can cut this part out, but apparently, it's extremely white/white, so it makes it more efficient. Like, the pigments are better at reflecting than just standard white paint, so it's just, like, super white.

Dave Bittner: Yeah, yeah, but it also has something to do with this, like, window in the atmosphere. You can use this to cool things. You could cool your house. You could use this instead of air conditioning.

Joe Carrigan: Really?

Dave Bittner: This effect, you could use, yeah, yeah.

Joe Carrigan: The problem with that is it always works, right?

Dave Bittner: There's that, yeah.

Joe Carrigan: In the summertime that's great, but in the wintertime, you're cooling a house you want to heat.

Dave Bittner: Yeah, yeah, so anyway, a little fun; fun with physics.

Joe Carrigan: Yes.

Dave Bittner: All right. Let's take a quick break to hear from our sponsors. When we come back, we will dive into our stories. [ Music ] We are back. Maria, you're up first this week. What do you got for us?

Maria Varmazis: Well, I saw something really interesting in my LinkedIn feed this week, and it felt like a good candidate for discussing on today's show. The headline was, "I got inside a North Korean hiring scam. What I found reveals a troubling shift in tactics." so, okay, I was hooked. So yeah, I got social engineered by a headline; it worked. This story is by Craig Silverman, and he wrote it for Indicator. Essentially, as the headline hints, he looked at North Korean hacker groups that are setting up elaborate multi-step schemes just to obscure what they are doing. Silverman, to research this, he was actually a willing Guinea pig for these scams, and they all appear to be part of a larger campaign called "Contagious Interview," which is something that MITRE has been tracking and Microsoft also since about 2022-2023. Have either of you heard of "Contagious Interview," this campaign?

Dave Bittner: That's a new one.

Joe Carrigan: Yeah, I haven't heard of this campaign, but I'm aware that the North Koreans do this frequently.

Maria Varmazis: Yeah, it was -- I was very interested in just watching Silverman go through the steps of this because he was just like, yeah, okay, I'll -- let's see if this can work on me. The hook for Contagious Interview is job offers that specifically target tech workers. The thing is, journalist Craig Silverman -- again, he's a journalist, not a tech worker, he responded to a job offer, a job post, for a full stack software engineer.

Dave Bittner: Oh.

Maria Varmazis: His LinkedIn says that he is a journalist covering, basically, deceptive practices on the internet and zero relevant experience in software engineering, but they decided to reach out to him and give him an interview anyway, so he was on to something. [Laughter]

Joe Carrigan: He even tells these guys what they're doing -- what he's doing.

Maria Varmazis: Yeah. He was just like, yeah, no relevant experience here, but they were, like, it doesn't matter, great --

Joe Carrigan: Let's see where this goes.

Maria Varmazis: Let's see where this goes. Maybe you've miraculously become a full stack software engineer.

Joe Carrigan: We'll train you.

Maria Varmazis: Yeah, that happens. The ultimate goal of the Contagious Interview campaign is to install malware on a victim's computer to steal passwords through that malware and then exfiltrate any kind of crypto wallet information. That is the ultimate goal here.

Dave Bittner: Okay.

Maria Varmazis: In order to do that, though, specifically as part of the campaign that Silverman put himself in the pipeline for, the North Korean hacker groups don't do the hiring process themselves. I guess, maybe, you know, AI deep fakes, they're not confident enough in how that works yet, or they just figure there's no point maybe because it's just cheaper to outsource the hiring process. They hire freelancers in the Philippines, in Nigeria, Colombia, and in Bangladesh. That freelancer will then conduct a video interview for a fake company, like the company that is offering a job for a full stack software engineer to a journalist.

Dave Bittner: So they've got fake headhunters basically?

Maria Varmazis: Yeah, fake headhunters, so again, there's zero AI face swapping going on. Nobody needs to do the put your hand in front of your face thing because these are 100% fully human people doing this job. They do an actual interview, and they actually manage the hiring pipeline. The freelancers in this case are fully coached. They are given scripts that they can follow, and they are also actually paid. Spoiler alert, they're paid in crypto, and it's almost like a real job for them. They actually collaborate in Slack, and they're tracking their job candidates through the hiring pipeline in Google spreadsheets. This, to the freelancers, probably feels like an actually legit job.

Dave Bittner: Maria, I'm sorry. Do we know if the freelancers know this is a scam or not?

