I just want to give you $25 million!

Dave Bittner: Hello, everyone, and welcome to the Hacking Humans podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner and joining me is Joe Carrigan. Hey there, Joe.

 

Joe Carrigan: Hi, Dave.

 

Dave Bittner: And our N2K colleague and host of the T-Minus Space Cyber Briefing, Maria Varmazis. Maria.

 

Maria Varmazis: Hello, hello. Good to see you both.

 

Dave Bittner: We've got some good stories to share this week, but first let's get into some follow-up here. Joe, any follow-up?

 

Joe Carrigan: I got some email from some -- I'm not going to name any names here. But I've received like three emails in my, what I call my "professional" Gmail account.

 

Dave Bittner: Okay.

 

Joe Carrigan: And I don't know how this person got my email address, but they're sending me opportunities for me to ghostwrite. And the first one says, hello, or "Hey, Joseph," which is the first red flag.

 

Dave Bittner: Right [laughter].

 

Joe Carrigan: "I just listened to your latest Hacking Humans episode about the Baltimore scam story. I don't know what that means.

 

Maria Varmazis: They don't either because a real person didn't write this, but that's okay.

 

Joe Carrigan: Yeah, really interesting how you break down the scammer's tools. It's always eye-opening to hear these. And then he goes on to, "looking back through your online content." There is no online content that he's referencing. And he says, "Might be a bit out of the blue, but have you ever thought about writing a book?" And the next email I got was, "Hi, Joseph, your post about searching for new opportunities in data analytics caught my eye." I made no such post about searching for new opportunities in data analytics. I did post on LinkedIn that, in one of my classes last year, there was a young man who was looking for a data analyst job. And so I shared his profile. And because I know the guy, I thought he would be good. He has since been hired, so good for him. But it's interesting, these things keep going out like this. The last one says, "Hi, Joseph, I won't keep emailing." Oh, thank you [laughter]. "But I'd regret not sending this one last note." Let's see if this is the one last note. So I am not interested in writing a book, and if I was, I kind of think I wouldn't need a ghostwriter. Maybe -- I'd need an editor, that much is certain. But a ghostwriter, I'd rather just write it myself.

 

Maria Varmazis: It's not a real thing. Yeah, I mean, I get -- Dave, I'm sure you get these emails. I get them as well. I mean, yeah, they just go directly in the trash. But I don't -- so we're not going to name names for this person. Although, again, I'm not convinced this person is actually real. But if you go to the website in the email and you look at like the sample of work that they've provided, this reminds me of like those "who's who" directories kind of thing, or like who is actually opting into this? Yeah, just delete it.

 

Joe Carrigan: Yeah, that's what I've done. I've actually set up a rule, so I don't even see them anymore.

 

Maria Varmazis: Yeah, they come in from different names, but that line, "this might be a bit out of the blue, but are you currently writing a book?" I've gotten so many of those with that exact line in there from different people.

 

Dave Bittner: The one that gets me is there's a template that is, "I recently listened to your podcast episode," blah, blah, blah. "What really caught my eye was where you talked about" blah, blah, blah. And it's just the same thing over and over again where they're scraping descriptions.

 

Joe Carrigan: Show descriptions.

 

Dave Bittner: Show descriptions, transcripts, something. And yeah, it's so templatized it's ridiculous.

 

Maria Varmazis: Yeah, it doesn't make sense. The one that I got a few days ago was, "Hey, Maria, I read your post about the security issues with kids' GPS devices." What the hell are they talking about? Excuse my language. What are they talking about?

 

Joe Carrigan: Right.

 

Maria Varmazis: Kids' GPS devices?

 

Joe Carrigan: Yeah, it's the same thing. My post about looking for new opportunities and data. I'm pretty happy with my current position. I'm not looking for any of these.

 

Dave Bittner: Right.

 

Maria Varmazis: Yeah.

 

Dave Bittner: You need like a good Amazon vanity book, Joe.

 

Joe Carrigan: Right.

 

Maria Varmazis: Yeah, that's exactly what it would be.

 

Dave Bittner: You know what needs to be what raising chickens taught me about cybersecurity. How about that?

 

Maria Varmazis: And B2B sales on LinkedIn.

 

Joe Carrigan: Yeah. And Dave, since you brought it up, I'll go ahead and tell you the chicken coop and run are now done.

 

Dave Bittner: Oh, congratulations.

 

Joe Carrigan: That took all summer.

 

Dave Bittner: Okay. Done, done or?

 

Joe Carrigan: Done, done. They are done, done. We still have some landscaping to do around it. But yeah, everything's good. And I just got to get a -- I've got to modernize their feeder because I'm still using the little chick feeder. Which is good, I don't have to fill that up but a couple every three days. We've got two new chickens coming when they are mature enough to come in. They're two new hens. My wife wanted them because they lay much darker eggs. And, you know, when my daughter started doing this, she had all one breed of chickens. And, you know, in retrospect, that's kind of what I would have liked to have had. But no, we're not. That's not the way Lisa wants to do it, so I guess that's not the way we're going to do it. We're going to compromise [laughter].

