Loading summary

Transcript211 lines

[00:00]
A
A married couple, both schoolteachers in Ohio, had one dream, which was to own a farm. They inherited $1.3 million. They found the perfect property, the farm of their dreams, on sale for 1.2 million. Everything seemed perfect. They made an all cash offer. It was accepted. And five days before closing, they received what looked like a legitimate email from their closing company with wire transfer instructions. So they transferred 1.2 million. And when they showed up at closing, they discovered they'd been scammed. The email that they had received was fake. It was sent by hackers who had infiltrated the closing company's servers. And those hackers had waited patiently for months until they saw exactly this type of high value cash deal. As of the time of this interview that you're about to hear, the Ohio school teachers have not recovered the money. They're in the midst of legal entanglements around who's liable. This story comes to us from cybersecurity expert Dr. Eric Cole. He joined us to explain why ordinary people, you and me, have become prime targets for cybercriminals. Because the thing is, big companies have cybersecurity professionals. You and I do not. Many criminals are not trying to steal $100 million from one company. They're trying to steal $50 a month from each of us. Today we are airing an interview with former CIA hacker Dr. Eric Kohl. He served as cybersecurity commissioner under President Barack Obama, and he advised high profile clients, including Bill Gates. This episode comes from our archives. We originally aired this episode in June 2025, and when we aired it, many people left comments on YouTube calling this informative. That was the word that kept coming up over and over again. One YouTube commenter said, wow, such an informative episode. Another one said, great info. Another one said, super informative. And so this is an episode full of practical advice, actionable advice that you can apply to protect yourself from hackers and cybercriminals. Because the original episode was so well received, we reached out to Dr. Eric Kohl and asked him to come back to the show for a second interview. He agreed, and we were in the process of seeing, scheduling that interview. Then, unfortunately, on May 19, 2026, Dr. Eric Cole very suddenly passed away at the age of 56. It was sudden and unexpected and the result of an undisclosed health condition. So we never got to bring him back onto the show, which we very much wanted to do. In honor of Dr. Eric Cole and in honor of the incredible information that is now his legacy that he has left to the afford anything community we wanted to share this episode with you one more time. So, again, this episode originally aired in June 2025, and it is with Bill Gates, security Advisor and Barack Obama's cybersecurity commissioner, former CIA hacker Dr. Eric Cole. Why should any ordinary person who's listening to this right now care about cybersecurity? How does it affect their money?
[03:42]
B
The short answer is, you're a target. Most people don't realize that, because here's the reality. If you go in and look at a $3 billion company, they have a team of 60 people doing cybersecurity. You try hacking them, good luck. You look at some big names like Bill Gates or those types of folks, they have dedicated people and cybersecurity specialists like me monitoring and tracking their accounts.
[04:08]
A
So you're an advisor to Bill Gates, right?
[04:10]
B
Yes, his personal estate. So you go in and look at those types of folks. Good luck. Because most people think cyber attacks are going after $100 million from one individual. The reality is, if you go after a small business owner or somebody who owns a dental practice or even a doctor that works at a hospital or a. A professional in other fields, they probably have nobody guarding their security. They probably have minimal security measures. And here's the thing. If I go in and steal $50 from everybody every month, most people won't notice it. Like, and I'll show you some tricks later, but most people don't check their credit card statements. So if there was a 20, 30, 40, $50 deviation, they wouldn't notice it. So we sort of call it the death by a thousand cuts. So the reality is the. You could have money being drained from your account that over years could be costing 20, 30,000, but it's done so low and so little, you don't even notice it. So it could have a huge impact. Second, if you don't have good cybersecurity, I can trick you to going to a website that you think is legit. And you go in and put in your name, your date of birth, your address, and things like that, which is very common. Most people give that out like candy on Halloween. And you do that and you have your. Your identity stolen. Somebody can go in and open credit cards. It's very common at Costco and Target and these other places, because when you go in to make a purchase, they say, hey, do you want to open up a credit card?
[05:37]
A
Right.
[05:37]
B
Try doing it once. It's scary. The minimal amount of information you need about somebody. We get this all the time with our clients where they're Opening up multiple credit cards. They're spending 500 or $800. So it's below the Ford alert systems. They know how the fraud alert system works. Target fraud alert. If you're under $1,100, it won't alert. So they're going to always stay between 7, $800. They know how to bypass the security system. But then here's the reality. They open up four or five credit cards in your name, they run up 8, $900. They go to a bogus address, but they're under your name. It destroys your credit. So now a lot of my clients, they think they have great credit because they're always paying off credit cards. They're always doing good for financial things. They go to get a loan or they go to buy a house and they get denied because they have like a 220 credit rating. And they're like, how could this be? And they're like, well, you have five outstanding credit cards with unpaid debt on it. And it destroys your credit. So it can also impact your credit on that front. It could basically take over your identity, your bank accounts. A big area that we see a lot of professionals getting burnt on is cryptocurrency. One of the cool things of cryptocurrency is it's untraceable, right? That's why people like it. That's why it's used for ransomware and other attacks. But the problem is a lot of people have their crypto wallets with a password, and those passwords are known. If you use the same password across multiple sites and you're not using two factor, and they can go in and empty your wallet. And we've seen this all the time where I get these calls from folks like Eric. I put my entire life savings in cryptocurrency and ran it up to 500 or a million dollars. And I woke up this morning and it's empty. What can I do? And the unfortunate, sad part is nothing. So it's one of those. With cyber, it's prevention and detection, and you need to go in and protect that. And then sort of last thing is, if you have parents or grandparents, they're one of the biggest targets because they have money, they have time. And this is not a negative. But they didn't grow up with the technology. They're naive and they trust people. So if they go in and get a message saying, hey, this is from your bank and we're noticing unusual activity, please click on the link and they will. And they'll empty out their bank Accounts. To me, one of the movies that everybody needs to watch the action is a little questionable, but it's a great movie. It's called the Beekeeper with Jason Statham. It's an action flick. But the core message in the movie is there's this wonderful 65 year old lady, she's a mom and I mean she's just the sweetest, kindest person. And she has her life savings of about 800k and she's running a non profit to help underprivileged children. And she raised 3, $3 million to invest in a orphanage for these kids. And she gets this scam message that says, hey, you've been hacked, please call us, we'll clean up your system. And it's real, it's a fraud. And within 10 minutes she gives away all her information, they're super good. Wipes out her entire life savings. And then because she's so distraught, she takes her own life. And unfortunately those things happen a lot. Where we see that with parents and grandparents and imagine if your parent or grandparent got hacked and they lost everything, that would be devastating. And then the other big area that just, I don't even like talking about it because it gets me so angry and frustrated. And you've seen recent stories with these sex torsion with kids where these kids very successful, they're 17, 18, they're real good in sports, they have a scholarship, they're accepted to a college and somebody hacks or does cyberbullying. And a lot of these kids can't handle it. They don't know who to talk to. And we're seeing more and more of these children taking their lives because they just can't handle that reputational damage. So whether you have kids, whether it's you or whether you're a parent, cybersecurity over the next year is going to impact your life. So if you don't start taking it seriously. And the good news is, as we'll talk about, there's lots of easy common sense things you can do. But it's one of those things where every day when I wake up in the morning and throughout the day I'm getting calls from family members, friends or people that found me online with these devastating stories. So it's one of those things to the listeners is it's going to happen to you. So the more proactive and you can realize you're a target and cybersecurity is your responsibility, you can save yourself headaches or devastating events happening to your family.
[10:23]
A
Wow. One thing that I Hear in your answer are a variety of different types of ways that you could get attacked. You mentioned ransomware, you mentioned identity theft, you mentioned a number of. You mentioned phishing schemes.
[10:39]
B
Phishing schemes are very common where they'll send you links or text messages. Yeah. Ransomware, or what they call extortion. Going in and stealing your identity, credit. Bank hacking. There's a whole, whole range of attacks.
[10:52]
A
Can we go through what some of those attacks are? What is bank hacking? Can they literally access your bank account and take money from a bank account?
[11:00]
B
Yes. A lot of people do not realize this, but most of your banks will allow you to do EFTs, electronic fund transfers. And most banks, depending on the size of your account, will let you take at least 50% in an EFT. So if you have 200k in your savings account, they can actually do an eft for under 100, like 75 or 80k. And you do not get an alert. And all they need is your account number and your password to be able to get in and do those types of attacks. And the reality is you put your account number in a lot of different places.
[11:39]
A
Yeah.
[11:40]
B
And one of the things that people don't realize is like you pay with a check.
[11:44]
A
Yeah, yeah. Your bank account number is written at the bottom of the check.
[11:47]
B
Exactly. And those checks sometimes can easily be caught or accessible. And especially when you do online purchases and you go in and put in your checking account number. Like online billing, a whole nother topic. But think of how many different locations from local municipals to small little places that have your bank information.
[12:09]
A
Right.
[12:09]
B
And then, so I get your bank account information, then I can go in and guess your passwords. Because most people have probably had their account and passwords taken in attacks and available on the dark web. And there's actually dictionaries of common passwords that people use. So if you're using dictionary names and numbers, which most people have some sort of predictability around it, those passwords are readily accessible. So now I can go in, get your banking information, get passwords information, and depending on your security settings, that can sometimes be enough to go in and do EFTs. And then here's the problem. If you don't have a learning turned on, which is one of the things we'll talk to later in the show if you don't have that turned on. Most people don't check their bank accounts for multiple days. And the way it works with the fraud based systems is you have 48 hours to report it because there's a 48 hour hold and then they transfer the money and it's too little, too late. So if you go check three or four days later, you're pretty much out of of the money. And the problem is if it's because of your negligence. And that's a hard pill for people to swallow. But if you had a weak password, or you didn't protect the password, or you didn't turn on the security settings, most of the time you're liable, not the bank. So you're actually out that money. And that's sort of the same thing with cryptocurrency. So people don't realize this. And when we talk about the security settings, people always like, oh, Eric, that's an inconvenience, like spending five extra seconds logging in. But what I always tell people is okay, five seconds is an inconvenience, but having your entire bank savings or your identity stolen, you're going to be inconvenient for nine months. So which inconvenience do you want? Right? Do you want a five second or a nine months? So you people just don't think it's going to happen to them. And the reality is it's happening to average people, folks that are business people, small business owners. So Whether you're making 100k or 100 million, it's across the board. Nobody is spared from these attacks.
[14:05]
A
Why nine months?
[14:06]
B
Just because if you go in and your identity is stolen or your bank account is wiped out, if you look at the amount of effort, because you're gonna have to submit forms, you might have to get attorneys because some of these banks are getting hit so much they can't pay out or go in and give you the $90,000 back. So you have to sometimes fight them, do legal action, put in new security measures, and then think about most people, if they lose 90,000, that could impact their lives. They might have to sell their car or sell their house or apartment. So when you look at.
[14:41]
A
So you mean many months?
[14:42]
B
Many months? Yeah, it's not a set number, but I'm saying it negatively impacts you. If you look at the emotional impact, like your kids going to college and you saved the money to put them to college and now your child can't go to college because your money's wiped out, or now you have to get a loan and you have to work a second job. So you look at emotional impact and impact on your family and it's once again it's, it could be even more, but it's many, many months. And I find on average when you look at the emotional support, the time, the energy, the effort, that is usually somewhere between six to 12 months that it negatively impacts you. So that's why I just use 9 as an average.
[15:19]
A
Right. Wow. So I think a lot of people understand that cryptocurrency is the wild west, and there's a lack of regulation. And part of the risk that you take if you decide to go into cryptocurrency is that lack of regulation, that lack of rule of law protecting what you're doing. But I think that most people, myself included, didn't know that or don't know that about bank accounts, because banks are one of the most highly regulated institutions in the United States. Other than pharmaceuticals right there or weaponry, there are very few industries that are more highly regulated than banks and financial institutions generally. So I think a lot of people would be surprised to learn that even the money in a bank account can be that vulnerable.
[16:00]
B
Yeah. The thing you have to remember is, you're right. It is one of the highly regulated industries, but the regulations are around protecting the bank if they get compromised. So you go to your bank and it says, you mean FDIC insured up to $300,000? That's if the bank gets hacked.
[16:18]
A
Yeah.
[16:19]
B
250, I believe, or 250. So if the bank gets hacked and the bank goes out of business, you're covered. But what people don't realize is the regulation. And it's scary because the US Is one of the few countries in the world that doesn't have a unified law on security and privacy that protects citizens. Most of the regulations out there are protecting the entity, like HIPAA protects hospitals. It doesn't protect individuals. The bank regulation protects the bank. So if the bank goes bankrupt or out of business, you're protected. But if you don't protect your password and somebody gets in and gets your user ID and password, that doesn't protect you from the regulations. You're liable, not the bank. And that's where you have to be real careful there, because, yeah, we think it's all regulations, but they're not protecting you. They're protecting the institution in addition to bank vulnerabilities.
[17:10]
A
Can you go through some of the other ones that you described? So you talked about ransomware, phishing, identity theft. Phishing, I know, is a big one when it comes to closing a mortgage, buying a home.
[17:20]
B
So phishing is a. A technique of. It's basically what we call social engineering, which is the most common method of exploitation, where you're tricking or manipulating something to do something they normally wouldn't do. So common phishing techniques. I don't know if you've seen this, but it happens a lot. You get a text message that says you have unpaid tolls in Florida.
[17:40]
A
Yeah, I get those messages all the time. And I look at them and I'm like, I don't have a car, I live in Manhattan, I don't have a car. But I get messages almost, probably two, three times a week telling me I have unpaid tolls.
[17:51]
B
And here's the thing you have to remember, the frequency in which you get them is the frequency in which people are falling vulnerable to it. If they sent out that message and nobody clicked and nobody replied, they'd stop. So when you're getting any of these, like the unpaid tolls or messages from Amazon or your bank or things like that, and it's fraud because you look at the messages or you look at the email and you're like, hey, this doesn't feel right. The frequency in which you're receiving it is the frequency in which people are falling victim to it. So just that Florida toll example, which is like $49, they have made over $3 million on that in six months. And the problem that we have is we know who they are, we know where they're coming from, but they're in countries that don't have extradition treaties and it's not against the law. A lot of these attacks are, are coming from Russia. And then people are surprised, North Korea, Iran, that those are big scams because they're easy, they're simple. And we don't have extradition treaties or laws. So the problem is law enforcement and cybersecurity professionals like me, we know where they are, but we can't do anything. So that's why these attacks continue. And then the other thing with phishing is we see these all the time. You get a message that it looks like it comes from Amazon. Nothing against Amazon, just they're the biggest retailer. And. And it says, the recent order you just placed is on backorder. If you want to receive this item within the next 24 to 48 hours, click on this link to reorder and you go, how do they know who ordered it? Here's the reality. Most people are ordering from Amazon.
[19:30]
A
Yeah.
[19:30]
B
So if I send it out at nine in the morning and three o', clock, the probability that at least 20 or 30% of the people have probably ordered an Amazon and is pretty high. So once again, people think it came from Amazon. They're not checking. They click on the link and then once again, stealing credit cards, stealing bank accounts, stealing money, stealing information along those lines. So that is by far the most common. And one of the tricks we'll talk about later is do not click on links under any circumstance. And you're like, but Eric, how do you then do business? Use the app. So if I get a message from Amazon that says, hey, there's an order that has an issue, I don't click on it, I delete it, I go to the app. So you have to just train yourself on good cyber hygiene. And then the other big attack, it's more business focused, but it happens with individuals, is ransomware, where essentially they go in and it's usually done with a link again, where you click on a link and it goes and encrypts your hard drive. Or if you're at a company, it goes to your database of all your clients and encrypts it and then it basically pops up a message saying unless you pay X amount of money, you'll never see the information again. And once again, these are big businesses. One of the big one is there's a company in Russia, company, so it's a actual company called the Cyber Investment Firm. It is a company, it's a building, a three story building. They have 700 employees. These employees get benefits, they get salaries, they get days off in pto. They go into the office, they have badges, they have everything else. And the entire business is going in and doing ransomware.
[21:08]
A
Wow.
[21:09]
B
And once again, because in countries like Russia and others, there's tied to government officials. So it's not illegal, there's no extradition treaties. So these are actually running as businesses that are targeting you and your family and they know what your price point is. The average person that has all their family pictures, all their taxes, all their information on their computer or laptop, if I encrypt it and say, you'll never see the data again, but if you pay $300, you'll get it back. Is your pictures, is your life, is your tax returns worth $300? Absolutely. So most people will actually pay it. And it's a sad state of affairs. But as security professionals, even law enforcement, because there's nothing else we can do, and the encryption is so good we can't break it, that we unfortunately tell people in most times it's actually better to pay the ransom than to be out and lose all that information and all that data. And now companies, they go in and no other price tags. I don't know if it came all the way up to New York. But if you remember two years ago, the Colonial Pipeline, the biggest oil pipeline for gasoline on the east coast, our gas stations were closed for five days. We had no gas. On Monday when it happened, I went to get gas to fill up the car. It was a 30 minute wait at the gas station. And by Tuesday evening, every gas station was out of gas. So, like people were panicking and no,
[22:32]
A
you live in the DC area, in
[22:33]
B
the DC area, in Virginia. And all these security professionals like, oh, they're not going to pay the ransom. They're not going to pay the ransom. I was one of the few that broke the story on they're going to pay the ransom. Because the reality is if they don't pay the ransom, they're going to lose 30, 40 million dollars in lost revenue. If they pay 5 million, they'll be up and running within 12 hours. And sure enough, by Thursday, I was right. They paid the $5 million ransom and gas was restored by the weekend. So these are the things with bigger companies, they know the monetary loss and the pressure points. So the ransom demand is going to be low enough that it's actually easier to pay the ransom than suffer the pain of having your systems down and unavailable.
[23:17]
A
Wow, there's something that feels very mafia about that someone. It's the cyber equivalent of someone coming to your store with a baseball bat and saying, would be a shame if anything happened. Yep, right.
[23:28]
B
And you just nailed it. Because here's the reality that that is really the, the hard part of why I sometimes tell companies, if you don't pay the ransom, you lose 30 million. But if you pay the ransom, you get your information back. But here's the problem. If you pay the ransom, once you're in the frequent flyer list, it's like New York in the 70s. They would come in the mafia and they'd be like, if you don't pay protection services, then we're going to trash your store, right? You don't believe them, they trash your store. So then you pay the, whatever it is, 100, a couple bucks. But once you do it once, you're going to have to pay every single single month nonstop. So the same thing. If you pay the ransom and you don't then fix the problem and hire good security professionals, they're going to come back every quarter and hit you up going, hey, because we're such nice people, right, with such nice evil hackers, instead of 5 million, we're just going to charge you 100k every quarter. So if you play 100k. We'll provide security protection. Right. It's all marketed as a business. It's not evil. It's like we'll provide security protection and monitor your site and we won't hit you with ransomware. But if you don't pay, then you might have to get hit with ransomware every three to four months. So it's actually a mafiosa disguised as sort of being nice, legitimate services, but it's really not. So it's one of those things, you pay once and if you don't fix the problem, you'll keep paying over and over again.
[24:53]
A
Wow. And this happens to individuals as well, right?
[24:56]
B
Yes. So the price tag is lower, but it happens to individuals. But here's the problem is you or the average person gets hit with ransomware at their home, it's $300. So unfortunately, if you try reporting it to the police, it's a small amount that, yeah, they'll file a police report. They're not really going to do anything.
[25:19]
A
Right.
[25:19]
B
The FBI is not going to be concerned because it's under typically their limits, which is usually 5 or 10,000. And the media doesn't care about $300. So nobody realizes how bad it's happening. Nobody realizes that it's happening to people across America on a regular basis where they're paying anywhere from 100 to 300 because they know what your income is, so they know what you can afford, so they tailor the ransom to that amount. But because no one's socializing it, no one's talking about it, no one's bringing it up, people have no idea how bad it is. But it is really a pandemic that's impacting a large number of people, but nobody's talking about it.
[26:00]
A
How are the types of cyber attacks that we're discussing right now, how are these similar to or distinct from scams? Right. So when I think about, for example, someone calling the grandparents scam, someone calling a grandparent and saying, hey, your grandson is in jail, you need to send money for bail. At least send the bail money to this address. Is that a different classification of financial problem or is that how are cybersecurity and financial scams related or different?
[26:30]
B
If you go back sort of four or five years ago, they were sort of different. And then the scams were very targeted on purely monetary and they were really phone driven where they'd call you up and say, hey, your son was arrested or something happened, you need to give us two or three hundred dollars. Mail it was, or eft it. But today because of the technology and artificial intelligence and all those, they've really sort of merged together where now they're almost one and the same, and it's the same entities doing it. So if you go in and think about. It's really just a delivery mechanism. So if I send you an email that says, hey, I've been arrested, or I don't know if you've seen this on social media, where social media attacks will get compromised, and then they'll text everybody in your following saying, hey, I'm traveling to Puerto Rico or Mexico, and the most unfortunate thing happened. My wallet was stolen, my driver's license was stolen, my credit cards were stolen. I am stuck, and I have no way to get home. Can you do me a favor and send me $500 and to this account, and I will pay you back when I get home? But otherwise, you. You might never see me again because I have no way of getting home. I have no money and no access to anything. Now, most people, if you're nice and kind and it's legit, like, if my friend legitimately had that issue, I'd send them the money in a second. But so people get emotional about it. They think it's important, and they'll send it that message. I could call on the phone. I could do it in social media. I can do it in an email. So it's really the same message of social engineering. It's just done at different levels of delivery. And sort of a funny story with that is one of my friends had his account hacked, and he had like 500 people in his contact list, and they sent out that scam. And I'm talking to him, and he's mad, and I'm like, dude, how much did your friends lose? He's like, nothing. I'm like, why are you mad? He's like, cause none of my friends cared. He goes, here. I'm telling them that I'm stuck in a foreign country, and not one of them people paid the amount. And I'm like, dude, you're missing the point, right? But it was funny how people emotionally rack going, nobody cared enough to actually fall victim to the scam. So it's sort of crazy. And then you layer on, like, you look at those scams where they call your parents and say, hey, I've been arrested. Or the grandparents, right? They used to just use a voice saying, hey, this is Officer Jones. I just arrested your son. And he's at bail for X amount. But now with AI, they're actually mimicking your kid's voice. So now, because think of a lot of kids put videos out. Your child puts a video out. I have their voice.
[29:17]
A
Right.
[29:17]
B
I now can train an AI model to mimic their voice. And now I can call their grandparent, because guess what? Their grandparents are following them on social. So very easy for me to find the grandparent. A lot of people list their contact information, so now I can call the grandparent with the actual child's voice saying, hey, this is eripa, and it sounds exactly like their voice. And now the probability of people falling for it is much, much higher.
[29:43]
A
Exactly. I actually had a conversation with my parents about that because when AI first became ubiquitous, I became really nervous about the fact that as a podcaster, we're at over 600 episodes.
[29:53]
B
Yeah. There's a lot of your voice and video.
[29:55]
A
Yeah, exactly. Right. And each episode is a minimum of an hour, sometimes an hour and a half or longer. There is probably a thousand hours of my voice in the public domain. I'm incredibly easy to mimic.
[30:10]
B
Yes.
[30:10]
A
And so, to the best of my knowledge, that hasn't happened yet. But what does happen and what's frequently happened with me, Social media, I will have accounts that pretend to be me. There will be these. What's the word for it? Like spoof account. Right. A spoof account that pretends to be me and that sends out messages to all of my followers. And it's without exaggeration. There have probably been at least 150 spoof accounts that I'm aware of over the years. And what is concerning to me is that on multiple occasions, there are people that I know, nobody I know closely, but distant acquaintances who. Who have genuinely believed that they've been having an exchange with me. So one time I went to Greece and I was chatting with a friend of a friend, and she started bringing up this conversation that we had had on Instagram. And I was like, what are you talking about? As it turned out, she'd been chatting with the spoof account, believing that it was me. And it was only the fact that we happened to meet face to face in Greece that cleared the air. Otherwise she might have believed that forever.
[31:18]
B
Yeah. And your prime example is influencers or people that are on social media. The more influential you get, the bigger your target. And I hate to say this because you're growing rapidly. So unfortunately, it's going to happen where somebody is going to start putting out videos with AI that look like you, but they're going to have discriminatory messages or negative publicity trying to. To go in and hurt your brand or hurt your reputation. And then the other thing that you've been lucky so far because it sounds like you must have good security on your prime account. But the other scam is they set up all these bogus accounts for you and then they take over your prime account and they say unless you hire and notice how they do it, they don't say ransomware. Now, because that could be illegal, because some of the laws, they go in and say, unless you hire us for security protection. Right, the Mafiosa model. And unless we hire you for security protection, you'll never get it back. But guess what? If you hire us and we do reputational improvement and monitoring, so it sounds really legit. And we'll make sure this doesn't happen in the future. And because you're such a great, wonderful person with such a great message, Paula, we're going to go in and charge you $39 a month. Now, once again, you don't like it, but $39 a month to get your account back and to be able to talk to your audience and not have it hijacked with bogus accounts is probably worth it. Then they'll go in and say, hey, for an upcharge of $29 a month, we'll remove all the bogus accounts. So now when people search on your name, they only get your account and nobody else. And once again, for most people, the discomfort is so hard that the money is worth it. And they're now spending 60, $70 a month, so less than $1,000 a year on so called fake cyber protection. But to stop your account from being hacked and stop the rogue accounts from being set up, we get contacted by influencers all the time that are just like, I'm losing hundreds of thousands of dollars because my account's been hijacked and I can't communicate and, and bogus accounts are putting out false information. So now my user base is getting corrupt, frustrated, and biased. And I'm losing followers, I'm losing money. How do I get it back? And unfortunately, a lot of cases it's if you didn't prevent it in the first place, it's very hard to get it back after the fact.
[33:47]
A
And you know, and one of my big fears is that someone will scam a fan of mine who will pay money, believing that I have asked them to do so.
[33:57]
B
Yes.
[33:57]
A
So I know there's a guy who's in our space named Mr. Money Mustache, and he has publicly written about how someone spoofed his account, sent out messages to a bunch of his followers. And one of his followers paid $1500 for some quote unquote investing course because they believed that it was coming from him, because that person trusted him as the person, as the recipient of that trust. That is such a responsibility, right? So that's a huge, huge fear of mine. I know that many of the spoof accounts that have pretended to be me have sent messages out to my followers asking either talking about some quote unquote investing course or asking if they invest in crypto over and over and over in my Instagram stories, I will create videos, you know, of myself saying, hey, it's, it's me. Like, just to reaffirm, I will never, ever, ever, ever, ever in my life will never initiate a DM to anybody, you know, B, I will never DM any one of my fans to ever ask for a sale of any sort, not even for a course that I actually run. Right. Just never going to do that by dm. But when I tell my audience that, I know that it's only a small fraction of them who are actually hearing that. Right? And statistically speaking, the overwhelming majority of people are not going to hear those messages.
[35:18]
B
Yep, exactly. And then this is a hard part is like with your friend, if somebody does that where they create a fraudulent account and a lot of people don't understand it, so now they think you took $1,500 from them. So now the question is, what do you do? Do you tell them, well, listen, that wasn't me and sort of stinks to be you. And then they're going to be annoyed at you because they're going to think you ripped them off. Or in a lot of cases, these folks, if they're making enough, they'll actually be kind enough to refund the person or give them a free course or give them something else. But then you have a financial impact because somebody else created fraud. So, yeah, you're on the right thing putting messages. But the other big thing is to really tell everyone, this is my only account. I do not text from any other account. This is my only Instagram account. So if you're getting messages from anybody else, don't click on it, don't go there, don't post it. Or the other thing, if you is, you gotta be a little tricky is you then hire somebody to go to all those bogus accounts and when they post articles or comments, you put a comment in basically saying, this is not me, this is a fraudulent account. Don't click on it. And because most of them are run by bots and not humans. They don't catch that. So then you can at least be proactive. But then here's the question. Do you really wanna spend and should you be spending 15 or $20,000 on hiring a person to solely protect yourself against trollers and cyber criminals out there? But unfortunately, as you grow as an influencer, it's a necessary evil because there's people that are going to be targeting you.
[36:54]
A
Yeah, I've seen it on Instagram and Facebook so many times. I am not exaggerating when I say a minimum of 150 that I know of. And I only know about it because some one of my fans will contact me and say, hey, is this you? Or hey, this does. I think this is a fake account. And my team can tell you, like, you know, we get that all the time.
[37:15]
B
You've been lucky because it sounds like you have really good security and they haven't been able to hijack your primary account, but I can guarantee you they've tried.
[37:23]
A
Wow.
[37:23]
B
And you've just had good security. But a lot of them don't. And I get called all the time from. And I won't mention some of the big names out there and they're like, eric, my accounts been taken over. What do I do? And there's not a whole lot we can do after the fact except pay to get it back. And then we'll really roll up really good security so it doesn't happen in the future.
[37:43]
A
Well, on that note, I'm gonna hand you my phone.
[37:46]
B
Okay.
[37:47]
A
All right. And so tell me, what am I doing wrong? Here's my phone. It's unlocked. Go wild.
[37:53]
B
Okay. So first thing you did wrong is hand me your phone.
[37:57]
A
Yeah.