Maria Varmazis: This is what's interesting in the article is we're not sure. It'd be easy for us to say that they're mere intermediaries because it appears like maybe they are, like the money mules that we've talked about in some of the other scams. In some cases, Silverman is saying that they actually do know that this is what's going on, and they're very willing to just be a part of it. It's debatable whether or not they know that they're part of a broader scheme here. They may believe that the company that they're being an interviewer for is legit and, like, hey, I'm just -- they've outsourced some of their HR processes to us, and isn't that wonderful? They definitely have, just, visibility into their little part of the world, and they're just hired to do a simple job. That's it. Just keep your head down and do this thing, and then the broader scheme, the scripts that are being provided to them, they never meet those people who are giving them this, and, you know, their English is very sketchy. The boss is kind of like a faceless name, but don't worry about it. When the interviewee, like in the case of Silverman, joins a Zoom call, they are then asked to do a live coding exercise after you go through the obligatory, tell me about yourself and your goals and why you'd be a good fit for this job. So again, it's a legitimate interview feel. The live coding exercise then comes up, and when that part of the interview happens, malware is quietly working in the background to exfiltrate passwords and also steal crypto wallet, details should they exist.

Dave Bittner: Oh, so do they say, "Hey, we're going to do this live coding exercise, and I just need to install this viewer software on your computer"? Is it that?

Maria Varmazis: Probably. I'm not entirely sure about that part, but yeah, very, very likely that's what's going on.

Joe Carrigan: Or they say go out to GitHub and download this repository.

Maria Varmazis: Download this thing, yeah, and don't worry about it. Apparently, some of the researchers who Craig Silverman collaborated with on the story -- because he, you know, is a journalist, but he collaborated with a number of InfoSec groups. Some of the researchers he worked with actually were able to capture the malware that was installed on the interviewee's computer. They were saying something about the malware was, like, very elegant and well made. This was not like some janky thing that somebody just bought and just started running. Like, this was actually really neat and clean coding for malware, so that speaks to some level of really high proficiency there. Some of the groups that Craig Silverman also collaborated with while working on this story was TRM Labs and also the Google Threat Intelligence Group. Google specifically, they said that this specific scheme is something that they track as UNC 5975, which they say is -- "a financially motivated North Korean threat cluster that primarily targets blockchain and cryptocurrency related entities." To me, what was interesting about this -- well, actually a lot of it was, but that they're paying upfront for a lot of infrastructure that's legit to have this scheme run. I mean, this is not just some sort of cast a wide net and let's see what happens. Clearly, the North Korean hacker group feels like all the upfront costs are worth it for the payoff that they're hypertargeting, presumably, higher net worth, higher skillset folks who are usually actual software engineers, because I guess it seems more likely than that that group of people would have assets of some value, especially potentially crypto compared to, like, the average bear, I suppose.

Joe Carrigan: Right.

Maria Varmazis: It's just interesting that this has been going on since 2023. It's still happening, and apparently, it's still working a treat because they're going after it.

Dave Bittner: I also think about all the layoffs that we've seen in tech. There's a lot of people out there who are hungry for a new job.

Maria Varmazis: Indeed, yes, and I know a lot of the -- there is a lot of discussion about this in sort of the software engineering world about how to protect yourself if you are either not on the market, but just a software engineer on LinkedIn, but especially if you are actively looking for a job. I mean, a full stack software engineer, that is about as generic a software engineer job description as you can get. Yeah, you don't have to worry about like, hey, put your hand in front of your face. This guy's clearly a deepfake dude. This is -- you're talking to real people who probably speak native English, so maybe some of the usual red flags are not there. I don't know. It's pretty nasty, and live coding exercises are kind of standard, too. I imagine if anyone's telling you to download something, that's a huge no, no. Immediately disconnect and do not proceed, but yeah, another thing that these scammer groups are doing is they're using fake company names and they're changing the fake company names all the time. I imagine they're also spinning up fake websites that maybe look legit because you can spin those up pretty much instantly now, thanks to AI.

Dave Bittner: Yeah.

Maria Varmazis: Good luck researching the company that you're trying to interview for, because it may pass some of the initial sniff tests for legitimacy. Yikes.

Joe Carrigan: A little bit of behind the curtain on this, and you can listen to the entirety of the "Lazarus" podcast to get this information, but North Korea funds a lot of what they do through cryptocurrency theft.

Maria Varmazis: Yeah.

Joe Carrigan: That is pretty much the, the big thing, keeping that regime afloat, or at least, I don't know. There's probably other things, as well, but it's, it's a big contributor to the national economy.

Maria Varmazis: Wild.

Dave Bittner: You know, one of the nice things about being a professional podcast host is that people rarely reach out to you on LinkedIn to try to poach you. It's such a weird job, you know?

Joe Carrigan: Instead, they reach out and go, "Hey, can I be on your podcast?"

Dave Bittner: Well, yes, that is the other -- yes, that is, that is the LinkedIn time suck for sure, but rarely are people trying to scam you out of anything work-related because very few people actually understand what goes into the job.

Joe Carrigan: Right.

Dave Bittner: All right. Well, that's interesting. We'll have a link to that story in the show notes here. My story this week -- I've got to tell you both, this has gotten under my skin a little bit --

Joe Carrigan: Okay.