 

Maria Varmazis: And do what she wants.

 

Joe Carrigan: Do what she wants.

 

Maria Varmazis: Marriage.

 

Dave Bittner: Well, one more bit of follow-up we got. We got a lovely note from a listener named Anne who wrote in and said, "First, I want to say that all of you do a fantastic job on the podcast."

 

Joe Carrigan: I'll agree.

 

Dave Bittner: Thank you, Anne. "Every episode is engaging, entertaining, informative, and full of practical advice. Your personalities really come through, which makes it enjoyable to listen while still being educational. And yes, that includes the chicken stories."

 

Maria Varmazis: Oh, no! Oh, no!

 

Dave Bittner: "I don't care what other listeners think."

 

Joe Carrigan: Well, Anne is pro-chicken.

 

Dave Bittner: She's on team chicken, team poultry.

 

Joe Carrigan: Team poultry.

 

Dave Bittner: Yeah. Anne goes on to say that she shared our recent episode on Shields Up with her co-workers, and that she's hoping that it helps people learn more about the types of things we do. She said she's waiting patiently for Shields Up t-shirts to be made. She says, looking forward to hearing Bill narrate the message. Who's Bill?

 

Maria Varmazis: Bill Shatner, William Shatner. We're on a first name basis with him, obviously [laughter].

 

Dave Bittner: I see, right, I'm with you now. Sorry.

 

Joe Carrigan: Got it.

 

Dave Bittner: Right, right.

 

Maria Varmazis: I did not write this email, I just know the parlance.

 

Dave Bittner: Sure. As you know, my dad's name is Bill, but it's not him. All right, so wraps up and says, "Thank you again for the great work you do for helping make cybersecurity awareness most informative and approachable. Dave, Joe, and Maria, live long and prosper and keep fighting the good fight." Well, thank you, Anne.

 

Maria Varmazis: Peace and long life to you, Anne.

 

Dave Bittner: All right. Well, I'll tell you what, let's take a quick break here to hear from our sponsors. We'll be right back after this message. And we are back. Maria, why don't you start things off for us here this week?

 

Maria Varmazis: All right, gladly. So my story involves the healthcare system, mainly because I am of that age as a middle-aged woman where there is a medical thing that I got to get done every year. It's really unpleasant [laughter].

 

Joe Carrigan: Dave and I have to do something kind of like that.

 

Dave Bittner: It's invasive, we'll put it that way.

 

Maria Varmazis: Yeah. In my case, bits of me get squished between two plates and it really hurts. But it's super fun. And because our medical system is undergoing a lot of strain, mine is scheduled like a year and a half out, which is not soon enough for my liking. So every once in a while, I'm on that list that says, "hey, if there's an opening that comes up sooner, you can find out instantly. We'll email you when there's an appointment that you can maybe jump on." And I jumped on such an email that I got the other day, and I noticed that there was an anti-phishing message on the MyChart website that I went to. And I remember thinking, "Was my mammogram email a phish?" I didn't put my credentials in, but this is very interesting. What's going on here? I have never seen this message before.

 

Dave Bittner: Good news! We can diagnose you with simply a selfie photo [laughter].

 

Joe Carrigan: There was a guy doing that.

 

Maria Varmazis: Yeah. People use ChatGPT for stuff like that, though. So, you know, ends up, so that phishing notice warning that I saw on the mammogram email that I got, there are a number of MyChart phishing email schemes on the rise right now. Apparently, this has been a noticeable rise in these since the end of July, and we are recording this in August, so it's only been a few weeks. And I just, I kind of went down the rabbit hole on these. Because my first reaction was, what is the appeal in getting access to someone's MyChart records? Because like do they want to pay my medical bills for me?

 

Joe Carrigan: No, they just want your medical records.

 

Maria Varmazis: Right. I mean, it's not great. I mean, don't get me wrong. But I'm just thinking like, what -- really, is this what we're going after? Apparently, there are two lines of scams that are being seen a lot. And for our listeners outside of the US who may not be familiar, MyChart is, for a lot of us in the States, the way that we access our medical records or make appointments with our medical providers, that kind of thing. So this is sort of like the online healthcare website that a lot of us use, the system.

 

Joe Carrigan: Yeah, it's like a CRM for medical offices and it's produced by EPIC, that's the company. It's a portal.

 

Maria Varmazis: Yes. And every doctor's office or chain of healthcare providers has their own version of MyChart, but they're all, it's all kind of, yeah, a CRM is a great way of putting it.