[37:58]
B
You never ever wanna give your phone to anybody else. You never wanna give. You ever want to give it to a kid? Like, I see parents in restaurants where they have younger kids and the kid is crying or screaming and they hand them their phone.
[38:12]
A
Yeah.
[38:13]
B
Because kids just click anything. Kids go on anything. My family knows. Not in my pocket. But nobody knows my passwords. Nobody gets access to it. Like, this is like a body part. Like you try to take this, it's like cutting off my arm. Right. You are not getting access to my phone. That's sort of the first thing is you want to control it. And then if we just go through. So first thing is way too many apps.
[38:37]
A
Yeah.
[38:38]
B
So I'm guessing if I go in, I don't want to be too intrusive, but if I look at usage, you probably haven't.
[38:44]
A
Feel free.
[38:45]
B
Okay. You probably intrusive, you probably haven't. So you can actually see what I'm doing. So I'm just going in and looking at your usage data. Looks like about 60% you haven't used in 45 days.
[38:55]
A
Yeah.
[38:55]
B
So if you're not using those apps, you definitely want to go in and turn that off. And then one of the big things, let me go into your. Find where your settings is. So if we go under settings and then we go under your security, and what I'm looking at there is the tracking of the data. So to see if you have tracking for which apps. So we'll put in your location. See, one of the things you are doing good is you have small prints. So for people like me that can't type, you go in. So I'm looking onto location services. Do you realize that you have all these different apps are tracking your location?
[39:34]
A
Wow.
[39:35]
B
So, like Bereal passing, there's a compass that tracks your location, which if we go in and we look at the compass app, which my guess is it's actually made in China. So, like, you talk about TikTok as an issue. So you actually have a Chinese company that's tracking your location because you have a compass app on your phone. We then go in and Instagram's tracking your location, Mighty's tracking location, PayPal. And like, it's about 70 different apps. And the good news is you're like most people.
[40:07]
A
Yeah.
[40:07]
B
And people don't realize one of the most dangerous things is free apps, because free isn't free because it basically means that whenever you download it, they're putting on location and monitoring your camera on your device. So then if we go in and I also look at access to your photos, that's also similar. So these are all the apps that can actually access your camera without you knowing about it.
[40:31]
A
Wow. So there's a list of, like, how Many is that?
[40:34]
B
1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 20. It's about 35.
[40:38]
A
35.
[40:39]
B
There's 35 apps that whenever you use them, they can technically turn on your camera without you knowing about it. And then the other one that always shocks people because, oh, you're actually doing really good on microphone.
[40:53]
A
Wow.
[40:54]
B
The other two, I'll maybe give you a C minus, but microphone, you'll get an A because you only have a few.
[40:59]
A
Ooh, look at that.
[41:00]
B
Yeah. But if you want to go in and be scared because this happens, one of the ones we always see is Chrome. And if you do this, where we start talking about, let's start talking about painkillers and medicine and ibuprofen.
[41:15]
A
Ibuprofen, yes, we'll talk. Ibuprofen, aleve, naproxen, acetaminophen.
[41:21]
B
So you go into Chrome now and you type in ho and it will auto fill in how much ibuprofen to take.
[41:29]
A
Wow.
[41:30]
B
Because Siri's actually listening all the time. Let me check that on your phone. Yeah, you have Siri turned on. So Siri's listening and that's what most people don't realize. They're not recording what we're doing. I'm like, how would Siri answer unless it's recording everything you're doing? So those would be one thing. The other big thing, let me check on your. I won't read your text messages. Your text has auto archive to the cloud, which means even if you delete a message or remove a message from your phone, it's still on your device and it's still getting backed up to the cloud and we can recover it. So we work on a lot of these. I don't like them because it's an evil part of society, but these super high profile like Hollywood stars when they get divorced and there's hundreds of millions at stake, we get involved and we can get their phone and we can find deleted messages of inappropriate pictures, communications with people that they shouldn't be communicating with and other factors along those lines. So that would probably be okay. Personal hotspots turned off. Good job on that. That's when we check, we look at Bluetooth. Actually, once again I'm impressed most people with Bluetooth and I'm victim to this because I have so many devices actually have auto discovery. So you have about 30 or 40. You don't have auto discovery on which is very good. You only have a few, few devices there. So good job on the Bluetooth. But that's something users want to check of how many different Bluetooth devices. Because that's the scary thing is a lot of people because they like convenience, they have auto connect Bluetooth. So now like if you go to somebody's house or location, right. I would call a play phone and a real phone.
[43:06]
A
Yeah.
[43:06]
B
So a play phone is just so I can mess with my friends and I have auto discovery and I go to their house and I'm like, oh, I just connected to your fridge, your thing. Or I only do this with friends. I really know. But most people have smart thermostats in their house or smart ovens, smart fridges. So I'll go in with only people I really know. And they, they know what I do is I'll go in and all of a sudden they're like, why is it so hot in here?
[43:29]
A
You just start messing with the settings.
[43:30]
B
I turn the thermostat up to 85 degrees or I want to make sure I'm careful with this. Cause we don't want to cause problems. All of a sudden I'll turn on their oven or their stove and they're like, what's going on? And they just don't realize how open the different technology is.
[43:44]
A
Right.
[43:44]
B
So I would say I could keep going. But those are probably some of the big things that I always look at on people's phones is number of app, free apps, location services, tracking pictures, camera. I mean those are really the big things you want to look at.
[43:58]
A
Microphone and Bluetooth also.
[44:00]
B
Right. The other one I'll look at real quick. Okay, once again, you're pretty good here. I look at subscriptions. Most people, they don't realize it, but they get these apps that are free. But if you read the fine print, it says in 30 days you'll be charged 19.99. And then they go in and, and they don't realize it, but they have like almost 7 or $800 a year worth of subscriptions that they're paying and they have no clue.
[44:29]
A
I watch my paid subscriptions like a hawk.
[44:31]
B
Yeah, I was going to say you're actually doing really, you're actually sort of, I would say in the upper tier of people that are security aware because most of the time, the big gotchas, you're actually doing really good here. Yeah, I mean you have the legitimate ones like Instagram chatgpt. Those are pretty valid ones. So you're actually doing pretty good on the subscription side. So. So I would say overall you're actually doing pretty good. Oh, but, but yeah, those are the big things that for the users is number of apps, usage of apps, free apps, subscriptions. Then look at location services, look at camera, look at phone, and then look at those key areas. And then also look at cloud backup and permanent delete for texting and others because the default settings are not secure and people don't realize this, but once you hit send, save or post, it lives forever. I didn't bring my forensic tools, but if I did a forensic analysis and I wouldn't do this to you cause it's personal. But I could pull up any deleted text messages, any deleted information or pictures or anything like that. So people that are doing questionable things or texting or sexting or stuff like that where they don't think it's there cause they delete it. It's still there and it can still be recovered.
[45:47]
A
When we were kids, summer meant freedom. No homework, no teachers, no school. And as adults, summer still means freedom thanks to Mint Mobile's summer sale. Right now all of Mint's plans are $15 per month, even unlimited. So free yourself from Big Wireless and their gimmicks and gotchas and switch to Mint for high speed data and coverage on the T Mobile 5G network. I've been using Mint Mobile. I'm now on my seventh year. I have saved a four digit sum of money. My savings is now in the thousands compared to what I would have spent if I had stayed with my previous carrier, which is one of those big box, brick and mortar carriers. With Mint Mobile, all plans come with high speed data and unlimited talk and text delivered on the nation's largest 5G network. You can bring your current phone, keep your same phone number. Choose from 3 month, 6 month or 12 month plans. So to get your new wireless Plan for just 15 bucks a month go to mintmobile.com Paula that's mintmobile.com Paula cut your wireless bill to 15 bucks a month at mintmobile.com Paula that's it. There's no catch. Upfront payment of $45 for three months, $90 for six months or $180 for 12 months. Plan required $15 per month equivalent taxes and fees Extra initial plan term Only greater than 50gb may slow when network is busy. Includes up to 20gb hotspot capable device required availability, speed and coverage varies. Siementmobile.com if you're a small business, the right hire can be make or break Hoping the right people see your job Posting isn't the best growth strategy when the pressure's on and you need the right hire. This is a job for Sponsored Jobs. We recently hired two people with Indeed Sponsored Jobs. One was for customer support and operations. The other was an EA and executive assistant. We used Indeed Sponsored Jobs to find both candidates. We got a lot of applications. We found people who understood our workflow who could contribute right away. People are finding quality hires on Indeed right now in the minute I've been talking to you. Companies like yours made 27 hires on Indeed. According to Indeed data worldwide, Sponsored Jobs posted directly on indeed are 95% more likely to report a hire than non sponsored jobs. Join the 3.3 million employers worldwide that use Indeed to connect with quite a quality talent that fits their needs. Spend less time searching and more time actually interviewing candidates who check all your boxes. Less stress, less time, more results when you need the right person to cut through the chaos. This is a job for Indeed Sponsored Jobs and listeners of this show will get a $75 sponsored job credit to help get your job the premium status it deserves@ Indeed.com podcast just go to Indeed.com podcast right now and support our show by saying you heard about Indeed on this podcast. Indeed.com podcast terms and conditions apply. Need to hire. This is a job for Indeed sponsored Jobs they say every day your business is late to AI, you fall two days behind. How do you keep up? The competition is only moving faster. Fortunately, there's NetSuite next. You probably know NetSuite, the AI powered business management suite that securely connects all of your data. It's a unified suite that brings your financials and inventory, commerce, HR and CRM into a single source of truth. Trusted by over 44,000 customers, NetSuite Next is the next huge leap in how business gets done. Because AI is built into everything you do, it automatically surfaces custom insights. Throughout your day, AI agents work alongside you to solve problems and handle routine work. And anytime you have a question about anything, ask, just like you're having a conversation with a colleague. NetSuite is customized for a wide range of industries, so it supports the way your business truly works. Whether your company earns millions or even hundreds of millions, it's time for NetSuite next, where your business meets AI. If we needed something this robust, this is what we'd use. For the first time ever, you can try netsuite Next for free. If your revenues are at least in the seven figures, go to NetSuite AI. Built for every industry, ready for every boardroom. NetSuite AI Paula, How secure is WhatsApp? I ask because I recently had a bunch of friends. We were all talking on WhatsApp and everyone was like, you know what, let's move to Signal. And they're like, we don't trust Meta. Meta owns WhatsApp. And I was like, oh, I don't want to move to another.
[50:21]
B
Yes, I know.
[50:22]
A
I'm so burned out on various messaging platforms, I don't want to adopt yet another one.
[50:28]
B
Yeah, WhatsApp fame to claim is when you're traveling internationally, you don't get text charges for normal text messaging.
[50:37]
A
Yeah, exactly.
[50:37]
B
So really WI Fi. Yeah, it's really the WI Fi texting ability, so. So you don't get charged. So it's really much more popular internationally because like in Europe, people travel across countries and their cell charges over there are so much more than the U.S. so, like most people in Europe are all about WhatsApp for texting because it saves them all this money and cell charges and it's so much cheaper and valid. So it's really good for going out of the country.
[51:06]
A
Well, I should say I, I have a lot of international friends.
[51:08]
B
Yeah, so, so, so for international friends, it's a very good tool. But the reality is, and there's a reason why it's out for free. Free isn't free. Because think about this. How in the world can meta run WhatsApp? It's a lot of servers, it costs them. I think the last numbers I saw was about 55 million a year to run WhatsApp. And they're not charging you a penny.
[51:30]
A
Right.
[51:30]
B
How can they do that? That's a bad business model. Except think of all the data they get. Think of all the information. So the good news is they're not tracking you specifically, because that actually would be against the law, but they're tracking your behavior based on your profile. So they're going in and saying, okay, we have all this communication about a female in New York City in this age bracket and group, and they're building profiles so they can do target marketing for all their other apps and all their other profiles. So yes, they, they are listening and monitoring. Now they're going in and filtering the data. So they don't know it's you. But do you really want all your communications monitored and tracked? And that's really where Signal comes in. Signal, you have to get verified contacts and it's point to point encryption so nobody can read the messages. Now, I know if you watch the news, Signal has sort of gotten a little negative press because of some of the people in the White House. But that had nothing to do with Signal. That just had to do with bad user hygiene. That's not a single issue, that's a user issue. Right. And one of the things I always jokingly say is you can have the best security and best encryption in the world, but no matter what you do, you can't secure stupid. They're just doing silly. I'm not trying to insult anyone, but the stuff they did with Signal is just ridiculous and simple. So if you and your friends are really concerned about security, like you're doing national secrets and things like that, then Signal is most secure. I'll be honest with you, with most of my friends and most of my communication, because I don't like A lot of apps is we use WhatsApp just because I'm the same way. I have international friends, I travel internationally, and to me we're not having any top secret conversations that would get anybody arrested or any issues. So I sort of just accept the risk that they're doing general profiling on us, but there's nothing specific that can actually be used against me. So it's one of those, if you're aware and accept the risk, I would say it's okay if you really start getting into very confidential type discussions. Like sometimes when we're working merger and acquisition deals because the SEC requires a security review. So if we're doing like high end merger deals or acquisitions where we're going to China or Australia and we're negotiating a $300 million deal, and I'm part of the advisory team, we use signal for all of that because like you use texting or WhatsApp or anything else, they will be able to monitor and see your discussions. And we actually had that where we had executives using standard texting and communication while they're in China negotiating a $300 million deal. And we go into the negotiations the first day and we're really close. They're saying, hey, we want 350. The Chinese company is saying 280. And we're like, okay, we're super close. So then that evening, I didn't realize it, but the executives and vice president were starting to text each other going, this is awesome, because we would went as low as 200. But if they're coming in at 280, let's just go at 285 and get the deal done. They come in the next day into the boardroom. I didn't know this happened, but I'm there with them and they go, okay, 285. And the Chinese company goes 200. And they're like, what are you doing? They're like, we know last night you discussed it and you said you go as low as 200. So now it's 200 or we walk away. And then they're sort of stuck. So people just don't realize how vulnerable these apps are. And when you talk about corporate espionage and assets and intellectual property, it is very, very active in China, Russia, even Australia. So you just gotta be super careful of the type and level of communication. And for super sensitive, you go signal. For friendly communication, WhatsApp is acceptable.
[55:22]
A
You said signal is point to point encrypted. And WhatsApp is end to end encrypted. What is the difference.
[55:29]
B
Okay, so WhatsApp, when I say end to end, it means from you to the meta server is encrypted, but then they decrypt and then they re encrypt to your friends, so they're seeing your communication with signal. If I encrypt the data, signal at their servers, don't decrypt it, and then you decrypt it at your point. So, so point to point means we're the only ones that are seeing the data. The servers are only seeing encrypted data. As with meta and others, the servers are seeing unencrypted data.
[56:01]
A
Oh, okay. So with WhatsApp, there's really three parties involved, whereas with Signal there's kind of two parties involved.
[56:09]
B
Exactly. But the benefit of WhatsApp is if you're at a coffee shop or, or you're on a wireless network at a hotel or an airplane, anybody else can't sniff or see your communication. So it is protected from local sniffing, but it's not protected from server level attacks.
[56:25]
A
Eric, you are the Commissioner of cybersecurity for President Barack Obama. Tell us about what happened when he wanted a smartphone.
[56:32]
B
So as you can imagine, presidents of the United States are people and they're really running a business, just a very large business, the country, and they want to communicate. So you think it's simple. Hey, you just go to the store and you buy a smartphone. But the problem is, and what most people don't remember is a smartphone is a tracking device. So do we really want the President of the United States to be able to be tracked anywhere he goes? Any location, any spot in the White House? So we sort of have a challenge where if the President says he wants a smartphone, you can't tell him no, you have to tell him how to do it in a creative manner. So at the time, one of the most secure devices was actually a BlackBerry. So we actually went in and configured the BlackBerry to connect to alternative cell towers. So now if he was, say, in the Oval Office, it would actually show up that he was across the street and vice versa. And then we also went in, which is a key aspect that I do with my phone with high profile individuals, is when he's in the White House or other locations, you turn off cellular and you connect to wireless, because wireless doesn't have the same accuracy of geolocation as cellular does. So we basically went in and I gave him a device so he can still communicate and make phone calls, but he couldn't be tracked or located or present any threats to himself.
[57:52]
A
Or his family and turning off cellular and just going on wireless. I mean, what that makes me think of is anytime that staying in a hostel in Costa Rica, right? That's exactly what I do just because I don't want to replace my SIM card. So it's funny to hear that high profile individuals do that.
[58:08]
B
The trick though, and this is the magical trick, you have to use something called a VPN or a virtual private network that actually not only encrypts your data but also masks your location. I always joke, if you're bored and you just want to have a good time in Vegas, don't go to the clubs, just go in and turn on a wireless sniffer because it's technically legal at a big hotel in Vegas. And most people don't realize text messages and pictures are sent plain text over the wire. So you can get some very interesting and unusual and let's say spicy information from individuals and they don't realize that. So if you're going to be texting over wireless at hotels or coffee shops or anything else, it's super simple. You just go to the app store and put in VPN virtual private network. And there's free apps, commercial apps. And then not only is the data encrypted, but you could mask your location. So now it's even better. So for example, with Barack Obama, we set up his VPN that it can look like he's in Chicago or Nebraska or the location. So now if somebody's actually tracking his device and his IP address, he shows up in an alternative location than where he's really located. So it also provides a level of obfuscation in terms of tracking and monitoring.
[59:26]
A
I mean, VPNs have been around for so long that I feel like don't understand exactly how. But there seem to the powers that be seem to understand when you're using a vpn. I say that from the perspective of someone who will sometimes try I'll be in a foreign country, I'll use a VPN to try to access HBO Max, right? To make it look as though I'm in the United States. And I still get the message that says, sorry, this is not available in your area.
[59:51]
B
So what's happening there is direct VPNs where you're actually basically just encrypting to the local ISP in that country. So in those cases you're still going to be blocked because you're showing up as a foreign IP address. But if you get some of the commercial VPN products, you can actually change your location. So it can actually tunnel to a location in New York. So for example, when I'm in some countries like Saudi Arabia, which are very restrictive, like they're super restrictive on, on what you can do. But if I go in and have my commercial VPN set up to New York, then I can still access US sites in English as opposed to if I go to Google in Saudi Arabia without the vpn, it's all in Saudi Arabia, I can't read it. So if I go in and change my location. But that's one of the key things we're going to talk about a lot today is these products have great security, but it's turned off. So you need to know to go in and reset the settings. So like if you're using a standard vpn, it'll still be in country, but if you go under settings, security and location and you change your location, then you can actually appear in the US and bypass those filtering controls.
[60:58]
A
We talked about WhatsApp and we talked about Signal. What about TikTok? Is TikTok Chinese spyware? If you download TikTok, does that mean that the Chinese government could subpoena the company that owns TikTok to get access to your photos? Are we at risk if we have TikTok on our phones or is that all just a bunch of hype?
[61:22]
B
So yes, no, maybe, and I'll just go and take you back to sort of a story to lay the context, because I think it's important. So in 2000, I'm part of this different government task force. I think if you read my bio, I worked at the CIA as a professional hacker, so I'm often brought in on these scenarios. And so in 2000 I was part of a the unclassified task force, so I can talk about it. And they said, okay, Eric, if you were China and you wanted to launch a cyber attack against the U.S. how would you do it? And I went in and researched and everything else and I came back with my report. And what I basically said in the report is I would create an app that's targeted at 16 to 20 year olds in the United States because they're the future generation. And I would make this the coolest app on the planet. I would make it like social media on steroids so you can actually do pictures, text, video, interact and make it so much better than anything that's available at the time. And then I would market the heck out of it to get everybody hooked on it. And then we would monitor and track all their activity for eight to 10 years. And once again, as far as I know, it wasn't publicly published. Then you look at TikTok and I took out the paper. It was almost an exact blueprint. Where TikTok is an application focused on 16 to 20. Now adults are using it too, and it's monitoring and tracking everything we're doing. And here's the reality. All of that data on our activities, our behavior and everything else is stored on Chinese servers that the Chinese government does have access to. So when I said, yes, no, maybe it isn't active malware. So like one of the mistakes that Congress has made, where they're like, it's spyware, where it's gathering and blah, blah, no, no, no. It doesn't install anything on your computer. We've reverse engineered the TikTok agents. It doesn't put any malware on your system. So it's not locally monitoring or tracking. But here's the reality. TikTok turns on location services, so you're allowing it to track your location with your data and information. So now if you're voluntarily putting information on TikTok about your behavior, your activity, your videos and everything else and they're monitoring it, that's not technically spyware, that's user cooperation. So everything you post, everywhere you go, everything you do now, good on you. Because you did not have location services turned on for TikTok. So gold star. But most people do. Most people, if I look at their phone, they absolutely do. So we're giving all this information to TikTok, where there's a company that's run in China and tightly connected to the People's Republic. So they're monitoring and tracking. I think TikTok's been in business eight or nine years. The eight years of data of U.S. people that are stored on Chinese servers, we're not talking about that. That's going to stay in China and they're going to be able to have that for the next 20 or 30 years. So they already have predictive analysis on US citizens, how we work and how we operate.
[64:26]
A
In the worst case scenario, that data could be used for blackmail. We talked earlier about ransomware.
[64:30]
B
Yes. It can be used not only for blackmail and ransomware, it can also be used for target marketing. It could also be used for tracking and espionage purposes. So for example, if I see somebody on TikTok and a lot of people say where they work and they work at say IBM or a large research entity that's doing high end chip design or high end technology, China can do that and now use that to go in and do target phishing attacks to break into their systems or servers to be able to steal large amounts of intellectual property from the systems. Or you look at what happened with Aldrich Ames at the CIA. He was one of the people that was converted by Russia. What they basically did is the, the way they converted Aldrich James is they basically got blackmail data on him and said, unless you steal information for us, we're going to ruin your life. Well, guess what, A lot of people are posting some questionable things or areas on TikTok that they don't think anyone else is seeing. Well, what if they get access to that and they can do the same thing saying, unless you spy for us, we're going to use that against you. So there's so many different avenues that an advanced technology company like China could use to target Americans. The list is so long.
[65:44]
A
It gets scary to take this conversation back to money. There are, as you've elaborated on throughout this conversation, there are so many nefarious things that entities can do with our data. But as ordinary individuals, as investors, one of our chief concerns is protecting the net worth that we've worked so hard to build. The portfolio, balance the income, the legacy that we want to pass on. Can you share some examples of times when it's gone wrong?
[66:11]
B
Absolutely. And one of the biggest areas that we see all the time, and I know I've seen a lot of your episodes and you're very big on real estate. Real estate's a great investment. And I know you have many properties. I have a lot of properties. And we go in and we buy real estate. Well, very often we're going to go in and get mortgages or closing or we're going to even pay cash. And we're using a reputable bank. So I'm using a really good bank. And we're like, okay, the bank's secure. But we failed to realize is a lot of these closing companies and a lot of these smaller entities that get involved are small businesses. They don't have really good security, and they can often be hacked or spoofed. So I see it all the time. But I'll give a specific example. It's a family that was in Ohio and I mean, they were doing okay, but they were two school teachers and they always dreamed of going in and having a farm. Like, they just wanted to have a nice farm, like a nice farmhouse and tractors and things like that. And one of their parents, they were the only child, and their parents actually did pretty good investment and had good amount of money. And the dad passed away a couple years and then the mom passed away and they inherited $1.3 million. The farm they wanted was 1.2. Their dream is going to come true. They go to the bank and they don't really need a loan because they're going to pay cash for it. And they get everything arranged and then get the closing company. They put an offer on the farm, it gets approved. They're going to close in 45 days. And five days before closing, they get the message that they're expecting from the closing company that basically says, here's the account information that you need to transfer the money to in order to go in and buy the house. Their real estate broker said, you're going to be getting the message three to five days. It was on the legitimate letterhead. The email looked okay. It came from one of the brokers there. And so they said, great. So they go to the bank, they do the eft, they transfer it to that account, and then they show up at closing and they're all excited and happy. And the other side goes, do you have a check? And they go, what do you mean? Well, how are you going to pay for the house? You said you offered to sell 1.2 million. And they're looking at each other going, we transferred the money according to the closing company to your account five days ago. And they go, we didn't send any email. And it turns out it was a scam. And we got involved because there was sort of lawsuits of who's liable in this case. And the email for any average person looked legitimate, it looked valid, it had all the proper authentication methods. And it turned out that the closing company servers were hacked and they were sending emails out to select individuals that were cash based deals. Because here's the reality, there's very few cash based deals. So if you're going in and you get a loan and you're only putting $80,000 down, an attacker doesn't want that. So they broke into those servers for three months and they were waiting for a big cash deal. And once they saw this $1.2 million cash deal, they then targeted them only. And because it was only a one and done, nobody knew about it. And because it was, there was a reason why they did five days. Remember I said earlier, you typically have 48 to 72 hours, you have two to three days. So by doing five days, the money was gone. And now the question is, who's liable? The banks were saying that they weren't. The closing company was like well, you clicked on the link, that's your fault. And we're saying, well, no, you didn't have proper security and you were compromised for three months, so it's your fault. And then it gets into legal litigation. But here's the part that's heartbreaking. They lost the farm, and it's being fought in the courts. And it's been a year and a half because civil cases in the courts are so backlogged. And if you don't know the court system, criminal cases take precedence. And because the courts were so backlogged because of COVID if you file a civil case today, an individual, it could take two to three years to get through the courts. And then even if you get a successful verdict from the jury, they could be appealed. So this couple might not see their money for three to four years. They're heartbroken, right? They lost their farm, and now they're spending a lot of the money on legal costs to try to get that money back. And unfortunately, this is not isolated story. Like we see these types of instances all the time with large amounts. And you're like, well, what could you do? So a couple of things. One is, if you're buying any real estate or any large purchase, don't trust email. So what we do with all of our purchases is I go in and I call the actual closing company and say, is this legit? Like, did you actually send this email? And then what we'll actually do is. And I know people say it's crazy and it's old school, but I still go to a bank and get certified checks, because me bringing in a physical piece of paper, sitting in the room with somebody who's bought their driver's license ID with a notary public and having witnesses in the room that I handed them to check is a much safer and better mechanism than trusting online. So even though I'm a cyber guy, I'm an Internet guy, a futuristic, I don't trust a lot of those traditional systems. So when I'm buying my real estate or I'm doing my investments, it's all paper checks that I'm bringing with me that's assigned to the person certified so it's valid and they'll do it. And then I hand that over. Or whenever I do mortgages, I actually make the mortgage broker come to my house or I go to a bank. We don't communicate email. I tell them that when I'm buying real estate or I'm doing any large purchases, we talk phone or in person. We do not Use email, we do not use communication. I do not use websites because they can be so easily spoofed and modified. I know it's convenient, I know we like it. But sometimes going old school, face to face paper checks and phone is going to be so much better and safer.
[72:23]
A
Right? The last house that I bought, I paid in cash and I remember getting the email with the wire instructions and being so scared. Instead of relying on what was in the email, I went to the entity's website, looked up the phone number on the website, called that phone number and then verified the information. But to your point, I mean as I talk through that, the weakness in that is that that website could have been spoofed.
[72:47]
B
Exactly. Yeah. But at least credit to you, you took an extra step. Unfortunately, most people aren't tech savvy like you and you would not believe how many people trust that email. And we're just blindly transfer the money based on an email. And I mean that's something if I thought of I could have done before our interview is I could have sent you an email from a closing company that you would have thought were legitimate. And when you clicked on the link it would have said Eric says hi, we do that exercise with people all the time just to show how easy it is to spoof email and, and how you look at these emails and you look at the legitimate email and the email I'll send you, they look identical. There's nothing that you can visibly tell. So I mean the name of the game is for anything sensitive, anything involving money, anything involving your life. No emails, no links, no clicking.
[73:34]
A
Right. Oh, you should Rickroll people rather than the Eric says hi. Yeah, that would be a.
[73:39]
B
That's true. That would be fun.
[73:40]
A
That would be a fun one.
[73:42]
B
I like how you think so foreign.
[73:49]
A