Maria Varmazis: Oh, all right.

Dave Bittner: - because --

Maria Varmazis: Sort of grinds your gears?

Dave Bittner: Yeah, because it's making the rounds as we record. Just this morning, I saw several friends on Facebook post about this alleged scam that turns out is probably a hoax, but it's one of those ones where once one person starts posting about it, all the usual suspects start posting.

Joe Carrigan: Yeah.

Maria Varmazis: Oh, boy. All right. Lay it on me.

Joe Carrigan: I saw this, this morning when I was looking for my story, and I was, like, what is this? Oh, this looks kind of -- eh, that's B.S. [ Laughter ]

Dave Bittner: Well, good. Well, my bar for including a story is lower than yours, Joe.

Joe Carrigan: I mean, you're not talking about the story. You're talking about the viral nature of the story, how this thing spread.

Dave Bittner: Right, right.

Joe Carrigan: Yeah, so let's -- I'm sorry for derailing you.

Dave Bittner: No, no, no, no, no. Here's the -- so basically, what the claim is, is that criminals are altering gas pump nozzles to steal fuel. What happens is you go up to pump your gas at your local gas station. You take the nozzle out. You pump your gas. When you go to put the nozzle back in the pump, there's a screw that is sort of wedged in the little flap that goes down when you put the nozzle back into the pump.

Joe Carrigan: Right, which is the switch to tell the pump the transaction is over.

Dave Bittner: Correct.

Joe Carrigan: Right.

Dave Bittner: You put the nozzle back in. This screw is in the way. The flap doesn't go down. You drive away, and the scammer immediately drives up where you were. They fill their gas tank, and your car gets charged.

Joe Carrigan: Right.

Dave Bittner: That's the scam.

Maria Varmazis: What?

Joe Carrigan: Is that how this works?

Dave Bittner: Well, that's --

Joe Carrigan: That's how they claim this works.

Dave Bittner: Yes.

Maria Varmazis: What? Okay.

Joe Carrigan: So in other words, the victim thinks that they -- allegedly, the victim thinks they've turned the pump off and completed the transaction.

Maria Varmazis: Yeah, but, like, don't people stand there and just wait for the thing to say, you know, do you want a receipt or whatever?

Dave Bittner: Well, I do.

Joe Carrigan: Yeah.

Maria Varmazis: Yeah, I'm just -- I thought that was -- do people just drive off? I mean, really? Okay. All right.

Dave Bittner: Well, Maria, people have got places to be. You know, they can't be waiting around for receipts and things. They're people of action.

Maria Varmazis: I'm impatient, but I'm cheap as heck. I don't want somebody getting free gas. This is just me for decades. I'm like, I'm waiting until this thing says I'm done and that they've closed out. I'm not driving off until it says this. Okay. Sorry. Sorry. Sorry. Okay.

Joe Carrigan: There's a gas station around here, Maria, that you'd love called Highs, owned by Carroll Fuels now. Highs used to be a dairy when Dave and I were kids.

Maria Varmazis: Wait, her last name is Fuels and she owes a gas station? Well, it's Carroll Fuels because I think they're based out of Carroll County.

Dave Bittner: Yeah.

Maria Varmazis: Oh, oh, okay.

Joe Carrigan: It's the county I now reside in, but High's --

Maria Varmazis: I thought it was a woman named Carroll and her last name is Fuels.

Dave Bittner: Yeah, it was destiny.

Joe Carrigan: Right. Every time I go to a High's and it says, "Would you like a receipt?" and I say, "Yes," it essentially says, "Clerk has receipt." In other words, we haven't bothered to refill the paper. Would you like a receipt? Well, too bad.

Maria Varmazis: That'd be nice, wouldn't it?

Joe Carrigan: The joke's on you.

Maria Varmazis: We'd all like a receipt, but we're not getting one. Okay.

Dave Bittner: You should go in there sometime just to see the blank stare. Like, wait, I'm sorry, what?

Joe Carrigan: I don't feel like dealing with that.

Dave Bittner: You want a receipt? Is everything okay, sir?

Joe Carrigan: Yeah, I'm traveling.

Maria Varmazis: What year is it?

Dave Bittner: Here's the thing. When I saw people sharing this, this morning, they were linking to a story from a local police station, a local police force, who was sharing the story on this.

Maria Varmazis: Okay, can we just -- has anyone else noticed that sometimes local police Facebook pages, the official ones, do perpetuate, like, nonsense like this?

Dave Bittner: Yes.

Maria Varmazis: Yes. Okay. It's not just me.

Dave Bittner: No, no.

Maria Varmazis: It's like, our local police is posting stuff. I'm, like, that stuff -- that's just not true. Just -- what are you doing? Okay. Yeah. Okay.