 

Joe Carrigan: So you've got to manage all those different logins.

 

Maria Varmazis: And they all look a little different depending on what system you're in. It's great. It's definitely not a mess at all.

 

Joe Carrigan: Right.

 

Maria Varmazis: Anyway, so there are two phishing schemes going around that are affecting MyChart users, that are targeting MyChart users, I should say. And I want to give kudos to EPIC, actually. They posted a really comprehensive blog post on the types of phishing schemes that they are seeing right now with a lot of detail. So we'll make sure to include those links in the post for people. But I'm going to give you a summary version of the two phishing schemes that they're seeing. So the first one are fake MyChart results. So I don't know if this is standard, I think it might be. When you get a test result back from your doctor, a lot of times you get an automated email saying that you can check out the results, actually before your doctor can in some cases, which is.

 

Joe Carrigan: I've gotten that.

 

Maria Varmazis: Yeah, not great for my anxiety, but I appreciate that it's there. So this phishing email starts very similarly. You get an email, as we all do for all these things, saying there's a new medical test with results available to you. And this is a phishing email, so of course it sends you to a lookalike but fake login site. And that is where it harvests your MyChart credentials. So that is the first thing that's not great. After you enter your username and password, you are brought to a fake medical alert page saying that there are some sort of alarming critical health finding that you need to know about. And they actually have a screenshot of this. And the text is this: "Our system has completed a retrospective analysis of your historical lab results and medical records. We have identified critical patterns in your recent blood work and diagnostic history that require immediate attention. Our AI powered review has flagged correlations between your lab values and early indicators that were not previously noted. A complete breakdown of these findings is available for review." That sounds terrifying.

 

Joe Carrigan: Yes.

 

Maria Varmazis: And just truthy, truthy-ish, truthy enough that I would be standing up and just freaking out. That would absolutely be.

 

Joe Carrigan: Yeah. One of the important things is that every single lab result I've ever had with my current doctor is in EPIC.

 

Maria Varmazis: Yes.

 

Joe Carrigan: So this is plausible.

 

Maria Varmazis: Yeah. And the idea of them using AI, they using AI, it just sounds ripped from the headlines real-ish enough that I would actually go, oh my God [laughter].

 

Joe Carrigan: And to be honest, this may actually be a valid, at least exploratory tool for the data, right? Hey, let's see what Joe's blood work has been over the past 20 years. And let's see if there's some kind of pattern that we can diagnose in it and see if it points to some other kind of test we should run.

 

Maria Varmazis: Yeah. I just, I mean, personally, I'd want to hear that from a human doctor and not want it to pop up on a website.

 

Joe Carrigan: Right.

 

Maria Varmazis: Yeah. Just saying, if that is a real thing, that's not how I want to find out about this. I'm just putting that as an aside.

 

Joe Carrigan: I'm with you on that.

 

Maria Varmazis: Yeah, but in any case, this is not real. Just to be clear, this is very much not real in this case. And to get those fake results that sound terrifying -- the victim is told that they need to complete a human verification process. So AI is looking at your data, but you need to prove that you are human. But that verification process tells users to press Windows R and then Control V. And just to be clear, for those of us who may not be on Windows machines or just haven't done this in a while, Windows R runs Windows Terminal and Control V is paste. So you are, very quickly, you are pasting in some kind of malicious code that will probably download malware to your machine through Windows Terminal. So that definitely is a big no-no, never do any of that. If anything tells you to do a couple of keystrokes to prove that you're human, that is no bueno, do not do it. There are newer versions of this specific phish that instead of saying, hey, you need to do this keystroke combination -- because some of us are on Macs. They instead prompt you to download your fake medical report, which is actually an executable file, and also make sure you bypass any of those, you know, annoying Windows security warnings [laughter]. So labreport.exe, again, not real, do not do it, do not open that. But essentially, either way that they do this attack, through you copying and pasting something or downloading an EXE, the attackers not only have your medical credentials to log into your medical records, but they also have gotten you to self-install malware. So that's a one-two punch that really stinks. So of note for this specific phish, the advice is never to click a link in the email. Doesn't that sound familiar? Except MyChart often will specifically tell you, "click this link."

 

Joe Carrigan: Yeah, I actually still don't click that link. I open my password manager and go to the MyChart portal and open the URL from my password manager.

 

Maria Varmazis: That is the best practice. That is what everyone should do, bookmark your legitimate MyChart login for your healthcare provider. But again, the legit emails from MyChart will tell you, just click this link to log in to, I don't know, reschedule your mammogram.

 

Joe Carrigan: It does indeed.

 

Maria Varmazis: It does indeed. So I'm like, that's not great. Reminder that also, scary medical alerts like, "Hey, you've had cancer for 20 years and didn't know it kind of stuff," they shouldn't tell you that through a pop-up. God help us if they start doing that legitimately [laughter].