They say every day your business is late to AI, you fall two days behind. How do you keep up? The competition is only moving faster. Fortunately, there's NetSuite next. You probably know NetSuite, the AI powered business management suite that securely connects all of your data. It's a unified suite that brings your financials, inventory, commerce, HR and CRM into a single source of truth. Trusted by over 44,000 customers, NetSuite NEXT is the next huge leap in how business gets done. Because AI is built into everything you do, it automatically surfaces custom insights. Throughout your day, AI agents work alongside you to solve problems and handle routine work. And anytime you have a question about anything, ask, just like you're having a conversation with a colleague. NetSuite is customized for a wide range of industries and so it supports the way your business truly works. Whether your company earns millions or even hundreds of millions, it's time for NetSuite next, where your business meets AI. If we needed something this robust, this is what we'd use for the first time ever. You can try netsuite next for free. If your revenues are at least in the seven figures, go to NetSuite AI Paula built for every industry, ready for Every boardroom and NetSuite AI Paula when we were kids, summer meant freedom. No homework, no teachers, no school. And as adults, summer still means freedom, thanks to Mint Mobile's summer sale. Right now, all of Mint's plans are $15 per month, even unlimited. So free yourself from Big Wireless and their gimmicks and gotchas and switch to Mint for high speed data and coverage on the T Mobile 5G network. I've been using Mint Mobile. I'm now on my seventh year and I have saved a four digit sum of money. My savings is now in the thousands compared to what I would have spent if I had stayed with my previous carrier, which is one of those big box, brick and mortar carriers. With Mint Mobile, all plans come with high speed data and unlimited talk and text delivered on the nation's largest 5G network. You can bring your current phone. Keep your same phone number. Choose from 3 month, 6 month or 12 month plans. So to get your new wireless plan for just $15 a month, go to mintmobile.com Paula that's mintmobile.com Paula cut your wireless bill to 15 bucks a month at mintmobile.com Paula that's it. There's no catch. Upfront payment of $45 for three months, $90 for six months or $180 for 12 months. Plan required $15 per month equivalent taxes and fees. Extra initial plan term Only greater than 50 gigabytes may slow when network is busy. Includes up to 20gb hotspot capable device required availability, speed and coverage varies. Siementmobile.com if you're a small business, the right hire can be make or break. Hoping the right people see your job posting isn't the best growth strategy. When the pressure's on and you need the right hire, this is a job For Sponsored Jobs, we recently hired two people with indeed sponsored jobs. One was for customer support and operations and the other was an ea, an executive assistant. We used indeed Sponsored Jobs to find both candidates. We got a lot of applications. We found people who understood our workflow, who could contribute right away. People are finding quality hires on Indeed right now in the minute I've been talking to you. Companies like yours made 27 hires on Indeed. According to Indeed data worldwide, Sponsored Jobs posted directly on indeed are 95% more likely to report a hire than non sponsored jobs. Join the 3.3 million employers worldwide that use Indeed to connect with quality talent that fits their needs. Spend less time searching and more time actually interviewing candidates who check all your boxes. Less stress, less time, more results when you need the right person to cut through the chaos. This is a job for Indeed Sponsored Jobs and listeners of this show will get a $75 sponsored job credit to help get your job the premium premium status it deserves@ Indeed.com podcast just go to Indeed.com podcast right now and support our show by saying you heard about Indeed on this podcast. Indeed.com podcast terms and conditions apply. Need to hire. This is a job for Indeed Sponsored Jobs. So in terms of what we can do if you're buying real estate, go in person, on phone or in person. Ideally in person, yes. Meet at a bank. Meet face to face at a bank for any type of transfer. Use cashier's checks. Don't click on links. That's no particular order number two.
[78:25]
B
The other thing I'd add is sort of a 1A or a 1B is if you're investing in real estate, use known trusted entities and always go in person. So like I know a lot of times if you buy in real estate, the seller wants to pick a closing agent or pick sometimes out of state entities because they're a little cheaper, they get better deals. And I'm like, no, if I'm buying your real estate and I do a lot of real estate investing, I'm using my trusted folks. So I have offices that are 15 minutes from my house, closing companies and loan agents and attorneys that I know and trust. And I'm like, we use these are no deal. And I know them, I trust them and I go to their office all the time. So if you're doing a large amount of real estate, I get some known trusted entities and always meet in person. Don't get me wrong, there's some really good small one offs and if you're buying a house once on a big mortgage, that's okay. But if you're doing cash deals, real estate, trust and control who the people are that you're working with, right?
[79:21]
A
But what happens if one of your trusted entities gets if their servers get hacked?
[79:25]
B
So I'm in person. So the chances of me getting rogue emails or anything like that are super Slim, right? But if they get hacked, they don't have any of my money or anything else. I'm bringing the money in a check. So even if they get hacked and they try spoofing me or they get some details on the property, or they try sending me eft, none of that matters. And because they're not ever touching my money, the money goes from my hand to the seller's hand. So when I bring that check, I have my fingerprints on it, and I'm not handing it to anybody else but the person selling the house. And I'm having that monitored and tracked. And sometimes if they allow it in big deals, I actually have a video because I want to have proof that they got the check. So now if they lose the check or they say something happened, I have actual evidence to show that I handed them and paid the money. And I know people are like, you're paranoid. I'm paranoid, I'm crazy. I'm insane. But guess what? I'm safe, I'm secure, and my money's protected. So sometimes I. Online, it's so wild, wild west that having a little sense of paranoia and a little craziness and a little sort of over the top, being paranoid is going to go a long, long way to protect yourself, right?
[80:38]
A
What would you do? So if you're buying out of state real estate, you say. You say you want that check to go to the seller. If the seller is out of state, the piece of real estate is out of state, Your closing agent can be local, right? What video are you taking? Who are you handing that check to?
[80:53]
B
So in that case, as if. If you're actually doing pure out of state, where you're not actually meeting with them, whoever their local representative is, then I will go in and hand them the check. Or in some cases where that's not practical, because unfortunately, there are some real estate deals, like we do some condos and some renovations, and it's all done online, right? In those cases, I will then have a zoom video call that I record where on the call they authenticate and verify who they are. So they're gonna show me their driver's license, I'm gonna show their driver's license. We're gonna verify and validate, and they're gonna tell me their banking information on the call recorded with evidence and validation, and then I will wire to that bank, but I'm getting the validation directly from them. It's as if it's face to face. That's what's great with zoom technology is it's Like a face to face meeting and you can record zoom. And here's the cool part, it's a social thing, but it's bizarre. If we're in a conference room meeting personal and I want to video it, it freaks people out, right? It really bugs them out. Like this is the weirdest thing on the planet of you videoing me. It freaks people out. But zoom is so common, right? Recording a zoom call doesn't freak people out. So in some cases if they don't want to meet face to face or they won't agree to video, I'll jump on a zoom and record it. And it's much safe and protected. You now have evidence. I get the banking from them. I never trust email. And then we do eft as bank to bank.
[82:23]
A
That makes a lot of sense.
[82:24]
B
And it's one of those where like people like okay Eric, that's a little more inconvenient, it takes a little more time. But as I said before is wouldn't you rather take 10 extra minutes on a zoom call recorded than lose a million dollars?
[82:37]
A
Right? Yeah.
[82:38]
B
And then to your other question, so what else can we do? Cause I sort of hijacked it. So here's my rules. First, every account from E commerce to banking to health care, you have to use two factor like passwords. I joke. Passwords are so 1980. If you're going to use passwords you might as well listen to the Bee Gees and wear bell bottom pants, right? It's so out of sync is you got to turn on two factor authentication. And then this is one of the things I hinted at but we're now getting to this part we're talking about solutions is every type of service I know of from Amazon to AWS to Instagram to banks to healthcare, they all have two factor but it's turned off by default because we're at this interesting stage where they don't think the public is fully acceptance and if they turn on too many security and it inconvenience people, people won't use their service. So I think we're getting close. I'm lobbying, I go to these companies, I brief their boards and we're very to having security turned on. But right now it's not, it's super easy. Go into your account under settings under security under authentication and just turn on two factors, either two FA or mfa two factor multi factor. And I think most people know what that is. It's where you log in with a username password and then you get texted a one time code Right. That you log in each time. Now, I know people go, it's an inconvenience. So here's the middle ground is once you two factor, you can have it remember your device and it will actually remember your IP address and place a cookie, which is a unique cryptographic string on your computer. So now, whenever you're coming from that location, you don't have to two factor. You can just log in with a password. And now when you travel, like you go to a new hotel, it's going to say this is a new location and you two factor again. I was just in San Diego for 10 days for a trial. I logged in the first day. It asked for two factor, but then it remembered location and IP address and I don't have to do it for the rest of the trip. So there is a balance there. But you can't trust passwords.
[84:47]
A
Right.
[84:47]
B
Almost all of the bank money transfers and all of the crypto wallets that have been stolen, I would say 95% of them were passwords. Only very few are two factor. Two factors really hard to spoof. I mean, there's advanced attacks where they can take over your cell, but it's so hard and difficult. It's almost all passwords. So if you turn on two factor, that's going to go a long way. Second, anything sensitive or involving money, put on account notification. So with my banks, if anyone's withdrawing money, efting or even deposits, I get a text notification that basically says somebody's trying to EFT $35,000 out of your account. Is this authorized? Yes or no? And if I'm doing the transfer, I know I'm doing it. So I have my phone ready and you have 5 minutes to reply. So basically I get the text message and I reply yes, in five minutes. Now, if it's fraudulent and it's the middle of the night and somebody does it, I don't see it till the morning. But guess what? Five minutes times out and automatically declines it. So now, and I know once again, people like Eric, that's annoying to get text messages all the time. But as I always say, you know what's annoying? To wake up in the morning and have your bank account wiped out. So it's one of those you're going to have a little bit of pain, you're going to have a little bit of inconvenience. I'd rather the extra security and not having any fraud committed. So account notification is another great mechanism. The next thing which we talked about is if in doubt, buy the app don't do free. Like when I go in, if there's a free version and a 9.99 version, I always pay because the paid version does it monitor your location, camera or microphone, and free always does. So minimize free applications then. My rule is any app you haven't used in 45 days, delete, get off the phone. And I actually do the 10 app challenge for an entire month. You only use 10 apps. Be really selective on the apps and use only 10 apps. And then try to remove or get rid of. Because any free app that's on your phone is a point of exploitation. So you really want to reduce those apps. Then as we talked about, don't click on links, use apps. So if I get an email that says, hey, there's unusual activity with your bank, or hey, your Amazon order's been discredited, I immediately go into the app and I check the app. Apps are safe, email is not. So don't trust email, don't use links, always use the apps. And then the last one, which is sort of a little bit of a curveball for most people, is most of the attacks and most of the exploits are written for Windows. Not that Windows is more vulnerable, but Windows is one of the most popular operating systems on the planet. So most of these exploits where you click on links or you get hacked are all Windows based exploits. So I basically, if you look at my little backpack, I only use an iPad because most of the exploits, most of the links, most, most of the compromises won't work on an iPad. So when I surf the web, when I check email, I basically only travel with iPads because, not that they're more secure, but they are simpler and less targeted. So the probability of compromise is a lot less.
[87:55]
A
Wait, so I'm hearing two different things in there. One is the Windows versus Mac, the other is laptop versus iPad. Right.
[88:01]
B
So Windows versus Mac, if you're talking about a full MacBook, are about the same.
[88:06]
A
Yeah.
[88:06]
B
So the Mac OS, the full Mac OS and the Windows OS are both vulnerable. So those, be careful. Like when you're using those, no links, minimize web surfing, minimize email because they're highly targeted and there's lots of vulnerabilities. Then an iPad, which is actually a completely different operating system than the macOS, it's much simpler.
[88:27]
A
Right.
[88:27]
B
The iPad has very few attacks, so I use the iPad for email and web surfing. So when I work on client reports, I'm doing large data processing, I use my Windows system, but when I check email or I surf the web, I always Use my iPad because it's a much simpler device and less probability of compromise.
[88:47]
A
Oh, that's interesting. So I could shift to only using my Mac for when I'm doing audio recording, when I'm doing video editing, things like that. But then shift to an iPad for banking. Using Google spreadsheets.
[89:02]
B
Exactly.
[89:03]
A
Email, web surfing, all that stuff, that really basic stuff. And then get rid of most of the apps on there.
[89:10]
B
Bingo.
[89:11]
A
Wow. All right. I've got my homework cut out for me.
[89:13]
B
Yeah. Just to tie it all together, basically. Most people, in my opinion, should have three devices. So you have your Windows or Mac for your power user, like for doing video recording, video editing, working on large client deliverables, all that kind of stuff.
[89:31]
A
Yeah, you have your desktop or laptop.
[89:32]
B
Exactly. You then have your iPad, which is really going to be for your email, your web surfing, sort of the more risky stuff. And then you have your phone that has most of the apps for doing banking, healthcare and others. But you don't have many apps. You only have the most secure ones. And then you use that for like WhatsApp, texting signal and then your phone calls.
[89:58]
A
Hmm. That makes sense.
[89:59]
B
Separation. Yeah. You have sort of three critical devices, so.
[90:03]
A
Right, that makes sense. How do we protect our security when we're getting rid of an old device?
[90:08]
B
Shred it, Burn it. Explosive. No, pretty much if you're using like Windows phones and things like that, you want to secure, wipe it. So like if you go to the Apple Store and you're getting a new phone and you transfer everything over to your. A new phone and then you go into the old phone and you say delete and it securely deletes it. That's actually really good like that. They have good encryption, good wiping on it, and it removes everything. If you're super paranoid like me, I don't ever trade in old devices. I keep them, I lock them in a safe. Or there are companies that will physically destroy them. Like they will come and. And like some of my real old. I got to the point where I had like 10 phones and I didn't have room in my safe anymore to keep all of them. So there's actually companies that. It sounds crazy that companies will come and you go to their truck and they actually have this tub and they actually acid bath it and it basically eats the phone. So the phone is destroyed completely. And I know that's paranoid.
[91:15]
A
What a cool job.
[91:16]
B
Yeah. But here's the thing. My stock information and my bank, there's millions upon millions of dollars on there that spending $50 to destroy it is so much safer than even though the encryption destruction is secure. I'm super paranoid. And then with like laptops or MacBooks, what you want to do is remove the hard drives because you're not going to. These are small things. You're not going to acid bet the whole laptop. Plus it's not really good because of all the electronics and glass. So you actually want to remove the hard drives and physically destroy them if it's super sensitive. Now for some of your listeners, they're like, okay, Eric is off his rocker and nuts. So for those that don't want to do acid baths, other devices, there are secure delete programs that you can actually go in and will encrypt your entire drive five times and the probability of recovery is almost nil. So if you want to go in and use the secure delete programs like in Apple phones, that's good for the average user if it's super sensitive. Millions worth of dollars of investments go in and do the physical destruction biometric data.
[92:22]
A
When we give access to our biometrics to, let's say something like clear. Yep. Are we, how safe is that? Is that something that you would do?
[92:31]
B
So you asked the right question, which is what I do it right. So here's how I make security decisions and here's how I recommend people making security decisions. It's never yes or no.
[92:42]
A
Mm.
[92:42]
B
It's two questions. First, what is the value and benefit?
[92:46]
A
Yeah.
[92:46]
B
Versus what is the risk and exposure? And then if the value and benefit is worth the risk, I do it. So to answer your question, I use Clear. Because here's the reality. What Clear does is it has my biometric data, but it has a small sample set that's unique to Clear. So if you look at facial recognition and not to geek out on you too much, there's actually around 80,000 different unique points about your face, which I know is crazy. If you look at a mirror go there's 80,000, but there's 80,000 unique features. You only need 4,000 to get an accurate reading. And one of the reasons I use them and I research them is they don't go in and take all 80,000. That would be dangerous. They only take 4,000. So now even if somebody compromise Clear and they only got 4,000, every other biometric system you're using are using different data points. So they wouldn't be able to replicate or steal your face. It would only be a one time usage. Now, could somebody go into Clear, get my biometric representation, make an actual mask and Wear it in the airport and try to pretend me. Yeah. But here's the thing. The probability and difficulty is so hard to do that that I'm willing to accept that risk. I travel all the time getting through an airport 30 minutes quicker every time I travel. If you look at my billable rate, that's well worth the risk of somebody potentially stealing a very limited subset of my mask. So to me, the benefit outweighs the risk. And I use clear.
[94:20]
A
Right. They might not make a mask and use it to try to get through an airport, but could they make a mask and use it to try to face ID into your phone?
[94:27]
B
No, because the phone uses a different 4,000. So everyone has a unique algorithm where they use different data points to get in and then you have the phone. I use biometric data. I love it. Because it can unlock and so quick. And everyone's like, oh, Eric, that's such a big risk. Because they're like, if somebody gets your face and get your phone, they can log in. Well, here's my response back. If somebody has access to my face physically, and they have my phone and they're forcing me, they probably have a gun to my head.
[94:55]
A
Yeah.
[94:56]
B
And guess what? I have bigger problems because guess what? If I didn't use biometric and I only use passwords and somebody has a gun to my head or a gun to my children's head, I'm giving them the information. So it's one of those where sometimes security professionals get too crazy with the hypotheticals going, oh, I would never, ever use biometrics. Because if somebody got this, this, and this, I'm like, yeah, but if you got in that situation, you have a bigger problem at that point. Now, could somebody break into my house when I'm sleeping, try to go in and unlock my phone? No one hears why. Your eyes have to be open. And now they go, oh, Eric, what if somebody breaks into your house, gets you while you're sleeping, opens your eyelid and does it? Once again, I have bigger problems at that point. Right. So you gotta be practical about it, where, yeah, there's a risk, but the probability is so low, I'm willing to accept the risk.
[95:45]
A
Right. What is. Okay, I have a friend who keeps talking about the Yubikey. Can you explain what is that?
[95:51]
B
That's a device that you plug in to your phone or your computer that basically auto authenticates you to allow you to go in. So if you don't have the Yubikey, you can't access the device. So it's basically like, A key to your house.
[96:07]
A
Okay. Is something like that beneficial? Is that something that you would recommend to the average Joe or Jane who's listening to this?
[96:13]
B
No. Here's why. Two reasons. One, it's something for you to lose. Think of how many times people forget things at home, forget their car keys. I've had friends that use it and they go in and they're at the office, or they go on a trip and they forget it at home. And now their phone is bricked, they can't access it. And also to me, it's an additional point of failure. And, and then here's the other reason why I don't recommend it for the average person. Where are they going to keep their Yubikey with their phone? I noticed you have the little wallet on the back.
[96:46]
A
Yeah.
[96:47]
B
So guess what? They keep their Yubike in the little wallet. Well, that sort of defeats the purpose because now if you lose your phone or somebody gets your phone, they're going to have a Yubikey. So unless you have like really high end security practices where you're going to have a separation and you're going to have somebody with you that has the Yubikey that they can give you to plug in like national secrets, like I would recommend the Secretary of Defense do that because he always has a cadre of people with him. So now he has his phone, somebody else. And when he's going to transfer secrets about a war strike in Yemen, he gets the Yubikey and plugs it in. So for that type of very high end information, I recommend it, but I don't use one because it's just the, the risk factor of being locked out versus the benefit. Is it worth it? To me, I have other security measures in place and that's probably one of the other things I want to recommend. Really quick Endpoint security like EDR is called Endpoint A. Detection and response companies like CrowdStrike, Sophos, McAfee, Symantec, you want to have the Endpoint security on every one of your devices. So we said three devices. You want Endpoint security on your laptop, on your iPad, on your phone. Most people do it on their laptop, but they don't do it on their phone and iPad. Once again, it's $59 a year for three to five devices. And having extra level of protection is going to help protect. To me, spending $59 on an EDR for your device is much better than having a Yubikey where you have to remember it and plug it in each
[98:19]
A
time and that's for Mac users as well.
[98:21]
B
Exactly. Pretty much every operating system has EDR Endpoint Security.
[98:26]
A
I remember in the days, in the old days, seemed as though that was primarily. Well, I'm thinking about Norton Antivirus for Windows only.
[98:33]
B
Windows. Yeah.
[98:33]
A
Right. Yeah. And Norton Antivirus was often so slow that I was like, this program itself is the virus.
[98:40]
B
Yes. You know, so 15 years ago, you're right. The endpoint was so terrible and it was so limited, people didn't use it. Today, it's so much more optimized and advanced, you wouldn't even know it's there unless there's a problem.
[98:51]
A
What? You mentioned that you have a safe. What else is in your safe? Or what should we all put in our saves?
[98:56]
B
I work on very high profile litigation cases. I've had multiple billion dollar verdicts. So when you're working on a $800 million lawsuit against a very large company and you have access to their trade secrets or their source code, that's worth hundreds of millions of dollars, I'm under protective orders that if I don't protect that information and secure it, that I could be liable. So I'm required in those cases with a PO to lock up any of that sensitive data in a safe. So that's one of the first things I have a safe for, is critical client information and client data. I also, when I'm not traveling, I store my passports in the safe. I also have my birth certificate and like documents like that. Any investments like bonds and stocks, I keep in my safe. I'll also be a little careful here because I don't want to be targeted. But I'm also a big believer in having cash on hand. So I have not crazy amounts that somebody would want to break in, but I have a certain amount of cash in that safe just for protection reasons. I then also back up my devices locally, so my laptop, my phone, my iPad. I don't always trust the cloud. I have local backups every month that I also keep that in my safe to be able to keep that protected. And then I'll usually go in because my iPad I use so much for business. I have a backup that's imaged and replicated so it has an exact duplicate copy of all the data, all the information, all the apps. I keep that in my safe. And then the last thing that shocks people, but I believe in redundancy and backup is my passwords. I know everyone says don't write passwords down. I'm a practical security practitioner. I write them down and I put it in the Safe because now if something does happen and I forget a password or something occurs and I need to get in or something happens to me and a family member needs to get in, they also could have access to it. So I do keep that in my safe. So those are usually the fundamental things. And then my safe is not only fireproof, that's very important because if there's a fire, you want to make sure that nothing burns inside of it. And then I use a two factor component is I use a combination and a biometric. So now in order to get into my safe, you have to go in and have my biometrics and you have to know the combination. So once again, for somebody to get in my safe, they pretty much have to have a gun to my head or a family member in order to get in or access it.
[101:34]
A
Right.
[101:35]
B
And then the last thing is you actually want to keep the safe in a non discreet location. Like you want to put it either sort of in a closet or in a certain areas. I. And once again freak people out. But, but I have a spot in my house where it looks like it's just a panel. You know how you have the grade for H vac is it looks like a panel but it actually just has two spin crews and we open it up and the safe is back there. So it's a little non discreet in where I keep it. And then last thing, because I'm always going to be honest with you and once again, I wasn't gonna say it, but I was like being honest and complete. I also keep a weapon, a sidearm in the safe. I believe in weapons and sidearms, but I also believe there can be too many accidents and in a lot of cases people have weapons for protection and the criminal can use it against you. So I believe in weapons, but I believe in securing them and keeping them safe. So I keep that in a safe too.
[102:26]
A
How large is your safe?
[102:28]
B
Yes, it's about this high and then this wide. And it actually, you see how paranoid it is. It's actually a two cabinets, so there's actually a cavity. So there's two different. So all of my business stuff for my clients, I keep in one portion of it, which is the bigger portion. And then my personal items, which I know it sounds like a lot, but they're all pretty small, I keep in the bottom portion. So there's actually two different combinations with two different biometrics.
[102:53]
A
Thank you for sharing all of this with us. It paints a real picture about what we need to do in order to protect Our investments, our money. I certainly have my list of homework assignments that have come from this. Where can people find you if they'd like to learn more?
[103:09]
B
You can find me online. I use doctorericole D R E R I C C O L E for my Instagram, for my YouTube. I put a lot of videos out there. My personal website is drerichcole.org. my company website is secure-anchor.com and I just want to really thank you for having me on the show because my mission is to secure cyberspace and many people don't know the dangers. So the fact that you have me here so I can share the message with your listeners, I really thank you for doing that.
[103:37]
A
Of course. Of course. Thank you for coming. And, you know, I think this is one of those topics that's incredibly important but often not talked about because it falls under the category of important but not urgent. Boom.
[103:50]
B
You know, until. Until something happens, then it becomes urgent. Yeah, exactly.
[103:54]
A
Exactly. So it's. It's just one of those things that. Lingering in the back of your mind, it's like creating an estate plan, right? Yes.
[104:01]
B
Bingo.
[104:01]
A
Like lingering in the back of your mind, you're like, I really should probably be doing something about this someday. But there's never any triggering event that causes you to take it seriously. And then it only becomes a problem. Like getting flood insurance. Right. No one thinks about it until your house gets flooded.
[104:21]
B
Like alarms.
[104:21]
A
Right.
[104:22]
B
Nobody gets an alarm until you're broken into. And that's why I love you asking me about the stories. Cause we can make it real. It's going to happen to you. Be proactive, and you can minimize it from happening.
[104:31]
A
Exactly. Well, thank you for spending this time with us.
[104:34]
B
My pleasure. And thank you for having me.
[104:36]
A
Of course. Thank you to Dr. Eric Cole, former CIA hacker, advisor to Bill Gates, and former cybersecurity commissioner under President Obama. What are three key takeaways that we got from this conversation? Key takeaway number one, you may already be being robbed and you don't even know it. Because cybercriminals don't just target billionaires or big companies. They figured out that it's easier to steal small amounts from millions of regular, ordinary, everyday people because we don't have the same level of protection that billionaires and big companies have. And so a lot of cybercriminals might be draining $20, $30, or $50 from your accounts every month. A lot of people never check their statements carefully enough to be able to catch that. And so over the span of years, this Death by a thousand paper cuts approach can ultimately cost you thousands or even tens of thousands of dollars.
[105:34]
B
If I go in and steal $50 from everybody every month, most people won't notice it. Most people don't check their credit card statements. So if there was a 20, 30, 40, $50 deviation, they wouldn't notice it. So we sort of call it the death by a thousand cuts. So the reality is you could have money being drained from your account that over years could be costing 20, 30,000, but it's done so low and so little, you don't even notice it.
[106:01]
A
That is the first key takeaway. Key takeaway number two. Your bank won't save you. You're on your own. FDIC insurance does not protect you from cybercrime. There are regulations, yes, but those regulations protect the bank if they get hacked, not you personally if you get hacked. So if criminals access your account using your own login credentials, you're the one who's liable for the loss, not the bank. And if they have just your account number and your password, they can transfer up to half your savings, which without triggering any alerts.
[106:36]
B
The thing you have to remember is you're right. It is one of the highly regulated industries. But the regulations are around protecting the bank if they get compromised. So you go to your bank and it says, you mean FDIC insured up to $300,000? That's if the bank gets hacked.
[106:54]
A
Yeah. 250, I believe.
[106:55]
B
Or 250 if the bank gets hacked and the bank goes out of business. You're covered. But what people don't realize is the regulation. And it's scary because the US is one of the few countries in the world that doesn't have a unified law on security and privacy that protects citizens. Most of the regulations out there are protecting the entity, like HIPAA protects hospitals. It doesn't protect individuals. The bank regulation protects the bank. So if the bank goes bankrupt or out of business, you're protected. But if you don't protect your password and somebody gets in and gets your user ID and password, that doesn't protect you from the regulations. You're liable, not the bank.
[107:36]
A
This makes it all the more critical to have good security practices in place. That is key takeaway number two. Finally, key takeaway number three. Be particularly careful when you're making a real estate transaction, because real estate deals have become cybercriminals favorite target. They break into the servers of closing companies and they wait for months for the quote, unquote, perfect victim, which is typically somebody who's Making a large cash purchase. And then just a few days before closing, they send fake wire instructions that look completely legitimate. Dr. Cole tells the story of two Ohio teachers who lost their entire $1.3 million inheritance, which was meant for their dream farm. And it was all because they got an email that looked legit.
[108:27]
B
And it turns out it was a scam. We got involved because there was sort of lawsuits of who's liable in this case. And the email for any average person looked legitimate, it looked valid, it had all the proper authentication methods. And it turned out that the closing company servers were hacked, and they were sending emails out to select individuals that were cash based deals. Because here's the reality, there's very few cash based deals. So if you're going in and you get a loan and you're only putting $80,000 down, an attacker doesn't want that. So they broke into those servers for three months and they were waiting for a big cash deal.
[109:08]
A
I actually know another person that this happened to as well. She's public about the story, so I'll say her name. Shannon Allen. She used to be a personal finance blogger back in the early days of personal finance blogging. She at the time wrote a blog on frugality, which is how we knew each other. She also fell victim to wire fraud during the closing of a real estate transaction. She lost $52,660 to wire fraud from scammers. This happens to ordinary people. It could happen to you, it could happen to your friends. I'm not trying to be alarmist, but ever since I heard Shannon's story, I have developed a paranoia around wiring money during real estate transactions. In fact, last year, I needed to send $100,000 to a closing attorney as part of a real estate deal. The most reasonable thing to do would have been to send a wire. I actually physically showed up in person at a bank branch and had a cashier's check made, which I then went and hand delivered. Even the people at the bank were like, you know, you could just wire this. And I'm like, I was thinking about Shannon Allen at the time. I even told them about Shannon's story. And I said, no, no, no, I'm insisting on doing this by cashier's check. Now, of course, that's not always possible because many closings are out of town or out of state. But there are still a variety of good practices that you can put into place to protect yourself from wire fraud and from scammers generally, not just in real estate transactions, but at all times. Because you heard Dr. Cole talk about the phishing scams that are out there, the grandparent scams that are out there. People calling a grandparent and saying, hey, your. Your grandson's in jail. You need to send bail money in jail on a dui, you know, you need to send bail money to get them out. You know, then grandma panics and sends over money like this. This stuff happens all the time. And you and your family and your friends don't have the protections that big institutions have, which is why this matters so much. Thank you for listening to this episode from the archives. This was our interview with Dr. Eric Kohl. It originally aired in June 2025. I am deeply sad that we could not bring him back onto the show a second time. Prior to his passing, we were in talks with his team to schedule that every two weeks we have these guest booking meetings, myself and my team in one of our meetings, we had talked about scheduling him, and we were chatting with his team and we were trying to find a date. And then I heard the news. And so at our next meeting, I had to come to the team and say, actually, actually, that interview is not going to happen. He was a force in the cybersecurity world. I was recently at an event at the Penn Club here in New York. I was chatting with a guy and I asked him what he did for a living, and he said he was a cybersecurity expert. So I asked him, do you know Dr. Eric Cole? He said yes, that he had actually testified in a trial. He had testified on the opposite side of him. So he and Dr. Eric Cole were both expert witnesses in a trial on opposite sides. Actually, he never told me how that case was decided. Come to think of it, he never volunteered that bit of information. It goes to show what a force Dr. Cole was, how well known he was, how well regarded he was within the cybersecurity community. So I am glad that we could share his knowledge with you, and I hope that it inspires you to take action, because that is the most important piece of this. You can learn, you can listen, we can bring you information, we can bring you great guests. But ultimately, what matters is that you take action. So please do something today that makes your financial life just a little bit more secure. Thank you so much for being part of this community. Thank you for being an afforder. My name is Paula Pant. This is the Afford Anything podcast, and I'll meet you in the next episode.

