Love, lies, and a fake 49er.
Dave Bittner: Hello, everyone, and welcome to the "Hacking Humans" podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner, and joining me is Joe Carrigan. Hey there, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: And our N2K colleague and host of the "T-Minus: Space" cyber briefing, Maria Varmazis. Maria.
Maria Varmazis: Hi, Dave. And hi, Joe.
Dave Bittner: We've got some good stories to share this week, but first, let's get into some follow-up here, and I have to start things off here. Joe?
Joe Carrigan: Yes.
Dave Bittner: You posted some photos of your chicken coop over on Facebook.
Joe Carrigan: I did.
Dave Bittner: And I have to say, without reservation, I am very impressed. It's beautiful.
Maria Varmazis: Looks nice.
Dave Bittner: It really does look nice. I mean, I don't want this to sound like a backhanded compliment.
Maria Varmazis: But...
Dave Bittner: But I'm really impressed with the craftsmanship. And I mean that sincerely. It's not like -- you know, I wasn't expecting this to be like, you know, look like something Homer Simpson built. Right?
Maria Varmazis: It's cozy.
Dave Bittner: Yeah. It's lovely. Yeah.
Joe Carrigan: That is why it took me all summer to do it. Because, well, first off, I was only working on it nights and weekends. You know, I didn't -- it's not my full-time job.
Maria Varmazis: What?
Joe Carrigan: Not yet. Not yet. Yeah, it might be. That might be something I do in retirement. Who knows?
Dave Bittner: Yeah, I can see that. Chicken coop builder.
Joe Carrigan: Yeah. So yeah, it looks very much like the Third Coast Craftsman models that I see everywhere else. It is done pretty close to the plans. There's only some minor modifications I had to make. There is also one thing that I did not put on here, and Lisa has not noticed yet, but there are supposed to be like corner braces going between the back of the coop or the egg boxes and up to the roof. And I haven't put those in. I don't know that I want to put those in.
Dave Bittner: okay.
Joe Carrigan: I don't think they add anything structurally. Maybe they do. I don't know.
Dave Bittner: We'll see.
Joe Carrigan: If the roof starts sagging, I'll just build a new roof and put them on again. The roof wasn't hard. The hard part was building the actual structure of the coop, and the T-111 siding is just ungodly to work with. It's so heavy.
Dave Bittner: Oh, wow. You built that part. See, I figured that part was like a kit.
Joe Carrigan: No.
Maria Varmazis: That's what I thought, too. You built this entirely from --
Joe Carrigan: I went to Home Depot and purchased lumber.
Dave Bittner: Wow.
Maria Varmazis: What?
Joe Carrigan: I also went to Harbor Freight and bought a framing nailer. That was a game changer.
Maria Varmazis: That was a clutch move. Yeah. Not making a chicken joke because it was a --
Dave Bittner: Right.
Maria Varmazis: A clutch move.
Dave Bittner: Oh, nice. Wow.
Maria Varmazis: Unintentional, but I'll take that one.
Joe Carrigan: That changed everything. That made a lot of these things go so much faster.
Dave Bittner: Yeah. So I'm curious, the area below the part that looks like a barn.
Joe Carrigan: Right.
Dave Bittner: Is that actually a useful area for the chickens, or did you screen that off?
Joe Carrigan: Yep.
Dave Bittner: okay.
Joe Carrigan: They can get to it.
Dave Bittner: okay.
Joe Carrigan: It's essentially part of the run. It's an extra, like, what is it, four by -- so 24 square feet of space for them.
Dave Bittner: okay.
Joe Carrigan: They also like to hang out under there when the sun's out and beating down on them.
Dave Bittner: Sure.
Joe Carrigan: Because it gives them more shade.
Maria Varmazis: Yeah, that makes sense.
Joe Carrigan: And when it's raining, you know, if the rain's coming in sideways, they go over there.
Dave Bittner: Yeah.
Joe Carrigan: But, you know, they can -- you know, it's pretty nice. The landscaping is really what brings it together, though.
Dave Bittner: Yeah.
Joe Carrigan: And that is my wife's doing, and it is great. She came up with that. I will say, she did use a little bit of chat GPT to help her out. Or maybe Gemini, I don't know. But she was like, how can I make this look like -- give me an idea. And she pulled it out. And, of course, it looked like it was, like, overgrown with flowers and everything. And so, right now, there's some mums along the outside of it. There's one of those old milk barrels.
Maria Varmazis: Jugs.
Joe Carrigan: Yeah, milk jugs. Big metal milk jugs.
Dave Bittner: Yeah.
Joe Carrigan: I'm actually not a fan of these things because I don't see the purpose in them. First off, you can't open them. They're sealed shut, so you can't put anything in there.
Maria Varmazis: They look farmy.
Joe Carrigan: Yeah, exactly.
Maria Varmazis: It's aesthetic.
Joe Carrigan: Right. It's aesthetic. That's about it. I'm much more of the -- sometimes that's all you need.
Dave Bittner: Right.
Joe Carrigan: And then we have this -- go ahead.
Maria Varmazis: I was going to say, the coop is beautifully red with, you know, white trim. The whole thing is actually very tastefully done. I was surprised that you made something that looks this nice.
Joe Carrigan: Yeah, we had -- my wife and I had a lot of conversation about the color of the coop. I mean, it was not -- this was not something -- we put a lot of thought into this.
Maria Varmazis: You clearly did. This really surpassed my expectations. When you were describing this, I was expecting functional, and that's it.
Joe Carrigan: Yeah, my wife is not having that.
Maria Varmazis: Good for her. Good for her. This is actually a pleasure to look at, honestly. This is very nice looking.
Joe Carrigan: Yeah, her word is that chicken coop better look bougie.
Dave Bittner: Oh, okay.
Maria Varmazis: It does. It does look bougie. You genuinely did a great job.
Dave Bittner: Yes, I agree. So what happens next? When you decide that you need more chicken coop in your life, do you expand this one, or do you get a second chicken coop? Do you tear this one down to the studs and just start over? Like, what happens?
Joe Carrigan: If I need more chicken coop, I can make -- I don't need more chicken coop, because this coop will hold 12 chickens, which is the most I can have.
Dave Bittner: okay.