Dave Bittner: Yeah, I understand, you know, maybe say better safe than sorry. Who knows? Whoever's running the social media channel at your local law enforcement agency.

Joe Carrigan: A summer intern.

Dave Bittner: Right.

Maria Varmazis: I know they're busy with actual stuff. I get it. Like, I get it.

Dave Bittner: Yeah, so according to this report here -- so let me back up just a bit. I, too, was skeptical of this. It just didn't make a whole lot of sense to me, so I did what everyone does, which is -- well, evidently my friends don't do it, but -- I did a Google search. The first thing I found was a page from Snopes, right, pretty reliable in terms of busting myths and that sort of thing. I know people have different opinions of Snopes, but overall, they're pretty good. They looked into this. They found that back in May of this year, there was a Facebook post from the Queen Anne's County Sheriff's Office, which is right here in the Great State of Maryland.

Joe Carrigan: Yeah, just over the bay.

Dave Bittner: They helped spread the warning. The office later revised the post and labeled the claim unfounded. They also found that the screw that someone found in the pump was a maintenance issue, not criminal activity. They reached out to Shell, Shell gasoline. A spokesperson was unaware of any such incident. They reached out to Racetrack, Walmart, Phillips 66, Conoco, and '76. None of them had any known cases of this. They say the earliest references appear to be in late 2025 on Reddit and TikTok, showing screws in pump nozzle holders.

Maria Varmazis: Oh, yes, TikTok. Nothing scammy or nonsense is ever posted there, certainly not Reddit either. Yeah. Okay.

Dave Bittner: It just took off. It just became viral TikTok videos. They said that the original sheriff's office post showed signs of AI-assisted editing, so there's that.

Maria Varmazis: No, no, never.

Dave Bittner: [Laughter] They say there is a related scam that is called a pump switching scam where someone will distract or assist the customer at a pump and then add fuel to their own vehicle, but this is not that.

Joe Carrigan: I just imagine somebody, "Look over there." "Hey, where'd my gas pump go?"

Dave Bittner: Right.

Maria Varmazis: I can't even get the gas thingy to go all the way around the right side of the car half the time. How are you getting it to another car entirely? I'm sorry.

Dave Bittner: No, it's not like -- remember the old days, Joe, when the hoses would reach --

Joe Carrigan: All the way around the car?

Dave Bittner: Yeah.

Joe Carrigan: Yeah, It didn't matter what side you pulled up to.

Dave Bittner: No, no, it's just -- now they don't do that. They don't do that.

Joe Carrigan: You've got to pay attention to that little arrow next to your gas gauge.

Dave Bittner: Right, right, which overall is better because, you know, we're not running over gas hoses like we used to back in the day.

Joe Carrigan: Right. We're not pulling them off anymore.

Dave Bittner: Right.

Joe Carrigan: Actually, they have breakaway nozzles now.

Dave Bittner: Right.

Joe Carrigan: I saw someone, actually, at a High's break one of those away the other day.

Dave Bittner: Oh, really?

Joe Carrigan: He was filling up a tank on the back of his truck, and the thing just falls off. He looks down and goes, "That's unfortunate." I mean, this guy handled it like a champ. I was like --

Maria Varmazis: "That's unfortunate."

Joe Carrigan: I was impressed with how well he handled it.

Maria Varmazis: Yeah, totally unbothered. That's kind of awesome.

Joe Carrigan: He was on the phone with a customer, and he was just, like -- it was great to watch. I need to be more like that guy.

Dave Bittner: Right, right.

Joe Carrigan: I know I've been like, what the --

Dave Bittner: Taking life in stride.

Joe Carrigan: Right. [ Laughter ]

Maria Varmazis: What else could go wrong today?

Dave Bittner: Again, according to Snopes, they say, "Despite widespread social media warnings and news coverage, no verified evidence has emerged showing that criminals are using screws in gas pump nozzle holders to steal fuel through open transactions."

Joe Carrigan: I've got a question for both of you.

Maria Varmazis: Bless the folks at Snopes, honestly, that they debunk stuff like this. Gosh.

Joe Carrigan: Here's my question for both of you: How great do you think it feels to be the guy that came up with this thing and start distributing it to see it blow up to this level?

Maria Varmazis: I feel like you're cooking an idea right now, Joe.

Joe Carrigan: Well, I've always wanted to do something like this.

Maria Varmazis: Yeah, no kidding.

Dave Bittner: They used to do this on The Letterman Show. Do you remember that, Joe, back in the day?

Joe Carrigan: What would they do?

Dave Bittner: They would try to start a rumor.

Joe Carrigan: Oh, no, I don't remember that.

