A golden opportunity...for fraud.
Maria Varmazis: Hello, everyone; and welcome to Hacking Humans where each week we take a look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I am Maria Varmazis in for our friend and cohost Dave Bittner. And joining me is Joe Carrigan. Hi, Joe.
Joe Carrigan: Hi, Maria. How are you?
Maria Varmazis: Good. I'm -- I'm excellent. And also joining us today is friend of the show Michelle Kellerman. Hi, Michelle.
Michelle Kellerman: Hey, Maria. Hey, Joe.
Maria Varmazis: How's it going?
Michelle Kellerman: Doing pretty well.
Maria Varmazis: Awesome. Awesome. Well, thanks for joining us today. Now, we have some interesting stories to share this week while Dave is away. But, first, let's get into our follow-up. And I understand, Joe, that we have some very exciting follow-up from the world of chickens.
Joe Carrigan: Yes. It's a chicken update.
Maria Varmazis: Chicken update.
Joe Carrigan: Yeah. You know, I know a lot of people don't listen to -- don't like the chicken updates. But you know what? We have only had, like, one chicken update in the past month and a half. So here's another chicken update for people that do like the chicken updates. And we have been -- we have uncovered the infinite chicken glitch.
Maria Varmazis: The infinite the infinite chicken glitch.
Michelle Kellerman: The what?
Joe Carrigan: Infinite chicken glitch.
Michelle Kellerman: Okay.
Joe Carrigan: Because I have a rooster, I have eggs that are fertilized. And we took some of those eggs over to my daughter's house where she had some broody hens, and they laid on them. Being that they are chickens and quite possibly the dumbest of farm animals, they started abandoning the nests they were brooding on. I guess they just stopped getting broody. I don't know why that happens, but then my daughter quickly snatched up the eggs and took them into an incubator. And so far we have hatched about 10 chicks successfully.
Maria Varmazis: Wow! Well, it's not infinite, though. Just to be a total pedant, the that's 10. That is actually quite finite.
Joe Carrigan: Right. But my chickens are still laying eggs.
Maria Varmazis: Oh. Okay. So maybe.
Joe Carrigan: Keep this going for years.
Maria Varmazis: Okay.
Michelle Kellerman: Infinite chicken issue pending.
Joe Carrigan: Right. So yeah. So we watched -- we watched one of them hatch last night. My daughter called them -- called us -- called us on a group chat phone call with video, and my wife was on her phone. And we watched this chicken come out of the egg and be free.
Maria Varmazis: Aww.
Joe Carrigan: He or she -- we don't know -- is -- was waddling around in the incubator. And so cute. Cute little messy chicken that comes out of there. They're not all -- they're not the cute fluff balls for about 12 hours. They look kind of greasy and disgusting.
Michelle Kellerman: Like all babies kind of. Yeah. Newborns are not cute.
Joe Carrigan: That's true. And I want to point out that, while we were on the phone on this Facebook call, my wife's phone was at 7% battery at the end.
Maria Varmazis: No. You're -- really?
Joe Carrigan: Yeah. I don't know how she does it. I mean.
Michelle Kellerman: Some people don't fear God, let alone --
Joe Carrigan: I'm going to have to go plug this in at some point on play. You're going to have to go plug this. You've got to do that now.
Maria Varmazis: Yeah. I mean, like, be tethered to the wall if you're at 7%. Don't -- yeah. I -- that's --
Michelle Kellerman: You're running out of runway here, Cap. What?
Maria Varmazis: Well, if you're not living on the edge, you're taking up too much space, as a T-shirt in the '90s once said. So maybe your wife lives by that motto.
Joe Carrigan: Yes.
Michelle Kellerman: Oh, yeah. I'm sure.
Maria Varmazis: No fear.
Joe Carrigan: That's right.
Maria Varmazis: Just throwing it back.
Joe Carrigan: No man.
Maria Varmazis: That's -- and no low battery.
Joe Carrigan: Right.
Maria Varmazis: Well, that is exciting. So when -- when are you at a point with the baby chicks that you can know if they're male or female? Like, what --
Michelle Kellerman: I was wondering that.
Joe Carrigan: If you know what you're doing, you can -- that's called sexing.
Maria Varmazis: Yes.
Joe Carrigan: Determine the sex of the chicken. If you know what you're doing -- which we really don't because, if we did know what we were doing, I wouldn't have a rooster -- you can tell pretty quickly by the feathers. But, if you wait about -- about four weeks, one of them -- any of the roosters will start showing signs of roosterdom, and they'll have longer tails.
Maria Varmazis: Huh.
Joe Carrigan: And you can tell which ones are boys and which ones are girls pretty quickly.
Maria Varmazis: And then -- and then you have chicken nuggets is what I I understand.
Joe Carrigan: Yeah. We'll probably wind up having chicken nuggets with those with the roosters because we're going to be having coq au vin here next week after we dispatch our rooster. So we'll see how that goes. And maybe next week I'll have an update on that, but probably not.
Maria Varmazis: Okay.
Joe Carrigan: It probably won't be until the following week.
Michelle Kellerman: Yeah. Maybe not -- maybe not updates on the nuggets. I don't know. Don't know how that's going to land with folks.
Maria Varmazis: That's farm life for you. I mean, that's the reality of farm life. I don't know. I'm -- I'm pretty suburban. But even I'm like, yeah. That's -- that's what you do. I don't know. But I don't know.
Joe Carrigan: I'm a farmer now.
Maria Varmazis: Yeah. Well, no. I -- I have very old world parents, so I -- I -- my dad told me his technique for -- you know what? I'm going to leave this part off the show.
Joe Carrigan: Yeah. We'll save that for afterwards.