Joe Carrigan: But if I get more than 10 chickens, I might want to extend the run a little bit, or maybe bump it out to the backside of this picture a little bit, or do something else.
Dave Bittner: I see.
Joe Carrigan: But I think we're going to probably cap out around 10 chickens, two of which might be Polish chickens, because I have always wanted to have a Polish chicken, or two Polish chickens.
Dave Bittner: okay.
Joe Carrigan: Because I think they are --
Dave Bittner: I feel like you're setting up a punchline or something.
Joe Carrigan: No, no.
Maria Varmazis: Is it because you like galopki and pierogi? Is that why?
Joe Carrigan: No. Have you ever seen a Polish chicken?
Maria Varmazis: All right. I'm off to Google it. Hold on.
Joe Carrigan: All right. Right.
Maria Varmazis: Polish chicken. And this is not like some joke, right? This is not --
Joe Carrigan: No, it's not. No, this is not some kind of racist Polish joke. Right. No.
Dave Bittner: Bofa.
Joe Carrigan: Right. No, no. That was a good joke, Dave. [ Laughter ] They're crested chickens. They have --
Maria Varmazis: okay. They are magnificent.
Joe Carrigan: Yeah, they are.
Maria Varmazis: Wow.
Joe Carrigan: They're really cool.
Dave Bittner: okay.
Joe Carrigan: They are not cheap.
Dave Bittner: So you can get bougie chickens for your bougie chicken coop.
Maria Varmazis: Bougie.
Dave Bittner: Very nice.
Joe Carrigan: Yeah. Rabbits live in a hutch. Chickens live in a coop.
Dave Bittner: All right. Well, we will attempt to -- if it's okay with you, Joe, we will attempt some way to include this photo in the show notes.
Maria Varmazis: Yeah.
Dave Bittner: Or show image or something like that so we can show off your handiwork here and people can enjoy it.
Maria Varmazis: Yeah.
Dave Bittner: So we'll see if that's possible to do. All right. I tell you what. Let's take a quick break here to hear from our show sponsors. We'll be right back with our stories after this. [ Music ] And we are back. I'm going to kick things off for us this week. My story comes from the AP, actually, the Associated Press. They put this story together along with the folks at PBS, "Frontline", the TV program.
Maria Varmazis: Oh, yes.
Dave Bittner: Investigative "Frontline".
Maria Varmazis: Big fan. I'm a big fan of "Frontline".
Dave Bittner: Yeah, good show, good show, "Frontline". So they've put together a special called "Inside the Scam", and this is sort of the print version of that, I guess, the one that will be on PBS. But really interesting story here. I'll just sort of run down it. It begins with a gentleman named Simon, who sadly lost his wife after 43 years of marriage, and he was feeling lonely and grieving the loss of his wife. So he went online looking for companionship, and he met a woman named Emily. And over the next few months, they developed what Simon thought was a real relationship. But, of course, Emily was not real. And by the time Simon realized he was being scammed, he'd lost about $800,000.
Joe Carrigan: Yikes.
Maria Varmazis: What? Okay. Yep. All right.
Dave Bittner: Yeah. So it gets worse.
Joe Carrigan: It gets worse than $800,000?
Dave Bittner: Well, some of the money he lost, he had borrowed. So now he had to pay that back.
Maria Varmazis: Oh.
Dave Bittner: But the thing I really want to focus on that this story highlights, that I don't think we've really touched on very much, is he had to pay tens of thousands of dollars in taxes from money he'd withdrawn from his retirement accounts.
Joe Carrigan: Yep.
Maria Varmazis: Aw.
Dave Bittner: He says he contacted the police and the FBI. He didn't get very much help from them. But then someone reached out to him and promised to connect him with the Secret Service to help recover his money, all for a low, low fee.
Maria Varmazis: Oh, my God.
Dave Bittner: A follow-on scam.
Joe Carrigan: This guy just keeps getting it.
Maria Varmazis: Oh, no.
Dave Bittner: Yeah. And it was a follow-on scam.
Maria Varmazis: I'm not angry at him, to be clear.
Dave Bittner: No.
Joe Carrigan: No, no. I'm angry at this organization that has so expertly, and I don't mean that in a good way, expertly exploited this guy.
Dave Bittner: Yeah.
Maria Varmazis: Oh, jeez.
Dave Bittner: So for this report, AP and "Frontline", they interviewed 58 victims between the ages of 32 and 90, all walks of life. They talked to doctors, IT professionals, academics. They say some lost thousands of dollars, others lost millions. And they say what we say here all the time, modern scams aren't about gullibility. They're sophisticated criminal exercises, and they're designed to exploit the fact that we're human. We have loneliness, grief, fear, trust, and financial insecurity. Interesting point. I want to get back to the thing about the taxes, but before I do --
Joe Carrigan: Yeah, I'm happy to talk about that.
Maria Varmazis: Oh, strap in, everybody. Okay.
Dave Bittner: They highlighted that in America, consumers have relatively limited protections.
Joe Carrigan: Yes.
Dave Bittner: So if somebody steals your credit card and spends your money without permission, you have a backup there. Like the bank will generally make you whole because you didn't do anything wrong, right?
Joe Carrigan: Right.
Dave Bittner: But if a scammer manipulates you into authorizing the transaction yourself, the banks are not required to reimburse you.
Joe Carrigan: Right.
Dave Bittner: Because from the bank's point of view, you authorized the transaction.
Joe Carrigan: Right.
Dave Bittner: The bank did nothing wrong. This is your, I'm putting air quotes around fault for having transferred the money or turned the money over or withdrawn the money. But I want to get back to this thing about the taxes. They talked to a retired nurse who had lost more than $200,000 after being tricked into -- she was tricked by someone who's impersonating a federal agent. And after she lost the $200,000, the IRS sent her a bill for $80,000.
Joe Carrigan: Yeah, sounds about right.
Dave Bittner: Because she'd withdrawn the money from her retirement accounts.
Maria Varmazis: Yeah. Oh my God.
Dave Bittner: And eventually she had to sell her house and she's kind of making due by selling quilts. So heads up to Lisa, Joe.
Joe Carrigan: Right. There's competition out there that's highly motivated.
Dave Bittner: Right.
Maria Varmazis: Yeah. Well, I mean, lives being ruined on so many levels. I mean, this is not --
Dave Bittner: Right.