Dave Bittner: Yeah, yeah, they would just, you know, classic sort of Letterman, "aren't I a stinker" kind of thing to do on live television. The one I remember is they were trying to start a rumor that the City of New York had put some additive in the water that would turn your urine blue. They started calling around to tell people that this was going to happen. You know, it was good late night TV comedy. Yeah, I think you're right, though. Whoever did this must have some sort of perverse satisfaction of seeing that probably what started off as a stupid TikTok video or just --

Joe Carrigan: A joke.

Dave Bittner: Yeah, and now --

Joe Carrigan: Law enforcement reported on this. I just made this up, awesome.

Maria Varmazis: Yeah, so, Joe, if you were to be starting a rumor, what would you start?

Joe Carrigan: I don't know. I'd have to think about it. This is where I fall short on this, is I can't think of something that isn't plausible like this, because I actually have come up with a number of plausible things. Maybe next time I'll just -- but highly unlikely.

Dave Bittner: Right, yeah, there is a bit of an art to this, isn't there?

Joe Carrigan: Oh, you know what? Maybe my school bus idea.

Dave Bittner: Okay.

Joe Carrigan: Do you remember the school bus idea?

Dave Bittner: Go on.

Joe Carrigan: My wife and I, when we were thinking about buying a camper, drove by a school bus that was for sale. My wife says, "We could buy that and turn that into a camper." I said, no, don't worry about that. Think of all the kids we could abduct with it. [ Laughter ]

Maria Varmazis: Oh, my God.

Joe Carrigan: Right? My daughter's reaction --

Maria Varmazis: Why is that where your -- okay. Oh, Joe.

Joe Carrigan: My daughter's reaction was exactly what Dave's was. She laughed because she has the same dark sense of humor. My wife was what Maria had, right? She was, like, you're a disgusting human being.

Maria Varmazis: Why would that -- why is that where your mind goes?

Dave Bittner: It was just in our wedding vows, Joe.

Joe Carrigan: Right, definitely under "sickness." My son was, like -- he sits in the back seat and he goes, "Wait a minute. What stops somebody from doing that?"

Dave Bittner: Yeah.

Joe Carrigan: I asked you about this once, Dave, and you said that patrols in Howard County were told what the license plate of Howard County buses look like.

Dave Bittner: That's true. Yes. Back in the day, they were anyway.

Joe Carrigan: Right.

Dave Bittner: Yes.

Joe Carrigan: Then somebody else -- I asked somebody else about it and they said, well, nothing. In Montgomery County -- a guy who is a principal in Montgomery County, he said, yeah, there's really nothing that stops that from happening. Then I talked about it with other security professionals, and one of them said, yeah, that's not really the threat model for abducting kids.

Dave Bittner: Yeah.

Joe Carrigan: You're going to get way too many kids.

Dave Bittner: Yeah, I just want to say there is a famous case of this happening, and there are plenty of YouTube videos about it where somebody did this, got a school bus, abducted basically an entire route's worth of kids. I want to say they had, like, an underground -- I think they buried a U-Haul truck or something. There was some bizarre twist to it where they had built an underground bunker to keep the kids in and the teachers while they were, basically, holding them for ransom. It did not end well for the crooks. I don't believe any of the kids got hurt, but I hope I'm wrong on that.

Joe Carrigan: Yeah, or you hope you're right on that.

Dave Bittner: I'm -- yes. I hope I'm right.

Joe Carrigan: You hope you're right and the kids all made it out safe. This is not more threats. They got what's coming to them, right?

Dave Bittner: Yeah.

Joe Carrigan: That's a very important malapropism to correct. [ Laughter ]

Dave Bittner: But yes, anyone can buy an old school bus, and it'll still be painted yellow.

Maria Varmazis: What's stopping you? Just do it. Go for it, everybody.

Dave Bittner: I know someone who bought an old Greyhound bus and converted it into a camper.

Joe Carrigan: Yeah, well, a Greyhound bus is essentially the same frame as a camper. Yeah, they're the same -- like, MCI, I think is -- Motor Coach International. Not the defunct dishonest accounting long distance company, but yeah, they built a lot of the camper bases, and then camper companies take them and turn them into Class A motor homes.

Dave Bittner: Yeah, so bottom line here, this gas pump screw thing, it's not real.

Joe Carrigan: Right.

Dave Bittner: Yeah, it's a write your own joke, and if you see people spreading this around on social media, please do your part. Refer them to the Snopes article, or if you have another debunking website that you prefer, send them there to help tamp this one down, but it's currently making the rounds. All right. Let's take a quick break before we get to Joe's story. We'll be right back after these messages. [ Music ] We are back. Joe, you are up. What do you got for us?

Joe Carrigan: Good news, I think. I hope this is good news. I've been nothing but a ray of sunshine on this show lately.

Dave Bittner: Yeah.