Maria Varmazis: Save it for after. Hacking Humans After Dark. Yeah. Anyway. Well, thank you for that update, Joe. Appreciate it. And I'm sure our chicken fans are are thrilled to to hear about your infinite chicken glitch. Just need to feed them, you know, as it is. Well, that's awesome. So we'll take a quick break now before we get back into our story. So quick break. And we are back. All right. So, for this episode, ends up that I am actually going first. And I'm not trying to be a total prima donna because, you know, I'm doing the show VO today. But, yeah. I'll start. And my story --
Joe Carrigan: It's just the regular distribution of hosting.
Maria Varmazis: Yeah. It is actually the algorithm that we use. Thank you for backing me up on that, Joe. We have an algorithm that Joe has and just said that it's me today. So the story that I have comes from Africa News. And, you know, the reason I picked this story is I saw a little news blip that reminded me that 35 years ago this week, I believe, in 1991 Al Gore invented the internet, and then we all found out that this whole time a wealthy Nigerian prince had been waiting to give us his money. And, you know, that -- I think my life was forever changed.
Michelle Kellerman: Oh, my gosh.
Maria Varmazis: I -- I felt that sigh of exasperation.
Joe Carrigan: Yeah.
Maria Varmazis: I felt it in my soul, and that made it worth it. I that you for that, Michelle.
Joe Carrigan: That goes back to 1992, and I'll tell you that story offline. But --
Maria Varmazis: Okay.
Joe Carrigan: I am not a fan of Al Gore, nor have I ever been. And, you know.
Maria Varmazis: But he invented the internet, Joe.
Joe Carrigan: He -- he tried to claim credit for the explosion of the internet because he was making campaign promises on the trail. We're going to build an information superhighway.
Maria Varmazis: Oh, we got Joe started. We got just --
Michelle Kellerman: I'm going to say bail out, bail out.
Maria Varmazis: All right. Bailing out.
Michelle Kellerman: Tuck and roll.
Maria Varmazis: Okay. So the reason I brought all that up is it occurs to me that the last couple of months we've been talking a lot, justifiably, about crime, cybercrime centers in Southeast Asia and the human suffering therein and the amount of money that the criminals there are stealing from people over the world. But we haven't talked as much about lately about what's been going on in Africa. And I was like, you know what? I think it's time we take a second look. So this story from African News is reporting on something from Interpol. They have a report called the African Cyberthreat Assessment Report 2026, and the story just goes over some of the things that this report found. So one of the bits of information was that 55% of cybercrime cases recorded across the African continent did involve the use of AI based on data that they collected over 36 African countries. The Interpol report says that, basically, especially thanks to AI making things much more scalable for the criminals, cross-border cybercrime has become even harder for authorities to detect and stop. So I don't think that -- and none of this is going to make us go, what? Really? But I just thought some of the data that was floated in this story was really interesting. So, according to this Interpol report, cybercrime-related financial losses climbed from 192 million US dollars in 2024 to 484 US million dollars. And they do attribute that increase directly to -- wait for it -- AI-powered fraud, as well as stolen login credentials and sophisticated social engineering attacks. And 72% of the countries that were surveyed said that they definitely knew about scam centers operating within their borders, with the highest concentration of scam centers being located in both West and Southern Africa. So, again, this sort of tracks with some stuff that we know. But another thing that, again, some of this was fascinating to me. They actually did -- did a little dig in with what kinds of cybercrime tends to be located in what areas of Africa. I -- I mean, I feel like we would go, okay. Nigeria, we sort of have a sense of what goes on there with, you know, the yahoo boys and that kind of thing.
Joe Carrigan: Yahoo! boys.
Maria Varmazis: Right. But, in East Africa, mobile money fraud and ransomware attacks targeting critical infrastructure are considered among the biggest threats. So I did not know that. I thought that was very interesting.
Michelle Kellerman: Interesting.
Maria Varmazis: West and Central Africa continue to experience high levels of what they call business email compromise and romance scams. Again, not a huge surprise there. And then Southern Africa, because they are generally more advanced in terms of digital connectivity, they are apparently an attractive target for international cybercriminal networks that are trying to maximize disruption. So not so much necessary a place where the scams are are located so much as a place the scams are targeting. And the Interpol report also mentions that AI is making everything worse. News at 11. So I just I -- I just thought that was very interesting. And, again, we hadn't talked about, you know, cybercrime located in and affecting Africa for some time. So I just wanted to to raise that. Thoughts.
Michelle Kellerman: Yeah. We -- this kind of reminds me of -- there's an author, Dmitri Alperovitch, in one of his books where he talked about crime, like cybercrime, as a geopolitical tool and how you can know what to look for when you look at the country itself. Cybercrime is just a mechanism to reach their goals and within their limitations. And you see that with, like, China. A lot of times, you have to look for money laundering, which is why crypto is so big. And, you know, you get into, like, the money laundering and sleight of hand schemes from China because they have export controls, whereas, in Africa, they have different goals. They have different infrastructure struggles. They have -- they are going to be looking for maybe lower amounts of money that you wouldn't think of because the conversion rate, the money goes a lot farther in Africa. So they can -- this is attractive to them, especially with, like, more limited international trade and things like that where you would find other scams. So it makes sense. We just never really talk about it. It's not an easy target. It's not a common mechanism that we would think about, but it makes a ton of sense that they would be interested in this.
Maria Varmazis: Yeah, yeah. And -- and you mentioned China, and I -- I just -- this is anecdotal. But the article in Africa News, I thought it was interesting, notable; but I didn't want to read too much into it, that the top image they have accompanying this article is of Chinese nationals being led into court in Zambia. So I was, like, are they trying to imply something here about who is committing these crimes? Or is this just a broader maybe a sense of a trend of, if a crime is harder to detect and potentially track, you know, track down and stop in places where the laws are weaker, is this becoming, like, international tourism for committing cybercrime?
Michelle Kellerman: Yeah. I could absolutely see that.
Joe Carrigan: Yeah.
Maria Varmazis: Yeah.