 

Dave Bittner: Before you click through, we recommend you be sitting down.

 

Maria Varmazis: Oh man, it's just dystopian enough that I could actually believe this might be real someday, but as of this recording, that is still not real. And any website, whether it's a MyChart lookalike or literally any website on the entire worldwide web, should never, ever, ever ask you to run a command, use a keyboard shortcut, or download any kind of EXE to view medical results or anything like that. So people, I feel like many of our savvy listeners know this, but it is always worth reminding folks, don't do any of that stuff. The other flavor of phishing campaigns affecting MyChart users are a free Medicare kit scam. So the email that they get says, "You've been selected for a free Medicare kit or a special benefit." And again, it sends you to a fake MyChart looking website where as long as you log in, you will receive some sort of free medical kit. All you got to do is put in your personal information and pay a small shipping fee, really, really small. Just put in that credit card for the tiny, tiny. Because imagine all the good medical devices you're going to get for free for just, you know, a $10 shipping fee. That seems like a steal, you know. But, you know, the thing being stolen is your credit card info.

 

Joe Carrigan: Steal it is.

 

Maria Varmazis: Steal it is, just not for you.

 

Joe Carrigan: And they are running your credit card against something to make sure that it actually works, that you're entering a valid credit card.

 

Maria Varmazis: Indeed, and they will maybe even possibly repeatedly charge your credit card.

 

Joe Carrigan: Oh, they will, they will.

 

Maria Varmazis: Before you realize what is going on. So MyChart wants everyone to know, they don't run giveaways or prize promotions. So just in general, the US healthcare system gives you nothing for free. That is just a reminder [laughter].

 

Dave Bittner: Yeah.

 

Maria Varmazis: Got to laugh so you don't cry.

 

Dave Bittner: Free bonus colonoscopy.

 

Maria Varmazis: Oh, man.

 

Dave Bittner: Better safe than sorry.

 

Joe Carrigan: At least you get a good nap.

 

Maria Varmazis: You know, yeah. And "just pay shipping" is always a classic sign of you're getting phished. Close out of that immediately. So I just thought this was very noteworthy. Again, I saw the note on my legitimate MyChart website saying, "Hey, phishing schemes are on the rise," and that made me curious. I saw more about it through MyChart. And indeed, there's some really nasty ones out there. And the best practice, as always, as Joe, as you mentioned, access MyChart through the bookmarked website or, you know, through the app if you have it. Never ever through unsolicited emails or texts, or I suppose even legitimate looking emails from MyChart. So just bookmark it and go there directly. And there you go.

 

Dave Bittner: All right, very good. Well, we'll have a link to that in the Show Notes. Joe, what do you have for us this week?

 

Joe Carrigan: I have two this week, as I normally do, but these are kind of short. At least the second one's kind of short. But the first one, we're going down to Georgia. And this involves a little online.

 

Maria Varmazis: Are you looking for a soul to steal?

 

Joe Carrigan: Maybe [laughter]. I'm a pretty good fiddle player.

 

Maria Varmazis: Are you really?

 

Joe Carrigan: No.

 

Maria Varmazis: Damn. I thought you were adding to the Joe lore.

 

Joe Carrigan: Maria was very hopeful.

 

Maria Varmazis: I was. That would be interesting facto. You're out there playing to your chickens.

 

Joe Carrigan: That is what I should do. I should play for the chickens. Just go out there and play fiddle to my chickens with my cowboy hat and my overalls.

 

Maria Varmazis: Goes by the name Duke Silver.

 

Joe Carrigan: Duke Silver. Duke and his chickens. Anyway, there is a tiny little internet concern, perhaps you guys have heard of it, it's called Amazon.

 

Dave Bittner: Rings a bell.

 

Joe Carrigan: Right. Well, according to US attorneys, the US Attorney's Office, this Brittany Hudson was an owner of a business that contracted to deliver packages for Amazon, and federal prosecutors have now actually -- she has been convicted and sentenced to 16 years in prison. The "federal pen," as they say. The Attorney's Office says that between January 2022 and June 2022, Brittany Hudson and her partner inside of Amazon, a woman named Wortham, were involved in this scheme where Hudson would bill Amazon for services and Wortham would approve the invoices. And take a guess, a wild guess, at how much in fake invoices they posted, they billed to Amazon and were paid for between January 2022 and June of 2022. Take a wild guess.

 

Dave Bittner: Six months.

 

Joe Carrigan: Yes, six months.

 

Dave Bittner: I'm going to say half a million dollars, 100 grand a month.

 

Joe Carrigan: Okay. Maria?

 

Maria Varmazis: Sure, I'll go with Dave's guess [laughter].

 

Joe Carrigan: It's wrong. $9.4 million in six months.

 

Maria Varmazis: Dang.

