Loading summary
Danny
Hold that serve.
Fred
There's no time for pickleball. Because you're gonna want to hear this. NOOM now has GLP1s.
Raj Punjabi
No way.
Fred
Oh, yes way, Fred. Psychology and meds. That's how Noom helps you lose the weight and keep it off.
Danny
That's really smart. Oh, Danny.
Fred
It's Noom smart. And they start at just 149 bucks and they're shipped to your door in seven days.
Danny
Holy smokes, that's fast. But not as fast as my service game.
Fred
Hey, who's ready to get pickled?
Raj Punjabi
Get started with Noom GLP1 today. Not all customers will medically qualify for prescription medications. Compounded medications are not reviewed by the FDA for safety, efficacy or quality.
Fred
For thousands of years, explorers the world over searched for and told tales of a mythical fountain said to restore one's youth and cure anything. Newsflash, it was never found. But hey, we do have collagen. While it's not a miracle, it is proven to be pretty darn good at helping you look and feel younger and more healthy. A collagen supplement from Ancient Nutrition can help you feel and look your best. My birthday is right around the corner and the older I get, the more I realize how important it is to take care of my body. I've started adding their multi collagen protein into my coffee and it's been the perfect way to start my day off strong. It's unflavored and includes 10 types of collagen from four sources. Ancient Nutrition's Multi Collagen Advanced Lean supplement formula is powered by clinically studied ingredients that promote fat loss and healthy weight management as well as building lean muscle. Right now, Ancient Nutrition is offering 25% off your first order when you go to ancient nutrition.com acast that's ancientnutrition.com acast that's acast A C A S T for 25% off your first order ancientnutrition.com.
Raj Punjabi
Acast Rebag your premier destination for luxury resale. Elevate your style with our curated collection of bags, watches and fine jewelry. At Rebag, quality is our priority. Each piece meticulously vetted and verified by experts, ensuring your investment is nothing short of perfection. Buy and sell finds from the world's top brands, including Hermes, Chanel and Cartier. Access expertly crafted and hard to find pieces that redefine luxury. Your next investment awaits at Rebag. Get 10% off your first purchase with code REBAG10. That's 10% off the luxury you deserve. Don't miss out. Head to Rebag.com and enter code Rebag10 at checkout. That's R E B A G10. Hi, I'm Raj Punjabi, head of identity content at HuffPost.
Noah Michelson
And I'm Noah Michelson, head of HuffPost Personal.
Raj Punjabi
Welcome to Am I Doing It Wrong? The show that explores the all too human anxieties we have about trying to get our lives right. Okay, Noah, are you good at protecting yourself from scams?
Noah Michelson
You know what? I think I am. I love a good scam movie.
Raj Punjabi
Same.
Noah Michelson
And I'm kind of. We've established I'm a nervous Nelly and so that kind of stuff freaks me out. But I also feel like I don't know what I don't know. And I worry about resting on my laurels.
Raj Punjabi
Sure.
Noah Michelson
What about you?
Raj Punjabi
I mean, very similar. I feel like I'm skeptical of everything. I watch a lot of Black Mirror, like love Rihanna in Ocean's Eight. So I know what could be going on on. But also, I think these scammers are kind of getting smarter and more, you know, intuitive every day. Yeah, I need to know about what's going on in order to protect myself from it.
Noah Michelson
Well, do not worry because I've got you covered. This week we have Jeremiah Baker. He is the author of Confessions of a Hacker. He spent the last 17 years growing a firm and he was hired to hack into clients networks and he would do that before the bad guys did it.
Danny
Love it.
Noah Michelson
And he would work with like casinos, banks, corporations, hospitals. And now he's doing it for Am I doing it wrong?
Raj Punjabi
An anti scamming superhero. Let's go.
Noah Michelson
Jeremiah, thank you for being here with us.
Danny
Thank you for having me. I really appreciate it.
Noah Michelson
So before we get into all your tips, I would love to hear just a little bit about how the hell you became a hacker for all these companies. What were you doing for them and how did this come about?