Maria Varmazis: I mean, when we talk about, oh, a romance scam, it sounds like somebody just lost a little lunch money. I mean, these are --
Dave Bittner: Right.
Joe Carrigan: So I want to talk about the tax issue for a second.
Dave Bittner: Yeah.
Joe Carrigan: So what happens when you go to make a withdrawal from your retirement account, like a 401k, a 403b, or an IRA?
Dave Bittner: Yeah.
Joe Carrigan: Those are all tax-deferred accounts.
Dave Bittner: Right.
Joe Carrigan: So you don't pay taxes when you put it in there unless you get a Roth IRA. It's the opposite. But you do pay taxes when you withdraw them and you pay them at the regular income rate. So if you make a $200,000 withdrawal, that very quickly bumps you up to a pretty high tax bracket. So on like the last, whatever, $50,000 of that, you're paying like 24% tax on that. And it's because in the U.S. we have a marginal tax rate.
Dave Bittner: Right.
Joe Carrigan: Which means you get taxed lower at the lower income levels and as you move up in income levels, the next bunch of money you make gets taxed at a higher level, then the next bunch of money you make gets taxed at a higher level. But if you make a withdrawal from an IRA before you are 59 1/2 years old, there is a 10% penalty. So immediately, you bump up your tax rate on all those brackets by 10%. So when you say that this woman took out $200,000 and owed $80,000 in taxes, that sounds about right. Now, when you make a withdrawal, you know, your account holder will say, would you like us to withhold taxes? And you can say yes. And then the IRS won't send you a bill.
Dave Bittner: Oh, interesting. Okay.
Joe Carrigan: You'll get I think a 1099, or some form from your retirement account holder and then you'll file your taxes normally. But you don't have to worry about that if you have them withhold it. They can do that. But it sounds to me like the scammers convinced her, especially if they were impersonating federal agents, that they don't -- no, we're the federal government. You don't need to withhold taxes. We'll take care of it and you won't have to worry about this when this is all over.
Dave Bittner: Right.
Joe Carrigan: But now, here's my question about this.
Dave Bittner: okay.
Joe Carrigan: Is there some recourse she has from a tax standpoint where she can claim some kind of loss from criminal activity?
Dave Bittner: Well, I'm glad you asked, Joe, because the article talks about that.
Joe Carrigan: okay.
Maria Varmazis: okay.
Dave Bittner: So at this point, no, not really. But Congress is starting to respond with proposed legislation. So there is a bill that has been put before Congress that is designed to help people in this exact situation.
Joe Carrigan: okay.
Dave Bittner: It's designed so that they can claim this as a loss for fraud and they will not have the same tax liability that they have if they had just withdrawn it.
Joe Carrigan: They should probably -- I think they should have no tax liability.
Dave Bittner: Well, it may be. I don't know the details of the bill, but I think it's just recognition that as more and more people are falling victim to these sorts of things, the tax bill is insult to injury.
Joe Carrigan: Yeah. Right.
Maria Varmazis: It sure is.
Joe Carrigan: Exactly. Because, you know, now she does owe these back taxes.
Dave Bittner: Yeah.
Maria Varmazis: So crazy.
Joe Carrigan: Yeah. This angers me so much. This angers me almost as much as my story does.
Dave Bittner: okay.
Maria Varmazis: It's a visceral anger. I'm feeling that, too. It's just feels emblematic of so many -- yeah. It just feels very emblematic of how much people are really, in our country, especially, really on their own with this stuff. And the pace at which the threat of facing the average person on these kinds of scams has just become far more than certainly our legislation and regulations have been able to keep up with.
Dave Bittner: Yeah.
Maria Varmazis: I really hope that that bill comes to fruition, but I'm very cynical. I can see that very easily not happening.
Joe Carrigan: Given how old everybody in Congress is, I'll bet it does.
Maria Varmazis: I'm hoping you're right. I'm hoping you're right. I really am.
Dave Bittner: We'll see.
Joe Carrigan: I don't want to get scammed out of my money.
Dave Bittner: That's right. That's right.
Maria Varmazis: I really hope that it works. I really hope it works in this bill's favor because, I mean, I'm getting so mad.
Dave Bittner: Yeah.
Maria Varmazis: And we've talked about this before, and so it's not even new to me. But still, every time I'm reminded that this is a thing, I get so angry.
Joe Carrigan: Right.
Dave Bittner: Well, and also, the UK requires banks to reimburse customers who are tricked into sending money to scammers.
Maria Varmazis: Wow.
Dave Bittner: So they have more of a backstop than we do. Yeah.
Maria Varmazis: Nope. What's that like?
Dave Bittner: A couple other interesting --
Maria Varmazis: Sorry, I'm getting really mad.
Dave Bittner: Yeah. A couple other interesting tidbits here. In their reporting, the AP and "Frontline" talked to a former FBI official who worked at the IC3, the Internet Complaint Center -- Internet Crime Complaint Center.
Joe Carrigan: Yes.
Dave Bittner: And they learned that the IC3 gets about 3,000 complaints every day, but they're only able to address about 10% to 12% of them just because of manpower issues.
Maria Varmazis: Of course. Yeah.
Dave Bittner: So the odds of you getting help are quite low, unfortunately.
Maria Varmazis: Yep. And that 3,000 a day, as high as that number is, you know that's a tiny fraction of what's going on.
Joe Carrigan: What's actually happening, yeah.
Maria Varmazis: So many people don't bother to report it, and can you blame them? I mean, it's what we always recommend. I will always recommend it. But at the same time, I don't blame people for going, what's the point?
Dave Bittner: Yeah, and they point out here that underneath all this is shame, that so many victims don't tell their friends or family because they're embarrassed, and that isolation helps the criminals.
Joe Carrigan: Yeah, it does.
Dave Bittner: So hopefully this will help shine a light on some of this stuff and maybe get that legislation passed and just get the word out that more people have to be wary of these sorts of things. So we'll have a link to that in the show notes. As I said, this is the version of it from AP. I have not looked to see if there's a "Frontline" show coming about this, but I suspect there is because that's what they do. So look for that as well.
Joe Carrigan: I'll have to watch it even though I don't have cable anymore. Find a way.
Dave Bittner: All right. That is my story. Joe, you are up next. What do you got for us?