Summary8 min read

Afford Anything | Get Smarter With Money

GREATEST HITS: Hackers Waited 3 Months for This Couple's $1.2 Million Deal (with Dr. Eric Cole)

Original Airdate: June 2025 | Re-release: August 4, 2026
Host: Paula Pant | Guest: Dr. Eric Cole, former CIA hacker, Obama’s cybersecurity commissioner, adviser to Bill Gates
Theme: Cybersecurity—and why ordinary people are prime targets for devastating financial cybercrime

Episode Overview

This episode dives deep into practical cybersecurity for everyday people, exploring how hackers target regular citizens rather than big companies, with devastating financial consequences. Cybersecurity legend Dr. Eric Cole shares stories, practical advice, and hard-learned rules for protecting your wealth—from your checking account to your real estate deals. The episode is anchored by the chilling story of a couple whose $1.2M dream home payment was stolen in a sophisticated cyber scam. The conversation covers hacker tactics, social engineering, safe real estate transactions, device security, app and password best practices, and the rising sophistication of scams in the AI era.

Key Discussion Points & Insights

1. Why You, An Ordinary Person, Are a Cyber Target

"The short answer is, you're a target." (Dr. Eric Cole, 03:41)
Corporate entities have security teams; regular people have none.
Hackers increasingly prefer “the death by a thousand cuts”—stealing small amounts from millions, rather than one big heist.
People rarely check their accounts closely enough to notice small $20-50 monthly thefts.
Major risks: identity theft, drained bank accounts, ruined credit, wiped-out crypto accounts, and ransomware holding family photos or business files hostage.

[Key Quotes]

“If I go in and steal $50 from everybody every month, most people won't notice it...So we sort of call it the death by a thousand cuts.” (Dr. Cole, 04:09)
“Whether you're making 100k or 100 million, it’s across the board. Nobody is spared from these attacks.” (Dr. Cole, 13:37)

2. Common Attack Types: What to Watch Out For

[10:23–25:11]

Phishing: Emails, texts, or DMs that appear legit—especially during real estate closing, Amazon orders, “unpaid tolls,” or “unusual bank activity.”
Ransomware: Your files/photos/business data encrypted and held for a small ransom ($100–$300 for individuals; millions for companies).
Identity Theft: Fake credit cards, credit destroyed, loans taken in your name—often via info shared on shopping apps, or at big retailers.
Bank Hacking: With only your account number and a common password, half your savings could be wire-transferred out—and you're likely liable.
Crypto Compromise: Repeat passwords and lack of 2FA (Two-Factor Authentication) lead to total wallet theft. Loss is almost always unrecoverable.
Grandparent Scams & AI Spoofs: AI mimics loved ones' voices for emotionally manipulative fraud.

Memorable Moment

"[Ransomware gangs] know what your income is, so they tailor the ransom to that amount... But because no one's socializing it, people have no idea how bad it is." (Dr. Cole, 25:18)

Tips

Don’t click links in emails. Always access services directly through their official apps.
“Do not click on links under any circumstance...Use the app.” (Dr. Cole, 19:30)

3. Why Bank Regulations Don’t Protect You

[15:18–17:09]

FDIC insurance only protects against your bank failing or being hacked.
If you get hacked (e.g., your password is stolen), you are liable for the funds lost.
US banking regulations mostly protect institutions, not individuals.

[Quote]

“If you don’t protect your password...that doesn't protect you from the regulations. You're liable, not the bank.” (Dr. Cole, 16:18)

4. The Real Estate Cybercrime Blitz

[66:10–73:41]

Hackers penetrate small closing companies’ emails, wait patiently, and then pounce days before a big wire transfer.
Ohio schoolteachers lost their $1.2 million inheritance in minutes and spent years in legal limbo.
Key defensive practice: For any large transaction, never trust emailed wire instructions (call, meet, or use certified checks in person).
“No emails, no links, no clicking”—especially with sensitive money matters.

[Quote & Timestamp]

“The email for any average person looked legitimate, it looked valid, it had all the proper authentication methods...they broke into those servers for three months and they were waiting for a big cash deal.” (Dr. Cole, 108:27)

Paula’s Personal Experience

“The last house that I bought, I paid in cash... Instead of relying on what was in the email, I went to the entity's website, looked up the phone number...But...that website could have been spoofed.” (Paula, 72:23)

5. Real-World Device & App Security Audit

[37:46–45:46]

In a live demonstration, Dr. Cole picks up Paula’s (unlocked) phone and shows:

Most users have dozens of apps, many unused and collecting data.
Many (esp. free, “harmless” apps) track your location, access microphones/cameras, and upload info constantly.
Cloud backups keep texts/photos even after deletion.
Bluetooth—auto-connecting can leave you open to device hijacking.
Rule: Delete any app not used in 45 days. Pay for ad-free versions if possible.