Danny
So about 17 years ago, I started it as a consultant, just helping companies really under the practice of something called ethical hacking or pen testing. There's many different words and labels that are used for it, but really the premise is companies do this on a very regular basis. And if they don't, they should, which is they have someone good ethical hack their systems, network software, even some of their physical locations and things like this before the bad guys do it so that they can know how it'll happen before it does happen in the wild. And then they can repair those findings, harden their security, put in proper monitoring and tracking and things like that so the damages aren't so horrible as we see in the news, when these things do happen. So that's how I started. And then that was almost 17 or a little over 17 years ago. And that evolved into working with many of the major casinos, banks, hospitals, government organizations, schools. It's just really endless because I think we're all. Nowadays especially, we're all exposed with things like our mobile phones and connectivity. And the whole connected universe has grown tremendously since back in 2007. I mean, iPhone came out in 2007, so that should set the stage for how long ago that was.
Noah Michelson
Yeah.
Raj Punjabi
Can you give us an idea of how bad quote, unquote, hacking is? Maybe some stats let us know who this is affecting and how many people? Because I think we hear about it a lot, but, like, we don't have a grasp of how widespread it is. And I think it's pretty widespread.
Danny
Sure. Yeah, it actually it is, and it's growing. And what I like to do is I like to share through kind of anonymized or redacted stories of real incidents because I think it's helpful for us to kind of hear what's happening, how it's happening, and share those experiences. And that's why I initially put together a talk called Confessions of a Hacker, which was just kind of a funny title to share these stories that we've experienced over the last, you know, going on 20 years. And even from what I've read recently is from 2019 to 2023, the amount of attacks, scams, cyber crimes, and so forth have doubled, and the amount of damages financially have also doubled. And that's kind of a scary thing. It seems like every. It's just progressing and progressing every day, every week, and I'm on the front line of it. So I receive a lot of phone calls at least once a week. It seems that someone is calling me. There's someone I know, a referral, a friend of a friend, a colleague, saying, hey, this is what happened to me. And I've noticed, you know, just from my experience, the trend is upticking quite a bit. And I just came back maybe last month or so, two months ago, speaking at a fraud conference where there were FBI agents, police force, banking, finance folks. And it was really kind of scary and strange because one, I'm about to board my plane from Atlanta to Texas, and I received a phone call from a CEO, for example, in New York, and she said, hey, I think someone just tried to create kind of a financial fund transfer fraud on me, a wire fraud. And luckily, I made a Mistake and the call disconnected and it actually didn't go through. So what should I do? So she got very lucky. I said I have 30 minutes, I'm boarding the plane, I'll call you the minute I land. And you know, let me help you. So I did that. But then as I landed, I was then taking an Uber to the actual bank where the speaking engagement was. And as I was getting out of Uber, I received a phone call from a colleague of mine who's an ultra high net worth individual in the Midwest. And he said that he also almost became a victim of wire fraud. And I just thought it was the timing one was just creepy. As I'm walking into an actual fraud conference to speak. So things are picking up. I don't know where they get the exact numbers from to be honest. Can only be reported if it's like a cyber insurance or the federal agencies and so forth. But I do see the frequency of the attacks going up and the dollar amounts that have been taken from the phone calls that I received seem to be pretty consistent as well.
Noah Michelson
I also think too, I mean I know this is not just happening to CEOs or high wealth individuals. Is there a particular group that we're seeing is actually experiencing these attacks more than others or that you think is more at risk?
Danny
Sure. Well, from, from recent reading and reports or seeing that, honestly it was a little bit shocking to me as well. Young adults, teens and young adults are heavily targeted.
Noah Michelson
Wow.
Danny
I think it's because of the connectivity and they're kind of what they would consider digital native. Grew up on the Internet with mobile phones or just used to doing everything. So probably the volume is why I would that to be the case. But in all honesty, we're all targets. And that's something that I struggled with even early on in my career was folks saying, well, we don't accept credit cards, we don't do this, we don't do that, so we're safe. Right. And I'm like, no, it's not the only thing that folks are after. Not just stealing credit cards for example, so everyone's susceptible. But the data showing that teens and young adults are extremely susceptible to scams and cyber crimes.
Raj Punjabi
I mean young people are extremely online. It makes sense. And that's a good point too because I always used to joke that like I've got $30, like no one wants to scam me, but it's like my identity and like lots of people would like to take advantage of my credit score or something like that. Right. So it's like as I learned more, it was more and more terrifying. Can you tell me what the most common types of online scams are like? What when we think of an online scam, what is it generally? What are the skeleton, the bones of it?