 

Dave Bittner: See, that's greedy.

 

Joe Carrigan: It is. This is why they got caught.

 

Maria Varmazis: Right. If they had just kept it cool, let's fly under the radar. But crooks are stupid and greedy. Yeah, don't get greedy.

 

Joe Carrigan: There is also an unnamed conspirator that -- this article says "co-conspirator," but that is not a word. It's actually "conspirator," because the "co" is unnecessary in "conspirator." Because conspiracy necessarily requires multiple people.

 

Dave Bittner: They decimated that definition, didn't they, Joe?

 

Joe Carrigan: You're doing it again, Dave [laughter]. I tend to be too much of a literalist with decimate, but.

 

Dave Bittner: Well, irregardless. Let's move on.

 

Joe Carrigan: No, stop it! He knows all the buttons for 'ya! We've been doing this for eight years, and he knows all the buttons.

 

Dave Bittner: We will cure you of your pedantry if it's the last thing we do, Joe.

 

Maria Varmazis: No, he's just going to dig in. That's just how pedantry works.

 

Joe Carrigan: We've been doing Hacking Humans for 10 years. I used to do CyberWire things before that for a couple of years before that.

 

Dave Bittner: True.

 

Joe Carrigan: So we've known each other for a very long time now. So they both posted bail in -- back in January of 2023. And while out on bail -- I love these kind of stories -- they tried to start a franchise for a hookah company. You know what a hookah pipe is?

 

Dave Bittner: I'm not familiar with it.

 

Maria Varmazis: Yes.

 

Joe Carrigan: Yeah, it's like a Middle Eastern tobacco pipe.

 

Maria Varmazis: Yeah, tobacco, yes [laughter].

 

Joe Carrigan: Right. And of course, the franchise did their due diligence, said, "Hey, you got these federal charges pending against you. We're not sure we want to go into business." And they were like, "Oh, those have been dropped. And here's the paperwork that shows they've been dropped." And that was forged paperwork. So that got, I think that got Wortham an extra year in prison for forging a judge's signature on a document. So they have now been convicted and sentenced. There is somebody else on the inside of Amazon who was not named, who I'm guessing was used as an informant and probably not as involved, but they've had to give up everything, including a nice $1 million house. Of course, when you get $9 million, you go out and you buy a Lamborghini Uras, a Dodge Durango, a Tesla Model X.

 

Dave Bittner: You don't want to show off your sudden wealth. You don't want to be conspicuous when it comes to these things.

 

Joe Carrigan: They also had a Porsche and a Kawasaki. And here's my analysis. This is -- Amazon is a very large business, right? So people think, they're not going to miss $10 million.

 

Dave Bittner: Right [laughter].

 

Joe Carrigan: Yes, they are. Yes, they are.

 

Dave Bittner: Somebody is. It's on somebody's balance sheet.

 

Joe Carrigan: That's right. And I am almost positive, you know, I'm speculating wildly here, but this is how I imagine this went down. Is somebody -- some data analysis system, checking for exactly this kind of thing, internal fraud, looked at this and said, "Hmm, this person has approved $10 million in invoices over the last six months when normally she only approves a million or two million," or something like that. It stuck out like an anomaly. And then once that anomaly showed up, somebody went in and did some digging around.

 

Dave Bittner: Yeah.

 

Joe Carrigan: And that's how they found this.

 

Dave Bittner: If you want to be a crook, you got to stay in the noise floor, right?

 

Joe Carrigan: That's right, you've got to stay in the noise floor.

 

Dave Bittner: Right.

 

Maria Varmazis: Are we giving people tips?

 

Joe Carrigan: Yeah, maybe, I don't know.

 

Maria Varmazis: I guess we are, okay.

 

Joe Carrigan: I thought about that on the way over, you know, should we talk about how to beat the data science behind all this?

 

Dave Bittner: I don't know, these days, you know, I think it'd be hard to beat the data science. The analytics are pretty amazing.

 

Joe Carrigan: The analytics are pretty good.

 

Dave Bittner: Yeah.

 

Joe Carrigan: I think even if you were just increasing what she was billing by like 10% or 5%, you'd still get caught. Yeah, those kind of things don't just happen. You'd have to do this over years in order for you to actually get this much money. So that's my first story. These two women have been caught and sentenced to 16 years in federal prison. My next story, we go all the way across the country, due north and then a little bit to the west, we go to Michigan. And this is another edition of a story we've already had on the show, but this is now coming out of South Haven, Michigan. South Haven, the town of South Haven, is warning residents of invoice scams targeting the residents. So this is another case where somebody is looking at online publicly available information and then sending out invoices to people saying, "Hey, we're from planning at.city name at.usa.com, and you need to pay this invoice as soon as you receive it and we need a wire transfer." And, you know, it's -- my point of bringing this story in is, this scam is now -- somebody said, "Hey, this is successful. So why don't we do this too?" Or somebody said, "Hey, we did it here. Why don't we do it over here?" This is becoming a more popular scam. You're going to start seeing more and more of these. Residents and businesses are encouraged to watch out for the red flags, this is from actually the city of South Haven. "Number one, a request for a wire transfer. South Haven does not request wire transfers. Payment may be made in person at City Hall or mailed to City Hall or paid through the BS&A portal." I don't know what BS&A stands for. A Business Services and Administration, that's probably what it stands for.

