Red flags ahead.
Dave Bittner: Hello, everyone, and welcome to the "Hacking Humans" podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner, and joining me is Joe Carrigan. Hey, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: And our N2K colleague and host of the "T-Minus, Space-Cyber Briefing," Maria Varmazis. Maria.
Maria Varmazis: Hi, Dave, and hi, Joe.
Dave Bittner: We've got some good stories to share this week, but first, let's get into some follow-up. We've got a couple things here this week, don't we, Joe?
Joe Carrigan: Yes, we do. Why don't you read the first one, Dave? Since this is Bob and he wrote in to correct me.
Dave Bittner: Yeah, Bob wrote in to say, "Joe is a big stinky jerk."
Joe Carrigan: Right.
Maria Varmazis: Oh! He's at 11.
Dave Bittner: He didn't say that. I said that, so this will seem much less harsh.
Joe Carrigan: Right.
Maria Varmazis: Walk that one back. Yeah.
Dave Bittner: Right. No, no. Bob wrote-- it was a kind note from Bob.
Joe Carrigan: Yes, it was.
Dave Bittner: Bob said, in episode 393 of "Hacking Humans," Joe was talking about how TP-Link routers are more vulnerable because, unlike Netgear and other router manufacturers, TP-Link does not sunset their routers. Bob says, "I've used Netgear routers for over 20 years, and I've never had a Netgear router stop working when Netgear ended support for any model. I found no manufacturer, consumer or enterprise, Netgear, TP-Link, Asus or otherwise, that has a stated policy of disabling or bricking a router once it reaches end of support. End of support universally just means updates stop. The hardware keeps running on its last firmware. The only real-world case of routers or hardware going dead were unintentional or involved companies explicitly shutting down a cloud service the device depended on, not a manufacturer saying, 'Your router no longer works as a matter of policy.' So on the specific factual claim, Joe is incorrect." Joe?
Joe Carrigan: Bob is right. So here's the thing. I could have sworn I heard somebody say out there that Netlink routers eventually, after they go end of life, they will brick themselves. And I don't know where I heard that. And you know what? I can't find it anywhere.
Dave Bittner: Yeah.
Joe Carrigan: So apparently I heard that from some fly-by-night nonsense source, probably somebody wearing a tinfoil hat and a conspiracy theorist because I can't find any evidence of it.
Maria Varmazis: So to be fair, it feels plausible. It feels like it could happen just in the cynical age in which we live, that that would be a thing that could happen.
Joe Carrigan: Yes. And I have bricked my Netgear router doing a software update, but that was just doing a software.
Maria Varmazis: That's different. That's you doing it.
Joe Carrigan: Well, I think it's a bad update because when I called Netgear and told them about it, they were like, we'll just send you another router. Literally, that's what happened. They sent me another router.
Dave Bittner: Yeah. I did respond to Bob's email, and the only thing that I thought of was that almost simultaneous to you talking about this on the show, we had a story on the CyberWire about a few thousand routers in Australia that had been issued to Australian citizens to kind of monitor Internet bandwidth and usage around the country. Kind of like--
Joe Carrigan: That makes me feel great.
Dave Bittner: Well, I mean, they were done like beacons, you know, just to see if everything was up and running and that sort of thing. And when that program ended, the government bricked those routers intentionally. And people were upset because rather than just ending the program and letting the routers still function as routers, as Bob says, which is what pretty much everybody does, they were intentionally bricked. So I don't know, who knows, there's some kind of liability issue or whatever. But that's the only time I've heard of that. So anyway, I was thinking-- I'm throwing you a rope here, Joe, that maybe you've got your wires crossed.
Joe Carrigan: No, I'm serious. I know I heard this from somebody because right now I'm looking into DDW-- or OpenWrt for my router that's out of support. Rather than buying a new router, I'm just going to put OpenWrt on it, which will have software updates for as long as the project is around.
Dave Bittner: Yeah.
Joe Carrigan: So the security concern will be resolved. And I don't have to go out and buy money. And it's fun to do. I like to do it. Again, I will say if you're not the kind of person that likes to tinker like this, just go buy yourself a new router, and have the best security. So no, I don't think I have my wires crossed here. But I know maybe somebody on one of those videos I was watching made that accusation. And, you know, that's just some guy in his basement.
Maria Varmazis: Right. Bob was right.
Joe Carrigan: Bob's correct.
Dave Bittner: Bob, thank you for the correction.
Joe Carrigan: Mea culpa, mea culpa.
Dave Bittner: We do appreciate it.
Joe Carrigan: Right.
Dave Bittner: All right. What's next, Joe? You have a little musical follow-up?
Joe Carrigan: Yeah, yeah. I wanted to wait for Maria to get back for this. I want to talk about X Japan.
Maria Varmazis: Oh, my God. Is this real life? Okay, I'm here.
Joe Carrigan: Yeah. Maria, you were correct. That singer is divisive. And I fall on the "I do not like that singer" side of--
Maria Varmazis: Yeah, you're not alone. Yeah.
Joe Carrigan: I will. I will say the rest of the band, pretty, pretty kick ass. Pretty good. Pretty good music.
Dave Bittner: Do they have any instrumentals?
Maria Varmazis: They do actually.
Joe Carrigan: And here's another thing. I am not-- like, I was never a big fan of a lot of like-- there's all kinds of Swedish metal bands that sing in Swedish and European. I've never been able to enjoy music that is not in English. Just because part of me listening to the music is understanding what's trying to be communicated. And if I don't speak the language-- I really view music holistically. I want to hear and experience every part of it, including the lyrics. And if I can't really experience that part, then music carries a lot less for me.
Maria Varmazis: Yep.
Dave Bittner: This is why you don't have season tickets to the opera.