Danny
I'll share from, from my experience of what I've consistently seen over, you know, almost two decades now. And that is really the folks the bad guys are really after, generally speaking, two things. One is of course our money. They want to scam us to send them money or to buy something through them and get our credit card information or commit a transaction that never delivered the product, for example, through fraudulent e commerce and things like that. And then secondarily they want our data like our personal identifiable information like you had just mentioned, kind of our cred and things like that, so they can go buy things acting as if they're us. Right. So and that's just some of, some of the things. But from a statistical perspective, I read something very interesting recently and this applies both to, I would say it applies to both corporate and individuals and most corporations nowadays and ultra high net worth individuals where I spend a lot of my work. They have something called cyber insurance, cyber security insurance to help when an incident happens. And I was reading that a cyber insurance firm stated that most of the claims they receive come from a small group of things and I believe it was around 60% or so were coming from what's called an account takeover where someone would take over our email account and do nefarious things, take over our social media accounts, take over our mobile phone accounts and do things. And then that generally leads to the, to the second component of that 60% which is fund transfer fraud. So things like, you know, if we're transferring money on our mobile phone through our banking protocol without naming specific brand names that do this, it's very common. So the bad guys will get into our account through getting our username and password, for example. An example of that would be a really a real example which is I'd received a phone call about a private aviation, a private jet company that was very close to making a sale and someone who had taken over and gotten access to their vice president of sales email account. And they just sat and watched and waited to see how they interacted with their potential new clients. And right around the time, after about three months of waiting, they were waiting, waiting, sitting in the email account and they saw that the buyer was about to make a transaction. So what they did is they hid this thread, started to hide the thread from the executive and asked the buyer to send their or to wire the payment, which was a very large sum of money, just shy of a million dollars, for the membership, to a different account, to the criminal's account. And it went through. The buyer thought they were happy we got my membership. A few days go by, the aviation company never said anything. So the buyer called and said, hey, where's my receipt? How do we get started? What happened? And they said, we never took an order from you. What do you mean? And they sent. Luckily they had some screenshots and some background information on the exchange. And they showed them. And when I received the phone call, I knew immediately that this was an all too common scam, which is they take over our account, sit silent, act as us, request money to be sent to different places, usually through some form of wire fraud. But usually all of these types of attacks involve some form of either an account takeover or someone's calling you, pretending to be your bank or some financial institution, saying, hey, we accidentally put some money into your account, can you please send it back? Well, one, your bank's never going to call you and ask you to do those kind of things or ask you for your username and password or any kind of identifiable information. But it's usually a tee up of someone asking you for something, pretending either an impersonation scam, pretending to be an institution when they're not a friend, a colleague, a relative. And then the ask comes, they ask you either for your info, login credentials, banking information, credit card information, whatever it may be, and, or your money. And that's the most frequent tee up or setup for these scams. And there's usually like a sob story, highly emotional, highly urgent, you have to hurry. And those are the things that, that really should raise a red flag to say, hey, wait a minute, I need to hang up this phone and you know, reach back out to the institution and make sure that it's really them or to the person through us through a second communication channel. But it's usually urgency and money that they're looking for. They want you to do something quickly.
Noah Michelson
Would you say that is the number one thing that would be a red flag then is that there's someone asking you for information or money and it feels heightened or urgent.
Danny
Yeah, exactly. And I think it's also valuable for us to trust our intuition. Most everyone I speak to said, yeah, I didn't really feel like I should be doing it, but I did it because they had all this other information on me. Like they knew my address, they knew my Name, birth date, they knew my Social Security number, by the way. All that information, with all these huge data breaches that we've seen over the last several years, bad guys get a hold of that information so they use it trust and context and then they get us to do something. So I would say trust our intuition. And also note that your institutions are never going to ask you for that information. The best medicine there is to hang up the phone, look on the back of your credit card, your bank card, or whom, wherever they're pretending to be from, and call them directly or go visit them if there's a local branch for that example. Because they take the extra steps, they.
Noah Michelson
Can dupe their phone numbers, right? I mean, this even happened to me. I got a phone call from Citibank. It said on my phone, citibank.
Raj Punjabi
Oh man.
Noah Michelson
And it was even the number on the back of my card, that was the number that was calling me.
Raj Punjabi
That's terrifying.