Joe Carrigan: This story comes from our friend, Mallory Sofastaii up at WMAR. We've got to have her back on.

Dave Bittner: Yeah, Mallory is great.

Joe Carrigan: Yeah, there has been a new law passed here in Maryland, Dave, that gives -- sorry, Maria, not Massachusetts -- that gives banks and credit unions the power to temporarily hit pause on suspicious transactions involving older people. Now, Mallory has the story of Judith Boyden, who lost $600,000, which amounted to all of her retirement, from one of these FBI scams and FBI impersonators. "Hey, we think that you guys are laundering money. We need to get that money out of that account and put it into our custody." --

Dave Bittner: Right.

Joe Carrigan: -- which is never how the FBI operates. If the FBI is going to seize your money, they have means of doing that.

Dave Bittner: Right, and they won't warn you.

Joe Carrigan: Right, and they will not warn you. Right. This new law takes effect on October 1st of this year, and it gives financial institutions the authority to hold transactions. One of the things in the law -- I took a look at the law real quick. It says adults who are 65 and older and other vulnerable adults. The hold can last for 15 days or some cases, 25 days, while the transaction is reviewed.

Dave Bittner: That's quite a hold.

Joe Carrigan: It is. It's significant. They're also -- financial institutions are now also permitted to notify trusted contacts. This is from John Bratsakis, who's the President and CEO of the Maryland DC Credit Union Association, because, Dave, you and I are members of credit unions.

Dave Bittner: That's true.

Joe Carrigan: Right? I'm a big fan of credit unions, better rates, better, better services. It's for the members. If you're a member, you're actually a shareholder when you're in, in, in the membership, which is good. "That's what we're trying to do is find better ways to protect our members," is a quote from him. They're adding a trusted contact person who is not a signer on the account. They don't have authority to access the money, but it's someone who might be helpful if a bank employee goes, this doesn't seem like it's in our customer's best interest. Let's call your trusted person and get them in here.

Dave Bittner: That's interesting.

Joe Carrigan: Then trusted person can come in and say, yeah, mom, dad, brother, whatever, this is a scam. Let's try to get a bunch of people in here to convince you that it's a scam. How do you guys think this is going to work in terms of, like, romance scamming? How well do you think it will work?

Maria Varmazis: I mean, we talked about something like this a while ago. It wasn't institutionalized, you know, legislatively, but a lot of financial institutions have training for their staff to kind of pump the brakes when they see something like this in an in-person transaction.

Joe Carrigan: Right.

Maria Varmazis: I do wonder. I mean --

Dave Bittner: It also reminds me that when my folks were still around, I had access -- they made me co-signer on their bank accounts, but I had automatic notification through the bank's app if a transaction over X amount of dollars happened. If someone tried to drain an account or something like that, or something unusual happened, I would get notified, but part of what intrigues me about this legislation is why specifically would you want it to be someone who did not have access to the account? I guess that means it's someone who doesn't have any financial skin in the game.

Joe Carrigan: I don't know if that's in the legislation. I think what the legislation says is "a trusted individual," so it can be somebody else on the account, but it doesn't have to be.

Dave Bittner: Oh, I see. Okay.

Joe Carrigan: So Bratsakis goes on to say that there was a credit union locally that somebody requested a wire. They had all the correct information to conduct this wire transaction, and it involved a mortgage payment. They wanted the money to go to an individual rather than the company, and the banks paused it. Then when they started to go through the process, they were able to stop it. The banks were able to stop it, and it was, like, $80,000 that somebody was going to send to some scammer.

Maria Varmazis: Oh, wow.

Joe Carrigan: They've already done these kinds of things when they can. When they recognize a fraudulent transaction they've said, hey, you're sending what looks like a mortgage payment to an individual, not a mortgage company. The AARP has a -- our favorite day -- our favorite account -- favorite website, Dave, the AARP.

Dave Bittner: Right. They start -- Maria hasn't hit this stage of life yet, but somewhere around 50, they just start -- and you don't even have to ask. They just start sending you things, and you're, like, "Too soon, too soon."

Maria Varmazis: Nope. I got one. I got a mailer from them when I was 29.

Dave Bittner: Oh, my, wow.

Maria Varmazis: Yep, and that put me into a tailspin. Let me tell you.

Dave Bittner: Wow.

Maria Varmazis: Yep, 29. [ Laughter ] My knees were still good. I was very offended.

Dave Bittner: Right, exactly.

Joe Carrigan: My knees are getting worse. It really sucks going upstairs.

Maria Varmazis: They don't tend to get better with age, Joe.

Dave Bittner: No, they do not. All that goes just in one direction.

Joe Carrigan: Yeah, I might have to do what my mom did and just get two new knees.

Maria Varmazis: Two new knees.