Joe Carrigan: Right, yeah. That's an excellent point. You know, there are a few sub-genres of music that I really don't like. Like, I'm not a big fan of death metal, and for the same reason. And I have a whole diatribe I go on about this. Mumble rap is essentially the death metal of the rap world. It comes, and you can't understand a word anybody is saying, and it totally ruins the entire genre. Right. And then generally like pop country. I can't stand that. And then opera. I can't listen to that. But just about everything else I can listen to. Oh, and reggae. I don't like that song.
Dave Bittner: Oh, that's interesting.
Joe Carrigan: Yeah.
Dave Bittner: Okay. Right.
Joe Carrigan: Yeah, but that's it. Everything else is fair game. And there's a lot of other stuff. And for some reason, like this doesn't translate to folk music. Like, if there's some kind of like folk music, I will listen to that, even though I can't understand a word they're saying. It's weird. I don't know, Dave. But for popular music, I need it to be in English.
Dave Bittner: All right. Well, moving on.
Maria Varmazis: Yep.
Joe Carrigan: Sorry. Everybody gets a look into the twisted mind of Joe.
Dave Bittner: That's right. That's right. All right. We got one more bit of listener feedback here. What do we got here, Joe?
Joe Carrigan: This was sent to me by Tony on LinkedIn, who is a security engineer. He goes, "Hey, Joe, how you been? I really enjoy the N2K podcast over the past several years. And 'Hacking Humans' has been a particular favorite because of how informative it is. Your podcasts are among the most professional and insightful ones out there. You, Dave, and Maria make an incredible team."
Dave Bittner: That's very nice.
Joe Carrigan: Thank you, Tony. That is very nice. "In my job, we recently investigated a business email compromise event and vendor payment diversion scam that targeted a local government. I thought your listeners would find it valuable. The attacker impersonated a county planner using publicly available planning and zoning information, including a legitimate case number, to make permit-related payment requests appear authentic. The email followed the normal government procedure or processes and terminology, and it was pretty convincing. It claimed a $5,000 review fee was required and instructed the recipient to request wires-- wire instructions by email."
Maria Varmazis: A $5,000 review fee? Holy cow.
Joe Carrigan: I have never had. I've actually gone over and applied for permits, and when they look at your stuff, that's free.
Dave Bittner: Okay.
Joe Carrigan: Right?
Dave Bittner: Yeah. I don't-- I mean, maybe it's different if you're like building a skyscraper or something.
Joe Carrigan: Right, maybe.
Maria Varmazis: Yeah, potentially, I suppose. I'm thinking it's like a shed in the backyard. I'm like, $5,000, good Lord.
Dave Bittner: Yeah.
Joe Carrigan: I found out if my shed is of a certain size, I don't need a permit where I live now.
Dave Bittner: Okay.
Joe Carrigan: Which is cool because probably I'm going to build a shed after I'm done with this scoop. "Several warning signs stood out. The attacker insisted on email-only communication, refused standard government payment methods, and ultimately convinced the victim to wire funds to what appeared to be a personal bank account rather than an official government one. The invoice also contained inconsistencies, including the metadata suggesting it was created after the state-issued date, and language that referenced the city audit process instead of a county one." So you apply for permits at the county level, but this is talking about some kind of city process. So there's an inconsistency there. "The evidence points to an external impersonation campaign rather than a compromise of county systems. The biggest takeaway is that official branding, real case numbers, and familiar processes do not make payment requests legitimate. Any request involving money, especially one changing payment instructions or requiring a wire transfer, should always be verified through a trusted, independent channel. Best regards, and keep up the great work." Thank you, Tony. This is a really good story. Almost made this my story this week, by the way.
Dave Bittner: Okay.
Joe Carrigan: But I have another one. But I'm fascinated by this kind of thing. Somebody went out there, found some information online, and said, "Look, here's all the contact information for this guy that applied for this permit. I'm just going to try to screw him out of $5,000."
Dave Bittner: Yeah.
Joe Carrigan: And apparently, it was successful.
Dave Bittner: Yeah. Wow. I guess, I mean, that's the flip side of having this information publicly available.
Joe Carrigan: Yeah. We talk about that frequently.
Dave Bittner: Yeah.
Joe Carrigan: Now you want transparency in government, especially at the local level.
Dave Bittner: Right.
Joe Carrigan: Maybe I should say now, especially the federal level.
Dave Bittner: Just all-- yeah.
Joe Carrigan: All levels.
Dave Bittner: You just want transparency in government, full stop.
Joe Carrigan: Yeah, thank you. Thank you, Dave. Thank you for helping clarify that.
Maria Varmazis: And yet, it all being on the open internet, one wonders, what have we--
Joe Carrigan: Right. What is that--
Maria Varmazis: Pandora's box has-- yeah.
Dave Bittner: Yeah. Well, let's say Ben and I over on the "Caveat" podcast talk about this all the time, that it's a velocity issue. Right. It's because it's on the Internet, you're able to vacuum up all this information so quickly.
Joe Carrigan: Right.
Dave Bittner: Where in the old days, you would have had to go down to City Hall or the Department of Records.
Joe Carrigan: Yep.
Dave Bittner: You know.
Joe Carrigan: Not only that, but now you can--
Maria Varmazis: Sweat equity. Yeah.
Joe Carrigan: You can suck it all up. Then you can pump it all into an LLM.
Dave Bittner: Right.
Joe Carrigan: And say, "Hey, structure this data so that I can-- you know, just give me the information in this structure to aid me in my scam." And maybe you even have an LLM that goes, "Yeah, sure, I'll help you do that."
Dave Bittner: Right.
Maria Varmazis: Yeah.
Joe Carrigan: Because there are plenty. If you go to Hugging Face, you can get those LLMs that don't have guardrails on them.
Dave Bittner: Right.