Joe Carrigan: So I really wanted to start off with one of those Dr. Farnsworth from "Futurama". Good news, everyone.
Dave Bittner: Right.
Joe Carrigan: Good news, everyone.
Maria Varmazis: Oh, I love it.
Joe Carrigan: Good news. Which always means really, really bad news, right? So the FBI is now probing a service online that is selling 153 million driver's licenses. This comes from Brian Krebs at Krebs on Security. And he's talking about this new identity theft service that was launched on the dark web is selling digital scans of more than 153 million driver's licenses. And he was alerted to it on August 31st because somebody checked it out and said in a Russian cybercrime forum, said, hey, Brian, your device, your stuff is on here.
Maria Varmazis: Oh my God. I know that guy.
Joe Carrigan: So this service is calling itself Nexus. Right? That's the first thing you do. Oh, and one of the great things about this is Brian did some poking around. And the very first picture is of somebody named Peter Heg something.
Maria Varmazis: That guy.
Dave Bittner: Yeah.
Joe Carrigan: Yeah. And it's got a picture of his face. And, yeah, it kind of looks like Pete Hegseth.
Dave Bittner: Yeah.
Joe Carrigan: So Brian went out there and he looked at this. He did a quick look around and he thinks they're not exaggerating because when he doesn't do any filtering and just does a search, he gets 11.5 million pages of results with roughly 15 results per page. Some of these are listing their records as having a source of being a CDL, which means a commercial driver's license.
Dave Bittner: Oh, yeah.
Joe Carrigan: There are other categories on here as well. There's driver's licenses, that's 153 million. Identification cards, 10 million. Uncategorized cards, 5 million. Travel documents -- I don't know what that means. Perhaps passports.
Maria Varmazis: Passports, probably, yeah.
Joe Carrigan: 1.9 million. International driver's license or IDs, 1.3 million. Medical cards, over 500,000. Common access cards, CACs, close to half a million CACs in this database.
Dave Bittner: Wait, wait, wait. Stop. What are what are common access cards?
Maria Varmazis: That's wicked bad.
Joe Carrigan: That's the card the government uses as an identification.
Dave Bittner: Oh, okay.
Joe Carrigan: And it also has a smart chip in it so that you can use it to authenticate yourself to a network.
Dave Bittner: I see. Okay.
Joe Carrigan: So you have keys and certificates on it.
Dave Bittner: Yeah.
Joe Carrigan: It's like a YubiKey, but it's, you know, a little bit more advanced than YubiKey, but kind of the same thing.
Dave Bittner: Okay.
Joe Carrigan: And it has a picture of you on it. And it's PIN protected as well. So the first question, obviously, is where are they getting all this data?
Dave Bittner: Right.
Joe Carrigan: How are they getting this? And the people behind Nexus claim these images are coming from an active breach at a major identity verification company.
Maria Varmazis: All right. Okay.
Joe Carrigan: Sorry. Maria, I can't wait to hear how you do your story.
Maria Varmazis: I cannot. I cannot. I cannot. I cannot. I'm sorry. I'm even madder now.
Joe Carrigan: And here's a quote from one of the actors. We have been continuously exfiltrating -- get ready, Maria. Buckle in. This is not a good story. We have been continually exfiltrating new data for over a year to our private database. The service records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.
Maria Varmazis: What?
Joe Carrigan: Or not customer, but I guess customer of the ID service. So Krebs says that, indeed, within the past 24 hours, the number of driver's license records has increased by nearly 400,000. So they're still stealing these drivers. They're doing it right now. As Krebs is writing this, they're doing it.
Dave Bittner: Yeah.
Maria Varmazis: What are we doing here? Seriously. What are we doing here?
Joe Carrigan: So Brian talks about his record in this database. It had six images that were of his license front and back in a regular photo, then an infrared version of the photo, and then an ultraviolet version of the photo. So apparently there are anti-tamper things on licenses that show up under ultraviolet light, maybe infrared as well.
Maria Varmazis: Yes.
Dave Bittner: Right.
Maria Varmazis: Yeah.
Joe Carrigan: So that's why these are in here. The date and the timestamp -- now, this is where Brian gets into the investigation. Like, okay, you talk about a major identification company. Who is that? So he looks at the date and timestamp attached to his images, and he finds that they coincided with a date back in June of 2025, where he took a flight to the Midwest to attend a family funeral. So he calls up a bunch of friends and says, can I look up your information in this database, which is actually a very ethical thing to do.
Maria Varmazis: Very nice. Yeah, kudos. I would have expected no less from Krebs.
Joe Carrigan: Yeah. I would have just gone ahead and looked somebody up and then called them and said, hey, you're in the database.
Dave Bittner: And you should be ashamed of yourself.
Joe Carrigan: No, no. Get ready, because somebody's coming with identity theft.
Dave Bittner: Right.
Maria Varmazis: Yeah.
Joe Carrigan: But they said one person whose license was in this system had not flown recently, but was renting a car from Hertz for several months around the date of their timestamps.
Dave Bittner: Okay.
Joe Carrigan: Also, two of the people that he asked were federal employees who said they shared other forms of government identification when passing through the airport security. So they may be a CAC, maybe your government ID card, maybe whatever your military ID is. And those didn't show up in the database. But they did say they scanned or they shared their state issue driver's license with Hertz for renting a car. Here's where it gets interesting. Brian says he was able to find his mother's driver's license in the service as well. And the timestamps for her image are just a few seconds apart from the timestamps for his image. And he says, that's important because we both handed our licenses to the Hertz rental representative at the same time. And that person just dropped it into one of those scanners and handed it back to him.
Dave Bittner: Yeah.
Maria Varmazis: Okay.
Joe Carrigan: So then Brian asked a friend of his, Zach Edwards, who's a well-known security researcher, if he can do his research, use Zach Edwards'. And Edwards says, sure, go ahead. And Zach's license is in there. Now, Zach said a timestamp on his record matched up with DEF CON last month when he was in Vegas.
Dave Bittner: Okay. Big hacker conference.
Joe Carrigan: Right.
Maria Varmazis: Yeah. Maybe you've heard of it.
Joe Carrigan: Yes. But Edwards did not rent a car in Vegas, which is interesting. So maybe, I don't know, it could be Hertz, could be not Hertz, but we're going to get there. He did hand over his license at the TSA.