Joe Carrigan: We've had stories on here about people doing what they call jurisdiction shopping. I think Maria, that was your story --
Maria Varmazis: That was last week. Yeah.
Michelle Kellerman: Yeah.
Joe Carrigan: So, yeah. They look for it. And I'm not surprised. West Africa, that's where Nigeria is. So that's where the yahoo boys are. And the Southern Africa, I think I had a story a couple weeks ago about a global scam that was broken up where people were impersonating a Brazilian police office out of -- of a country in the southern part of Africa.
Maria Varmazis: Hmm. It's -- it's interesting. And, you know, there's no -- as I said, nothing here blows my hair back in terms of, oh, I'm so shocked. But just to to hear that essentially that the amount of money being stolen through cybercrime through Africa has tripled, quadrupled. I'm not great at math, but it's gone up a lot.
Joe Carrigan: Right.
Maria Varmazis: And, again, it's it just confirms a lot of suspicions and gut feelings, I think, that we've been talking about in the show lately about the accelerant that truly is AI. It doesn't -- it's not great.
Michelle Kellerman: They don't specify what's going on in North Africa, which makes sense to me because North Africa is a hotbed for terrorism. And I would imagine that information about what's going on and coming in and out of that -- those countries is a lot more restricted.
Maria Varmazis: I would imagine that too. And, yep. And internet connectivity I'm sure comes into play here, you know, how built up is the infrastructure. They certainly have the internet in Northern Africa. I'm not saying they don't. But, you know, some -- I imagine in Southern Africa there's a lot more infrastructure there.
Michelle Kellerman: Yeah. So it's just -- it's kind of a interesting crossover between cybercrime and, like, geopolitics and stuff like that.
Maria Varmazis: Yeah.
Michelle Kellerman: Which always just tickles my brain.
Maria Varmazis: Yes. Your -- yes. I was going to say yours and my producer Ethan Cook. This is, like, his favorite thing so.
Michelle Kellerman: Particularly my cup of tea.
Maria Varmazis: Yeah, yeah.
Michelle Kellerman: Stuff like this.
Maria Varmazis: Absolutely.
Joe Carrigan: I like your term accelerant; and it makes me think of, like, pouring gasoline on a dumpster fire. AI is an accelerant for these scammers, and that's exactly -- you know, scamming's already been a dumpster fire. Now we're pouring gasoline on the dumpster fire with -- with AI capabilities.
Michelle Kellerman: Joe and I were talking about this, this morning. My biggest frustration, I think, it's different on the day what's biggest. But at least with other -- up until this point, and this point being the last like 10, 15 years, when you committed crime, there was some modicum of risk that you had to take. You had to physically risk being seen doing something. You had to, like, run the risk of safety, of cops, whatever. You had to, like, be kind of good at this, you know, whatever crime it is that you're doing. Now with, like, AI and all this, like, scam infrastructure, there's no risk; and that just irks me.
Maria Varmazis: Yeah. There's no risk and no skill needed either.
Michelle Kellerman: Yeah.
Maria Varmazis: So you don't have to even be half decent at it. So it's all incentive and absolutely nothing disincentivizing you, essentially, because, if there -- if people are saying you're not going to get caught and there's going to be no consequences for you, why would anyone not do these things?
Michelle Kellerman: Nobody can agree on how they want to prosecute across borders. Everybody's got their own issue. Yeah. This is like --
Maria Varmazis: Yeah.
Michelle Kellerman: Nobody has any skin in the game; and they're, like, cleaning house. And that just rubs me the wrong way.
Maria Varmazis: You and me too. And I think a lot of us, a lot of folks listening. I think we're all in the same -- we're not happy about this situation, certainly.
Michelle Kellerman: Yeah.
Maria Varmazis: So, yeah. Well said. All right. So that is my story. Michelle, it's -- it's over to you for the next story. Tell us what you've got.
Michelle Kellerman: So this is an interesting story. This caught my interest. This is from ABC7, Brian Shlonsky, the NYPD put out a warning for gold bar scams targeting older New Yorkers. And we've talked about gold bar scams. I like this one because it kind of highlights this -- a scam being multi-step, making it harder for people to realize that it's a scam. And it's been touched on where, like, talking about scammers revictimizing people who are already the victims of scams, things like that. This one is -- the first step is it starts with a fraudulent pop-up that it's almost too cheesy to take seriously, where it's, like, you've been infected with a virus. Microsoft wants you to call them and give them a buzz about it.
Joe Carrigan: My mom got one of those last week on her Chromebook.
Maria Varmazis: Really.
Joe Carrigan: Yeah. It was just like little alerts on her Chromebook. And she sent me a text with a picture of it. What is this? I'm like, that's scam. Just delete it. If you --
Michelle Kellerman: I haven't seen one in like over a decade, but I see them being referenced all the time so.
Joe Carrigan: Yeah. It looked like it was one of those Google Calendar invites that --
Michelle Kellerman: Gotcha.
Maria Varmazis: That just appear in your inbox. Yeah.
Joe Carrigan: Yeah. You can send them to anybody, and it just shows up as, like, an alert on your Chromebook down in the lower -- lower right corner.
Maria Varmazis: Yeah. Apple Calendar had that for a long time too. I would see them every once in a while. It really ticked me off. Yeah.
Michelle Kellerman: So the first step is having the victim call this number, and then the scammer convinces them to install some type of malware that gives them unfettered access to their system but doesn't do anything with it at that point. So then the person thinks, yep. Got rid of the virus. Great. Nothing suspicious. And then they do recon because they have the ability to access so much information, potentially seeing you log into your bank statements, whatever. And then they collect enough information to then proceed to step 2, which is calling the victim, claiming to be from the US Treasury or the police or some other law enforcement stating that they have an issue with their money, not the police having an issue. Like, the victim is at risk for their money being stolen for some reason. And they need to put that money in gold to protect it. And especially with seeing all of these news stories about, you know, crypto scams and you know all these scammers, they think that, between the -- the scare being real and all the information that the scammers have from just monitoring them over the last couple weeks from this malicious code, from this malicious software that was installed weeks prior, they're separated enough that a person wouldn't put 2 and 2 together. I wouldn't.