Maria Varmazis: Yeah. And if you combine it with just open-source information, that's just-- maybe open source is not the right word, but information that's just publicly available on the Internet that's non-governmental, thinking like Open Street View type stuff. The barrage that we've seen of bad actors doing really gnarly things with people's public information is just really-- I was reading a thread the other day, people asking, "It's so annoying that the previous owner of my house opted to blur the house on Google Street View. I can't get it unblurred. Why would anyone choose to do this?
Joe Carrigan: Why wouldn't you choose to do that?
Maria Varmazis: Well, here's-- and see, that's my point of view too. However, it was really fascinating reading just thread after thread of people just going, "I don't understand why somebody would opt out of this kind of a convenience." It was like, well, you combine that kind of Google Street View, for example, with all the publicly available information through, you know, your town or your city, and you can make some pretty scary scams that we've talked about a whole bunch of times. So for me, yeah, same as you, Joe. I'd be like, why wouldn't you want to keep that blurred? But, in one case, people were saying, "Hey, I own a business, and now people can't find me." I'm like, okay, yeah. I can see that being annoying.
Joe Carrigan: Put a sign out front.
Maria Varmazis: That's right.
Joe Carrigan: There's a guy in my neighborhood who has a big sharpening service sign right in his front yard. Sharpening service. And I'm like, oh, I might go there and see what he sharpens.
Maria Varmazis: Well, he can't sharpen a blurry image.
Dave Bittner: Oh, nice. Good. Nice, Maria.
Joe Carrigan: Good call, Maria.
Dave Bittner: Oh, see? Oh, I'm so jealous I didn't come up with that one first. Sharpening service for the blurry street view images.
Maria Varmazis: There you go. That's why I'm here.
Dave Bittner: So good. So good.
Joe Carrigan: I didn't know that I was setting that one up.
Dave Bittner: All right.
Joe Carrigan: That is awesome. Wow.
Dave Bittner: All right.
Joe Carrigan: Well done, Maria.
Maria Varmazis: Thank you. Appreciate it.
Dave Bittner: Yeah. Two points for Gryffindor. All right. All right. I'll tell you what. Let's take a quick break. We'll be right back with some stories after this. Stay with us. [ Music ] All right. We are back. And, Maria, you're up first this week. What do you got for us?
Maria Varmazis: Well, I've got just a kind of a quick story that I thought was really fun, I guess. This was from Mallory Sofastaii.
Dave Bittner: "Sofaste."
Maria Varmazis: "Sofaste."
Dave Bittner: Mallory "Sofaste." Regular guest on our show.
Maria Varmazis: Oh, my gosh. So this is the Mallory.
Joe Carrigan: Yes.
Dave Bittner: This is the Mallory.
Maria Varmazis: All right. This is y'all's territory. So Mallory Sofastaii. "Sofaste." Oh, my God. I did it twice. Okay, can we try it a third time to get it right? This is by Mallory Safastaii.
Dave Bittner: Nice, well done.
Maria Varmazis: Did I get that right?
Dave Bittner: That's her.
Maria Varmazis: My brain overwrote my mouth when I was looking at how it's written, and, you know--
Dave Bittner: That's not an easy name.
Joe Carrigan: It isn't, no.
Maria Varmazis: As someone with a not-easy last name, I feel a little bit of a shame that I messed that up. But anyway, this one comes from Mallory, and I thought this was a really funny kind of story, I guess. It was basically there was a jury duty scam that was targeting a woman in the Annapolis, Maryland region. And her name is Nadine O'Drain. What a great name, just for the record. That's amazing. And the scammer that called her was from a local phone number. And she figured, well, this could be my doctor's office. So that is why she picked up the phone. I was like, "Okay, she's an elderly woman. I can see that line of thinking. It makes sense." And the person on the other end of the line was saying that she had missed a jury duty summons. We've talked about scams like this a lot. So that's a sort of familiar script to a lot of us here. And the scammer told her, "Hey, you failed to appear in court for your jury duty. So we're going to charge you a $4,500 fine. And then also contempt of court, we're throwing that in for just good measure. And that's another $4,500 fine. And Ms. O'Drain, thankfully, her antenna went up immediately going, "What?" Like, this doesn't make a lick of sense. But that was sort of the first red flag for her. But the thing that actually made this scam completely fall apart is my favorite bit of detail. The local shibboleths gave the scammer away. So apparently the scammer said that he was from the federal court, and he pronounced the town-- or, see, this is where-- I'm not from your region, so I don't know how to pronounce any of this.
Dave Bittner: Oh, we're here to correct you.
Maria Varmazis: Yes, please.
Joe Carrigan: This is how we tell people who aren't from around here, by the way.
Maria Varmazis: That's right. Well, that's how we deal with a lot of these things, right? He said "Servin" instead of Severin. I would-- Oh, my God, I wasn't even close. Okay, Severin.
Dave Bittner: Severin.
Maria Varmazis: And then also said Ananapolis instead of Annapolis. I think I got that one right.
Joe Carrigan: Annapolis.
Dave Bittner: Annapolis, yeah.
Maria Varmazis: And then he said that she could pay the fine on a place called Church Street, and she said, "Well, there is no such place; it's Church Circle." That said, but he had all of her personal data to validate that-- try and make his claims sound real, like all that public data that we were just talking about. He was trying to make her scared and go, listen, I know all about you, I've got all this info on you, but he clearly had no idea how to pronounce anything locally, and she was going, "You're not from around here. I don't think you know what you're talking about." And hung up on the guy. It was-- I just-- I love that the local shibboleth gave this all away.
Joe Carrigan: I've never heard that word, shibboleth.
Dave Bittner: What's shibboleth? Yeah, I don't know that either.