[Quote]

“Free isn't free because...they're putting on location and monitoring your camera...for ordinary users, any free app that's on your phone is a point of exploitation." (Dr. Cole, 40:07)

6. Messaging, VPNs, Device Choices & Emerging Threats

[50:20–60:57]

WhatsApp and Meta: Free to use, but trades user data for profit; only “end-to-end” encrypted between you and Meta.
Signal: Better for highly confidential conversations (“point-to-point” encryption, server never sees plaintext).
VPNs: Great for masking location/encrypting at public places/hotspots, but settings matter.
Device choice: Most malware targets Windows and full Mac OS, not iPads. Use iPads for web/email/app risk.
TikTok: Not "spyware" but, by design, a Chinese server-based data vacuum (location, habits, photos)—potential for state surveillance or blackmail later.

7. Security Rules & Habits: Dr. Cole’s Checklist

[82:38–89:10]

Two-Factor Authentication (2FA) is critical for all accounts—banking, email, health, everything.
- Most services have it, but it’s off by default.
Account alerts: Texts for every transaction, withdrawal, or login.
Paid Apps: If there's a $9.99 vs. free version, buy it. Free apps are selling your data/access.
10 App Challenge: Keep your device lean; delete unused apps.
Device segregation: Use computers for high-power work, iPads for risky functions, phones for basic apps/calling.
No email/wire transfer for big transactions—use phone/in person.
Endpoint security on all devices, not just laptops.
Be careful with biometrics: Their risk is minor compared to their convenience and security.

[Quote]

“Passwords are so 1980. If you're going to use passwords, you might as well listen to the Bee Gees and wear bell bottom pants...You got to turn on two-factor authentication.” (Dr. Cole, 82:38)

8. Defensive Real Estate Transactions

Use only trusted, local professionals.
For out-of-state deals, do a recorded Zoom call with ID proofs and bank details.
Prefer paper, cashier’s checks in person—“paranoid” is good, “convenient” is dangerous.

9. What to Do With Old Devices, Biometric Security, and Safes

Wipe old phones securely, or destroy physically if ultra-sensitive.
Keep a fireproof, biometric-safe for critical documents, backup drives, and passwords.
Use multi-factor authentication on your safe if possible.

Notable Quotes & Moments

“It's going to happen to you...The more proactive you can be, the more you can realize you're a target...you can save yourself headaches or devastating events from happening to your family.” (Dr. Cole, 09:45)
“Do you really want all your communications monitored and tracked? That's really where Signal comes in.” (Dr. Cole, 51:05)
“TikTok turns on location services...we're giving all this information to TikTok, where there's a company that's run in China...So they're monitoring and tracking." (Dr. Cole, 61:21)
“Even though I'm a cyber guy...I still go to a bank and get certified checks...for large investments, it's old school." (Dr. Cole, 70:00)
“You can learn, you can listen...But ultimately, what matters is that you take action. So please do something today that makes your financial life just a little bit more secure." (Paula, 109:58)

Timestamps for Major Segments

[00:00–03:41] — The $1.2M Ohio schoolteacher scam: episode setup
[03:41–10:23] — Why everyone is a target, 'death by a thousand cuts,' and classic attacks
[10:23–17:09] — Breaking down attack styles: phishing, ransomware, identity theft, crypto, and bank hacks
[25:18–31:18] — Rise of AI-driven scams, social engineering, spoofing influencers, "grandparent scams"
[37:46–45:46] — Dr. Cole audits Paula’s phone: apps, privacy, device hygiene
[50:20–56:24] — Messaging apps, encryption, VPN, and public WiFi risk
[60:57–66:10] — TikTok and state-level surveillance threats; privacy realities of global data
[66:10–73:41] — Real estate scam story and bulletproofing big transactions
[82:38–89:10] — The Security Checklist: 2FA, notifications, app hygiene, device choices
[90:02–96:47] — How to decommission old devices, using safes, and endpoint security
[103:36–104:35] — Summary, key takeaways, concluding thoughts

Action Steps: What You Can Do Today

Turn On Two-Factor Authentication everywhere, especially banking, email, and investment.
Set Transaction Alerts & Account Notifications: Texts for every withdrawal or transfer.
Never Trust Wire Instructions in Emails—verify in person or via a known direct phone.
Purge Unused Apps and always pay for the ad-free/paid version when possible.
Do Not Click Links in Emails or Texts—always use the app or verified website.
Segment Devices: Use an iPad (not Mac/Windows laptop) for emails and web surfing.
**Install Endpoint Security/AV on All Devices—including iPads and smartphones.
Keep a Fireproof/Password Safe for critical docs, backups, and written passwords.
For old devices: Securely wipe and/or physically destroy them if highly sensitive.
Be Paranoid (It's Good)—a little “over the top” is better than catastrophic loss.

In Dr. Cole's Words...

"Every day when I wake up in the morning and throughout the day, I’m getting calls...with these devastating stories. It’s going to happen to you. The more proactive you can be, the more you can realize you’re a target and cybersecurity is your responsibility, you can save yourself headaches or devastating events from happening to your family." (09:45)

For more from Dr. Eric Cole:

Instagram/YouTube: @doctorericole
Websites: drerichcole.org | secure-anchor.com

Final word from Paula:
"You can learn, you can listen, we can bring you great guests...But ultimately, what matters is that you take action. So please do something today that makes your financial life just a little bit more secure."