Noah Michelson
And I was like, this is weird. And I did, I did exactly what you said, Jeremiah. I hung up and I called them back and they said we would never do that. That was not us, but it looked like it.
Raj Punjabi
What else should we be looking for that can tip us off that something says scam, right? I know, I'll get. My favorite things are like emails with like the name of the company spelled wrong. I'm like, this is so dumb. Some scammers are like 15 to 20 times smarter than me and sometimes they're just super dumb. And I'm like, this is such a.
Danny
Waste of my real basic things that I think we can all do that have huge impact. That would have helped avoid A lot of the things I see is one, just keep an eye on your inbox and keep an eye out and assume everything could potentially be phishing. If it feels suspect, it probably is. And you shouldn't click it, you shouldn't give the information. And then there are some basics that we can do that are super helpful. Like most of these wire fraud transfers and basically modern day robbery. Money theft that we see happening come from not having things like multi factor authentication, which is just a second step to be able to log into our account. For example email or banking or whatever social media account, a lot of people still don't have that active. And then all the bad guys have to do is get our information on a public breach where they found our username and password and they can log in and do whatever they want. But I would say the real basics for spotting it is are they asking me for money? Are they asking me for username, password, Social Security, credit card information? Things that I really just don't want to give out? That's a telltale sign. And then the urgency aspect. Hurry up or else this is going to happen to you. And just keep a real keen eye and set of ears on that.
Raj Punjabi
You know, one of my favorite things is those TikToks that are up now of people kind of making asses out of scammers.
Noah Michelson
Yeah.
Raj Punjabi
It's like when the scammer is texting you or calling you and is like, hurry up and do this. They're like, hold on, I just have to. And they, like, really make clowns out of this gamer. It feels so good in my soul.
Noah Michelson
So I got a text six months ago from Arianna Huffington, who used to own Huffington Post HuffPost, that Raj and I work for. And she hasn't worked. She hasn't owned it for 10 years. But the. The text said, noah, I'm in a really important meeting and I can't leave, but I need you to do me a favor immediately. And I think if someone, like, they obviously thought that she was still my boss.
Raj Punjabi
That's hilarious.
Noah Michelson
And I was like, okay, what do you need? And they were like, I need you to go and get me gift cards to Target, I think it was. And send them to me immediately.
Raj Punjabi
Oh, my God.
Noah Michelson
And I was like, oh, okay, Ariana, you're calling me from a. You know, you're texting me from a meeting for gift cards. But I did the whole thing. I was like, okay, but I have to tell you first, I've always been in love with you.
Raj Punjabi
So.
Danny
Good.
Noah Michelson
And if I do this, can you promise me that we can finally be together? And, like, we had this whole thing back and forth.
Raj Punjabi
That's hilarious.
Noah Michelson
Yeah. And, like, they were like, yes, just get me the gift cards. And I kept stringing them along. But, like, it's exactly what you said, though, like, the urgency and also the sort of this. This idea that, like, you're going to be in trouble if you don't do this. Something bad is going to happen if you don't respond immediately.
Raj Punjabi
Yeah.
Noah Michelson
That really preys on your emotions.
Danny
I can't.
Raj Punjabi
Not the target gift cards. Let's take a quick break, and we'll be right back. This podcast is brought to you by eHarmony, the dating app to find someone you can be yourself with.
Noah Michelson
Okay, let's be honest and talk about doing dating wrong. So, Raj, have you ever pretended to be into something that you're not actually into when you're on a date just so you keep the person's attention.
Raj Punjabi
Oh, absolutely. I once was on a date, and I am a Knicks fan, but I was pretending to be this, like, hardcore sports girly because that's what the dude was into. And I am not a sports girly.
Noah Michelson
Right. So I bet even despite doing all of that, the date didn't go anywhere.
Raj Punjabi
It certainly did not.
Noah Michelson
That's because I'd imagine the best dates we've had were the ones where we were totally and completely ourselves, not trying to jam square pegs into round holes, but enjoying a natural flow and chemistry with our date.
Raj Punjabi
Well, eharmony knows this, and this is their whole deal now. Helping you find someone you can be yourself with.
Noah Michelson
That's what true connection and compatibility are all about. Being seen and understood. And that's why folks are turning to eharmony.