Maria Varmazis: Oh, gosh. Oh, sorry. Maybe I'm misusing the word. My understanding of that word is sort of like an insider knowledge that indicates to other people that you are of that in-group. So for a lot of us, it's knowing how to pronounce local places and the weird way that local places are often pronounced. Like I have a friend who lives in the Hudson Valley, New York, and there's a bunch of really quaint little villages out there that have names that are very familiar, but they're all pronounced exactly the wrong way. Like the town of Milan, New York, instead of Milan, which is, you know, stuff like that. It just gives you away instantly that you ain't from around there. So I just love that that was how she figured out that the scammer wasn't from around there. And a lot of times you don't, especially for smaller area, you know, smaller places in a region, you don't have the pronunciation as readily available. So it just gave them away. And I just love that. So I don't know. I thought that was a great little bit of color.
Dave Bittner: I have a very kind listener of the Cyber Wire who is from the United Kingdom and writes me whenever I butcher the name of a small town in the UK.
Joe Carrigan: Right.
Dave Bittner: Because they're all like herfersheshire, you know, like-- and he's very nice about it, and I appreciate it.
Joe Carrigan: Smithwicks.
Dave Bittner: I do try to-- yeah, the Scunthorpe is the one that causes spellcheck error problems.
Maria Varmazis: Oh, Smithicks, right, yeah. Yeah, sorry. Yeah. Oh, there's so many of those. You name a region, everyone's got them, so I just love that could actually be-- that gave away the game in this case.
Dave Bittner: What's up your way, Maria, that gives a big giveaway?
Maria Varmazis: In Massachusetts?
Dave Bittner: Yeah. Are there any up there? I'm sure people aren't particular about it, the locals or anything.
Maria Varmazis: Yeah, definitely not. People don't get all up-ons about how you pronounce Worcester or Peabody or Billerica. But I know we're not unique in that. I think every region's got stuff like that.
Joe Carrigan: I thought about making a video going, how Marylanders know you're not from around here. And there is all kinds of things like this. Like we-- I'm sorry, Maria, I stepped all over it. You were going on. But go ahead.
Maria Varmazis: No, I just-- I was thinking about the differences in how you pronounce the same town in two different regions. Like, I know in Pennsylvania, it's Lancaster. But there's also a Lancaster, Massachusetts. But if you pronounce it Lancaster in Pennsylvania, they will run you out of town.
Joe Carrigan: Right. So you have to say Lancaster. My son-in-law is from that region and very adamant about it's Lancaster.
Maria Varmazis: Yep. Lancaster, Massachusetts. Yep.
Joe Carrigan: And I know there's Monticello, New York, and then Jefferson's plantation is Monticello in Virginia. They're both spelled exactly the same. And the thing that makes me know immediately when someone is not from around here is when they say Ellicott City.
Dave Bittner: Yes, I was going to say the same one.
Joe Carrigan: Ellicott City. We don't say Ellicott. We say Ellicott.
Dave Bittner: Yeah, I tell people Ellicott rhymes with delicate.
Joe Carrigan: Right.
Maria Varmazis: Interesting. Well, there's so many. It's like infinite amounts. And, you know, it's a 50-50 on if you're going to get it right half the time. So I wonder when AI will catch up to understanding these sort of local in-jokes in pronunciation. I mean, I keep using the word shibboleth because I really don't know what else to call this. I'm sure there's a better word for it, but that's just sort of how I think of them.
Dave Bittner: We've got another town not far from here that's pronounced "buoy."
Joe Carrigan: Buoy, right.
Dave Bittner: But it's spelled "Bowie" like David Bowie. Yeah.
Maria Varmazis: Oh, gee, I would not-- I would never get that right.
Dave Bittner: No, why would you?
Maria Varmazis: David Bowie.
Dave Bittner: Right? No, why would you? Yeah, there's no reason you would.
Joe Carrigan: Yeah, there's a university there Bowie State.
Dave Bittner: Yeah.
Joe Carrigan: And people from out of town call it Bowie State.
Dave Bittner: Yeah, and those people are wrong.
Joe Carrigan: Yes, they are.
Maria Varmazis: Yeah, I guess flip side, though, if you did pronounce everything correctly and you were from that area, that would give more credence to the scam. So I suppose that could be weaponized in that way, too. But in this case, thankfully, it worked in Miss O'Drain's advantage. So I'm glad to hear it.
Dave Bittner: When I was a student at the University of Maryland, there was a building there called Tolliver Hall, and it's spelled Taliaferro. And that was how you knew the freshmen on campus. They'd ask you-- and I was one of them. "How do I get to Taliaferro Hall? And they would look down and shake their head at you ruefully.
Joe Carrigan: And that and the-- you can tell the freshman girls because they were still carrying purses. And then the freshman guys would always have two straps of their backpack on.
Dave Bittner: Oh, okay.
Maria Varmazis: That's very of its time, Joe.
Dave Bittner: Yeah.
Maria Varmazis: The straps of the backpack thing.
Joe Carrigan: Right.
Dave Bittner: Yeah, I think they've gotten over that one.
Maria Varmazis: Yeah, I don't think that's a thing anymore.
Joe Carrigan: Actually, I don't think a lot of high school girls carry purses anymore, but back in the '80s, they sure did.
Maria Varmazis: Yeah, I don't think young people care about one strap. No.
Dave Bittner: No, no, no, no.
Maria Varmazis: They like having their spines going in the right direction.
Dave Bittner: That's right.
Joe Carrigan: Yeah, I've adapted now. With my backpack, I have to wear two straps. I can't just sling at one strap and put it on, and my wife makes fun of me. Being a child of the '80s yourself, yeah.
Maria Varmazis: Does anyone under the age of 40 know what the heck we are talking about?
Dave Bittner: Probably not. Joe's backpack is the size of, you know, an international shipping container.
Maria Varmazis: That is true. I have seen it. It scares me. I feel bad for your spine.
Dave Bittner: Has its own zip code. Joe's backpack.
Joe Carrigan: Right.