Loading summary

Transcript211 lines

[00:00]
A
A married couple, both schoolteachers in Ohio, had one dream, which was to own a farm. They inherited $1.3 million. They found the perfect property, the farm of their dreams, on sale for 1.2 million. Everything seemed perfect. They made an all cash offer. It was accepted. And five days before closing, they received what looked like a legitimate email from their closing company with wire transfer instructions. So they transferred 1.2 million. And when they showed up at closing, they discovered they'd been scammed. The email that they had received was fake. It was sent by hackers who had infiltrated the closing company's servers. And those hackers had waited patiently for months until they saw exactly this type of high value cash deal. As of the time of this interview that you're about to hear, the Ohio school teachers have not recovered the money. They're in the midst of legal entanglements around who's liable. This story comes to us from cybersecurity expert Dr. Eric Cole. He joined us to explain why ordinary people, you and me, have become prime targets for cybercriminals. Because the thing is, big companies have cybersecurity professionals. You and I do not. Many criminals are not trying to steal $100 million from one company. They're trying to steal $50 a month from each of us. Today we are airing an interview with former CIA hacker Dr. Eric Kohl. He served as cybersecurity commissioner under President Barack Obama, and he advised high profile clients, including Bill Gates. This episode comes from our archives. We originally aired this episode in June 2025, and when we aired it, many people left comments on YouTube calling this informative. That was the word that kept coming up over and over again. One YouTube commenter said, wow, such an informative episode. Another one said, great info. Another one said, super informative. And so this is an episode full of practical advice, actionable advice that you can apply to protect yourself from hackers and cybercriminals. Because the original episode was so well received, we reached out to Dr. Eric Kohl and asked him to come back to the show for a second interview. He agreed, and we were in the process of seeing, scheduling that interview. Then, unfortunately, on May 19, 2026, Dr. Eric Cole very suddenly passed away at the age of 56. It was sudden and unexpected and the result of an undisclosed health condition. So we never got to bring him back onto the show, which we very much wanted to do. In honor of Dr. Eric Cole and in honor of the incredible information that is now his legacy that he has left to the afford anything community we wanted to share this episode with you one more time. So, again, this episode originally aired in June 2025, and it is with Bill Gates, security Advisor and Barack Obama's cybersecurity commissioner, former CIA hacker Dr. Eric Cole. Why should any ordinary person who's listening to this right now care about cybersecurity? How does it affect their money?
[03:42]
B
The short answer is, you're a target. Most people don't realize that, because here's the reality. If you go in and look at a $3 billion company, they have a team of 60 people doing cybersecurity. You try hacking them, good luck. You look at some big names like Bill Gates or those types of folks, they have dedicated people and cybersecurity specialists like me monitoring and tracking their accounts.
[04:08]
A
So you're an advisor to Bill Gates, right?
[04:10]
B
Yes, his personal estate. So you go in and look at those types of folks. Good luck. Because most people think cyber attacks are going after $100 million from one individual. The reality is, if you go after a small business owner or somebody who owns a dental practice or even a doctor that works at a hospital or a. A professional in other fields, they probably have nobody guarding their security. They probably have minimal security measures. And here's the thing. If I go in and steal $50 from everybody every month, most people won't notice it. Like, and I'll show you some tricks later, but most people don't check their credit card statements. So if there was a 20, 30, 40, $50 deviation, they wouldn't notice it. So we sort of call it the death by a thousand cuts. So the reality is the. You could have money being drained from your account that over years could be costing 20, 30,000, but it's done so low and so little, you don't even notice it. So it could have a huge impact. Second, if you don't have good cybersecurity, I can trick you to going to a website that you think is legit. And you go in and put in your name, your date of birth, your address, and things like that, which is very common. Most people give that out like candy on Halloween. And you do that and you have your. Your identity stolen. Somebody can go in and open credit cards. It's very common at Costco and Target and these other places, because when you go in to make a purchase, they say, hey, do you want to open up a credit card?
[05:37]
A
Right.
[05:37]
B
Try doing it once. It's scary. The minimal amount of information you need about somebody. We get this all the time with our clients where they're Opening up multiple credit cards. They're spending 500 or $800. So it's below the Ford alert systems. They know how the fraud alert system works. Target fraud alert. If you're under $1,100, it won't alert. So they're going to always stay between 7, $800. They know how to bypass the security system. But then here's the reality. They open up four or five credit cards in your name, they run up 8, $900. They go to a bogus address, but they're under your name. It destroys your credit. So now a lot of my clients, they think they have great credit because they're always paying off credit cards. They're always doing good for financial things. They go to get a loan or they go to buy a house and they get denied because they have like a 220 credit rating. And they're like, how could this be? And they're like, well, you have five outstanding credit cards with unpaid debt on it. And it destroys your credit. So it can also impact your credit on that front. It could basically take over your identity, your bank accounts. A big area that we see a lot of professionals getting burnt on is cryptocurrency. One of the cool things of cryptocurrency is it's untraceable, right? That's why people like it. That's why it's used for ransomware and other attacks. But the problem is a lot of people have their crypto wallets with a password, and those passwords are known. If you use the same password across multiple sites and you're not using two factor, and they can go in and empty your wallet. And we've seen this all the time where I get these calls from folks like Eric. I put my entire life savings in cryptocurrency and ran it up to 500 or a million dollars. And I woke up this morning and it's empty. What can I do? And the unfortunate, sad part is nothing. So it's one of those. With cyber, it's prevention and detection, and you need to go in and protect that. And then sort of last thing is, if you have parents or grandparents, they're one of the biggest targets because they have money, they have time. And this is not a negative. But they didn't grow up with the technology. They're naive and they trust people. So if they go in and get a message saying, hey, this is from your bank and we're noticing unusual activity, please click on the link and they will. And they'll empty out their bank Accounts. To me, one of the movies that everybody needs to watch the action is a little questionable, but it's a great movie. It's called the Beekeeper with Jason Statham. It's an action flick. But the core message in the movie is there's this wonderful 65 year old lady, she's a mom and I mean she's just the sweetest, kindest person. And she has her life savings of about 800k and she's running a non profit to help underprivileged children. And she raised 3, $3 million to invest in a orphanage for these kids. And she gets this scam message that says, hey, you've been hacked, please call us, we'll clean up your system. And it's real, it's a fraud. And within 10 minutes she gives away all her information, they're super good. Wipes out her entire life savings. And then because she's so distraught, she takes her own life. And unfortunately those things happen a lot. Where we see that with parents and grandparents and imagine if your parent or grandparent got hacked and they lost everything, that would be devastating. And then the other big area that just, I don't even like talking about it because it gets me so angry and frustrated. And you've seen recent stories with these sex torsion with kids where these kids very successful, they're 17, 18, they're real good in sports, they have a scholarship, they're accepted to a college and somebody hacks or does cyberbullying. And a lot of these kids can't handle it. They don't know who to talk to. And we're seeing more and more of these children taking their lives because they just can't handle that reputational damage. So whether you have kids, whether it's you or whether you're a parent, cybersecurity over the next year is going to impact your life. So if you don't start taking it seriously. And the good news is, as we'll talk about, there's lots of easy common sense things you can do. But it's one of those things where every day when I wake up in the morning and throughout the day I'm getting calls from family members, friends or people that found me online with these devastating stories. So it's one of those things to the listeners is it's going to happen to you. So the more proactive and you can realize you're a target and cybersecurity is your responsibility, you can save yourself headaches or devastating events happening to your family.
[10:23]
A
Wow. One thing that I Hear in your answer are a variety of different types of ways that you could get attacked. You mentioned ransomware, you mentioned identity theft, you mentioned a number of. You mentioned phishing schemes.
[10:39]
B
Phishing schemes are very common where they'll send you links or text messages. Yeah. Ransomware, or what they call extortion. Going in and stealing your identity, credit. Bank hacking. There's a whole, whole range of attacks.
[10:52]
A
Can we go through what some of those attacks are? What is bank hacking? Can they literally access your bank account and take money from a bank account?
[11:00]
B
Yes. A lot of people do not realize this, but most of your banks will allow you to do EFTs, electronic fund transfers. And most banks, depending on the size of your account, will let you take at least 50% in an EFT. So if you have 200k in your savings account, they can actually do an eft for under 100, like 75 or 80k. And you do not get an alert. And all they need is your account number and your password to be able to get in and do those types of attacks. And the reality is you put your account number in a lot of different places.
[11:39]
A
Yeah.
[11:40]
B
And one of the things that people don't realize is like you pay with a check.
[11:44]
A
Yeah, yeah. Your bank account number is written at the bottom of the check.
[11:47]
B
Exactly. And those checks sometimes can easily be caught or accessible. And especially when you do online purchases and you go in and put in your checking account number. Like online billing, a whole nother topic. But think of how many different locations from local municipals to small little places that have your bank information.
[12:09]
A
Right.
[12:09]
B
And then, so I get your bank account information, then I can go in and guess your passwords. Because most people have probably had their account and passwords taken in attacks and available on the dark web. And there's actually dictionaries of common passwords that people use. So if you're using dictionary names and numbers, which most people have some sort of predictability around it, those passwords are readily accessible. So now I can go in, get your banking information, get passwords information, and depending on your security settings, that can sometimes be enough to go in and do EFTs. And then here's the problem. If you don't have a learning turned on, which is one of the things we'll talk to later in the show if you don't have that turned on. Most people don't check their bank accounts for multiple days. And the way it works with the fraud based systems is you have 48 hours to report it because there's a 48 hour hold and then they transfer the money and it's too little, too late. So if you go check three or four days later, you're pretty much out of of the money. And the problem is if it's because of your negligence. And that's a hard pill for people to swallow. But if you had a weak password, or you didn't protect the password, or you didn't turn on the security settings, most of the time you're liable, not the bank. So you're actually out that money. And that's sort of the same thing with cryptocurrency. So people don't realize this. And when we talk about the security settings, people always like, oh, Eric, that's an inconvenience, like spending five extra seconds logging in. But what I always tell people is okay, five seconds is an inconvenience, but having your entire bank savings or your identity stolen, you're going to be inconvenient for nine months. So which inconvenience do you want? Right? Do you want a five second or a nine months? So you people just don't think it's going to happen to them. And the reality is it's happening to average people, folks that are business people, small business owners. So Whether you're making 100k or 100 million, it's across the board. Nobody is spared from these attacks.
[14:05]
A
Why nine months?
[14:06]
B
Just because if you go in and your identity is stolen or your bank account is wiped out, if you look at the amount of effort, because you're gonna have to submit forms, you might have to get attorneys because some of these banks are getting hit so much they can't pay out or go in and give you the $90,000 back. So you have to sometimes fight them, do legal action, put in new security measures, and then think about most people, if they lose 90,000, that could impact their lives. They might have to sell their car or sell their house or apartment. So when you look at.
[14:41]
A
So you mean many months?
[14:42]
B
Many months? Yeah, it's not a set number, but I'm saying it negatively impacts you. If you look at the emotional impact, like your kids going to college and you saved the money to put them to college and now your child can't go to college because your money's wiped out, or now you have to get a loan and you have to work a second job. So you look at emotional impact and impact on your family and it's once again it's, it could be even more, but it's many, many months. And I find on average when you look at the emotional support, the time, the energy, the effort, that is usually somewhere between six to 12 months that it negatively impacts you. So that's why I just use 9 as an average.
[15:19]
A
Right. Wow. So I think a lot of people understand that cryptocurrency is the wild west, and there's a lack of regulation. And part of the risk that you take if you decide to go into cryptocurrency is that lack of regulation, that lack of rule of law protecting what you're doing. But I think that most people, myself included, didn't know that or don't know that about bank accounts, because banks are one of the most highly regulated institutions in the United States. Other than pharmaceuticals right there or weaponry, there are very few industries that are more highly regulated than banks and financial institutions generally. So I think a lot of people would be surprised to learn that even the money in a bank account can be that vulnerable.
[16:00]
B
Yeah. The thing you have to remember is, you're right. It is one of the highly regulated industries, but the regulations are around protecting the bank if they get compromised. So you go to your bank and it says, you mean FDIC insured up to $300,000? That's if the bank gets hacked.
[16:18]
A
Yeah.
[16:19]
B
250, I believe, or 250. So if the bank gets hacked and the bank goes out of business, you're covered. But what people don't realize is the regulation. And it's scary because the US Is one of the few countries in the world that doesn't have a unified law on security and privacy that protects citizens. Most of the regulations out there are protecting the entity, like HIPAA protects hospitals. It doesn't protect individuals. The bank regulation protects the bank. So if the bank goes bankrupt or out of business, you're protected. But if you don't protect your password and somebody gets in and gets your user ID and password, that doesn't protect you from the regulations. You're liable, not the bank. And that's where you have to be real careful there, because, yeah, we think it's all regulations, but they're not protecting you. They're protecting the institution in addition to bank vulnerabilities.
[17:10]
A
Can you go through some of the other ones that you described? So you talked about ransomware, phishing, identity theft. Phishing, I know, is a big one when it comes to closing a mortgage, buying a home.
[17:20]
B
So phishing is a. A technique of. It's basically what we call social engineering, which is the most common method of exploitation, where you're tricking or manipulating something to do something they normally wouldn't do. So common phishing techniques. I don't know if you've seen this, but it happens a lot. You get a text message that says you have unpaid tolls in Florida.
[17:40]
A
Yeah, I get those messages all the time. And I look at them and I'm like, I don't have a car, I live in Manhattan, I don't have a car. But I get messages almost, probably two, three times a week telling me I have unpaid tolls.
[17:51]
B
And here's the thing you have to remember, the frequency in which you get them is the frequency in which people are falling vulnerable to it. If they sent out that message and nobody clicked and nobody replied, they'd stop. So when you're getting any of these, like the unpaid tolls or messages from Amazon or your bank or things like that, and it's fraud because you look at the messages or you look at the email and you're like, hey, this doesn't feel right. The frequency in which you're receiving it is the frequency in which people are falling victim to it. So just that Florida toll example, which is like $49, they have made over $3 million on that in six months. And the problem that we have is we know who they are, we know where they're coming from, but they're in countries that don't have extradition treaties and it's not against the law. A lot of these attacks are, are coming from Russia. And then people are surprised, North Korea, Iran, that those are big scams because they're easy, they're simple. And we don't have extradition treaties or laws. So the problem is law enforcement and cybersecurity professionals like me, we know where they are, but we can't do anything. So that's why these attacks continue. And then the other thing with phishing is we see these all the time. You get a message that it looks like it comes from Amazon. Nothing against Amazon, just they're the biggest retailer. And. And it says, the recent order you just placed is on backorder. If you want to receive this item within the next 24 to 48 hours, click on this link to reorder and you go, how do they know who ordered it? Here's the reality. Most people are ordering from Amazon.
[19:30]
A
Yeah.
[19:30]
B
So if I send it out at nine in the morning and three o', clock, the probability that at least 20 or 30% of the people have probably ordered an Amazon and is pretty high. So once again, people think it came from Amazon. They're not checking. They click on the link and then once again, stealing credit cards, stealing bank accounts, stealing money, stealing information along those lines. So that is by far the most common. And one of the tricks we'll talk about later is do not click on links under any circumstance. And you're like, but Eric, how do you then do business? Use the app. So if I get a message from Amazon that says, hey, there's an order that has an issue, I don't click on it, I delete it, I go to the app. So you have to just train yourself on good cyber hygiene. And then the other big attack, it's more business focused, but it happens with individuals, is ransomware, where essentially they go in and it's usually done with a link again, where you click on a link and it goes and encrypts your hard drive. Or if you're at a company, it goes to your database of all your clients and encrypts it and then it basically pops up a message saying unless you pay X amount of money, you'll never see the information again. And once again, these are big businesses. One of the big one is there's a company in Russia, company, so it's a actual company called the Cyber Investment Firm. It is a company, it's a building, a three story building. They have 700 employees. These employees get benefits, they get salaries, they get days off in pto. They go into the office, they have badges, they have everything else. And the entire business is going in and doing ransomware.
[21:08]
A
Wow.
[21:09]
B
And once again, because in countries like Russia and others, there's tied to government officials. So it's not illegal, there's no extradition treaties. So these are actually running as businesses that are targeting you and your family and they know what your price point is. The average person that has all their family pictures, all their taxes, all their information on their computer or laptop, if I encrypt it and say, you'll never see the data again, but if you pay $300, you'll get it back. Is your pictures, is your life, is your tax returns worth $300? Absolutely. So most people will actually pay it. And it's a sad state of affairs. But as security professionals, even law enforcement, because there's nothing else we can do, and the encryption is so good we can't break it, that we unfortunately tell people in most times it's actually better to pay the ransom than to be out and lose all that information and all that data. And now companies, they go in and no other price tags. I don't know if it came all the way up to New York. But if you remember two years ago, the Colonial Pipeline, the biggest oil pipeline for gasoline on the east coast, our gas stations were closed for five days. We had no gas. On Monday when it happened, I went to get gas to fill up the car. It was a 30 minute wait at the gas station. And by Tuesday evening, every gas station was out of gas. So, like people were panicking and no,
[22:32]
A
you live in the DC area, in
[22:33]
B
the DC area, in Virginia. And all these security professionals like, oh, they're not going to pay the ransom. They're not going to pay the ransom. I was one of the few that broke the story on they're going to pay the ransom. Because the reality is if they don't pay the ransom, they're going to lose 30, 40 million dollars in lost revenue. If they pay 5 million, they'll be up and running within 12 hours. And sure enough, by Thursday, I was right. They paid the $5 million ransom and gas was restored by the weekend. So these are the things with bigger companies, they know the monetary loss and the pressure points. So the ransom demand is going to be low enough that it's actually easier to pay the ransom than suffer the pain of having your systems down and unavailable.
[23:17]
A
Wow, there's something that feels very mafia about that someone. It's the cyber equivalent of someone coming to your store with a baseball bat and saying, would be a shame if anything happened. Yep, right.
[23:28]
B
And you just nailed it. Because here's the reality that that is really the, the hard part of why I sometimes tell companies, if you don't pay the ransom, you lose 30 million. But if you pay the ransom, you get your information back. But here's the problem. If you pay the ransom, once you're in the frequent flyer list, it's like New York in the 70s. They would come in the mafia and they'd be like, if you don't pay protection services, then we're going to trash your store, right? You don't believe them, they trash your store. So then you pay the, whatever it is, 100, a couple bucks. But once you do it once, you're going to have to pay every single single month nonstop. So the same thing. If you pay the ransom and you don't then fix the problem and hire good security professionals, they're going to come back every quarter and hit you up going, hey, because we're such nice people, right, with such nice evil hackers, instead of 5 million, we're just going to charge you 100k every quarter. So if you play 100k. We'll provide security protection. Right. It's all marketed as a business. It's not evil. It's like we'll provide security protection and monitor your site and we won't hit you with ransomware. But if you don't pay, then you might have to get hit with ransomware every three to four months. So it's actually a mafiosa disguised as sort of being nice, legitimate services, but it's really not. So it's one of those things, you pay once and if you don't fix the problem, you'll keep paying over and over again.
[24:53]
A
Wow. And this happens to individuals as well, right?
[24:56]
B
Yes. So the price tag is lower, but it happens to individuals. But here's the problem is you or the average person gets hit with ransomware at their home, it's $300. So unfortunately, if you try reporting it to the police, it's a small amount that, yeah, they'll file a police report. They're not really going to do anything.
[25:19]
A
Right.
[25:19]
B
The FBI is not going to be concerned because it's under typically their limits, which is usually 5 or 10,000. And the media doesn't care about $300. So nobody realizes how bad it's happening. Nobody realizes that it's happening to people across America on a regular basis where they're paying anywhere from 100 to 300 because they know what your income is, so they know what you can afford, so they tailor the ransom to that amount. But because no one's socializing it, no one's talking about it, no one's bringing it up, people have no idea how bad it is. But it is really a pandemic that's impacting a large number of people, but nobody's talking about it.
[26:00]
A
How are the types of cyber attacks that we're discussing right now, how are these similar to or distinct from scams? Right. So when I think about, for example, someone calling the grandparents scam, someone calling a grandparent and saying, hey, your grandson is in jail, you need to send money for bail. At least send the bail money to this address. Is that a different classification of financial problem or is that how are cybersecurity and financial scams related or different?
[26:30]
B
If you go back sort of four or five years ago, they were sort of different. And then the scams were very targeted on purely monetary and they were really phone driven where they'd call you up and say, hey, your son was arrested or something happened, you need to give us two or three hundred dollars. Mail it was, or eft it. But today because of the technology and artificial intelligence and all those, they've really sort of merged together where now they're almost one and the same, and it's the same entities doing it. So if you go in and think about. It's really just a delivery mechanism. So if I send you an email that says, hey, I've been arrested, or I don't know if you've seen this on social media, where social media attacks will get compromised, and then they'll text everybody in your following saying, hey, I'm traveling to Puerto Rico or Mexico, and the most unfortunate thing happened. My wallet was stolen, my driver's license was stolen, my credit cards were stolen. I am stuck, and I have no way to get home. Can you do me a favor and send me $500 and to this account, and I will pay you back when I get home? But otherwise, you. You might never see me again because I have no way of getting home. I have no money and no access to anything. Now, most people, if you're nice and kind and it's legit, like, if my friend legitimately had that issue, I'd send them the money in a second. But so people get emotional about it. They think it's important, and they'll send it that message. I could call on the phone. I could do it in social media. I can do it in an email. So it's really the same message of social engineering. It's just done at different levels of delivery. And sort of a funny story with that is one of my friends had his account hacked, and he had like 500 people in his contact list, and they sent out that scam. And I'm talking to him, and he's mad, and I'm like, dude, how much did your friends lose? He's like, nothing. I'm like, why are you mad? He's like, cause none of my friends cared. He goes, here. I'm telling them that I'm stuck in a foreign country, and not one of them people paid the amount. And I'm like, dude, you're missing the point, right? But it was funny how people emotionally rack going, nobody cared enough to actually fall victim to the scam. So it's sort of crazy. And then you layer on, like, you look at those scams where they call your parents and say, hey, I've been arrested. Or the grandparents, right? They used to just use a voice saying, hey, this is Officer Jones. I just arrested your son. And he's at bail for X amount. But now with AI, they're actually mimicking your kid's voice. So now, because think of a lot of kids put videos out. Your child puts a video out. I have their voice.
[29:17]
A
Right.
[29:17]
B
I now can train an AI model to mimic their voice. And now I can call their grandparent, because guess what? Their grandparents are following them on social. So very easy for me to find the grandparent. A lot of people list their contact information, so now I can call the grandparent with the actual child's voice saying, hey, this is eripa, and it sounds exactly like their voice. And now the probability of people falling for it is much, much higher.
[29:43]
A
Exactly. I actually had a conversation with my parents about that because when AI first became ubiquitous, I became really nervous about the fact that as a podcaster, we're at over 600 episodes.
[29:53]
B
Yeah. There's a lot of your voice and video.
[29:55]
A
Yeah, exactly. Right. And each episode is a minimum of an hour, sometimes an hour and a half or longer. There is probably a thousand hours of my voice in the public domain. I'm incredibly easy to mimic.
[30:10]
B
Yes.
[30:10]
A
And so, to the best of my knowledge, that hasn't happened yet. But what does happen and what's frequently happened with me, Social media, I will have accounts that pretend to be me. There will be these. What's the word for it? Like spoof account. Right. A spoof account that pretends to be me and that sends out messages to all of my followers. And it's without exaggeration. There have probably been at least 150 spoof accounts that I'm aware of over the years. And what is concerning to me is that on multiple occasions, there are people that I know, nobody I know closely, but distant acquaintances who. Who have genuinely believed that they've been having an exchange with me. So one time I went to Greece and I was chatting with a friend of a friend, and she started bringing up this conversation that we had had on Instagram. And I was like, what are you talking about? As it turned out, she'd been chatting with the spoof account, believing that it was me. And it was only the fact that we happened to meet face to face in Greece that cleared the air. Otherwise she might have believed that forever.
[31:18]
B
Yeah. And your prime example is influencers or people that are on social media. The more influential you get, the bigger your target. And I hate to say this because you're growing rapidly. So unfortunately, it's going to happen where somebody is going to start putting out videos with AI that look like you, but they're going to have discriminatory messages or negative publicity trying to. To go in and hurt your brand or hurt your reputation. And then the other thing that you've been lucky so far because it sounds like you must have good security on your prime account. But the other scam is they set up all these bogus accounts for you and then they take over your prime account and they say unless you hire and notice how they do it, they don't say ransomware. Now, because that could be illegal, because some of the laws, they go in and say, unless you hire us for security protection. Right, the Mafiosa model. And unless we hire you for security protection, you'll never get it back. But guess what? If you hire us and we do reputational improvement and monitoring, so it sounds really legit. And we'll make sure this doesn't happen in the future. And because you're such a great, wonderful person with such a great message, Paula, we're going to go in and charge you $39 a month. Now, once again, you don't like it, but $39 a month to get your account back and to be able to talk to your audience and not have it hijacked with bogus accounts is probably worth it. Then they'll go in and say, hey, for an upcharge of $29 a month, we'll remove all the bogus accounts. So now when people search on your name, they only get your account and nobody else. And once again, for most people, the discomfort is so hard that the money is worth it. And they're now spending 60, $70 a month, so less than $1,000 a year on so called fake cyber protection. But to stop your account from being hacked and stop the rogue accounts from being set up, we get contacted by influencers all the time that are just like, I'm losing hundreds of thousands of dollars because my account's been hijacked and I can't communicate and, and bogus accounts are putting out false information. So now my user base is getting corrupt, frustrated, and biased. And I'm losing followers, I'm losing money. How do I get it back? And unfortunately, a lot of cases it's if you didn't prevent it in the first place, it's very hard to get it back after the fact.
[33:47]
A
And you know, and one of my big fears is that someone will scam a fan of mine who will pay money, believing that I have asked them to do so.
[33:57]
B
Yes.
[33:57]
A
So I know there's a guy who's in our space named Mr. Money Mustache, and he has publicly written about how someone spoofed his account, sent out messages to a bunch of his followers. And one of his followers paid $1500 for some quote unquote investing course because they believed that it was coming from him, because that person trusted him as the person, as the recipient of that trust. That is such a responsibility, right? So that's a huge, huge fear of mine. I know that many of the spoof accounts that have pretended to be me have sent messages out to my followers asking either talking about some quote unquote investing course or asking if they invest in crypto over and over and over in my Instagram stories, I will create videos, you know, of myself saying, hey, it's, it's me. Like, just to reaffirm, I will never, ever, ever, ever, ever in my life will never initiate a DM to anybody, you know, B, I will never DM any one of my fans to ever ask for a sale of any sort, not even for a course that I actually run. Right. Just never going to do that by dm. But when I tell my audience that, I know that it's only a small fraction of them who are actually hearing that. Right? And statistically speaking, the overwhelming majority of people are not going to hear those messages.
[35:18]
B
Yep, exactly. And then this is a hard part is like with your friend, if somebody does that where they create a fraudulent account and a lot of people don't understand it, so now they think you took $1,500 from them. So now the question is, what do you do? Do you tell them, well, listen, that wasn't me and sort of stinks to be you. And then they're going to be annoyed at you because they're going to think you ripped them off. Or in a lot of cases, these folks, if they're making enough, they'll actually be kind enough to refund the person or give them a free course or give them something else. But then you have a financial impact because somebody else created fraud. So, yeah, you're on the right thing putting messages. But the other big thing is to really tell everyone, this is my only account. I do not text from any other account. This is my only Instagram account. So if you're getting messages from anybody else, don't click on it, don't go there, don't post it. Or the other thing, if you is, you gotta be a little tricky is you then hire somebody to go to all those bogus accounts and when they post articles or comments, you put a comment in basically saying, this is not me, this is a fraudulent account. Don't click on it. And because most of them are run by bots and not humans. They don't catch that. So then you can at least be proactive. But then here's the question. Do you really wanna spend and should you be spending 15 or $20,000 on hiring a person to solely protect yourself against trollers and cyber criminals out there? But unfortunately, as you grow as an influencer, it's a necessary evil because there's people that are going to be targeting you.
[36:54]
A
Yeah, I've seen it on Instagram and Facebook so many times. I am not exaggerating when I say a minimum of 150 that I know of. And I only know about it because some one of my fans will contact me and say, hey, is this you? Or hey, this does. I think this is a fake account. And my team can tell you, like, you know, we get that all the time.
[37:15]
B
You've been lucky because it sounds like you have really good security and they haven't been able to hijack your primary account, but I can guarantee you they've tried.
[37:23]
A
Wow.
[37:23]
B
And you've just had good security. But a lot of them don't. And I get called all the time from. And I won't mention some of the big names out there and they're like, eric, my accounts been taken over. What do I do? And there's not a whole lot we can do after the fact except pay to get it back. And then we'll really roll up really good security so it doesn't happen in the future.
[37:43]
A
Well, on that note, I'm gonna hand you my phone.
[37:46]
B
Okay.
[37:47]
A
All right. And so tell me, what am I doing wrong? Here's my phone. It's unlocked. Go wild.
[37:53]
B
Okay. So first thing you did wrong is hand me your phone.
[37:57]
A
Yeah.