Maria Varmazis: Yeah.
Michelle Kellerman: Like, I'm going to remember something from a week ago potentially.
Joe Carrigan: Right.
Michelle Kellerman: Yeah. And so --
Maria Varmazis: Same day stuff I forget. Yeah.
Michelle Kellerman: If you're getting that --
Maria Varmazis: Interesting dwell time. Yeah.
Michelle Kellerman: Yeah. They're being really patient with it now. And then they're saying gold is the way to make sure your money is safe; and, especially if you're older, with all this new stuff, yeah. Gold I know has value. That makes sense to -- that would make sense to a person. Gold would be a good way to protect your wealth. It's physical. You don't have to be worried about it being, like, a crypto thing. It's a feasible story. And, if you have enough information that only the government would have posing as somebody from the Treasury, this is not -- this is, like, plausible to a person.
Maria Varmazis: Yeah.
Michelle Kellerman: Like, I'm never buying gold just in general but --
Maria Varmazis: In times of economic distress --
Michelle Kellerman: Yeah.
Maria Varmazis: -- however you want to put it, we usually see a big uptick in people trying to buy or sell gold. This is like a common pattern. I'm sure we've all seen it in our lives, and so this is -- this makes sense that these scammers are taking advantage of economic anxiety. But, yeah. It's noteworthy that they are being patient.
Michelle Kellerman: And they're probably looking at like, what kind of websites are these -- are these people browsing? Like, how real -- how likely would they be to fall for something like this? Are they somebody who checks their source? If you're, like, committed to this, you can get a ton of information and pick the right targets.
Maria Varmazis: I'm sure AI is making this so much easier for scammers, and I feel like that sentence we can just copy and paste pretty much everywhere.
Michelle Kellerman: Put it into every episode, right. Everywhere. And so you -- the NYPD said that they have been investigating this case since May 2024, along with Homeland Security, the IRS, and police from other states. It's a nationwide issue, not just targeting New York. And, oftentimes, a courier will show up to the victim's house to collect the gold bars while both parties talk on the phone to the scammer, pretending to be based in the US. And they -- the callers will give a code name to further convince the victims that the gold bar handoff is legitimate. Like, they are getting a third-party courier who may not even know that they are committing a crime.
Maria Varmazis: Right. Yes. Yep.
Michelle Kellerman: Like, there's just -- it's so well thought off -- so well thought out, and it's terrifying. The amount of money that they're getting from these victims is very staggering: 9 million in one case, 5.8 million in another case.
Maria Varmazis: Wow. Wow.
Michelle Kellerman: Yeah. It -- so far -- so far they believe the losses from hundreds of victims is exceeding $100 million.
Maria Varmazis: Jeez.
Michelle Kellerman: So it's kind of -- it's -- they're evolving and being more picky depending on who you are, and they're taking time between initial -- initial scam to, like, bringing it over the finish line. So, like, you may not know. So all those red flags that you're thinking about when something gets suspicious of, like, take this -- like, let's take this off the platform to Telegram or something. They're not doing that. They're finding ways around those red flags internally.
Maria Varmazis: Yeah, yeah. It makes sense. I mean, I'm -- I'm thinking back -- since I was talking about the '90s in my story, I'm thinking back in the wild west days of the internet when I would download, you know, Juarez and stuff. And it's definitely not a thing I do anymore. Wink, wink. And, you know, you would download something dodgy; and then immediately you would get -- you just knew. I have all the viruses, right?
Michelle Kellerman: Yeah.
Joe Carrigan: Right. I mean --
Michelle Kellerman: And then also you don't trust a single email for the next two days.
Maria Varmazis: Yeah. And you would just be like, yep. Okay. I did that to myself, and I know how I did it. It wasn't exactly a mystery.
Michelle Kellerman: And it's like, who knows where else this other -- the information that they're collecting is going, especially with all these, like, initial access brokers and, like, scammer infrastructures. Like, maybe they're selling that information to others too. It's just so ubiquitous. It -- ah.
Maria Varmazis: And -- and you know what's interesting? You mentioned the couriers also. I had seen a news story not terribly related but just reminded me of a courier who I think accidentally became a drug mule, and they -- this person I think was just an Uber driver, and somebody just dropped stuff in their car and was like, Drive it to this place. And I -- I do wonder --
Joe Carrigan: Was that the story about my friend? Because I have a friend who's an Uber driver, and he had that -- he did a courier job once, and he did exactly what you're describing.
Maria Varmazis: I hope not. I mean, I think this -- was he driving near the Canadian border?
Joe Carrigan: No.
Maria Varmazis: Because I think the story was in Vermont. Okay. Yeah. That I -- I just can't help but wonder if there is any training or awareness for the drivers. And, I mean, I -- I know that a lot of them tend to be in communities where they're talking to each other, and there might be community knowledge. But, you know, do -- do any of these companies say, Hey. If these are the types of rights you should look out for.
Michelle Kellerman: Probably not.
Maria Varmazis: Yeah. I wonder.
Michelle Kellerman: The gig economy has made it so that, like, you are normalized to just random one-off requests from people you don't know. Like, remember when I was like, Don't talk to strangers. Don't get into a stranger's car. Don't, like, mess with [inaudible 00:22:56] on your phone.
Maria Varmazis: Yeah, yeah.
Michelle Kellerman: It's, like, now you're going to do it on purpose. Like, we're just so desensitized via the gig economy of like, Hey. If I asked a random person to go to the grocery store on my behalf and bring me salt and toilet paper, everybody would -- like, I would be committed.
Maria Varmazis: Yeah.
Michelle Kellerman: But now it's, like, no. That's a -- that's an Instacart order.