Maria Varmazis: Does it qualify as a weapon in some situations? I'm sure it could.
Dave Bittner: Right. Sir, are you going to try to carry that on the plane?
Joe Carrigan: I do have a hard time getting through the TSA with it, multiple times.
Maria Varmazis: I don't doubt it.
Joe Carrigan: Although I do get comments, this is an awesome backpack, and I tell them this is the best backpack I've ever owned.
Dave Bittner: All right. Let's move on.
Joe Carrigan: Okay.
Dave Bittner: We'll have a link to Maria's story in the show notes. Joe, you're up. What do you got for us?
Joe Carrigan: I have something that has a lot of similarity to Maria's story, but this comes from our "It Can Happen to Anyone" department.
Dave Bittner: Okay.
Joe Carrigan: This happened to Matt Gutman, who is a CBS chief correspondent for their news department.
Maria Varmazis: Yeah!
Joe Carrigan: And here's the thing about him. He frequently covers scams. So he posted on X that on July 10th that he-- a tweet. I just-- I guess what is it now called? An X? It's not a tweet anymore if you're not on Twitter.
Dave Bittner: I don't know what you'd call it.
Joe Carrigan: All right.
Dave Bittner: Exclamation.
Joe Carrigan: You're helping, Dave. "I just got scammed." So here's what happened to him. He had a call from his bank from the "fraud protection" department. And fraud protection is in quotes here. And it said, "People are illegally withdrawing money from your account," is what the person on the phone said. And this person had a name, a badge ID, which I don't know why a bank employee would have a badge ID and not an employee number. But here's the most interesting part is that they had insider knowledge about his bank account. They had some other information that was convincing enough. And he-- what he said is, "We suspect that there is significant fraud activity at the branch where you bank." So the caller told him that the fraudsters are inside the bank and he had to help catch them. So here's what you do, you go to your local bank, you take out a big pile of cash, and that will prompt the scammers to act inside the bank, right?
Dave Bittner: Okay.
Joe Carrigan: And now they give him a little bit of isolation here. They say-- they say, "Don't tell anyone at the bank because they may be in on it." Right? Right. So now, here's the interesting part. Matt was actually convinced based on the caller's knowledge of his account and a little bit of coincidental timing. There had been some recent fraud activity on his daughter's account, which, you know, we talk about this all the time as well. This is a numbers game for these scammers.
Dave Bittner: Right.
Joe Carrigan: And when you think to yourself, how could somebody fall for this? Well, think about Matt's situation. Matt's daughter just had actual fraudulent activity on her bank account. Here's the bank saying, oh, now they're doing something to your account.
Dave Bittner: He's primed.
Joe Carrigan: He's primed already by his circumstances, not by anything else. These guys didn't have to do any of the work.
Maria Varmazis: It's just coincidence, but they got lucky.
Joe Carrigan: It is just a coincidence.
Dave Bittner: Yeah.
Joe Carrigan: So he goes to the bank, and he went to the teller, and he starts withdrawing funds. And then this thought occurs to him. He goes-- I'm going to quote the article. "There is no way this is possibly real that anyone would use a regular civilian for a sting operation at a bank." It's just good thought. It just dawned on him.
Maria Varmazis: I mean, but also, he's a journalist, so, I mean, maybe they're thinking he could be helped. I mean, I could imagine him going, "As a journalist, maybe I could help with the sting, and this is a scoop or something."
Dave Bittner: Nothing else is going to make a great story, which it did.
Joe Carrigan: Which it does.
Maria Varmazis: Which it did but not for the reason he thought, yeah.
Joe Carrigan: Right. So, thankfully, he had thought this before it was too late, and he didn't lose any money. But he said the scary thing was that he found out these scammers often call, make these calls, and then they know what you look like. And when you walk out of the bank, they rob you. I mean, it's an old up close and personal robbery.
Maria Varmazis: Dang, kind of retro. You just get mugged. Oh, my God.
Joe Carrigan: You just get mugged after, you know, go take $5,000 out of your bank account. And then you walk out of the bank with $5,000 cash and somebody sticks a gun at you and says, "Give me the money."
Maria Varmazis: Yeah, that's terrifying.
Joe Carrigan: You're like, "What money?" He says, "We know you just withdrew $5,000 from your bank account."
Maria Varmazis: Oh, boy.
Dave Bittner: Because we're on the inside.
Joe Carrigan: Because we're on the inside.
Dave Bittner: Yeah.
Joe Carrigan: The story has a quote from Joshua Copeland, who is an adjunct professor at Tulane University, and he teaches a bunch of stuff, including risk management and cybersecurity. He says the traditional phone scams typically involved contacting large numbers of individuals with generic narratives, and contemporary scams are increasingly personalized. And Copeland called this a deliberately orchestrated social engineering operation rather than a random call. So this is something that these people targeted. Now, I'm going to bet that these guys had some kind of information because Copeland says that scammers get this information from social media, public records, and data breaches.
Dave Bittner: Right.
Joe Carrigan: And then they use some kind of caller ID spoofing, which for some reason is still a thing.
Maria Varmazis: Yeah. Gosh.
Joe Carrigan: To bolster their credibility.
Dave Bittner: Right.
Joe Carrigan: And I'm going to bet that behind the scene, what these guys are doing is they're taking all this data and pumping it into another LLM. And they're coming up with all these different cases where they can just start with a very targeted and probably much more-- well, I'm going to not say probably-- and much more successful, higher rate of success script that they can talk to somebody and convince them that they're real. So there's a great bit of advice in here that comes from Darius Kingsley, who is the head of consumer fraud and scam prevention at JPMorgan Chase. He says, "If you receive a call from someone claiming to be your bank, the best thing to do is hang up and call your bank and the number of the back of your credit card." And he also provided another simple rule to follow that should protect you from most types of scams. Don't send money. Avoid sending money to anyone you've only spoken to online or by phone. So that's-- I don't know. I think that's probably good advice. I still like to do a lot of things by cash and check in person. But I don't know. Yeah, I don't know. What do you guys think about this? I mean, I think this is good advice, generally speaking.