 

Maria Varmazis: Sure.

 

Dave Bittner: We'll go with that.

 

Joe Carrigan: The itemized fees on the invoice do not match the city's fee schedule or the fee schedule. You can find that fee schedule on the website. So when you get an itemized bill, make sure everything matches up. Simple check. The from-email address is not a City of South Haven email address, which includes South Haven mi.gov as the domain. The logo they noted on the invoices were a little bit distorted. That's just sloppy, Dave.

 

Dave Bittner: In today's day and age, that's right.

 

Joe Carrigan: Yeah. How hard is it to just go and get a good copy of the logo and put it on? You could do the work on this.

 

Dave Bittner: Sure.

 

Joe Carrigan: Yeah, it's just a little bit distorted. Okay.

 

Dave Bittner: Yeah, crooks, lazy, lazy, lazy.

 

Joe Carrigan: Trying to maximize profits.

 

Dave Bittner: Yes.

 

Joe Carrigan: The due date is listed as due upon receipt. Legitimate invoices will include a specific due date. So if you apply for a permit, watch out for this. It's probably going to happen. Because all those permit applications are public knowledge or public information. So they're available online. Because we have said, hey, we want transparency in government. And that apparently only means that they're just going to put all of our government filings online and not do things like post -- well, I guess they do post voting records. But I don't know, it doesn't seem, this transparency in government doesn't seem to protect elected officials or doesn't seem to be transparent for elected officials as much as it does for the general populace. At least that's my feeling, and I'm angry about it [laughter]. I have no evidence to back up that claim, but I'm still angry about it.

 

Dave Bittner: I'm just looking out the window to see if there are any clouds you can yell at.

 

Joe Carrigan: Right. [ Laughter ]

 

Dave Bittner: This reminds me of a story from a long time ago that resonated with me because, well, I'll tell you that story in a minute, but it was a guy who basically got a list of all the restaurants in town and he sent them all letters saying that he had been a customer in the restaurant and a waiter had spilled food on him. And this was the bill for the dry cleaning.

 

Joe Carrigan: Yeah.

 

Dave Bittner: Right? So, you know, 10 bucks, 15 bucks these days, 20 bucks, whatever it is to, let's say, get a suit dry cleaned. And the restaurant would just pay it. They'd just write him a check, because this sort of thing happens. But at some point, I guess enough local restaurateurs got together for some sort of meeting or something and just were chatting about it and like, "Yeah, I paid that too. You paid that? I paid that." And eventually they tracked the guy down. But actually, that was a clever scam. The reason it resonated with me was that one time I was a waiter when I was in college. I worked on a lunch and dinner cruise boat and I was a singing waiter, which is the best kind of waiter to be. And I actually spilled a whole bunch of gravy down the back of a woman's dress.

 

Joe Carrigan: Oh, no!

 

Maria Varmazis: Oh, no!

 

Dave Bittner: It was not a good day, and she was not at all happy. And one of the things about being out on a boat is that someone -- you can't leave.

 

Joe Carrigan: Right.

 

Dave Bittner: So she couldn't just storm out. No, we were stuck together for the next several hours, so it was not good.

 

Joe Carrigan: Yes, and every time, "would you like more water, ma'am?" Get the heck away from me.

 

Dave Bittner: Exactly. No, it was awful. I feel bad about it to this day. It was an accident, but.

 

Joe Carrigan: It's one of those things that makes you scream in the shower.

 

Dave Bittner: Yeah. Just, you know, oh, well, I wish I could have that one back. But anyway, we paid for her dry cleaning.

 

Joe Carrigan: Very good.

 

Dave Bittner: All right. Well, we will have links to both of Joe's stories in our Show Notes. Let's take another quick break here. We'll be right back after these messages. And we are back, and that means it's my turn. So my story comes from the folks at Malwarebytes.

 

Joe Carrigan: Another great website, by the way.

 

Dave Bittner: Yeah.

 

Maria Varmazis: Yep, yep.

 

Dave Bittner: And here's what's going on. You're sitting home. What are you doing, Joe?

 

Joe Carrigan: You're minding your own business.

 

Dave Bittner: You're minding your own business.

 

Maria Varmazis: I never mind my own business.

 

Dave Bittner: No, you're too busy clicking links.