Maria Varmazis: Yeah, yeah.
Michelle Kellerman: Somebody doesn't want to leave in the middle of cooking.
Maria Varmazis: And then I know if you -- if you're -- if you want to be a gig -- a gigger, a gig worker, I've heard a couple different phrases for --
Michelle Kellerman: Both of those are awful.
Maria Varmazis: Yeah. I know. I'm sorry. I'm so sorry.
Joe Carrigan: I really don't like the first one.
Maria Varmazis: Yeah. I regret it.
Michelle Kellerman: Across the board no go.
Maria Varmazis: I completely regret saying it. A gig worker.
Michelle Kellerman: Yep.
Maria Varmazis: If you are a gig worker, I'm pretty sure nowadays the process is meant to be as frictionless as possible and quick to get you in the door to start working because a lot of times people go, I just need a little extra money. Maybe I can sign up to be a driver for something, something, something, something brand names here. And, again, like, I -- if -- what training would be involved there? I think it's just download an app and go, right?
Joe Carrigan: Yeah. I'm sure that's it.
Maria Varmazis: Yeah.
Michelle Kellerman: Yeah.
Maria Varmazis: No. I -- these drivers are -- are being used for -- as mules in these crimes. They don't know. And then, you know, this -- it's just awful, awful, awful.
Michelle Kellerman: Yeah. It's just definitely interesting. They did so much work to make it look legitimate that the what can we do about it, I -- I don't -- only do gold business with a bank. That's all I've got. Like, don't let anybody else. Oh. That actually reminds me. There is another thing to do. I feel like people don't realize this, especially for something where you're interacting potentially with the federal government. A lot of people don't know. You can call your Congress people for assistance with interacting with any federal agency. They have an entire -- every single Congressperson has staff responsible for what's called constituent services. So, if you need resources -- I was thinking about it when it came to the mortgage issue last year. Even though the federal government doesn't overlook that, they know resources to work with some of these bigger, more ubiquitous things.
Maria Varmazis: Yeah.
Michelle Kellerman: Anytime you need to interact with another federal agency and you don't quite know how to do it, or they're not answering you, you can call your congressperson; and their staff will do the -- do their best to solve your -- assist you with solving your problem. I used to intern for my congressman. That's why I know. Like, they --
Maria Varmazis: That's so interesting.
Michelle Kellerman: It's a whole staff.
Maria Varmazis: Yeah. I -- you know, I -- I don't think most people know that. And that's so good that you mentioned that because I did not know that.
Michelle Kellerman: Same thing at the city and state level.
Maria Varmazis: Yeah.
Michelle Kellerman: They -- constituent services is a part. It's not just screaming at them about a vote that you want them to make or not make. It's, like, their job to help solve problems with you. Like, even -- I had one where somebody needed help getting access to gambling addiction resources, and that was my job for the week.
Maria Varmazis: Wow.
Michelle Kellerman: Yeah.
Maria Varmazis: It's good to know that.
Michelle Kellerman: Be almost anything.
Maria Varmazis: Yeah. Well, that -- that is really good to know. So that is a great tip, Michelle. We will have a link to that story in our show notes for everybody. Why don't we take a quick break now, and we'll get to Joe's story after the break. And we are back. Joe, you are our third storyteller for today. So why don't you regale us with what you got?
Joe Carrigan: I am, and I have a pretty good one today. Mine comes from Rony Roy over at crypto.news. And it is --
Maria Varmazis: Yeah. I was going to say is this person real?
Joe Carrigan: This person, I don't know if this person's real.
Michelle Kellerman: If you get duped on your own show about getting duped, I'm going to laugh about this until the end of time.
Joe Carrigan: Right. Well, I will tell you this. This article was poorly written, but it was --
Michelle Kellerman: Looking good for me. Okay.
Joe Carrigan: -- sussed out what's going on. But he did link to the original article, which unfortunately is all in Chinese because this takes place in Hong Kong. And the actual article was in Chinese, so I couldn't -- I couldn't read it, but -- so I had to read Rony's article. The Hong Kong police have received 255 reports linked to this company called Fun Coffee -- sounds like an awesome opportunity, Fun Coffee -- reporting losses of around 104 million Hong Kong dollars. Now, that's about -- there's about eight Hong Kong dollars in an American dollar. So that's like 12, $12.5 million around there.
Maria Varmazis: Okay.
Joe Carrigan: Investigators are -- are actually making arrests and expanding the investigation here, but they've already arrested six people in Hong Kong. They are out on bail. And then Macau, which is another autonomous region of China that's west of Hong Kong, their police separately arrested two women in connection with nine cases in losses of about 3.6 million dollars in million of the local currency. I don't know what the local currency is. But -- so I have no frame of reference for that. But police are now also investigating the promoters of this scam. So their reports started coming in, in July. And here's how this thing worked -- July of this year. Fun Coffee GM's -- GCM, Fun Coffee GCM said, Hey. We're an investment opportunity. We're a Vietnam-based business, and we're focused on these projects where we're working on multifunction coffee equipment. So think espresso machines that also make a cup of coffee.
Maria Varmazis: Yep. Okay.
Joe Carrigan: Right. Coffee gene research, so they can genetically modify your coffee. Agriculture machinery and other technology-related ventures. The investors were instructed to fund their plans using cryptocurrencies. Primarily, these guys were looking for a stablecoin called Tether, which is tied to the US dollar. I don't know how they accomplish tying it to the US dollar. I -- I looked into this today. They have reserves. I don't know how this works under the hood. But investors were instructed to use -- use the -- use that cryptocurrency to fund their plans. The platform, once you put the cryptocurrency in there, you had several different options in where you wanted to invest, and they all promised big returns. And it would -- the returns were bigger if your deposits were larger and you agreed to lock -- lock in for a longer period of time. And these returns ranged anywhere from 197% to 278%.
Michelle Kellerman: Whoa.