Dave Bittner: I'm curious about how they got information about his bank account. So I'm curious for the two of you, do either of you still get paper accountings from your bank mailed to you?
Joe Carrigan: Yes.
Maria Varmazis: I don't think I do, no.
Dave Bittner: I don't think I do either, but it seems to me like that could be a way. If I was-- if I had somebody keeping an eye on your mailbox.
Joe Carrigan: Right.
Dave Bittner: Right.
Maria Varmazis: That has definitely happened to me in the past where some stuff that was in the mail or recycling caused issues later.
Dave Bittner: I hadn't thought about recycling. Yes.
Maria Varmazis: Yeah. Yeah.
Joe Carrigan: I do shred those documents.
Dave Bittner: Yeah.
Maria Varmazis: Yeah. You know, I got lazy. I remember thinking there's no way anybody's going through my trash. This was years ago. I learned the hard way that actually, yes. So it can happen. It happened to me.
Dave Bittner: Because if somebody just had a bank statement, they could say, "Well, I'm looking at the-- you know, you're at the grocery store two weeks ago, and you spent this amount." And, you know, how would they know that?
Joe Carrigan: Right.
Dave Bittner: So maybe it's something like that.
Joe Carrigan: Yeah, it could be just as simple as dumpster diving.
Maria Varmazis: Something as simple as his information was lost in a breach and someone's-- he hadn't changed his password. I mean--
Dave Bittner: Yeah.
Maria Varmazis: People do it. Yeah.
Dave Bittner: Yeah, absolutely. On your bank account, multi-factor authentication.
Maria Varmazis: Please, yes.
Joe Carrigan: Yes, indeed.
Maria Varmazis: Anything having to do with all the good stuff.
Dave Bittner: Anything having to do with money. Yeah.
Maria Varmazis: Yeah.
Dave Bittner: All right. Well, interesting story. And we'll have a link to that in the show notes. I'll tell you what, let's take a quick break here. We'll be right back after these messages. [ Music ] All right, we are back. And my story this week actually is generated from an email I got from one of our regular listeners. This is a listener and regular contributor. This is someone who enjoyed a career in federal law enforcement but requests anonymity. I know who this person is, so I can vouch for them, but they don't want their name used on the show, so I respect that.
Joe Carrigan: Yeah, absolutely.
Dave Bittner: And I thought this was pretty clever. Now, Maria, I know you are a "Star Trek" fan.
Maria Varmazis: Yeah. Ah, yes.
Dave Bittner: Now, which is your-- which is-- when I say "Star Trek," which is your "Star Trek?"
Maria Varmazis: I mean, the one that is mine is "The Next Generation," but I have to say my favorite is "Deep Space Nine."
Dave Bittner: Okay. I'm a Next Generation guy.
Maria Varmazis: I know it gets people going, hmm. But "The Next Generation" is the one I grew up with.
Joe Carrigan: Yeah, I like "The Next Generation." That's probably my favorite. I am also more of a Star Trek person than "Star Wars."
Dave Bittner: Yeah, I'm definitely more of a "Star Wars" person than a "Star Trek" person. In fact, I remember the first time my neighbor kid asked if I wanted to go see this new movie, "Star Wars." I thought to myself, that sounds a lot like "Star Trek," and I don't like "Star Trek." But all right, I'll go. Little did I know how much it was going to change my life.
Maria Varmazis: Yeah, you're kind of an equal opportunity Trek and Wars fan, I feel.
Dave Bittner: I am but "Star Wars" is closest to my heart but I do love, particularly "The Next Generation Star Trek." At any rate, what our listener wrote in about was, I think, a very interesting guidance and metaphor for the kind of things we talk about. They said, "Looking back, one of the things that stands out to me about Captain Kirk-- " and I will add, and Captain Picard, "is that when an unknown spacecraft suddenly appeared on the view screen, his first response was not to assume hostile intent, but neither was it to assume friendly intent. He recognized a simple reality. He did not yet understand the situation. His response?" Maria?
Maria Varmazis: Shields up.
Dave Bittner: Shields up.
Maria Varmazis: Or yellow alert, as I think they introduced in the '90s.
Dave Bittner: Yes. Yes. Not because he knew there was a danger, because he did not yet know." Our listener says, "I think there's a lesson here for how we handle unexpected phone calls, text messages, emails and other inbound communications. When an unexpected caller claims there's a problem with your bank account, your computer, taxes, package, or anything else of consequence, remember that you have just entered a situation you did not create and do not yet understand. There is no requirement to solve that problem in real time on their timetable, on their terms, within an environment they control."
Maria Varmazis: Damn. Tattoo that on your forehead. That's just brilliant right there. My goodness.
Joe Carrigan: We should make t-shirts.
Maria Varmazis: Yeah. Yes. Preach. That's so great. Yep.
Dave Bittner: He goes on. He says, "Instead, this is an unknown situation. Shields up. Understand the situation. Adjust your posture accordingly. Shields up does not mean panic, paranoia, or assuming everyone is a scammer."
Maria Varmazis: Yes, Joe.
Joe Carrigan: That's for me, isn't it? I have a great story.
Maria Varmazis: I like how you instantly fessed up. You're like, yep.
Dave Bittner: Mr. Carrigan, I am your mailman. It is my job to put these letters in your mailbox.
Joe Carrigan: You stop bringing those bills to my house.
Dave Bittner: I am wearing a United States Postal Service uniform.
Maria Varmazis: You can buy those on Amazon.
Dave Bittner: I'm driving a postal truck.
Maria Varmazis: Probably also get that on Amazon.