[37:58]
B
You never ever wanna give your phone to anybody else. You never wanna give. You ever want to give it to a kid? Like, I see parents in restaurants where they have younger kids and the kid is crying or screaming and they hand them their phone.
[38:12]
A
Yeah.
[38:13]
B
Because kids just click anything. Kids go on anything. My family knows. Not in my pocket. But nobody knows my passwords. Nobody gets access to it. Like, this is like a body part. Like you try to take this, it's like cutting off my arm. Right. You are not getting access to my phone. That's sort of the first thing is you want to control it. And then if we just go through. So first thing is way too many apps.
[38:37]
A
Yeah.
[38:38]
B
So I'm guessing if I go in, I don't want to be too intrusive, but if I look at usage, you probably haven't.
[38:44]
A
Feel free.
[38:45]
B
Okay. You probably intrusive, you probably haven't. So you can actually see what I'm doing. So I'm just going in and looking at your usage data. Looks like about 60% you haven't used in 45 days.
[38:55]
A
Yeah.
[38:55]
B
So if you're not using those apps, you definitely want to go in and turn that off. And then one of the big things, let me go into your. Find where your settings is. So if we go under settings and then we go under your security, and what I'm looking at there is the tracking of the data. So to see if you have tracking for which apps. So we'll put in your location. See, one of the things you are doing good is you have small prints. So for people like me that can't type, you go in. So I'm looking onto location services. Do you realize that you have all these different apps are tracking your location?
[39:34]
A
Wow.
[39:35]
B
So, like Bereal passing, there's a compass that tracks your location, which if we go in and we look at the compass app, which my guess is it's actually made in China. So, like, you talk about TikTok as an issue. So you actually have a Chinese company that's tracking your location because you have a compass app on your phone. We then go in and Instagram's tracking your location, Mighty's tracking location, PayPal. And like, it's about 70 different apps. And the good news is you're like most people.
[40:07]
A
Yeah.
[40:07]
B
And people don't realize one of the most dangerous things is free apps, because free isn't free because it basically means that whenever you download it, they're putting on location and monitoring your camera on your device. So then if we go in and I also look at access to your photos, that's also similar. So these are all the apps that can actually access your camera without you knowing about it.
[40:31]
A
Wow. So there's a list of, like, how Many is that?
[40:34]
B
1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 20. It's about 35.
[40:38]
A
35.
[40:39]
B
There's 35 apps that whenever you use them, they can technically turn on your camera without you knowing about it. And then the other one that always shocks people because, oh, you're actually doing really good on microphone.
[40:53]
A
Wow.
[40:54]
B
The other two, I'll maybe give you a C minus, but microphone, you'll get an A because you only have a few.
[40:59]
A
Ooh, look at that.
[41:00]
B
Yeah. But if you want to go in and be scared because this happens, one of the ones we always see is Chrome. And if you do this, where we start talking about, let's start talking about painkillers and medicine and ibuprofen.
[41:15]
A
Ibuprofen, yes, we'll talk. Ibuprofen, aleve, naproxen, acetaminophen.
[41:21]
B
So you go into Chrome now and you type in ho and it will auto fill in how much ibuprofen to take.
[41:29]
A
Wow.
[41:30]
B
Because Siri's actually listening all the time. Let me check that on your phone. Yeah, you have Siri turned on. So Siri's listening and that's what most people don't realize. They're not recording what we're doing. I'm like, how would Siri answer unless it's recording everything you're doing? So those would be one thing. The other big thing, let me check on your. I won't read your text messages. Your text has auto archive to the cloud, which means even if you delete a message or remove a message from your phone, it's still on your device and it's still getting backed up to the cloud and we can recover it. So we work on a lot of these. I don't like them because it's an evil part of society, but these super high profile like Hollywood stars when they get divorced and there's hundreds of millions at stake, we get involved and we can get their phone and we can find deleted messages of inappropriate pictures, communications with people that they shouldn't be communicating with and other factors along those lines. So that would probably be okay. Personal hotspots turned off. Good job on that. That's when we check, we look at Bluetooth. Actually, once again I'm impressed most people with Bluetooth and I'm victim to this because I have so many devices actually have auto discovery. So you have about 30 or 40. You don't have auto discovery on which is very good. You only have a few, few devices there. So good job on the Bluetooth. But that's something users want to check of how many different Bluetooth devices. Because that's the scary thing is a lot of people because they like convenience, they have auto connect Bluetooth. So now like if you go to somebody's house or location, right. I would call a play phone and a real phone.
[43:06]
A
Yeah.
[43:06]
B
So a play phone is just so I can mess with my friends and I have auto discovery and I go to their house and I'm like, oh, I just connected to your fridge, your thing. Or I only do this with friends. I really know. But most people have smart thermostats in their house or smart ovens, smart fridges. So I'll go in with only people I really know. And they, they know what I do is I'll go in and all of a sudden they're like, why is it so hot in here?
[43:29]
A
You just start messing with the settings.
[43:30]
B
I turn the thermostat up to 85 degrees or I want to make sure I'm careful with this. Cause we don't want to cause problems. All of a sudden I'll turn on their oven or their stove and they're like, what's going on? And they just don't realize how open the different technology is.
[43:44]
A
Right.
[43:44]
B
So I would say I could keep going. But those are probably some of the big things that I always look at on people's phones is number of app, free apps, location services, tracking pictures, camera. I mean those are really the big things you want to look at.
[43:58]
A
Microphone and Bluetooth also.
[44:00]
B
Right. The other one I'll look at real quick. Okay, once again, you're pretty good here. I look at subscriptions. Most people, they don't realize it, but they get these apps that are free. But if you read the fine print, it says in 30 days you'll be charged 19.99. And then they go in and, and they don't realize it, but they have like almost 7 or $800 a year worth of subscriptions that they're paying and they have no clue.
[44:29]
A
I watch my paid subscriptions like a hawk.
[44:31]
B
Yeah, I was going to say you're actually doing really, you're actually sort of, I would say in the upper tier of people that are security aware because most of the time, the big gotchas, you're actually doing really good here. Yeah, I mean you have the legitimate ones like Instagram chatgpt. Those are pretty valid ones. So you're actually doing pretty good on the subscription side. So. So I would say overall you're actually doing pretty good. Oh, but, but yeah, those are the big things that for the users is number of apps, usage of apps, free apps, subscriptions. Then look at location services, look at camera, look at phone, and then look at those key areas. And then also look at cloud backup and permanent delete for texting and others because the default settings are not secure and people don't realize this, but once you hit send, save or post, it lives forever. I didn't bring my forensic tools, but if I did a forensic analysis and I wouldn't do this to you cause it's personal. But I could pull up any deleted text messages, any deleted information or pictures or anything like that. So people that are doing questionable things or texting or sexting or stuff like that where they don't think it's there cause they delete it. It's still there and it can still be recovered.
[45:47]
A
When we were kids, summer meant freedom. No homework, no teachers, no school. And as adults, summer still means freedom thanks to Mint Mobile's summer sale. Right now all of Mint's plans are $15 per month, even unlimited. So free yourself from Big Wireless and their gimmicks and gotchas and switch to Mint for high speed data and coverage on the T Mobile 5G network. I've been using Mint Mobile. I'm now on my seventh year. I have saved a four digit sum of money. My savings is now in the thousands compared to what I would have spent if I had stayed with my previous carrier, which is one of those big box, brick and mortar carriers. With Mint Mobile, all plans come with high speed data and unlimited talk and text delivered on the nation's largest 5G network. You can bring your current phone, keep your same phone number. Choose from 3 month, 6 month or 12 month plans. So to get your new wireless Plan for just 15 bucks a month go to mintmobile.com Paula that's mintmobile.com Paula cut your wireless bill to 15 bucks a month at mintmobile.com Paula that's it. There's no catch. Upfront payment of $45 for three months, $90 for six months or $180 for 12 months. Plan required $15 per month equivalent taxes and fees Extra initial plan term Only greater than 50gb may slow when network is busy. Includes up to 20gb hotspot capable device required availability, speed and coverage varies. Siementmobile.com if you're a small business, the right hire can be make or break Hoping the right people see your job Posting isn't the best growth strategy when the pressure's on and you need the right hire. This is a job for Sponsored Jobs. We recently hired two people with Indeed Sponsored Jobs. One was for customer support and operations. The other was an EA and executive assistant. We used Indeed Sponsored Jobs to find both candidates. We got a lot of applications. We found people who understood our workflow who could contribute right away. People are finding quality hires on Indeed right now in the minute I've been talking to you. Companies like yours made 27 hires on Indeed. According to Indeed data worldwide, Sponsored Jobs posted directly on indeed are 95% more likely to report a hire than non sponsored jobs. Join the 3.3 million employers worldwide that use Indeed to connect with quite a quality talent that fits their needs. Spend less time searching and more time actually interviewing candidates who check all your boxes. Less stress, less time, more results when you need the right person to cut through the chaos. This is a job for Indeed Sponsored Jobs and listeners of this show will get a $75 sponsored job credit to help get your job the premium status it deserves@ Indeed.com podcast just go to Indeed.com podcast right now and support our show by saying you heard about Indeed on this podcast. Indeed.com podcast terms and conditions apply. Need to hire. This is a job for Indeed sponsored Jobs they say every day your business is late to AI, you fall two days behind. How do you keep up? The competition is only moving faster. Fortunately, there's NetSuite next. You probably know NetSuite, the AI powered business management suite that securely connects all of your data. It's a unified suite that brings your financials and inventory, commerce, HR and CRM into a single source of truth. Trusted by over 44,000 customers, NetSuite Next is the next huge leap in how business gets done. Because AI is built into everything you do, it automatically surfaces custom insights. Throughout your day, AI agents work alongside you to solve problems and handle routine work. And anytime you have a question about anything, ask, just like you're having a conversation with a colleague. NetSuite is customized for a wide range of industries, so it supports the way your business truly works. Whether your company earns millions or even hundreds of millions, it's time for NetSuite next, where your business meets AI. If we needed something this robust, this is what we'd use. For the first time ever, you can try netsuite Next for free. If your revenues are at least in the seven figures, go to NetSuite AI. Built for every industry, ready for every boardroom. NetSuite AI Paula, How secure is WhatsApp? I ask because I recently had a bunch of friends. We were all talking on WhatsApp and everyone was like, you know what, let's move to Signal. And they're like, we don't trust Meta. Meta owns WhatsApp. And I was like, oh, I don't want to move to another.
[50:21]
B
Yes, I know.
[50:22]
A
I'm so burned out on various messaging platforms, I don't want to adopt yet another one.
[50:28]
B
Yeah, WhatsApp fame to claim is when you're traveling internationally, you don't get text charges for normal text messaging.
[50:37]
A
Yeah, exactly.
[50:37]
B
So really WI Fi. Yeah, it's really the WI Fi texting ability, so. So you don't get charged. So it's really much more popular internationally because like in Europe, people travel across countries and their cell charges over there are so much more than the U.S. so, like most people in Europe are all about WhatsApp for texting because it saves them all this money and cell charges and it's so much cheaper and valid. So it's really good for going out of the country.
[51:06]
A
Well, I should say I, I have a lot of international friends.
[51:08]
B
Yeah, so, so, so for international friends, it's a very good tool. But the reality is, and there's a reason why it's out for free. Free isn't free. Because think about this. How in the world can meta run WhatsApp? It's a lot of servers, it costs them. I think the last numbers I saw was about 55 million a year to run WhatsApp. And they're not charging you a penny.
[51:30]
A
Right.
[51:30]
B
How can they do that? That's a bad business model. Except think of all the data they get. Think of all the information. So the good news is they're not tracking you specifically, because that actually would be against the law, but they're tracking your behavior based on your profile. So they're going in and saying, okay, we have all this communication about a female in New York City in this age bracket and group, and they're building profiles so they can do target marketing for all their other apps and all their other profiles. So yes, they, they are listening and monitoring. Now they're going in and filtering the data. So they don't know it's you. But do you really want all your communications monitored and tracked? And that's really where Signal comes in. Signal, you have to get verified contacts and it's point to point encryption so nobody can read the messages. Now, I know if you watch the news, Signal has sort of gotten a little negative press because of some of the people in the White House. But that had nothing to do with Signal. That just had to do with bad user hygiene. That's not a single issue, that's a user issue. Right. And one of the things I always jokingly say is you can have the best security and best encryption in the world, but no matter what you do, you can't secure stupid. They're just doing silly. I'm not trying to insult anyone, but the stuff they did with Signal is just ridiculous and simple. So if you and your friends are really concerned about security, like you're doing national secrets and things like that, then Signal is most secure. I'll be honest with you, with most of my friends and most of my communication, because I don't like A lot of apps is we use WhatsApp just because I'm the same way. I have international friends, I travel internationally, and to me we're not having any top secret conversations that would get anybody arrested or any issues. So I sort of just accept the risk that they're doing general profiling on us, but there's nothing specific that can actually be used against me. So it's one of those, if you're aware and accept the risk, I would say it's okay if you really start getting into very confidential type discussions. Like sometimes when we're working merger and acquisition deals because the SEC requires a security review. So if we're doing like high end merger deals or acquisitions where we're going to China or Australia and we're negotiating a $300 million deal, and I'm part of the advisory team, we use signal for all of that because like you use texting or WhatsApp or anything else, they will be able to monitor and see your discussions. And we actually had that where we had executives using standard texting and communication while they're in China negotiating a $300 million deal. And we go into the negotiations the first day and we're really close. They're saying, hey, we want 350. The Chinese company is saying 280. And we're like, okay, we're super close. So then that evening, I didn't realize it, but the executives and vice president were starting to text each other going, this is awesome, because we would went as low as 200. But if they're coming in at 280, let's just go at 285 and get the deal done. They come in the next day into the boardroom. I didn't know this happened, but I'm there with them and they go, okay, 285. And the Chinese company goes 200. And they're like, what are you doing? They're like, we know last night you discussed it and you said you go as low as 200. So now it's 200 or we walk away. And then they're sort of stuck. So people just don't realize how vulnerable these apps are. And when you talk about corporate espionage and assets and intellectual property, it is very, very active in China, Russia, even Australia. So you just gotta be super careful of the type and level of communication. And for super sensitive, you go signal. For friendly communication, WhatsApp is acceptable.
[55:22]
A
You said signal is point to point encrypted. And WhatsApp is end to end encrypted. What is the difference.
[55:29]
B
Okay, so WhatsApp, when I say end to end, it means from you to the meta server is encrypted, but then they decrypt and then they re encrypt to your friends, so they're seeing your communication with signal. If I encrypt the data, signal at their servers, don't decrypt it, and then you decrypt it at your point. So, so point to point means we're the only ones that are seeing the data. The servers are only seeing encrypted data. As with meta and others, the servers are seeing unencrypted data.
[56:01]
A
Oh, okay. So with WhatsApp, there's really three parties involved, whereas with Signal there's kind of two parties involved.
[56:09]
B
Exactly. But the benefit of WhatsApp is if you're at a coffee shop or, or you're on a wireless network at a hotel or an airplane, anybody else can't sniff or see your communication. So it is protected from local sniffing, but it's not protected from server level attacks.
[56:25]
A
Eric, you are the Commissioner of cybersecurity for President Barack Obama. Tell us about what happened when he wanted a smartphone.
[56:32]
B
So as you can imagine, presidents of the United States are people and they're really running a business, just a very large business, the country, and they want to communicate. So you think it's simple. Hey, you just go to the store and you buy a smartphone. But the problem is, and what most people don't remember is a smartphone is a tracking device. So do we really want the President of the United States to be able to be tracked anywhere he goes? Any location, any spot in the White House? So we sort of have a challenge where if the President says he wants a smartphone, you can't tell him no, you have to tell him how to do it in a creative manner. So at the time, one of the most secure devices was actually a BlackBerry. So we actually went in and configured the BlackBerry to connect to alternative cell towers. So now if he was, say, in the Oval Office, it would actually show up that he was across the street and vice versa. And then we also went in, which is a key aspect that I do with my phone with high profile individuals, is when he's in the White House or other locations, you turn off cellular and you connect to wireless, because wireless doesn't have the same accuracy of geolocation as cellular does. So we basically went in and I gave him a device so he can still communicate and make phone calls, but he couldn't be tracked or located or present any threats to himself.
[57:52]
A
Or his family and turning off cellular and just going on wireless. I mean, what that makes me think of is anytime that staying in a hostel in Costa Rica, right? That's exactly what I do just because I don't want to replace my SIM card. So it's funny to hear that high profile individuals do that.
[58:08]
B
The trick though, and this is the magical trick, you have to use something called a VPN or a virtual private network that actually not only encrypts your data but also masks your location. I always joke, if you're bored and you just want to have a good time in Vegas, don't go to the clubs, just go in and turn on a wireless sniffer because it's technically legal at a big hotel in Vegas. And most people don't realize text messages and pictures are sent plain text over the wire. So you can get some very interesting and unusual and let's say spicy information from individuals and they don't realize that. So if you're going to be texting over wireless at hotels or coffee shops or anything else, it's super simple. You just go to the app store and put in VPN virtual private network. And there's free apps, commercial apps. And then not only is the data encrypted, but you could mask your location. So now it's even better. So for example, with Barack Obama, we set up his VPN that it can look like he's in Chicago or Nebraska or the location. So now if somebody's actually tracking his device and his IP address, he shows up in an alternative location than where he's really located. So it also provides a level of obfuscation in terms of tracking and monitoring.
[59:26]
A
I mean, VPNs have been around for so long that I feel like don't understand exactly how. But there seem to the powers that be seem to understand when you're using a vpn. I say that from the perspective of someone who will sometimes try I'll be in a foreign country, I'll use a VPN to try to access HBO Max, right? To make it look as though I'm in the United States. And I still get the message that says, sorry, this is not available in your area.
[59:51]
B
So what's happening there is direct VPNs where you're actually basically just encrypting to the local ISP in that country. So in those cases you're still going to be blocked because you're showing up as a foreign IP address. But if you get some of the commercial VPN products, you can actually change your location. So it can actually tunnel to a location in New York. So for example, when I'm in some countries like Saudi Arabia, which are very restrictive, like they're super restrictive on, on what you can do. But if I go in and have my commercial VPN set up to New York, then I can still access US sites in English as opposed to if I go to Google in Saudi Arabia without the vpn, it's all in Saudi Arabia, I can't read it. So if I go in and change my location. But that's one of the key things we're going to talk about a lot today is these products have great security, but it's turned off. So you need to know to go in and reset the settings. So like if you're using a standard vpn, it'll still be in country, but if you go under settings, security and location and you change your location, then you can actually appear in the US and bypass those filtering controls.
[60:58]
A
We talked about WhatsApp and we talked about Signal. What about TikTok? Is TikTok Chinese spyware? If you download TikTok, does that mean that the Chinese government could subpoena the company that owns TikTok to get access to your photos? Are we at risk if we have TikTok on our phones or is that all just a bunch of hype?
[61:22]
B
So yes, no, maybe, and I'll just go and take you back to sort of a story to lay the context, because I think it's important. So in 2000, I'm part of this different government task force. I think if you read my bio, I worked at the CIA as a professional hacker, so I'm often brought in on these scenarios. And so in 2000 I was part of a the unclassified task force, so I can talk about it. And they said, okay, Eric, if you were China and you wanted to launch a cyber attack against the U.S. how would you do it? And I went in and researched and everything else and I came back with my report. And what I basically said in the report is I would create an app that's targeted at 16 to 20 year olds in the United States because they're the future generation. And I would make this the coolest app on the planet. I would make it like social media on steroids so you can actually do pictures, text, video, interact and make it so much better than anything that's available at the time. And then I would market the heck out of it to get everybody hooked on it. And then we would monitor and track all their activity for eight to 10 years. And once again, as far as I know, it wasn't publicly published. Then you look at TikTok and I took out the paper. It was almost an exact blueprint. Where TikTok is an application focused on 16 to 20. Now adults are using it too, and it's monitoring and tracking everything we're doing. And here's the reality. All of that data on our activities, our behavior and everything else is stored on Chinese servers that the Chinese government does have access to. So when I said, yes, no, maybe it isn't active malware. So like one of the mistakes that Congress has made, where they're like, it's spyware, where it's gathering and blah, blah, no, no, no. It doesn't install anything on your computer. We've reverse engineered the TikTok agents. It doesn't put any malware on your system. So it's not locally monitoring or tracking. But here's the reality. TikTok turns on location services, so you're allowing it to track your location with your data and information. So now if you're voluntarily putting information on TikTok about your behavior, your activity, your videos and everything else and they're monitoring it, that's not technically spyware, that's user cooperation. So everything you post, everywhere you go, everything you do now, good on you. Because you did not have location services turned on for TikTok. So gold star. But most people do. Most people, if I look at their phone, they absolutely do. So we're giving all this information to TikTok, where there's a company that's run in China and tightly connected to the People's Republic. So they're monitoring and tracking. I think TikTok's been in business eight or nine years. The eight years of data of U.S. people that are stored on Chinese servers, we're not talking about that. That's going to stay in China and they're going to be able to have that for the next 20 or 30 years. So they already have predictive analysis on US citizens, how we work and how we operate.
[64:26]
A
In the worst case scenario, that data could be used for blackmail. We talked earlier about ransomware.
[64:30]
B
Yes. It can be used not only for blackmail and ransomware, it can also be used for target marketing. It could also be used for tracking and espionage purposes. So for example, if I see somebody on TikTok and a lot of people say where they work and they work at say IBM or a large research entity that's doing high end chip design or high end technology, China can do that and now use that to go in and do target phishing attacks to break into their systems or servers to be able to steal large amounts of intellectual property from the systems. Or you look at what happened with Aldrich Ames at the CIA. He was one of the people that was converted by Russia. What they basically did is the, the way they converted Aldrich James is they basically got blackmail data on him and said, unless you steal information for us, we're going to ruin your life. Well, guess what, A lot of people are posting some questionable things or areas on TikTok that they don't think anyone else is seeing. Well, what if they get access to that and they can do the same thing saying, unless you spy for us, we're going to use that against you. So there's so many different avenues that an advanced technology company like China could use to target Americans. The list is so long.
[65:44]
A
It gets scary to take this conversation back to money. There are, as you've elaborated on throughout this conversation, there are so many nefarious things that entities can do with our data. But as ordinary individuals, as investors, one of our chief concerns is protecting the net worth that we've worked so hard to build. The portfolio, balance the income, the legacy that we want to pass on. Can you share some examples of times when it's gone wrong?
[66:11]
B
Absolutely. And one of the biggest areas that we see all the time, and I know I've seen a lot of your episodes and you're very big on real estate. Real estate's a great investment. And I know you have many properties. I have a lot of properties. And we go in and we buy real estate. Well, very often we're going to go in and get mortgages or closing or we're going to even pay cash. And we're using a reputable bank. So I'm using a really good bank. And we're like, okay, the bank's secure. But we failed to realize is a lot of these closing companies and a lot of these smaller entities that get involved are small businesses. They don't have really good security, and they can often be hacked or spoofed. So I see it all the time. But I'll give a specific example. It's a family that was in Ohio and I mean, they were doing okay, but they were two school teachers and they always dreamed of going in and having a farm. Like, they just wanted to have a nice farm, like a nice farmhouse and tractors and things like that. And one of their parents, they were the only child, and their parents actually did pretty good investment and had good amount of money. And the dad passed away a couple years and then the mom passed away and they inherited $1.3 million. The farm they wanted was 1.2. Their dream is going to come true. They go to the bank and they don't really need a loan because they're going to pay cash for it. And they get everything arranged and then get the closing company. They put an offer on the farm, it gets approved. They're going to close in 45 days. And five days before closing, they get the message that they're expecting from the closing company that basically says, here's the account information that you need to transfer the money to in order to go in and buy the house. Their real estate broker said, you're going to be getting the message three to five days. It was on the legitimate letterhead. The email looked okay. It came from one of the brokers there. And so they said, great. So they go to the bank, they do the eft, they transfer it to that account, and then they show up at closing and they're all excited and happy. And the other side goes, do you have a check? And they go, what do you mean? Well, how are you going to pay for the house? You said you offered to sell 1.2 million. And they're looking at each other going, we transferred the money according to the closing company to your account five days ago. And they go, we didn't send any email. And it turns out it was a scam. And we got involved because there was sort of lawsuits of who's liable in this case. And the email for any average person looked legitimate, it looked valid, it had all the proper authentication methods. And it turned out that the closing company servers were hacked and they were sending emails out to select individuals that were cash based deals. Because here's the reality, there's very few cash based deals. So if you're going in and you get a loan and you're only putting $80,000 down, an attacker doesn't want that. So they broke into those servers for three months and they were waiting for a big cash deal. And once they saw this $1.2 million cash deal, they then targeted them only. And because it was only a one and done, nobody knew about it. And because it was, there was a reason why they did five days. Remember I said earlier, you typically have 48 to 72 hours, you have two to three days. So by doing five days, the money was gone. And now the question is, who's liable? The banks were saying that they weren't. The closing company was like well, you clicked on the link, that's your fault. And we're saying, well, no, you didn't have proper security and you were compromised for three months, so it's your fault. And then it gets into legal litigation. But here's the part that's heartbreaking. They lost the farm, and it's being fought in the courts. And it's been a year and a half because civil cases in the courts are so backlogged. And if you don't know the court system, criminal cases take precedence. And because the courts were so backlogged because of COVID if you file a civil case today, an individual, it could take two to three years to get through the courts. And then even if you get a successful verdict from the jury, they could be appealed. So this couple might not see their money for three to four years. They're heartbroken, right? They lost their farm, and now they're spending a lot of the money on legal costs to try to get that money back. And unfortunately, this is not isolated story. Like we see these types of instances all the time with large amounts. And you're like, well, what could you do? So a couple of things. One is, if you're buying any real estate or any large purchase, don't trust email. So what we do with all of our purchases is I go in and I call the actual closing company and say, is this legit? Like, did you actually send this email? And then what we'll actually do is. And I know people say it's crazy and it's old school, but I still go to a bank and get certified checks, because me bringing in a physical piece of paper, sitting in the room with somebody who's bought their driver's license ID with a notary public and having witnesses in the room that I handed them to check is a much safer and better mechanism than trusting online. So even though I'm a cyber guy, I'm an Internet guy, a futuristic, I don't trust a lot of those traditional systems. So when I'm buying my real estate or I'm doing my investments, it's all paper checks that I'm bringing with me that's assigned to the person certified so it's valid and they'll do it. And then I hand that over. Or whenever I do mortgages, I actually make the mortgage broker come to my house or I go to a bank. We don't communicate email. I tell them that when I'm buying real estate or I'm doing any large purchases, we talk phone or in person. We do not Use email, we do not use communication. I do not use websites because they can be so easily spoofed and modified. I know it's convenient, I know we like it. But sometimes going old school, face to face paper checks and phone is going to be so much better and safer.
[72:23]
A
Right? The last house that I bought, I paid in cash and I remember getting the email with the wire instructions and being so scared. Instead of relying on what was in the email, I went to the entity's website, looked up the phone number on the website, called that phone number and then verified the information. But to your point, I mean as I talk through that, the weakness in that is that that website could have been spoofed.
[72:47]
B
Exactly. Yeah. But at least credit to you, you took an extra step. Unfortunately, most people aren't tech savvy like you and you would not believe how many people trust that email. And we're just blindly transfer the money based on an email. And I mean that's something if I thought of I could have done before our interview is I could have sent you an email from a closing company that you would have thought were legitimate. And when you clicked on the link it would have said Eric says hi, we do that exercise with people all the time just to show how easy it is to spoof email and, and how you look at these emails and you look at the legitimate email and the email I'll send you, they look identical. There's nothing that you can visibly tell. So I mean the name of the game is for anything sensitive, anything involving money, anything involving your life. No emails, no links, no clicking.
[73:34]
A
Right. Oh, you should Rickroll people rather than the Eric says hi. Yeah, that would be a.
[73:39]
B
That's true. That would be fun.
[73:40]
A
That would be a fun one.
[73:42]
B
I like how you think so foreign.
[73:49]
A