Joe Carrigan: The AARP says that this is a House Bill 1008 and Senate Bill 753, Vulnerable Banking Protection Act, that allows financial institutions to temporarily delay or deny suspicious transactions. Banks and credit unions may pause a disbursement if they reasonably believe it could lead to financial exploitation, which I think is great. I'm anxious to see how this plays out. I really want to see if this works. I'd like to know if the State of Maryland is going to collect data on this. The State of Maryland does a lot of data collection on things like this. One of the other things, as much as I complain about the State of Maryland, the government here is very consumer protection oriented.

Dave Bittner: Yeah, that's true.

Joe Carrigan: I mean, it's not a caveat emptor state like our neighbors to the south in Virginia. It is consumer protection oriented, which is great, which is one of the things I really appreciate about it.

Dave Bittner: A thing I wonder about, I guess, if I had a slight concern is whether or not the banks could use this as an excuse to float money, right? Already, when you do some large transactions, they're not immediately made available. Banks make a lot of money by floating your money, by making it unavailable for a few days or whatever the float may be, depending on the amount. In the meantime, that money is making money for the bank, and that's part of their business plan and so be it, but if suddenly everyone over the age of 65 had a 15-day delay on any transaction --

Joe Carrigan: Every transaction, right.

Dave Bittner: -- right, then I think we'd have a problem. So hopefully, it doesn't come to that, but that's the only thing that gives me a little bit of pause, if somebody --

Joe Carrigan: That's why I was wondering about data analytics. Actually, it's one of the benefits of my wondering about data. I wasn't thinking about that factor, Dave. Yeah, I mean, if you had the data on how many times -- what percentage of -- you know, how many transactions you conducted without putting a hold on it and how many transactions you conducted with putting a hold on it, it'd be pretty easy to spot that kind of thing.

Dave Bittner: Yeah. No, overall, I like that they're trying to put things in place to look out for seniors who more and more are being targeted by this kind of thing.

Joe Carrigan: Indeed.

Dave Bittner: All right. Well, we will have a link to that story in the show notes. Joe, Maria, it is time for our Catch of the Day. [ Soundbite of Reeling in Fishing Line ] [ Music ]

Joe Carrigan: Dave, our Catch of the Day comes from one of our favorite locations, r/scambait.

Dave Bittner: Right.

Joe Carrigan: It has to do with Prince Andrew, who you say no longer a prince.

Maria Varmazis: No longer a prince, he got de-princed.

Joe Carrigan: He got de-princed.

Dave Bittner: This is titled, "Dr. Prince Andrew Admits to Drinking Blood Occasionally."

Maria Varmazis: "Dr. Prince Andrew"?

Dave Bittner: So, Maria, I think I will be Prince Andrew.

Maria Varmazis: Dr. Prince Andrew.

Dave Bittner: Dr. Prince Andrew to you, and the other person on the other end of the line here is a lady, so you are best suited for that part.

Maria Varmazis: Okay.

Dave Bittner: That's no lady, that's Maria.

Maria Varmazis: That's right. That's right.

Dave Bittner: All right. Here it goes. Starts out and says, "Hello."

Maria Varmazis: "Hello, Dr. Prince Andrew," s smiley, winky face.

Dave Bittner: "How are you, dear? My old friend. It's been a while. Hope you're doing well."

Maria Varmazis: "Have we met?" blushing, smiley face.

Dave Bittner: "We have been friends from a long time ago on this app. I was not active here for a long time due to my challenges with Jeffrey Epstein's scandal. I've been facing one ordeal to the other. I've lost so many people close to me, now isolated, but looking for a new genuine friendship. After all the fake news about me, it's become clear I have no case to answer. I really would love to be a very close friend, as I love your personality online."

Joe Carrigan: I don't know that that statement is at all correct, that he has no case to answer.

Dave Bittner: "Please, where are you from?"

Maria Varmazis: "I see. It really is a shame that you turned out to be a pedo," smiling, crying face. "If we really were friends before, like you say, please tell me something about myself to prove it."

Dave Bittner: "I am never a pedophile. I made a wrong choice of friends. Being an elite, I had a few circles of powerful friends whose secret lives I wasn't aware of. We've been friends online. That's what I meant. I've never met you physically. The media over-exaggerated my friendship with Epstein, a friendship I regret and had suffered a lot of humiliation."

Maria Varmazis: "Don't sweat it," smiling face.

Dave Bittner: "How are you today? I hope you're okay. I've been thinking about you. Have you been able to fill the form?"

Maria Varmazis: "The form?" Confused emoji.

Dave Bittner: "Yes, dear. Please submit it here. Sorry, it wasn't meant for you. How have you been?"

Joe Carrigan: Was the scammer getting his wires crossed here?

Maria Varmazis: "You're an odd man."