Joe Carrigan: My steering wheel is on the right side of the car. That's just a British car.
Dave Bittner: Yeah, it's right.
Maria Varmazis: Oh, my God.
Dave Bittner: "It means adopting a protective posture until you understand what you're dealing with. Slow things down. Create time and distance. Maintain control of the situation. Then decide what happens next. Many scams succeed because people feel compelled to act before they understand. The moment someone tells you there's a problem is often the moment your shields should go up."
Joe Carrigan: Interesting.
Maria Varmazis: Wow. Brilliant.
Joe Carrigan: This is great.
Maria Varmazis: Absolutely brilliant.
Dave Bittner: I got this email, and I read through it and immediately wrote back and said, "Can I use this on the show?" He was like, "Yes, please, please."
Joe Carrigan: This is great.
Maria Varmazis: We should just read this every week. It's perfect, honestly.
Joe Carrigan: We should put this in the show closure. Remember, there's no need for-- there's no requirement that you solve a problem in real time on the caller's timetable, on their terms, in an environment they control.
Maria Varmazis: Yeah. Yep.
Dave Bittner: You know what somebody should do is make refrigerator magnets.
Joe Carrigan: Yes.
Dave Bittner: Right?
Maria Varmazis: Somebody should reach out to Bill Shatner and say, "Listen, can you please read this for us?"
Dave Bittner: Oh, wow. Yeah.
Maria Varmazis: Can you imagine if we could get him to read this?
Joe Carrigan: That would be awesome.
Maria Varmazis: Oh, we can't afford it, though. But it would be amazing.
Dave Bittner: We'll get producer Liz on it.
Joe Carrigan: Or Patrick Stewart, maybe?
Dave Bittner: Shatner, Patrick Stewart.
Maria Varmazis: Definitely cannot afford Patrick Stewart.
Dave Bittner: I don't know. Are there any Star Trek captains who are down on their luck right now who might need--? I don't know who haven't worked in a while.
Joe Carrigan: Shatner's doing a lot of oil commercials.
Maria Varmazis: How is Scott Bakula doing?
Joe Carrigan: Scott Bakula, yeah.
Dave Bittner: Who played the Borg Queen? Maybe we can get her. I don't know. What's Michael Dorn up to these days?
Maria Varmazis: He's still working? Oh, we could probably get Michael Dorn. Oh, yeah.
Dave Bittner: He's a good guy.
Joe Carrigan: Brent Spiner. We could probably get Brent Spiner.
Maria Varmazis: I would die. Just for the record, I would actually die. So, you know, I don't think I could handle it. Or John de Lancie. I would also actually--
Joe Carrigan: John de Lancie.
Dave Bittner: Oh, yeah.
Joe Carrigan: That would be good.
Maria Varmazis: Yeah. Yeah. Can you imagine Q telling you this?
Joe Carrigan: Yeah, Q telling you that.
Maria Varmazis: I would die.
Joe Carrigan: What does Q care? He'll just go around your shields anyway.
Dave Bittner: That's true.
Maria Varmazis: If you don't like the laws of physics, you can just change them. Right.
Joe Carrigan: He shows up with the mariachi band, puts cigars in your hand.
Dave Bittner: I do like Q for all those reasons.
Maria Varmazis: Yep.
Joe Carrigan: And John de Lancie kills that. He's so good at that.
Dave Bittner: Yeah, he's really good.
Maria Varmazis: We can maybe get Robert Picardo. Oh, man.
Dave Bittner: Robert Picardo.
Joe Carrigan: Robert Picardo, yeah.
Dave Bittner: What about Wil Wheaton? He's nerdy enough.
Joe Carrigan: No.
Maria Varmazis: I will not stand for Wil Wheaton's slander. He's amazing. I love him.
Joe Carrigan: No.
Maria Varmazis: Don't be mean to him. I don't like that.
Joe Carrigan: As long as I can say, shut up, Wesley, we're good.
Maria Varmazis: No, no, don't say that. That's so mean.
Dave Bittner: Well, okay. Well, you're off the show.
Joe Carrigan: Yeah.
Dave Bittner: Sorry. It's come down to this.
Maria Varmazis: Listen, we're talking "Star Trek." I'm going to stand up for Wesley. He was a kid.
Dave Bittner: Yeah.
Joe Carrigan: Yeah. What's he doing on the bridge?
Maria Varmazis: That's not his fault.
Joe Carrigan: Yeah, I know. That's the writer's fault.
Maria Varmazis: Yep.
Dave Bittner: All right. Well, again, thanks to our listener for sending this in. Good stuff, and yeah, absolutely appreciate it.
Maria Varmazis: Jonathan Frakes. That's who we should get to read it.
Joe Carrigan: Jonathan Frakes, yeah.
Dave Bittner: He'd be good. How about Whoopi Goldberg?
Maria Varmazis: Oh! Guinan telling you to shield-- okay, I'll stop now. Sorry, sorry.
Dave Bittner: You know, my wife actually spoke with Whoopi Goldberg on the phone once.
Joe Carrigan: Really?
Dave Bittner: Yeah.
Maria Varmazis: Really?
Dave Bittner: Yeah. It was very nice. She was very nice, as you would expect.
Maria Varmazis: I would imagine. That's cool.
Dave Bittner: All right. We would love to hear from you. If there's something you'd like us to talk about on the show, please email us. It's hackinghumans@n2k.com. Joe, Maria, it is time for our "Catch of the Day." [ Soundbite of Reeling in the Fishing Line ] [ Music ]
Joe Carrigan: Dave, our "Catch of the Day" was sent to us by a listener named William. And the subject of this email is "I need your forgiveness" in all caps. Maybe I should just yell it. It claims to come from someone named Mr. James Morrison. But I don't know. I'm going to guess it isn't from someone named James.
Dave Bittner: All right. Do you want me to do the honors?