Maria Varmazis: Right.
Joe Carrigan: He did buy some marijuana at a marijuana dispensary in Vegas. And he handed over his license in a hotel. But he said the only one of those three that scanned his ID was a dispensary.
Maria Varmazis: Yeah. That makes sense.
Joe Carrigan: When he bought the weed, the dispensary, which is Planet 13, which is a big multi-chain marijuana distributor all over the West Coast. Now, here's where Krebs has done a little bit of digging around, because this is fascinating work. And thank you, Brian Krebs, for doing this, because I think we have our answer in this article, although we can't really say for sure. But in 2022, the New Orleans-based identity provider IDScan published a press release that said, we have reached an exclusive identity verification deal with Planet 13.
Maria Varmazis: Oh, yep.
Joe Carrigan: So okay, that's interesting. So IDScan says it processes verification for more than a thousand dispensaries in 19 states. So then if you go to IDScan's website -- you know how when you go to a company's website, they have these big, look at our big customers?
Maria Varmazis: Oh, yeah. Marketing departments love those.
Joe Carrigan: Guess who's on the list?
Dave Bittner: Planet 13.
Joe Carrigan: Well, Planet 13 is on the list. Think nigger.
Dave Bittner: Oh, Hertz.
Maria Varmazis: Oh, Hertz. Yeah, yeah, yeah.
Joe Carrigan: Hertz is on the list.
Dave Bittner: Right.
Maria Varmazis: Yeah. Oh, there you go.
Joe Carrigan: Now, IDScan is based in New Orleans. Guess which field office of the FBI has opened up an investigation into this?
Dave Bittner: Alaska.
Joe Carrigan: No. It's New Orleans, Dave.
Dave Bittner: Oh, okay. Gotcha. Sorry.
Joe Carrigan: Yeah. So all signs are pointing to IDScan.
Maria Varmazis: Oh, man.
Joe Carrigan: So I don't know if there's been any public stuff. One of my favorite things about reading Krebs on Security is going through the comments. And I found this comment on this story from VBB. I'm just going to read this verbatim. It's a little late to hold ID vendors to a higher security standard when the ID data has been exfiltrating for over a year. IDScan is so concerned about it, they sent a marketing person to talk to you, which is, I guess, Krebs reached out and they got a marketing person.
Dave Bittner: Yeah.
Joe Carrigan: Surely, the next step for IDScan is to issue a press release saying, your security is our top priority.
Maria Varmazis: Yeah, yeah. We take it very seriously. Blah, blah, blah, blah, blah.
Joe Carrigan: And someone named Stephen Tinius says, and to show we're sincere, here's a free identity theft service for a year.
Dave Bittner: Yeah.
Maria Varmazis: Well, you'll get a whole bunch of emails that you will ignore because you're getting 20 of them already.
Dave Bittner: Yep.
Maria Varmazis: Ask me how I know.
Joe Carrigan: So if you -- I remember when I was working up at Hopkins, Tony Dahbura, Dr. Dahbura and I did a survey of Maryland people, Maryland residents on their cybersecurity, and we asked, has your data been in a breach? And something like 50% of people said no, and that is incorrect. This is 150 million records.
Dave Bittner: Right.
Joe Carrigan: Now, there may be duplicates in there, but it's big.
Dave Bittner: Yeah.
Joe Carrigan: It's big.
Maria Varmazis: Yeah, this is huge.
Joe Carrigan: The chances are your data -- if you're listening to this and you live in the U.S. and Canada, your data is probably in here.
Maria Varmazis: Yep. Yeah. So I think part of the reason this story incenses us all so much is we try to tell people on this show, in practice, in general, what people can do to try and protect themselves. There's no stinking recourse for something like this.
Joe Carrigan: Right.
Maria Varmazis: Like what alternative do you have? Not show your driver's license when you want to rent a car? I mean, you just -- I mean, you can just stay home and do nothing.
Joe Carrigan: Then you can't rent a car. Right, right, right.
Maria Varmazis: Yeah, but like you have no recourse here.
Dave Bittner: No, I was at the doctor's office earlier this week --
Joe Carrigan: I was just about to say that, Dave. That happened to me last month.
Dave Bittner: Yeah. And just, you know, I just handed over my insurance card and my driver's license.
Joe Carrigan: And they scanned both of them.
Dave Bittner: Yeah. And it could have been this company. Who knows?
Joe Carrigan: Yeah. Your data could very well be in here from your doctor's office. Who knows? Yeah.
Maria Varmazis: Yeah, we try to hold, you know, the businesses that we all deal with. You know, if you're very security conscious, you try to get a sense of, you know, what are they going to do with my data? Are they good data stewards? That's like five full-time jobs right there, just tracking that all down. But, I mean, would you think that -- I don't even know how this works. Is it a little device on the employee's desk that, you know, calls into an app or something? I mean, would you even think --
Joe Carrigan: It's a scanner that probably has some software behind it.
Maria Varmazis: It's a scanner, yeah. It's a second place thing, right?
Joe Carrigan: It uploads it to the --
Maria Varmazis: Yeah. Would you even think that that's something that you had to even worry about? And now it's too late.
Joe Carrigan: Well, I'm going to tell you, when I walked into the doctor's office and she said, can I have your driver's license and your insurance card? And she scans them. I looked at her. I said, where does that go? Where do the images go? And she goes, I don't know.
Maria Varmazis: Yeah. I mean, how would they know?
Joe Carrigan: Yeah. Of course, the person at the front desk doesn't know, but I'd like to know. I'd like to know where it goes, but I think I might have an idea where it went.
Dave Bittner: Yeah.
Maria Varmazis: Yeah. It becomes -- you become the in-person equivalent of the guy who reads the terms and conditions in full.
Dave Bittner: Right.
Maria Varmazis: Which is a very rare specimen.
Joe Carrigan: Right.
Dave Bittner: I will add to your story, Joe, because we've been following this on the CyberWire. First of all, I want to echo your praise of Brian Krebs.
Joe Carrigan: Yes.
Maria Varmazis: Yes.
Dave Bittner: Few people come at something like this better than he does with his tenacity of just hunting down the details.
Joe Carrigan: I think he got pissed off.
Maria Varmazis: Can you blame him?
Joe Carrigan: Not only his data is in there, but his mom's data is in there.