Dave Bittner: "Sorry about that. I had a friend who suffered from cancer, so I recommended him to the British Royal Family Non-Official Ambassadorship so that he can receive the privileges accrued to members, which include elite-styled medical assistance and financial assistance. She was supposed to fill a form and submit a copy to me and send one to the British Royal Family Non-Official Membership Committee, but I mistakenly asked you for the form. However, she has done that. Sorry about the inconvenience."

Maria Varmazis: "Is your friend male or female?"

Joe Carrigan: Yeah, good catch. I was going to ask that.

Dave Bittner: "Female. Why do you ask? Hope you're fine. Where are you from?"

Maria Varmazis: "Antarctica," pride flag.

Dave Bittner: "Okay. Are you single or married?"

Maria Varmazis: "Widowed. My late husband, Olfart, choked to death on a chili cheese top," crying face.

Dave Bittner: "So sorry to hear that, are you in any relationship now, and how old are you?"

Maria Varmazis: "I am 47-1/2." [Laughter] "I'm seeing my neighbor Earl casually." Happy winky face. "How about you?"

Dave Bittner: "Not seeing anyone. M66, can I see your pictures?"

Maria Varmazis: I don't even know how to describe that image. A hag, a really -- a swamp hag, perhaps, with very interesting choices in makeup.

Dave Bittner: "Okay, but you're not 47, are you?"

Maria Varmazis: "And a half."

Dave Bittner: It's okay.

Maria Varmazis: "There's an age difference of 18-1/2 years between us. I would like to have children someday. Aren't you too old for that?" Question marks? "Why are you ignoring me, sweat heart?" [Laughter]

Dave Bittner: She probably meant sweetheart. I'm going to just go with that. [ Laughter ] "Been busy. How are you?"

Maria Varmazis: "I'm wondering if our goals are aligned," thinking Emoji.

Dave Bittner: "Of course it can be possible to be together," heart emoji, "but firstly, you need to apply for the Royal Family Non-Official Membership, but even before that, there's need for you to make a charity donation to the UK Royal Family Charity Organization.

Maria Varmazis: There it is.

Joe Carrigan: Here it comes. There it is.

Maria Varmazis: Yep. "You didn't even answer if you plan to have more children."

Dave Bittner: "Yes, dear."

Maria Varmazis: "Wonderful." Heart emoji.

Dave Bittner: "But you need to apply for the Royal Family Non-Official Ambassadorship Membership first."

Maria Varmazis: "What's the difference between the Official and Non-Official Ambassadorship membership?"

Dave Bittner: "The officials are for carrier ambassadors, but the non-official are for the people designated as influential persons on behalf of the Royal Family and are answerable to the King."

Maria Varmazis: "But I don't think the King even likes you."

Dave Bittner: "Privately, we are very good brothers and good to one another. Don't worry about that, okay? We are blood."

Maria Varmazis: "Do you drink it, though?"

Dave Bittner: "I do occasionally. What about you?" >> Maria Varmazis:" No, I'm vegetarian." "Okay, sweetheart. We can accommodate each other. Are you ready to apply for the Royal Family Non-Official Ambassadorship Membership?"

Maria Varmazis: "I'm not emotionally ready, no."

Dave Bittner: It ends there.

Joe Carrigan: That's pretty good.

Dave Bittner: That is a pretty good one.

Joe Carrigan: Yep.

Maria Varmazis: So many questions. "Dr. Prince Andrew."

Dave Bittner: Yeah, it's probably an honorary doctorate, I'm guessing.

Joe Carrigan: Right. It hasn't been stripped from him yet?

Maria Varmazis: Holy cow. Why him? All the Reddit comments said exactly what I'm thinking. Why would you choose to pretend to be that guy?

Joe Carrigan: Right. That's a top comment here. "He's fully aware of Prince Andrew's problematic history but chooses to impersonate him anyway?" Am I getting that part right?

Maria Varmazis: Oh, man.

Joe Carrigan: He should move to Bill Cosby or Gary Glitter for the next one.

Maria Varmazis: Oh, my God. Oh, my God.

Dave Bittner: Like, what, Hitler wasn't available?

Joe Carrigan: Right. [ Laughter ]

Dave Bittner: All right. We will have a link to our Catch of the Day in the show notes. Of course, we would love to hear from you. If there's something you'd like us to consider for the show, please email us. It's hackinghumans@n2k.com. We're going to take a quick break here. We will be right back after this message. [ Music ] That is Hacking Humans brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our Executive Producer is Jennifer Eiben. We're mixed by Elliot Peltzman and Tré Hester. Peter Kilpe is our Publisher. I'm Dave Bittner.

Joe Carrigan: I'm Joe Carrigan.

Maria Varmazis: And I'm Maria Varmazis.

Dave Bittner: Thanks for listening. [ Music ]