Joe Carrigan: Yes.
Maria Varmazis: Good luck.
Dave Bittner: It looks like this. "I need your forgiveness. I am an internet fraudster and scamming people for the past 22 years. I made over $450 million over the years with all kinds of expensive cars, houses, and living extremely rich life. I made so much money from scamming people, but now I realize that nothing good lasts forever and no amount of money can buy life. I've been hospitalized for months on a life-supporting machine over lung cancer. And my doctor said I've less than 48 hours on this earth. Yesterday, my pastor visited me at the hospital. And while he was praying, he told me to confess my sins and ask God for forgiveness. Then I confessed to my pastor how on I used to scam people and how I made over $450 million from defrauding people through the Internet. Then my pastor said that I needed to give all those money and properties away, especially to those I defrauded. But unfortunately, most of the people I defrauded are late now, but I have decided to split all those money to everybody found on my computer contacts."
Maria Varmazis: That's one sentence, isn't it?
Dave Bittner: It is. "I have listed all the email names on my contact list and decided to compensate all the people I found on my contact list with a sum of $500,000 each."
Joe Carrigan: Hallelujah.
Dave Bittner: "And to be honest, 90% of the people I defrauded was from America. So I'm doing exactly what my pastor said, that I should return all those money back to those I collected it from before I can seek the face of the Lord. I have selected all the American contact details on my computer, and yours was among them, probably. You and I might have something in the past, but that I can't remember anymore because all that matters to me now is pay back this money so I can be free to seek the face of God. And for these reasons, I have already concluded an arrangement with my bank to pay the sum of $500,000 each to any name submitted by my pastor. The bank can only make payment to only those names submitted by my pastor, as I have handed all the payment transaction to him as the only one I can trust at the moment of knowing that I might not even be alive in the next 48 hours, as the doctor said. So, I will advise you to kindly contact my pastor with below details. Name, Reverend Pastor Francis Easy of Live in Faith Church of God. Please, you have to contact my pastor immediately for your compensation of half a million dollars from me. And also find it in your heart to forgive me. And if this is all I have to do for God to have mercy on my soul and forgive me, then I am ready and willing to give away all the money and the properties besides."
Maria Varmazis: Oh, Lord, he's ready.
Dave Bittner: "What is the need of money, luxury cars and houses when you don't have a life? It's better I return all this money rather than leaving it at the bank for those corrupt bank managers or even the government to take over all my assets when I'm gone. So please, you have to contact my pastor for your $500,000 compensation. And do remember to forgive my mistakes, as I'm not sure if I will still be alive for the next 48 hours, just like my doctor said. Yours truly, James Morrison, a.k.a. Hush Puppy." [ Applause ] Can I get a hallelujah? Hush Puppy.
Maria Varmazis: Hallelujah.
Dave Bittner: Wow. You know, it's a shame with all that money he couldn't afford any punctuation.
Joe Carrigan: Right.
Maria Varmazis: He's going to die from running out of breath.
Joe Carrigan: Right.
Dave Bittner: I was going to die from running out of breath.
Joe Carrigan: You don't even have lung cancer like this guy does.
Maria Varmazis: Oh, my God.
Dave Bittner: Wow.
Maria Varmazis: What the heck?
Dave Bittner: Well, a lot going on here. I mean, this is a scam we've seen before, right? This is the "please help me give away my money" scam.
Joe Carrigan: Yep.
Dave Bittner: Pretty common.
Maria Varmazis: Won't anyone take this free pile of money? Gosh.
Dave Bittner: Yeah, I can't find anyone. I'd say this is a new twist on it.
Joe Carrigan: It is. I've not seen this one before.
Dave Bittner: No.
Joe Carrigan: A lot of reaching out to or trying to appeal to people's religious sensibilities here.
Dave Bittner: Right.
Joe Carrigan: So it's--
Maria Varmazis: Yeah.
Joe Carrigan: Go ahead, Maria.
Maria Varmazis: I was going to say, I really like that it actually starts by disarming you, saying, hey, I'm actually an Internet fraudster. So you read it, and you're going, okay, they're starting out honestly.
Joe Carrigan: Right.
Dave Bittner: Right.
Maria Varmazis: It is kind of an interesting tactic.
Dave Bittner: Yeah.
Maria Varmazis: Very interesting.
Dave Bittner: Yeah. And, yeah. Lots of-- well, obviously, no punctuation and some sporty English. So I'm going to say this went through some kind of translation engine.
Joe Carrigan: Yeah.
Dave Bittner: Not a recent one.
Joe Carrigan: "I will ask, what does it profit a man if he gained the world yet loses his soul?"
Dave Bittner: Yeah.
Joe Carrigan: So this, I mean, this seems in line with a lot of thinking, but it's far from small or orthodox thinking, if you understand what I'm saying.
Maria Varmazis: I appreciate the clarification on that.
Dave Bittner: Thank you, Reverend Joe.
Maria Varmazis: Thanks, Joe.
Dave Bittner: Not a reverend. So what would likely happen if we engaged with these folks?
Joe Carrigan: Oh, they're just going to give you advanced fee scams. You know, that's all it is.
Dave Bittner: Yeah, they're going to ask you for money. In order to get the big money, you have to give them a little bit of money, which in this case would probably be a few thousand dollars.
Joe Carrigan: Yep.
Dave Bittner: You would never see again.
Joe Carrigan: That's right.
Dave Bittner: All right. Well, again, thanks to our listener, William, for sending that in. That was a great one. And we would love to hear from you. You can email us. It's hackinghumans@n2k.com. [ Music ] And that is our show brought to you by N2K Cyber Wire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights to keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliott Peltzman and Tré Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe Carrigan.
Maria Varmazis: And I'm Maria Varmazis.
Dave Bittner: Thanks for listening. [ Music ]