Maria Varmazis: You go after someone's mom, come on.
Dave Bittner: Right. So you mentioned this service is called Nexus. The day after Krebs published his report, Nexus went offline.
Joe Carrigan: Really?
Dave Bittner: Yeah. They said this service is no longer available.
Joe Carrigan: Oh, good.
Dave Bittner: Which doesn't mean --
Joe Carrigan: Doesn't mean anything is what it means.
Dave Bittner: Well, right. I mean, obviously, the data is still out there. The data still has value. So the data is being bought and sold on the black market. It might just be not so publicly facing as it was before.
Joe Carrigan: Right.
Maria Varmazis: Yeah.
Joe Carrigan: All they've done is relocate the website. I'll bet they haven't even changed the software.
Dave Bittner: Yeah.
Maria Varmazis: Yeah. And honestly, that's as of the time of this recording.
Dave Bittner: Right.
Maria Varmazis: By the time this episode goes live, this story may have a huge update or five to it. So I guess we'll see.
Dave Bittner: Yeah. We'll see how the FBI does.
Joe Carrigan: Yeah.
Dave Bittner: Yeah. All right. We'll have a link to that report from Brian Krebs in the show notes. Tell you what. Let's take a quick break here. We'll be right back after this message with Maria's story. [ Music ] And we are back. Maria, what do you have for us this week?
Maria Varmazis: I have a good old fashioned romance scam that that is also an investment scam that the FBI recently busted.
Joe Carrigan: Oh, good.
Maria Varmazis: And this story kind of missed my usual scans of stories because it comes from the world of U.S. football, which is not one that I am normally in. I don't know about you two, but it's not -- I mean, I'm sure people will be shocked to hear I'm not a big football fan.
Dave Bittner: That's the one with the pointy ball, right?
Maria Varmazis: It's the pointy one.
Dave Bittner: Yeah. Really pointy ball.
Maria Varmazis: As opposed to the one that you kick.
Dave Bittner: Yeah. Right.
Maria Varmazis: The pointy ball.
Joe Carrigan: There's one -- rugby has a less pointy ball.
Dave Bittner: Oh, okay.
Maria Varmazis: Yes, it's true. Well, no. What if I am -- I forgot that I shouldn't unleash that. Anyway --
Joe Carrigan: Let me tell you about rugby.
Maria Varmazis: Oh, no. What have I done?
Joe Carrigan: Go ahead.
Maria Varmazis: So the district attorney's office -- the attorney's office for the District of Oregon and the Justice Department in Portland, Oregon, put out a press release at the end of August saying that they had busted a love and investment scam that had been running for like five years.
Joe Carrigan: Five years.
Maria Varmazis: And defrauded at least 26 women across the states of Oregon, Washington, Idaho and California out of roughly a total of $1.3 million. And the key name in this story -- so people who listen to our show who are also U.S. football fans, they may have heard this name as Daejon Love is the name of the scammer. He was recently arrested with his accomplice Taylor Chan. So Daejon Love is 35. Taylor Chan is the ripe old age of 18.
Joe Carrigan: Wow. Turn your life around, Taylor. Come on.
Maria Varmazis: Right?
Joe Carrigan: She's going to have some time to think about it.
Maria Varmazis: And again, this this scam had been running for years. So was Taylor like 15 when we started?
Joe Carrigan: Oh, I don't want to think about that.
Maria Varmazis: Yeah, that that was horrifying. They were arrested on August 24th, 2026, and both charged with wire fraud and conspiracy to commit wire fraud. Okay, so the way that this scam worked -- I'm not even saying that this is necessarily a novel take on the scam. I'm sort of reminded of "Dirty Rotten Scoundrels" a little bit. This actually strikes me a little bit old school.
Dave Bittner: Great movie.
Maria Varmazis: It's one of my favorites. It's a great film. Great film. But it's just to me, we talk about romance scams a lot and we talk about how they tend to affect the elderly. This one is one that went right after young people on dating apps. So I want to go over first how the scam worked and then how one person figured it out, which is my favorite part of the story. So the scammer, Daejon Love, would meet people through dating apps and social media and to convince them that he was actually an NFL player -- he is not, but he would tell people he was. He created a number of multiple fake identities and social media accounts where he would show himself as being a wealthy San Francisco 49ers player or, depending on the year you caught him doing this in, a successful real estate investor. I guess it depended on his mood. I'm not really sure.
Dave Bittner: So was he pretending to be a real football player?
Maria Varmazis: He was.
Dave Bittner: Okay.
Maria Varmazis: He was genuinely pretending to be an active member of the San Francisco 49ers.
Joe Carrigan: Was he impersonating somebody?
Maria Varmazis: Nope.
Joe Carrigan: He's just saying, I'm Daejon Love. I'm on the San Francisco --
Maria Varmazis: Yep.
Dave Bittner: Oh, he's using his real name?
Maria Varmazis: He was.
Joe Carrigan: So you can even go to the San Francisco 49ers website, look at their roster and see that he's not on it.
Maria Varmazis: So you know, it's funny that you mentioned that. That is actually how I found out about this scam this past week was the Kelce's of the Taylor Swift world.
Dave Bittner: Oh, yeah, yeah. Okay.
Maria Varmazis: The brother, Jason Kelce, was apparently talking to his more famous brother, I guess, saying -- the quote that I saw was, it's hard to feel bad when it's just as easy to Google it. Essentially, they were talking about this scam specific and specifically and said, I'll be honest, it's hard to feel bad when it's as easy as just Googling it. Like you're going to give $50,000 without Googling the guy's name and find out what happened before this was noteworthy. Like if you Google his name, it would show up, you know, like even if you're not well known, at some point you'll have some documentation that this guy was actually real or not. And he was like, why didn't anyone Google this guy? Well, they didn't. I don't know what to tell you, Sir Kelce.
Joe Carrigan: 26 women didn't.
Maria Varmazis: Yeah. 26 women didn't. I bet a lot of other women did and were like, I don't know who you are. Goodbye. Yeah.
Joe Carrigan: You got to lie to 100 to get one that believes you.
Maria Varmazis: That's exactly it. Yeah. And I get his point. I do understand that. But I like to try and still default on the side of sympathy for people because --
Joe Carrigan: Yes, I do, too.