They say every day your business is late to AI, you fall two days behind. How do you keep up? The competition is only moving faster. Fortunately, there's NetSuite next. You probably know NetSuite, the AI powered business management suite that securely connects all of your data. It's a unified suite that brings your financials, inventory, commerce, HR and CRM into a single source of truth. Trusted by over 44,000 customers, NetSuite NEXT is the next huge leap in how business gets done. Because AI is built into everything you do, it automatically surfaces custom insights. Throughout your day, AI agents work alongside you to solve problems and handle routine work. And anytime you have a question about anything, ask, just like you're having a conversation with a colleague. NetSuite is customized for a wide range of industries and so it supports the way your business truly works. Whether your company earns millions or even hundreds of millions, it's time for NetSuite next, where your business meets AI. If we needed something this robust, this is what we'd use for the first time ever. You can try netsuite next for free. If your revenues are at least in the seven figures, go to NetSuite AI Paula built for every industry, ready for Every boardroom and NetSuite AI Paula when we were kids, summer meant freedom. No homework, no teachers, no school. And as adults, summer still means freedom, thanks to Mint Mobile's summer sale. Right now, all of Mint's plans are $15 per month, even unlimited. So free yourself from Big Wireless and their gimmicks and gotchas and switch to Mint for high speed data and coverage on the T Mobile 5G network. I've been using Mint Mobile. I'm now on my seventh year and I have saved a four digit sum of money. My savings is now in the thousands compared to what I would have spent if I had stayed with my previous carrier, which is one of those big box, brick and mortar carriers. With Mint Mobile, all plans come with high speed data and unlimited talk and text delivered on the nation's largest 5G network. You can bring your current phone. Keep your same phone number. Choose from 3 month, 6 month or 12 month plans. So to get your new wireless plan for just $15 a month, go to mintmobile.com Paula that's mintmobile.com Paula cut your wireless bill to 15 bucks a month at mintmobile.com Paula that's it. There's no catch. Upfront payment of $45 for three months, $90 for six months or $180 for 12 months. Plan required $15 per month equivalent taxes and fees. Extra initial plan term Only greater than 50 gigabytes may slow when network is busy. Includes up to 20gb hotspot capable device required availability, speed and coverage varies. Siementmobile.com if you're a small business, the right hire can be make or break. Hoping the right people see your job posting isn't the best growth strategy. When the pressure's on and you need the right hire, this is a job For Sponsored Jobs, we recently hired two people with indeed sponsored jobs. One was for customer support and operations and the other was an ea, an executive assistant. We used indeed Sponsored Jobs to find both candidates. We got a lot of applications. We found people who understood our workflow, who could contribute right away. People are finding quality hires on Indeed right now in the minute I've been talking to you. Companies like yours made 27 hires on Indeed. According to Indeed data worldwide, Sponsored Jobs posted directly on indeed are 95% more likely to report a hire than non sponsored jobs. Join the 3.3 million employers worldwide that use Indeed to connect with quality talent that fits their needs. Spend less time searching and more time actually interviewing candidates who check all your boxes. Less stress, less time, more results when you need the right person to cut through the chaos. This is a job for Indeed Sponsored Jobs and listeners of this show will get a $75 sponsored job credit to help get your job the premium premium status it deserves@ Indeed.com podcast just go to Indeed.com podcast right now and support our show by saying you heard about Indeed on this podcast. Indeed.com podcast terms and conditions apply. Need to hire. This is a job for Indeed Sponsored Jobs. So in terms of what we can do if you're buying real estate, go in person, on phone or in person. Ideally in person, yes. Meet at a bank. Meet face to face at a bank for any type of transfer. Use cashier's checks. Don't click on links. That's no particular order number two.
[78:25]
B
The other thing I'd add is sort of a 1A or a 1B is if you're investing in real estate, use known trusted entities and always go in person. So like I know a lot of times if you buy in real estate, the seller wants to pick a closing agent or pick sometimes out of state entities because they're a little cheaper, they get better deals. And I'm like, no, if I'm buying your real estate and I do a lot of real estate investing, I'm using my trusted folks. So I have offices that are 15 minutes from my house, closing companies and loan agents and attorneys that I know and trust. And I'm like, we use these are no deal. And I know them, I trust them and I go to their office all the time. So if you're doing a large amount of real estate, I get some known trusted entities and always meet in person. Don't get me wrong, there's some really good small one offs and if you're buying a house once on a big mortgage, that's okay. But if you're doing cash deals, real estate, trust and control who the people are that you're working with, right?
[79:21]
A
But what happens if one of your trusted entities gets if their servers get hacked?
[79:25]
B
So I'm in person. So the chances of me getting rogue emails or anything like that are super Slim, right? But if they get hacked, they don't have any of my money or anything else. I'm bringing the money in a check. So even if they get hacked and they try spoofing me or they get some details on the property, or they try sending me eft, none of that matters. And because they're not ever touching my money, the money goes from my hand to the seller's hand. So when I bring that check, I have my fingerprints on it, and I'm not handing it to anybody else but the person selling the house. And I'm having that monitored and tracked. And sometimes if they allow it in big deals, I actually have a video because I want to have proof that they got the check. So now if they lose the check or they say something happened, I have actual evidence to show that I handed them and paid the money. And I know people are like, you're paranoid. I'm paranoid, I'm crazy. I'm insane. But guess what? I'm safe, I'm secure, and my money's protected. So sometimes I. Online, it's so wild, wild west that having a little sense of paranoia and a little craziness and a little sort of over the top, being paranoid is going to go a long, long way to protect yourself, right?
[80:38]
A
What would you do? So if you're buying out of state real estate, you say. You say you want that check to go to the seller. If the seller is out of state, the piece of real estate is out of state, Your closing agent can be local, right? What video are you taking? Who are you handing that check to?
[80:53]
B
So in that case, as if. If you're actually doing pure out of state, where you're not actually meeting with them, whoever their local representative is, then I will go in and hand them the check. Or in some cases where that's not practical, because unfortunately, there are some real estate deals, like we do some condos and some renovations, and it's all done online, right? In those cases, I will then have a zoom video call that I record where on the call they authenticate and verify who they are. So they're gonna show me their driver's license, I'm gonna show their driver's license. We're gonna verify and validate, and they're gonna tell me their banking information on the call recorded with evidence and validation, and then I will wire to that bank, but I'm getting the validation directly from them. It's as if it's face to face. That's what's great with zoom technology is it's Like a face to face meeting and you can record zoom. And here's the cool part, it's a social thing, but it's bizarre. If we're in a conference room meeting personal and I want to video it, it freaks people out, right? It really bugs them out. Like this is the weirdest thing on the planet of you videoing me. It freaks people out. But zoom is so common, right? Recording a zoom call doesn't freak people out. So in some cases if they don't want to meet face to face or they won't agree to video, I'll jump on a zoom and record it. And it's much safe and protected. You now have evidence. I get the banking from them. I never trust email. And then we do eft as bank to bank.
[82:23]
A
That makes a lot of sense.
[82:24]
B
And it's one of those where like people like okay Eric, that's a little more inconvenient, it takes a little more time. But as I said before is wouldn't you rather take 10 extra minutes on a zoom call recorded than lose a million dollars?
[82:37]
A
Right? Yeah.
[82:38]
B
And then to your other question, so what else can we do? Cause I sort of hijacked it. So here's my rules. First, every account from E commerce to banking to health care, you have to use two factor like passwords. I joke. Passwords are so 1980. If you're going to use passwords you might as well listen to the Bee Gees and wear bell bottom pants, right? It's so out of sync is you got to turn on two factor authentication. And then this is one of the things I hinted at but we're now getting to this part we're talking about solutions is every type of service I know of from Amazon to AWS to Instagram to banks to healthcare, they all have two factor but it's turned off by default because we're at this interesting stage where they don't think the public is fully acceptance and if they turn on too many security and it inconvenience people, people won't use their service. So I think we're getting close. I'm lobbying, I go to these companies, I brief their boards and we're very to having security turned on. But right now it's not, it's super easy. Go into your account under settings under security under authentication and just turn on two factors, either two FA or mfa two factor multi factor. And I think most people know what that is. It's where you log in with a username password and then you get texted a one time code Right. That you log in each time. Now, I know people go, it's an inconvenience. So here's the middle ground is once you two factor, you can have it remember your device and it will actually remember your IP address and place a cookie, which is a unique cryptographic string on your computer. So now, whenever you're coming from that location, you don't have to two factor. You can just log in with a password. And now when you travel, like you go to a new hotel, it's going to say this is a new location and you two factor again. I was just in San Diego for 10 days for a trial. I logged in the first day. It asked for two factor, but then it remembered location and IP address and I don't have to do it for the rest of the trip. So there is a balance there. But you can't trust passwords.
[84:47]
A
Right.
[84:47]
B
Almost all of the bank money transfers and all of the crypto wallets that have been stolen, I would say 95% of them were passwords. Only very few are two factor. Two factors really hard to spoof. I mean, there's advanced attacks where they can take over your cell, but it's so hard and difficult. It's almost all passwords. So if you turn on two factor, that's going to go a long way. Second, anything sensitive or involving money, put on account notification. So with my banks, if anyone's withdrawing money, efting or even deposits, I get a text notification that basically says somebody's trying to EFT $35,000 out of your account. Is this authorized? Yes or no? And if I'm doing the transfer, I know I'm doing it. So I have my phone ready and you have 5 minutes to reply. So basically I get the text message and I reply yes, in five minutes. Now, if it's fraudulent and it's the middle of the night and somebody does it, I don't see it till the morning. But guess what? Five minutes times out and automatically declines it. So now, and I know once again, people like Eric, that's annoying to get text messages all the time. But as I always say, you know what's annoying? To wake up in the morning and have your bank account wiped out. So it's one of those you're going to have a little bit of pain, you're going to have a little bit of inconvenience. I'd rather the extra security and not having any fraud committed. So account notification is another great mechanism. The next thing which we talked about is if in doubt, buy the app don't do free. Like when I go in, if there's a free version and a 9.99 version, I always pay because the paid version does it monitor your location, camera or microphone, and free always does. So minimize free applications then. My rule is any app you haven't used in 45 days, delete, get off the phone. And I actually do the 10 app challenge for an entire month. You only use 10 apps. Be really selective on the apps and use only 10 apps. And then try to remove or get rid of. Because any free app that's on your phone is a point of exploitation. So you really want to reduce those apps. Then as we talked about, don't click on links, use apps. So if I get an email that says, hey, there's unusual activity with your bank, or hey, your Amazon order's been discredited, I immediately go into the app and I check the app. Apps are safe, email is not. So don't trust email, don't use links, always use the apps. And then the last one, which is sort of a little bit of a curveball for most people, is most of the attacks and most of the exploits are written for Windows. Not that Windows is more vulnerable, but Windows is one of the most popular operating systems on the planet. So most of these exploits where you click on links or you get hacked are all Windows based exploits. So I basically, if you look at my little backpack, I only use an iPad because most of the exploits, most of the links, most, most of the compromises won't work on an iPad. So when I surf the web, when I check email, I basically only travel with iPads because, not that they're more secure, but they are simpler and less targeted. So the probability of compromise is a lot less.
[87:55]
A
Wait, so I'm hearing two different things in there. One is the Windows versus Mac, the other is laptop versus iPad. Right.
[88:01]
B
So Windows versus Mac, if you're talking about a full MacBook, are about the same.
[88:06]
A
Yeah.
[88:06]
B
So the Mac OS, the full Mac OS and the Windows OS are both vulnerable. So those, be careful. Like when you're using those, no links, minimize web surfing, minimize email because they're highly targeted and there's lots of vulnerabilities. Then an iPad, which is actually a completely different operating system than the macOS, it's much simpler.
[88:27]
A
Right.
[88:27]
B
The iPad has very few attacks, so I use the iPad for email and web surfing. So when I work on client reports, I'm doing large data processing, I use my Windows system, but when I check email or I surf the web, I always Use my iPad because it's a much simpler device and less probability of compromise.
[88:47]
A
Oh, that's interesting. So I could shift to only using my Mac for when I'm doing audio recording, when I'm doing video editing, things like that. But then shift to an iPad for banking. Using Google spreadsheets.
[89:02]
B
Exactly.
[89:03]
A
Email, web surfing, all that stuff, that really basic stuff. And then get rid of most of the apps on there.
[89:10]
B
Bingo.
[89:11]
A
Wow. All right. I've got my homework cut out for me.
[89:13]
B
Yeah. Just to tie it all together, basically. Most people, in my opinion, should have three devices. So you have your Windows or Mac for your power user, like for doing video recording, video editing, working on large client deliverables, all that kind of stuff.
[89:31]
A
Yeah, you have your desktop or laptop.
[89:32]
B
Exactly. You then have your iPad, which is really going to be for your email, your web surfing, sort of the more risky stuff. And then you have your phone that has most of the apps for doing banking, healthcare and others. But you don't have many apps. You only have the most secure ones. And then you use that for like WhatsApp, texting signal and then your phone calls.
[89:58]
A
Hmm. That makes sense.
[89:59]
B
Separation. Yeah. You have sort of three critical devices, so.
[90:03]
A
Right, that makes sense. How do we protect our security when we're getting rid of an old device?
[90:08]
B
Shred it, Burn it. Explosive. No, pretty much if you're using like Windows phones and things like that, you want to secure, wipe it. So like if you go to the Apple Store and you're getting a new phone and you transfer everything over to your. A new phone and then you go into the old phone and you say delete and it securely deletes it. That's actually really good like that. They have good encryption, good wiping on it, and it removes everything. If you're super paranoid like me, I don't ever trade in old devices. I keep them, I lock them in a safe. Or there are companies that will physically destroy them. Like they will come and. And like some of my real old. I got to the point where I had like 10 phones and I didn't have room in my safe anymore to keep all of them. So there's actually companies that. It sounds crazy that companies will come and you go to their truck and they actually have this tub and they actually acid bath it and it basically eats the phone. So the phone is destroyed completely. And I know that's paranoid.
[91:15]
A
What a cool job.
[91:16]
B
Yeah. But here's the thing. My stock information and my bank, there's millions upon millions of dollars on there that spending $50 to destroy it is so much safer than even though the encryption destruction is secure. I'm super paranoid. And then with like laptops or MacBooks, what you want to do is remove the hard drives because you're not going to. These are small things. You're not going to acid bet the whole laptop. Plus it's not really good because of all the electronics and glass. So you actually want to remove the hard drives and physically destroy them if it's super sensitive. Now for some of your listeners, they're like, okay, Eric is off his rocker and nuts. So for those that don't want to do acid baths, other devices, there are secure delete programs that you can actually go in and will encrypt your entire drive five times and the probability of recovery is almost nil. So if you want to go in and use the secure delete programs like in Apple phones, that's good for the average user if it's super sensitive. Millions worth of dollars of investments go in and do the physical destruction biometric data.
[92:22]
A
When we give access to our biometrics to, let's say something like clear. Yep. Are we, how safe is that? Is that something that you would do?
[92:31]
B
So you asked the right question, which is what I do it right. So here's how I make security decisions and here's how I recommend people making security decisions. It's never yes or no.
[92:42]
A
Mm.
[92:42]
B
It's two questions. First, what is the value and benefit?
[92:46]
A
Yeah.
[92:46]
B
Versus what is the risk and exposure? And then if the value and benefit is worth the risk, I do it. So to answer your question, I use Clear. Because here's the reality. What Clear does is it has my biometric data, but it has a small sample set that's unique to Clear. So if you look at facial recognition and not to geek out on you too much, there's actually around 80,000 different unique points about your face, which I know is crazy. If you look at a mirror go there's 80,000, but there's 80,000 unique features. You only need 4,000 to get an accurate reading. And one of the reasons I use them and I research them is they don't go in and take all 80,000. That would be dangerous. They only take 4,000. So now even if somebody compromise Clear and they only got 4,000, every other biometric system you're using are using different data points. So they wouldn't be able to replicate or steal your face. It would only be a one time usage. Now, could somebody go into Clear, get my biometric representation, make an actual mask and Wear it in the airport and try to pretend me. Yeah. But here's the thing. The probability and difficulty is so hard to do that that I'm willing to accept that risk. I travel all the time getting through an airport 30 minutes quicker every time I travel. If you look at my billable rate, that's well worth the risk of somebody potentially stealing a very limited subset of my mask. So to me, the benefit outweighs the risk. And I use clear.
[94:20]
A
Right. They might not make a mask and use it to try to get through an airport, but could they make a mask and use it to try to face ID into your phone?
[94:27]
B
No, because the phone uses a different 4,000. So everyone has a unique algorithm where they use different data points to get in and then you have the phone. I use biometric data. I love it. Because it can unlock and so quick. And everyone's like, oh, Eric, that's such a big risk. Because they're like, if somebody gets your face and get your phone, they can log in. Well, here's my response back. If somebody has access to my face physically, and they have my phone and they're forcing me, they probably have a gun to my head.
[94:55]
A
Yeah.
[94:56]
B
And guess what? I have bigger problems because guess what? If I didn't use biometric and I only use passwords and somebody has a gun to my head or a gun to my children's head, I'm giving them the information. So it's one of those where sometimes security professionals get too crazy with the hypotheticals going, oh, I would never, ever use biometrics. Because if somebody got this, this, and this, I'm like, yeah, but if you got in that situation, you have a bigger problem at that point. Now, could somebody break into my house when I'm sleeping, try to go in and unlock my phone? No one hears why. Your eyes have to be open. And now they go, oh, Eric, what if somebody breaks into your house, gets you while you're sleeping, opens your eyelid and does it? Once again, I have bigger problems at that point. Right. So you gotta be practical about it, where, yeah, there's a risk, but the probability is so low, I'm willing to accept the risk.
[95:45]
A
Right. What is. Okay, I have a friend who keeps talking about the Yubikey. Can you explain what is that?
[95:51]
B
That's a device that you plug in to your phone or your computer that basically auto authenticates you to allow you to go in. So if you don't have the Yubikey, you can't access the device. So it's basically like, A key to your house.
[96:07]
A
Okay. Is something like that beneficial? Is that something that you would recommend to the average Joe or Jane who's listening to this?
[96:13]
B
No. Here's why. Two reasons. One, it's something for you to lose. Think of how many times people forget things at home, forget their car keys. I've had friends that use it and they go in and they're at the office, or they go on a trip and they forget it at home. And now their phone is bricked, they can't access it. And also to me, it's an additional point of failure. And, and then here's the other reason why I don't recommend it for the average person. Where are they going to keep their Yubikey with their phone? I noticed you have the little wallet on the back.
[96:46]
A
Yeah.
[96:47]
B
So guess what? They keep their Yubike in the little wallet. Well, that sort of defeats the purpose because now if you lose your phone or somebody gets your phone, they're going to have a Yubikey. So unless you have like really high end security practices where you're going to have a separation and you're going to have somebody with you that has the Yubikey that they can give you to plug in like national secrets, like I would recommend the Secretary of Defense do that because he always has a cadre of people with him. So now he has his phone, somebody else. And when he's going to transfer secrets about a war strike in Yemen, he gets the Yubikey and plugs it in. So for that type of very high end information, I recommend it, but I don't use one because it's just the, the risk factor of being locked out versus the benefit. Is it worth it? To me, I have other security measures in place and that's probably one of the other things I want to recommend. Really quick Endpoint security like EDR is called Endpoint A. Detection and response companies like CrowdStrike, Sophos, McAfee, Symantec, you want to have the Endpoint security on every one of your devices. So we said three devices. You want Endpoint security on your laptop, on your iPad, on your phone. Most people do it on their laptop, but they don't do it on their phone and iPad. Once again, it's $59 a year for three to five devices. And having extra level of protection is going to help protect. To me, spending $59 on an EDR for your device is much better than having a Yubikey where you have to remember it and plug it in each
[98:19]
A
time and that's for Mac users as well.
[98:21]
B
Exactly. Pretty much every operating system has EDR Endpoint Security.
[98:26]
A
I remember in the days, in the old days, seemed as though that was primarily. Well, I'm thinking about Norton Antivirus for Windows only.
[98:33]
B
Windows. Yeah.
[98:33]
A
Right. Yeah. And Norton Antivirus was often so slow that I was like, this program itself is the virus.
[98:40]
B
Yes. You know, so 15 years ago, you're right. The endpoint was so terrible and it was so limited, people didn't use it. Today, it's so much more optimized and advanced, you wouldn't even know it's there unless there's a problem.
[98:51]
A
What? You mentioned that you have a safe. What else is in your safe? Or what should we all put in our saves?
[98:56]
B
I work on very high profile litigation cases. I've had multiple billion dollar verdicts. So when you're working on a $800 million lawsuit against a very large company and you have access to their trade secrets or their source code, that's worth hundreds of millions of dollars, I'm under protective orders that if I don't protect that information and secure it, that I could be liable. So I'm required in those cases with a PO to lock up any of that sensitive data in a safe. So that's one of the first things I have a safe for, is critical client information and client data. I also, when I'm not traveling, I store my passports in the safe. I also have my birth certificate and like documents like that. Any investments like bonds and stocks, I keep in my safe. I'll also be a little careful here because I don't want to be targeted. But I'm also a big believer in having cash on hand. So I have not crazy amounts that somebody would want to break in, but I have a certain amount of cash in that safe just for protection reasons. I then also back up my devices locally, so my laptop, my phone, my iPad. I don't always trust the cloud. I have local backups every month that I also keep that in my safe to be able to keep that protected. And then I'll usually go in because my iPad I use so much for business. I have a backup that's imaged and replicated so it has an exact duplicate copy of all the data, all the information, all the apps. I keep that in my safe. And then the last thing that shocks people, but I believe in redundancy and backup is my passwords. I know everyone says don't write passwords down. I'm a practical security practitioner. I write them down and I put it in the Safe because now if something does happen and I forget a password or something occurs and I need to get in or something happens to me and a family member needs to get in, they also could have access to it. So I do keep that in my safe. So those are usually the fundamental things. And then my safe is not only fireproof, that's very important because if there's a fire, you want to make sure that nothing burns inside of it. And then I use a two factor component is I use a combination and a biometric. So now in order to get into my safe, you have to go in and have my biometrics and you have to know the combination. So once again, for somebody to get in my safe, they pretty much have to have a gun to my head or a family member in order to get in or access it.
[101:34]
A
Right.
[101:35]
B
And then the last thing is you actually want to keep the safe in a non discreet location. Like you want to put it either sort of in a closet or in a certain areas. I. And once again freak people out. But, but I have a spot in my house where it looks like it's just a panel. You know how you have the grade for H vac is it looks like a panel but it actually just has two spin crews and we open it up and the safe is back there. So it's a little non discreet in where I keep it. And then last thing, because I'm always going to be honest with you and once again, I wasn't gonna say it, but I was like being honest and complete. I also keep a weapon, a sidearm in the safe. I believe in weapons and sidearms, but I also believe there can be too many accidents and in a lot of cases people have weapons for protection and the criminal can use it against you. So I believe in weapons, but I believe in securing them and keeping them safe. So I keep that in a safe too.
[102:26]
A
How large is your safe?
[102:28]
B
Yes, it's about this high and then this wide. And it actually, you see how paranoid it is. It's actually a two cabinets, so there's actually a cavity. So there's two different. So all of my business stuff for my clients, I keep in one portion of it, which is the bigger portion. And then my personal items, which I know it sounds like a lot, but they're all pretty small, I keep in the bottom portion. So there's actually two different combinations with two different biometrics.
[102:53]
A
Thank you for sharing all of this with us. It paints a real picture about what we need to do in order to protect Our investments, our money. I certainly have my list of homework assignments that have come from this. Where can people find you if they'd like to learn more?
[103:09]
B
You can find me online. I use doctorericole D R E R I C C O L E for my Instagram, for my YouTube. I put a lot of videos out there. My personal website is drerichcole.org. my company website is secure-anchor.com and I just want to really thank you for having me on the show because my mission is to secure cyberspace and many people don't know the dangers. So the fact that you have me here so I can share the message with your listeners, I really thank you for doing that.
[103:37]
A
Of course. Of course. Thank you for coming. And, you know, I think this is one of those topics that's incredibly important but often not talked about because it falls under the category of important but not urgent. Boom.
[103:50]
B
You know, until. Until something happens, then it becomes urgent. Yeah, exactly.
[103:54]
A
Exactly. So it's. It's just one of those things that. Lingering in the back of your mind, it's like creating an estate plan, right? Yes.
[104:01]
B
Bingo.
[104:01]
A
Like lingering in the back of your mind, you're like, I really should probably be doing something about this someday. But there's never any triggering event that causes you to take it seriously. And then it only becomes a problem. Like getting flood insurance. Right. No one thinks about it until your house gets flooded.
[104:21]
B
Like alarms.
[104:21]
A
Right.
[104:22]
B
Nobody gets an alarm until you're broken into. And that's why I love you asking me about the stories. Cause we can make it real. It's going to happen to you. Be proactive, and you can minimize it from happening.
[104:31]
A
Exactly. Well, thank you for spending this time with us.
[104:34]
B
My pleasure. And thank you for having me.
[104:36]
A
Of course. Thank you to Dr. Eric Cole, former CIA hacker, advisor to Bill Gates, and former cybersecurity commissioner under President Obama. What are three key takeaways that we got from this conversation? Key takeaway number one, you may already be being robbed and you don't even know it. Because cybercriminals don't just target billionaires or big companies. They figured out that it's easier to steal small amounts from millions of regular, ordinary, everyday people because we don't have the same level of protection that billionaires and big companies have. And so a lot of cybercriminals might be draining $20, $30, or $50 from your accounts every month. A lot of people never check their statements carefully enough to be able to catch that. And so over the span of years, this Death by a thousand paper cuts approach can ultimately cost you thousands or even tens of thousands of dollars.
[105:34]
B
If I go in and steal $50 from everybody every month, most people won't notice it. Most people don't check their credit card statements. So if there was a 20, 30, 40, $50 deviation, they wouldn't notice it. So we sort of call it the death by a thousand cuts. So the reality is you could have money being drained from your account that over years could be costing 20, 30,000, but it's done so low and so little, you don't even notice it.
[106:01]
A
That is the first key takeaway. Key takeaway number two. Your bank won't save you. You're on your own. FDIC insurance does not protect you from cybercrime. There are regulations, yes, but those regulations protect the bank if they get hacked, not you personally if you get hacked. So if criminals access your account using your own login credentials, you're the one who's liable for the loss, not the bank. And if they have just your account number and your password, they can transfer up to half your savings, which without triggering any alerts.
[106:36]
B
The thing you have to remember is you're right. It is one of the highly regulated industries. But the regulations are around protecting the bank if they get compromised. So you go to your bank and it says, you mean FDIC insured up to $300,000? That's if the bank gets hacked.
[106:54]
A
Yeah. 250, I believe.
[106:55]
B
Or 250 if the bank gets hacked and the bank goes out of business. You're covered. But what people don't realize is the regulation. And it's scary because the US is one of the few countries in the world that doesn't have a unified law on security and privacy that protects citizens. Most of the regulations out there are protecting the entity, like HIPAA protects hospitals. It doesn't protect individuals. The bank regulation protects the bank. So if the bank goes bankrupt or out of business, you're protected. But if you don't protect your password and somebody gets in and gets your user ID and password, that doesn't protect you from the regulations. You're liable, not the bank.
[107:36]
A
This makes it all the more critical to have good security practices in place. That is key takeaway number two. Finally, key takeaway number three. Be particularly careful when you're making a real estate transaction, because real estate deals have become cybercriminals favorite target. They break into the servers of closing companies and they wait for months for the quote, unquote, perfect victim, which is typically somebody who's Making a large cash purchase. And then just a few days before closing, they send fake wire instructions that look completely legitimate. Dr. Cole tells the story of two Ohio teachers who lost their entire $1.3 million inheritance, which was meant for their dream farm. And it was all because they got an email that looked legit.
[108:27]
B
And it turns out it was a scam. We got involved because there was sort of lawsuits of who's liable in this case. And the email for any average person looked legitimate, it looked valid, it had all the proper authentication methods. And it turned out that the closing company servers were hacked, and they were sending emails out to select individuals that were cash based deals. Because here's the reality, there's very few cash based deals. So if you're going in and you get a loan and you're only putting $80,000 down, an attacker doesn't want that. So they broke into those servers for three months and they were waiting for a big cash deal.
[109:08]
A
I actually know another person that this happened to as well. She's public about the story, so I'll say her name. Shannon Allen. She used to be a personal finance blogger back in the early days of personal finance blogging. She at the time wrote a blog on frugality, which is how we knew each other. She also fell victim to wire fraud during the closing of a real estate transaction. She lost $52,660 to wire fraud from scammers. This happens to ordinary people. It could happen to you, it could happen to your friends. I'm not trying to be alarmist, but ever since I heard Shannon's story, I have developed a paranoia around wiring money during real estate transactions. In fact, last year, I needed to send $100,000 to a closing attorney as part of a real estate deal. The most reasonable thing to do would have been to send a wire. I actually physically showed up in person at a bank branch and had a cashier's check made, which I then went and hand delivered. Even the people at the bank were like, you know, you could just wire this. And I'm like, I was thinking about Shannon Allen at the time. I even told them about Shannon's story. And I said, no, no, no, I'm insisting on doing this by cashier's check. Now, of course, that's not always possible because many closings are out of town or out of state. But there are still a variety of good practices that you can put into place to protect yourself from wire fraud and from scammers generally, not just in real estate transactions, but at all times. Because you heard Dr. Cole talk about the phishing scams that are out there, the grandparent scams that are out there. People calling a grandparent and saying, hey, your. Your grandson's in jail. You need to send bail money in jail on a dui, you know, you need to send bail money to get them out. You know, then grandma panics and sends over money like this. This stuff happens all the time. And you and your family and your friends don't have the protections that big institutions have, which is why this matters so much. Thank you for listening to this episode from the archives. This was our interview with Dr. Eric Kohl. It originally aired in June 2025. I am deeply sad that we could not bring him back onto the show a second time. Prior to his passing, we were in talks with his team to schedule that every two weeks we have these guest booking meetings, myself and my team in one of our meetings, we had talked about scheduling him, and we were chatting with his team and we were trying to find a date. And then I heard the news. And so at our next meeting, I had to come to the team and say, actually, actually, that interview is not going to happen. He was a force in the cybersecurity world. I was recently at an event at the Penn Club here in New York. I was chatting with a guy and I asked him what he did for a living, and he said he was a cybersecurity expert. So I asked him, do you know Dr. Eric Cole? He said yes, that he had actually testified in a trial. He had testified on the opposite side of him. So he and Dr. Eric Cole were both expert witnesses in a trial on opposite sides. Actually, he never told me how that case was decided. Come to think of it, he never volunteered that bit of information. It goes to show what a force Dr. Cole was, how well known he was, how well regarded he was within the cybersecurity community. So I am glad that we could share his knowledge with you, and I hope that it inspires you to take action, because that is the most important piece of this. You can learn, you can listen, we can bring you information, we can bring you great guests. But ultimately, what matters is that you take action. So please do something today that makes your financial life just a little bit more secure. Thank you so much for being part of this community. Thank you for being an afforder. My name is Paula Pant. This is the Afford Anything podcast, and I'll meet you in the next episode.