 

Maria Varmazis: That's right. I want to know where.

 

Dave Bittner: Yeah, you get a text from a number you don't recognize, something that doesn't seem to be too out of the ordinary. It's something like, "Hey, are we still on for dinner tomorrow?" And you do what any reasonable person would do, you write back, "I'm sorry, you have the wrong number." So according to the researchers at Malwarebytes, that tiny little act of courtesy may have just made your phone a target.

 

Joe Carrigan: Just because they know it's a hot phone? That somebody has it?

 

Dave Bittner: Exactly, exactly. So they point out, they say the important thing here is that the first text often isn't really the scam. There's no malicious link, there's no attachment, there's no malware. They're basically screening you.

 

Joe Carrigan: Right.

 

Maria Varmazis: Yeah, they're pinging you.

 

Dave Bittner: Yeah, they already have your number from an old database. They're just checking to see if this is, A, an active phone, B, someone who's willing to engage. And your reply answered that question. It also tells them that you're polite, you're responsive, and depending on how quickly you answer, you pay attention to your phone. So Malwarebytes says that "An unverified phone number sells on underground markets for pennies, but a confirmed active number can be worth anything from 50 cents to $2."

 

Joe Carrigan: Really?

 

Dave Bittner: So it's a lot more valuable.

 

Joe Carrigan: So this is somebody buying up phone numbers or maybe even just guessing phone numbers, sending out bulk texts and saying, yep, these are active.

 

Dave Bittner: Right. And they said even better, someone who they consider a hot lead, where they have more information on you, that can be worth $6 to $10.

 

Joe Carrigan: Wow.

 

Dave Bittner: And they say, from there, there are two paths. One is the one that we talk about most often on our Catch of the Day, where the person will say, "oh, sorry about that. You seem nice."

 

Joe Carrigan: Right.

 

Dave Bittner: And then that becomes a conversation, and the next thing you know, you're looking to get a wedding in Romania [laughter].

 

Joe Carrigan: Or maybe lose some kidneys.

 

Dave Bittner: Right, right. So the other path is quieter. They say nobody responds to your wrong number message, but your number's still been validated and categorized, and now it's being recycled and sold for other campaigns. So maybe it'll be a recruiter or a package delivery system or anything like that. Because again, they know that they have a hot number, that's active.

 

Joe Carrigan: That is valuable information.

 

Dave Bittner: Yeah. So Malwarebytes, they modeled a campaign in which sending 100,000 texts costs the bad guys less than $1,000, but it could easily generate more than $200,000. So the return for the scammers can be quite high with these sorts of things. Again, a numbers game. And I would imagine, like most things these days, it's been supercharged by AI.

 

Joe Carrigan: AI.

 

Maria Varmazis: Yeah.

 

Dave Bittner: And of course, there's a darker side to this is that a lot of these scam operations come out of Southeast Asia, where they're dealing with trafficked workers who are forced to conduct this kind of fraud.

 

Joe Carrigan: Every time I do a search for a story for this show, something about that is in the top 10 results. So at least the media is paying attention to it.

 

Dave Bittner: Yeah, yeah. So in terms of advice, Malwarebytes says, it's simple, just don't reply.

 

Joe Carrigan: Disregard.

 

Dave Bittner: They said, "This could be distressing for anyone raised to be courteous," which is me. "You don't owe them a reply. Report suspicious messages, block the sender, tighten the privacy settings around accounts connected to your phone number, and resist the urge to correct someone's apparent mistake."

 

Joe Carrigan: Oh, that's going to be very hard for me.

 

Maria Varmazis: Really?

 

Joe Carrigan: Yeah, I like correcting mistakes.

 

Maria Varmazis: No. Yes, that is known. Because I thought for sure you would easily ignore these inbounds.

 

Joe Carrigan: Because that's -- it depends on the phone number I get the text to. Because I have the old house phone going to an app on my phone now. So I will respond to those and, you know, see if I can get anybody to do anything. Because I don't really care about that phone number. I just want, in the event that someone does call me, and occasionally my mother-in-law does call that number, that the phone gets answered if it needs to be answered. But normally it doesn't need to be answered. I get probably 10 scam calls a day on that number.

 

Dave Bittner: Yeah. So let me ask you this. Because I think Maria and I are both iOS users.

 

Joe Carrigan: Right.

 

Dave Bittner: But you are on Android.

 

Joe Carrigan: I am.

 

Dave Bittner: When you get something out of the blue on Android, does the message include a "report spam" button?

 

Joe Carrigan: It does, yeah. Like I get -- on my Android messaging system -- the app I'm talking about is like a completely self-contained app for this phone from my mobile provider. So the Android system is where I actually have my actual mobile number. And that is a completely different, that's just the standard Android messaging system. And that comes up with, you know, "this looks like spam." And you can click "report spam." And once you click "report spam," you can block the number. And I do that every time.