Maria Varmazis: Yeah.
Joe Carrigan: That was the promised return. I'm going to tell you right now that, if you get an investment like that, that is a red flag.
Michelle Kellerman: That's crime.
Joe Carrigan: It -- this is crime.
Michelle Kellerman: Probably crime.
Maria Varmazis: I know crime. Yeah.
Michelle Kellerman: I know. But, I mean, like, if it's a legitimate -- like if you're actually getting those returns, it's like, yeah. That's diamond. That's like blood diamond money.
Joe Carrigan: Right.
Maria Varmazis: That's a Ponzi scheme and/or a crime.
Michelle Kellerman: Yeah.
Maria Varmazis: That's -- yeah.
Joe Carrigan: Oh, you're -- you're going to like this, Maria. I think we get into a little bit of Ponzi scheme territory.
Maria Varmazis: Oh, yay. Okay.
Michelle Kellerman: As we do.
Joe Carrigan: But there was one investment package that specifically mentioned in this article where you would -- investors would put 10,800 Tether, which is literally equal to $10,800 US. And they would hold it for 10 days; and, in return, you would get a profit of about 680 US Tether in -- returned to you. That is what -- it says here police calculated an advertised annualized return of approximately 230%. That's if you're not compounding it. That's if you just take that $680 and don't put it back into the same investment. That -- that's the minimum amount of promised return here. I did the math and, yeah; it's -- if you take 680 and divide it by 10,800 and then multiply that by 30 -- 36.5, that comes out to about 230%. So, obviously, that's not real.
Maria Varmazis: Yeah.
Joe Carrigan: I mean, there's no way you're getting those kind of investments -- those kind of returns on investment from anything that's legitimate. I mean, maybe you can get lucky with a stock pick. But, again --
Michelle Kellerman: Even then, the SEC is getting involved of, like, where do -- where are these returns coming from?
Maria Varmazis: Michelle, you said it right.
Michelle Kellerman: Yeah.
Maria Varmazis: That's crime.
Michelle Kellerman: Yeah. The SEC is like, Not on my watch.
Joe Carrigan: That is probably insider trading, they'll say.
Michelle Kellerman: Yeah.
Joe Carrigan: The platform expanded its reach by organizing investment seminars and social gathering and other promotional events where participants were encouraged to recruit new members for additional rewards.
Maria Varmazis: Oh. An inverted triangle, you say.
Joe Carrigan: Yes.
Maria Varmazis: Okay. Okay.
Joe Carrigan: And people were told, Hey. Go download the Coffee Fun mobile app, register for an account, and transfer some cryptocurrency; and select an investment package inside the app. And step 5, I guess, is profit. Now here's an interesting thing.
Maria Varmazis: Understand gnomes get around. Yeah.
Joe Carrigan: Right. Yeah. The interesting thing here is that early investors were reportedly able to withdraw some amounts of money, and that's why I think Ponzi scheme.
Maria Varmazis: Yeah. You have to be able to get some money out a little bit just to prove that there is some legitimacy to keep people in.
Joe Carrigan: Exactly.
Maria Varmazis: That's -- always. Yeah. It's got to -- you've got to have the whiff of legitimacy, even though don't look too close.
Joe Carrigan: Yes. So everything came apart last month on July 20 when the Coffee Fun app just stopped working, and investors were no longer able to withdraw any of their deposits or any of their returns. I bet they were still able to make deposits, though. I'll bet that was still --
Michelle Kellerman: That always seems to work.
Joe Carrigan: Yeah.
Maria Varmazis: The money goes in; it does not come out. Yeah.
Joe Carrigan: Customer service channels just stopped responding, and that prompted the -- some of the victims to file complaints with the police. Now, Hong Kong One, who had the original -- the original story in here, had the story of one person who was a 51-year-old person who lost 9.3 -- I'm sorry, 9.6 million Hong Kong dollars. That's about $1 million.
Maria Varmazis: That's a lot of money.
Joe Carrigan: Yeah. It's a lot of money. People have been scammed out here. So, obviously, I mean, we sit here and we think this is a scam. But, I mean, when you start putting your money into this thing and you see the interface that goes, Hey, you put in 10,000 Tether; now you have more than 11,000 Tether, and it's only 10 days later. You're like, I can see where this hooks people. I can see where that dopamine fires off; and they just start going, Oh. This is so great. I'm never getting out of this.
Michelle Kellerman: And there's another part of, like, that dawned on me about what gets their hooks, like, in. When you mentioned the we also arrange for social events and stuff, it's, like, think about also the loneliness side of things. When -- we all crack jokes. Everybody cracks jokes about, like, people who are super into crypto being the most annoying person and --
Maria Varmazis: Joe.
Michelle Kellerman: Yeah. Like --
Joe Carrigan: Super into crypto.
Michelle Kellerman: No. Like, I'm talking about the -- if a decision is made about crypto regulations, like the worst person you know is upset about this right now --
Maria Varmazis: You're not wrong. You're not wrong.
Michelle Kellerman: -- and how isolating that person must -- how isolated that person must feel. And that's, like, also on top of everything else of, like, the crypto and the money is like, Oh. Maybe I'll meet people like me who get it, people who are just as committed to this, like, a search for like-minded individuals. And then you get scammed, and then you're even more embarrassed; and you're not going to talk about it with people. Like, it kind of feels like they're almost the perfect person who would be drawn to this beyond just somebody who's looking to make a quick buck. I think it's more than that because crypto schemes are now a lot more, like, common knowledge.
Joe Carrigan: Right.
Michelle Kellerman: I feel like there's a social aspect to this that maybe people aren't pulling the thread on for the people that are affected by this.
Joe Carrigan: I think there's another angle in this; and that's the FOMO, the fear of missing out.
Maria Varmazis: Yes. Yep.