Maria Varmazis: Yeah. That's just me. So Daejon Love would, on his social media accounts, do the sort of braggadocio that many people think that rich people would do of showing off their luxury cars, expensive lifestyles, and then also random football imagery to sort of reinforce his story, like walking across the turf or, you know, being in the stadium when no one else is there, that kind of thing.
Joe Carrigan: Posing like the Heisman trophy.
Maria Varmazis: I suppose. And so this convinced enough victims that he was genuine and he actually would see them in person. So this was like he got something out of this physically. He actually would physically be with these women. So he was not just like a voice through the screen or whatever. He was actually like courting these women, to put it politely. And he would convince them that like he was the real deal pro NFL player, which for many women in this world -- I am not one of them. But for many women in this world, that is like as great a catch as you can get. Like, that is the goal.
Dave Bittner: I got to keep hitting the gym.
Maria Varmazis: Yeah, I mean, he looks physically -- if I saw him and you told me he was a pro NFL player --
Joe Carrigan: You'd believe it.
Maria Varmazis: I mean, I wouldn't go, oh, he's obviously not. I mean, I don't --
Joe Carrigan: Right.
Maria Varmazis: But it wouldn't strike me as implausible. Let me put it that way.
Dave Bittner: Yeah.
Maria Varmazis: So I guess during the course of their courtships, he and his friend, Taylor Chan, would start to drop the little fish hook in about, oh, I've got these exclusive investment opportunities that could generate huge returns. Like, you know, I'm already so wealthy, so I want to share the wealth. And since I'm in love with you, maybe you want to get rich alongside me so we can both be rich. And he would use fake bank screenshots and investment apps to show like multimillion-dollar balances to sort of legitimize his fake story. And Taylor Chan was also posing as love's financial advisor. And so they would be on like --
Joe Carrigan: I got me an 18-year-old financial advisor.
Maria Varmazis: I mean, if you don't know that he's 18, maybe he has a really deep voice. I don't know.
Joe Carrigan: My son had an amazingly deep voice at 18.
Maria Varmazis: I mean, some guys do. And also, if you can talk a lot of financial blah-di-blah, you know, and people who don't know a lot about this stuff, they might go, that sounds real enough to me. Sure, I'm in. And also, I love this guy. So why would he want to defraud me? It's not where their brain is at. They're not thinking this is what's going on.
Joe Carrigan: Right.
Maria Varmazis: So, you know, basically, you know, Daejon Love and Taylor Chan would work the victim. I mean, there's no other way to put it. They would just convince this victim to give them loads and loads of money. And they were encouraged to send money directly, invest their savings and in some cases take out personal loans.
Joe Carrigan: Ugh.
Dave Bittner: There you go.
Maria Varmazis: Yeah. And then once the victims either ran out of money or started asking questions, they were immediately cut off. And just to be clear, the prosecutors in this case have said that absolutely not a single victim who's been identified has actually received any investment return or payment. So that's not a huge surprise. So they're out of the money. So that's how that scam worked. When I was researching this story and this, as you might imagine, this story has gone gangbusters on social media and sort of mainstream media because it's, you know, a romance scam that involves the NFL kind of, so everyone's got a take on this one.
Dave Bittner: Right.
Maria Varmazis: So there's a story from this woman named Ayana Velasquez about, she actually met Daejon Love through a dating app in 2021. And apparently at that time he was going by Jonathan Love.
Dave Bittner: Johnny Love.
Maria Varmazis: Johnny Love. And the thing I love about Ayana Velasquez is it is a scientific fact that if your last name starts with a V, that you are a very smart person.
Dave Bittner: Oh, I'm sure.
Maria Varmazis: Yeah.
Dave Bittner: Makes sense.
Joe Carrigan: The later in the alphabet, the smarter you are.
Maria Varmazis: The smarter you are.
Dave Bittner: Yeah. Some of us are slumming at the other end of the alphabet.
Maria Varmazis: But those of us at the Vs, we're just like, we can catch on real fast.
Dave Bittner: Sure.
Joe Carrigan: So Ayana figured out this guy was a scammer really easy, but I love how she figured it out. She immediately was skeptical of his very too good to be true claims. It was like, apparently at that time, Jonathan Love was saying his family was among the richest in Switzerland and owned several extensive real estate properties. And that seems a little bit hard to believe.
Dave Bittner: Right.
Maria Varmazis: And then he reappeared in 2024, then also saying that he was now a pro NFL player. And she was going, hmm. He would send Ayana photos and videos of himself appearing to show himself as not just a San Francisco 49er, but as I mentioned earlier, like him walking the turf of the stadium or being waved at by fans in the bus, like the bus that they take in between games, I guess. And she did a little investigation herself. She checked the files that he would send her and looked at the metadata and realized that there was no metadata, that these are all screen recordings and not original footage.
Joe Carrigan: Awesome.
Maria Varmazis: And that was how she immediately figured out this guy was no good. And as soon as she figured that out, she just stopped and dropped him immediately. But I love that she was like, hang on a second. Let me check the metadata on this guy's videos and photos. Good on you, Ayana.
Joe Carrigan: I want to meet Ayana. She does sound like a very smart, smart person.
Maria Varmazis: Yeah. She is. And if she doesn't work in InfoSec, maybe she should consider a career in it.
Joe Carrigan: She should.
Maria Varmazis: Because honestly, that is so amazing. And I love that she did that. Good for you.
Dave Bittner: Yeah.
Maria Varmazis: So yeah, this is not necessarily like a big, hot new scam that does something we've never seen before. A lot of these are really classic scam tactics of like extraordinary claims and trying to fake what you're saying with, you know, social media presence that sort of makes you seem more trustworthy. But there's always the ask. There's always the financial ask. It came later after I suppose the scammer got, you know, his physical dues as well. And, you know, the financial ask was huge in this case. In many cases -- you know, $1.6 million, I think they said. $1.3 million rather is how much the victims lost in total. That is a lot of money. So you know, romance scams can often blend into an investment scam. This is a classic example of that. And he took his time. This scam ran for five years. So he would really take his time working on getting these women to trust him and enmeshing himself in their lives, like getting them to fall in love with him. And then once that trust was there and rock solid, then he would make the financial ask and he brought his friend in to make it seem more plausible. It's pretty insidious. Yeah, you're going to be hearing about this all over the news if you haven't already. Very water cooler stuff.