 

Dave Bittner: Yeah. Good, good, good. All right, well, we will have a link to that story again from the fine folks over at Malwarebytes, so please do check that out. And of course, we'd love to hear from you. If there's something you'd like us to consider for the show, you can email us. It's hackinghumans at n2k.com. All right, Joe, Maria, it is time for our Catch of the Day. [ Music ]

 

Joe Carrigan: Dave, our catch of the day comes from a listener named Bob.

 

Dave Bittner: All right, well, this is an email that they received. It is from Mr. Clinton Tabo.

 

Joe Carrigan: Or is it Thabo?

 

Dave Bittner: Thabo, Tabo, I don't know. But the email address is actually BradleyReed94 @hotmail.com. So those don't match.

 

Joe Carrigan: Right, Bradley Reed has gotten his email compromised.

 

Dave Bittner: We're off to a good start. The subject in all caps is "read carefully."

 

Joe Carrigan: Yes.

 

Dave Bittner: And then it starts off, "read carefully. My name is Clinton Thabo, the personal attorney of Mr. Khalib Kassim, the Chief Financial Officer and Acting CEO of Eskom Holdings Limited SA. I got your email from my personal search. He, Khalib Kassim, has in his possession an over-invoice, overestimated contract amount executed by a foreign contractor through his department, which the contractor has been paid and left the over-invoice, overestimate amount of US dollars 25 million with the bank. So the objective is to channel these funds into viable business opportunities within your country. Should you be interested, I would be glad to discuss the structure of the arrangement, including your role and the terms. Please, if you can handle this deal, please reply with your phone number and the percentage you want for more discussion. Sincerely, Mr. Clinton Thabo." Now, he has a different email here.

 

Joe Carrigan: He does.

 

Dave Bittner: Clintonthabo10 @gmail.com. So what's going on, Clinton? If that's your real name.

 

Joe Carrigan: I want to send this guy an email, but I don't want to compromise any of my actual emails in doing that. Let him know, "Oh, this is Joe Carrigan. He has this email address." So next thing I know, Clinton's going to send me book offerings.

 

Dave Bittner: Right.

 

Joe Carrigan: This is essentially just the same thing as a Nigerian print scam.

 

Dave Bittner: Yeah, advanced fee scam.

 

Joe Carrigan: Advanced fee scam, right. We got this $25 million. We're going to put the whole thing in your account, but you need to pay us the export fee of $1,000 first.

 

Dave Bittner: Right.

 

Maria Varmazis: So reasonable. Who would say no to such a reasonable request?

 

Dave Bittner: And why would anyone who just has $25 million laying around just want to give it away?

 

Joe Carrigan: Right. Well, they want to invest it, Dave.

 

Dave Bittner: Oh, I see.

 

Joe Carrigan: They want -- they're hoping to get more than $25 million.

 

Dave Bittner: They want to turn it into $25 billion.

 

Joe Carrigan: Right. That's how this works, Dave.

 

Dave Bittner: What better place than the good old US of A?

 

Joe Carrigan: Yeah.

 

Maria Varmazis: Specifically with you, who is a well-known investor and financial guru.

 

Dave Bittner: Right.

 

Maria Varmazis: Yeah.

 

Joe Carrigan: I like to think I'm smart. Maybe I'll do something. No, don't respond to these. These are obviously fake. And of course, one of the reasons that these are so obviously fake is because they will get responses from people who genuinely believe it. And, you know, that's.

 

Dave Bittner: More filtering.

 

Joe Carrigan: Yeah, more filtering.

 

Dave Bittner: Yeah, it's a shame.

 

Maria Varmazis: Yeah, I wonder how many of those people are very, very young people who are like new to the internet sometimes? If that's even a thing anymore.

 

Dave Bittner: And finances, yeah.

 

Maria Varmazis: Yeah, I have to wonder. Because I remember when I got my first scam email when I was a teenager, you know, the internet was still new, I actually got really scared, because I thought it was genuinely from the FBI [laughter]. This was a really long time ago, and I was probably like 15. But it took me a minute to go, no, that can't be real. I figured it out. I didn't do anything, you know, that got me hacked or anything. But I remember, it got me for a minute, because I genuinely had no idea. So I have to wonder.

 

Dave Bittner: All right, well, again, we would love to hear from you. If there's something you'd like us to consider for our Catch of the Day, please email it to us. It's hackinghumans @n2k.com. And that's Hacking Humans brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the Show Notes or send an email to hackinghumans @n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliott Peltzman and Tre Hester. Peter Kilpe is our Publisher. I'm Dave Bittner.

 

Joe Carrigan: I'm Joe Carrigan.

 

Maria Varmazis: And I'm Maria Varmazis.

 

Dave Bittner: Thanks for listening. [ Music ]