Joe Carrigan: Because wouldn't it be great if we could all go back to what it was, 2004, whatever -- Buy bitcoin. Yeah. -- came out and buy bitcoin at 25 cents a coin. Wouldn't that be awesome? Because I remember looking at that and going, I should buy some bitcoin. And I went back to buy it. It was like $4. I was like, nah. It's not going to go any higher than that. I really missed out.
Maria Varmazis: Yeah. Well, you know, it's like people in the '80s going, I really wish I had bought Apple when I -- you know, it was a penny stock or whatever.
Joe Carrigan: Right.
Maria Varmazis: And -- or the '90s, whenever it went for --
Michelle Kellerman: It also feels like there's the only way of you're going to get ahead now. It also feels like like that's the finance -- the way to get ahead and get a house is by hitting it big in one of these random stocks or cryptos.
Maria Varmazis: Or apparently--
Michelle Kellerman: It's -- you know, it's emotional.
Maria Varmazis: Betting on the markets now, the predictive markets.
Joe Carrigan: Oh, yeah, which are essentially just gambling, financial instruments.
Maria Varmazis: It is gambling. It is 100% gambling.
Michelle Kellerman: That's like the incentive plus the social side of things. Yeah. It feels like this is just ready-made scamming material.
Joe Carrigan: Yeah.
Maria Varmazis: Yep. Absolutely.
Joe Carrigan: So it looks like the Hong Kong police are on it, and I'll bet the Chinese government's going to get involved here. We'll see how this goes. I don't know if I'm going to be able to follow up on this because it's one story from some crypto site. And, you know, I'm not going to be following Hong Kong One, the channel that actually ran this. And, even if I was, I couldn't read it. It's just all in Chinese. I can go to the translate thing. That kind of works pretty well.
Maria Varmazis: Yeah. You might lose something in the translation.
Michelle Kellerman: I think a lot of that nuance is probably lost.
Maria Varmazis: Yeah.
Joe Carrigan: Right. [ SOUNDBITE OF REELING IN FISHING LINE ]
Maria Varmazis: Okay. And we are back for the Catch of the Day. And this is one that I found, Joe, unless you want to pretend that you found it. That's fine.
Joe Carrigan: No. It's fine.
Maria Varmazis: All right, I -- I was trolling on -- not literally trolling, scroll trolling, lurking, I should say, on r slash scams. And I saw one that caught my eye, mainly because I wasn't 100% sure how this works or why it would work. So why don't I read it; and, Michelle and Joe, I'd love to get your take on this. So this is a text message that was sent to someone, and this is what it reads: Hello. I sincerely apologize for the confusion. I accidentally gave my employer the wrong phone number for my Zelle by entering one incorrect digit, so my paycheck was sent to your account by mistake.
Joe Carrigan: Hey. Thanks.
Maria Varmazis: That money is my paycheck, and I truly need it to support my children.
Michelle Kellerman: Oh, but they're children.
Maria Varmazis: And I would really -- for the children. I would really appreciate it if you could return it. I have already spoken with my bank, and they advised me that, if we can't resolve this directly, my next option is to file a claim in small claims court. I hope it doesn't come to that. I would much rather resolve this peacefully and without involving the courts. Thank you for your time --
Michelle Kellerman: I love veiled threats.
Joe Carrigan: Yeah.
Maria Varmazis: And I love -- I love -- and I hope you'll reconsider and help me get my paycheck back. Yeah. So, yeah. So lots of hmmm with this one. Michelle, what are your thoughts?
Michelle Kellerman: I specifically want to tell this person to their face that I don't like them. Just -- normally I roll my eyes at this. Like, I want to fight with this person just for a -- because, if anybody talked to me like that in any circumstance, whether you're trying to take my money or not, it's like I'd rather resolve this peacefully. Bet you would. Bet you would. So just off the bat, off the bat I'm irritated in like a -- in a mildly hostile manner. So, that aside, yeah. I -- I get where the person's, like, trying to come from. But I feel like putting in stop orders for wrong payments and taking money back is a pretty well-established -- like, we all know banks can do that. We all know payroll can do that. They -- like, Social Security can claw back overpayments fairly easily. It was an interesting tactic, given that everybody kind of knows, like, that's not how this works.
Maria Varmazis: I would hope so. Yeah.
Michelle Kellerman: Yeah. This is between you and your -- this is between you and your job.
Maria Varmazis: Yeah. I mean, and to be clear, this is not spam. So this is not --
Michelle Kellerman: Yeah.
Maria Varmazis: This is not a legitimate thing. But, yeah. That -- that is -- that was my first reaction, too, is why are you talking to me about that?
Michelle Kellerman: Yeah. I know it's a scam, but it's like I feel like that'd be a standard reaction being like, This between you and your job.
Maria Varmazis: Yeah. This ain't my problem. Thanks for the free money.
Michelle Kellerman: And, like, how'd you get my number when it's just a wrong bank account?
Maria Varmazis: Yeah. Yep.
Joe Carrigan: Right. Well, it's a Zelle number, right? So they're -- they're sending -- they're sending money -- they're alleging that money has been sent to the wrong -- wrong phone number via Zelle. My response to that would be, I'm sorry. I don't have a Zelle account. I don't know where your money went, but it didn't go to me.
Michelle Kellerman: I also wonder if they did the appreciation -- appreciation for attention to detail of like, okay. Did you spoof one digit off phone number of mine?
Maria Varmazis: You know, it doesn't show the phone number up top. That is a really interesting.
Michelle Kellerman: You're going to commit to this?
Maria Varmazis: Yeah. I don't think they did. So it falls apart right there.
Michelle Kellerman: Yeah.
Maria Varmazis: So you're right. Oh, my gosh, I didn't even think of that angle. But I did really like also that they -- they have the pressure of I need this for my children. And, also, it's my paycheck. And, also, if you don't give me my money, I'm taking you to court. Love -- love all of that. It's very polite. I want to mention there's also an M dash in there.