Dave Bittner: Do you know what eventually led to his downfall?
Maria Varmazis: The FBI was actually tracing him for a while and both Love and Chan were flying to meet together in Idaho, in Boise, Idaho. And that is where the FBI got them both, at Boise airport.
Dave Bittner: Wow.
Maria Varmazis: And they were there to meet a new victim. And I guess just from July to August of 2026 alone, Love had traveled to New Mexico, California, Oregon, Nevada, Utah, and Idaho. So he had been real busy tracking down a lot of different victims. So that's just crazy. But I guess if you scam people out of $1.3 million, you can afford some flights, but still.
Dave Bittner: Yeah.
Maria Varmazis: Yeah.
Dave Bittner: It's a business. Yeah. It was a business.
Maria Varmazis: Sure was.
Dave Bittner: All right. Wow. Interesting. All right. Well, we will have a link to that story in our show notes. And of course, we'd love to hear from you. If there's something you'd like us to consider for the show, please email us. It's hackinghumans@n2k.com. Joe, Maria, it is time for our Catch of the Day. [ Music ]
Joe Carrigan: Dave, our Catch of the Day comes from the r/phishing, P-H-I, phishing. The title of this post is Clicked On A Phishing Link From Calendly.
Dave Bittner: Yeah.
Joe Carrigan: I can never say Calendly properly. It's such an awkward company name, but it looks good. I know what it means when I see it. So maybe it's not so bad, but it's hard to say.
Dave Bittner: Yeah.
Joe Carrigan: But here is the here is the link right here. We'll put a link in the show notes.
Dave Bittner: All right. Well, it reads like this. Your payout is ready for collection. Confirm the order to receive it. Click the link below to complete your transaction and get your funds. We're excited to see your store grow with every new listing you add. Need any help? Just reply. Our dedicated support team is here for you. We learn from every sale you make and use that knowledge to drive improvements. Our goal is to make selling so smooth, you never have to think about the platform. We're constantly building new tools to save you time and boost your sales. We know you have many choices. We're so glad you're part of our community. Regards, Calendly team. P.S., good to know, schedule your inventory weekly to speed up payouts. Now, here's the thing.
Joe Carrigan: Okay.
Maria Varmazis: You have some thoughts. I know it. I know it.
Dave Bittner: Well, so first of all, we use Calendly every day at CyberWire.
Maria Varmazis: We sure do.
Dave Bittner: Like it is one of our primary -- it is a load-bearing tool for us.
Maria Varmazis: It sure is.
Dave Bittner: Right?
Maria Varmazis: Yep. Yes, it is.
Dave Bittner: And I have to say, when I, years ago, probably nine years ago or so, when I first tried using Calendly, it was a major lifestyle upgrade, just in terms of scheduling people. And so we use it every day. We rely on it. Great tool. Highly recommended.
Maria Varmazis: Love it. Yep.
Dave Bittner: Overall, it's just worked great for us. Yeah. Five out of five. That was a great beat. You can dance to it. But Calendly is not an e-commerce site.
Joe Carrigan: No. No. I was going to ask, because as I'm reading this, I'm thinking, is Calendly upping their game?
Dave Bittner: No.
Joe Carrigan: They're moving into like Shopify and Wix territory?
Dave Bittner: No. They have added an AI component.
Maria Varmazis: I was just going to say that.
Joe Carrigan: Of course they have.
Maria Varmazis: This is one of those things where it could be plausible in the future that maybe they're going to start doing stuff like this, and then we won't know.
Dave Bittner: No, no. No. So they're not an e-commerce platform at all.
Maria Varmazis: Yeah.
Dave Bittner: So here's what I wonder. When you have a major platform like Calendly, could it be that these scammers are relying on the fact that Calendly really can't be blacklisted?
Joe Carrigan: Could be.
Dave Bittner: Because they're such a ubiquitous tool.
Joe Carrigan: Yeah.
Dave Bittner: And they're such a part of doing business.
Joe Carrigan: So is this like a Calendly -- I really can't say it. Calendly invite? Is that what this is?
Dave Bittner: No. This is nothing like -- well, you mean is what the person got a Calendly invite?
Joe Carrigan: Right. Did it come from Calendly?
Dave Bittner: I don't know the answer to that. No, I don't. I do not know, and I don't think so.
Maria Varmazis: No, it was probably just an email that was using an alias to make it look like it was a legitimate Calendly email.
Joe Carrigan: Okay.
Maria Varmazis: Yeah.
Dave Bittner: Right.
Joe Carrigan: So they should be able to block it with like DMARC and whatever the other thing is. I never remember.
Dave Bittner: Yeah, if you say so.
Maria Varmazis: Yeah, I think this has been an issue plaguing Calendly for quite some time.
Dave Bittner: Yes.
Maria Varmazis: I'm sure there's a reason why they're still dealing with this, and they haven't just been able to shut it down, and it's probably because of the wide reach that they need to have to be able to get people to -- I don't know. I'm sure there's a technical explanation.
Dave Bittner: In fact, Maria, one of the comments here on the Reddit thread says, I got tons of these emails. Apparently, Calendly -- you got me now.
Joe Carrigan: It's contagious.
Dave Bittner: Apparently, Calendly, a legit business is unable to stop it. I informed them several times of this issue, so they're aware of it, but for whatever reason, they can't put a stop to it.
Maria Varmazis: Yeah.
Dave Bittner: But it's just an odd mismatch, and I suppose there are plenty of people out there who have no idea what Calendly is. They see a link that says, get paid, and they're like, oh, maybe I'll get paid.
Joe Carrigan: Right.
Dave Bittner: And click through, and away they go.
Joe Carrigan: Yep. [ Music ]
Dave Bittner: All right. Well, we will have a link to that in our show notes, and again, we would love to hear from you. If there's something you'd like us to consider for the show, please email us. It's hackinghumans@n2k.com. [ Music ] And that is our show, brought to you by N2K Cyber Wire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes, or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliott Peltzmann and Trey Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe, probably in the data, Carrigan.
Maria Varmazis: And I'm Maria Varmazis.
Joe Carrigan: With a capital V.
Maria Varmazis: With a capital V.
Dave Bittner: Thanks for listening. [ Music ]