Joe Carrigan: Ah.
Michelle Kellerman: You don't -- you don't have money to feed your kids, but you have money to take me to court. Okay..
Maria Varmazis: But I saw the M dash. And I'm going, now, I'm a fan of the M dash; but nowadays that is sort of an AI tell, isn't it?
Joe Carrigan: Yes.
Maria Varmazis: Sadly.
Michelle Kellerman: Yeah.
Maria Varmazis: Sadly. So it's a very interesting.
Michelle Kellerman: I don't think about that.
Joe Carrigan: I will say this: I do like the iMessage feature at the bottom of this. There is a little message at the -- from -- from the Apple interface that goes, If you did not expect this message from an unknown sender, it may be spam. And then there's a button where you click to report spam.
Maria Varmazis: Yep. I love that button. I'm a big fan of the report spam button. Big fan.
Michelle Kellerman: Oh, yeah.
Joe Carrigan: Android has that, as well, and I report a lot of spam. And then, when you are done reporting the spam and Android just says, Do you want to block this number? I'm like, absolutely. Every time.
Michelle Kellerman: Heck, yeah, brother.
Maria Varmazis: Yep.
Joe Carrigan: Elizabeth, macho man send.
Maria Varmazis: Yeah. I go full Hulk Hogan. I'm like, hey, brother and block.
Joe Carrigan: Maria. Why did I call you Elizabeth? I have no idea.
Maria Varmazis: I don't know.
Michelle Kellerman: Do you know an Elizabeth?
Joe Carrigan: I do, but I have no idea why I said Elizabeth because I was trying too hard to come up with Randy Macho Man Savage and cram that into Maria's name. And my brain just went I'll take Elizabeth.
Michelle Kellerman: Lots of stuff got mixed up there.
Maria Varmazis: I've been told many times that I sound and look like an Elizabeth. I don't know what that means, and I know that.
Joe Carrigan: Ah. I think maybe you do.
Maria Varmazis: Maybe I do. Maybe I do. Who knows? But I was thinking Hulk Hogan, but I don't know. Anyway, I just -- I thought that was an interesting little spam scam spam -- scam spam.
Michelle Kellerman: Yeah. It's both.
Joe Carrigan: Yeah.
Michelle Kellerman: Yeah.
Maria Varmazis: And -- and I wonder if this person actually just got some money in their Zelle account that there -- is it just sitting there? And what would happen to it? Does it -- do they just get free money? That's --
Joe Carrigan: Yeah.
Maria Varmazis: Yeah.
Joe Carrigan: That's an excellent question. I mean, if I had a Zelle account, the first thing I'd do is check my Zelle account and say, I don't have it.
Maria Varmazis: Oh, yeah. I'm actually looking at the -- I'm looking at the post and it says, I got sent $450 by this random person.
Michelle Kellerman: What?
Joe Carrigan: Ah. Okay.
Michelle Kellerman: Well, because they can claw it back. They can claw it back. Yeah.
Joe Carrigan: Here's how that -- okay. Here's how that works. That's interesting because what's happened is this person has sent them $450 with a stolen credit card.
Maria Varmazis: Oh.
Joe Carrigan: Can you pay with a credit card on Zelle?
Maria Varmazis: I have no idea. I don't have Zelle. My -- my bank does not use Zelle. It's a -- they got hit with fraud too much, so they stopped supporting it.
Joe Carrigan: Good.
Michelle Kellerman: There's going to be a lot of that. Banks are starting to show that they are not footing these bills anymore.
Maria Varmazis: No. I don't blame them at all. I really don't.
Joe Carrigan: Here's how this goes. They -- they get a stolen credit card. They charge $450 to the account, and they send it to you. Then they're hoping you look at this and you go, Oh. Look at that! There's my Zelle. I do have a Zelle $400. And you say, Okay. I did get $450, and I'm going to send it back to you. Where would you like me to send it? And you send the money off from your account.
Maria Varmazis: Yeah.
Joe Carrigan: Then --
Maria Varmazis: Now you're out of that money. Yeah.
Joe Carrigan: Then the credit card company gets a scam or a fraud report from the customer whose credit card it was. And they go, Oh. Okay. Well, Zelle can't have that money. We're going to -- we're going to claw that back. And then Zelle says to you, Oh. That was a fraudulent transaction. We're going to claw that back.
Maria Varmazis: Right.
Joe Carrigan: And now you're out 450 bucks. That's how this works.
Maria Varmazis: Yep. Oh, there you go.
Joe Carrigan: Thank you for that little bit of context. That helped me put everything together.
Maria Varmazis: You know, context helps. It's a nice thing.
Michelle Kellerman: Yeah.
Maria Varmazis: I'm glad I thought of it. I was like, wait a second. Did they actually get the money or not? They did. So, yeah. It's a it's essentially a check cashing scam but with Zelle kind of.
Michelle Kellerman: And passive aggressive neighbor energy.
Maria Varmazis: Oh, yeah.
Michelle Kellerman: That's why I'm irritated.
Maria Varmazis: Yeah. It sets me off immediately. So it has the opposite effect of what I think the scammers hoping for so.
Joe Carrigan: Michelle's over there going, I'll burn your house down.
Maria Varmazis: Be more like Michelle. Just go, that's crime; and just don't. Well, thank you, Michelle; and thank you, Joe, for another great show. And thank you, listeners, for tuning in. That is Hacking Humans for today, brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email complaining about Joe's chickens to hackinghumans@n2k.com. We read them all. We're privileged that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. This episode is produced by Liz Stokes. Our executive producer is Jen Eiben. We are mixed by Elliott Peltzman and Tré Hester. Peter Kilpie is our publisher. I'm Maria Varmazis.
Joe Carrigan: I'm Joe Infinite Chickens Carrigan.
Michelle Kellerman: And I'm Michelle Kellerman.
Maria Varmazis: Thanks for listening.