Raj Punjabi
Eharmony's compatibility quiz brings out your personality and helps you meet people who will like you for you. They want people to like you for the right reasons, not for made up nonsense that you have to pretend to care about.
Noah Michelson
So let's do dating. Right. We'd love for you to give eharmony a shot. Get started with their compatibility quiz for free so you can find someone you can be yourself with.
Raj Punjabi
Eharmony. Get who gets you.
Noah Michelson
Hold that serve.
Fred
There's no time for pickleball, because you're gonna want to hear this. Noom now has GLP1s.
Raj Punjabi
No way.
Fred
Oh, yes. Wayfred psychology and meds. That's how Noom helps you lose the weight and keep it off.
Danny
That's really smart. Oh, Danny, it's Noom smart.
Fred
And they started just 149 bucks, and they're shipped to your door in seven days.
Danny
Holy smokes, that's fast. But not as fast as my service game.
Fred
Hey, who's ready to get pickled?
Raj Punjabi
Get started with Noom GLP1 today. Not all customers will medically qualify for prescription medications. Compounded medications are reviewed by the FDA for safety, efficacy, or quality.
Fred
For thousands of years, explorers the world over searched for and told tales of a mythical fountain said to restore one's youth and cure anything. News flash, it was never found. But, hey, we do have collagen. While it's not a miracle, it is proven to be pretty darn good at helping you look and feel younger and more healthy. A collagen supplement from ancient nutrition can help you feel and look your best. My birthday is right around the corner, and the older I get, the more I realize how important it is. To take care of my body. I've started adding their multi collagen protein into my coffee and it's been the perfect way to start my day off strong. It's unflavored and includes 10 types of collagen from four sources. Ancient Nutrition's Multi Collagen Advanced Lean Supplement formula is powered by clinically studied ingredients that promote fat loss and healthy weight management as well as building lean muscle. Right now, Ancient Nutrition is offering 25 off your first order when you go to ancientnutrition.com Acast that's ancientnutrition.com Acasta that's Acast A C A S T for 25 off your first order ancientnutrition.com Acast.
Raj Punjabi
Welcome back to Am I Doing It Wrong?
Noah Michelson
Here's the thing. I always wonder. So Jeremiah, you. You hear, you even said, you know, I think at some point already if you get one of those emails and it wants you to click the link, don't click the link. What happens to us if we do click the link? Or what can happen to us?
Danny
Yeah, a lot of bad things can happen. And going back kind of to a story, this was 2021 and bad things can happen. Then I will share some things that we can do to kind of minimize the damages or hopefully prevent damages in many cases. It was late in the day. One day I was wrapping up work and I received a phone call from a friend. I could tell he was in a busy restaurant. And he said, hey, something just happened to a friend of mine that's here. I think someone compromised his Instagram account. So he got on the phone. I just started doing diagnostics. I asked him, hey, can you step to a quiet spot and tell me what happened? Give me all the details. Basically, he was in his office wrapping up the day, getting ready to go to this dinner, and he had his computer in front of him and then an iPad or something over to the right. He saw a message pop up inside Instagram that appeared to be from a friend of his. That was that he was connected to and said, hey, check out our vacation photos. And he said, I never go on Instagram or really do anything like that. And he really doesn't. When we looked into his account, but he was distracted. He clicked the link to view the photos, and that was embedded with a piece of malware that took over his account. They went in and changed his username and password, which therefore in turn locked him out. And then they started to send cryptocurrency scams to his contacts. And he's an ultra high net worth individual, very prominent person. And it was like, hey, I found this great deal for like $15,000 or something like that. You guys should invest too. Well, his friends know him. So luckily someone started sending him screenshots saying, hey, this happened. But when he went to go back into his account to remedy this, to change his password and so forth, he couldn't even log in.
Noah Michelson
Right.
Danny
And then on top of that, at that time, the way that Instagram was verifying that it's him, if you have lost your account, is they do something with the phone where they do facial recognition. Yeah, well, he's very private, so he never had his face on there in the first place. And then he couldn't find any. And I was trying to help him. Couldn't find the free service Instagram, couldn't find any real technical help.
Raj Punjabi
Yeah.
Danny
And I believe it to help him with a phone number or anything like that. So in that particular case, it took him well over a month.
Noah Michelson
Wow.
Danny
To get this situation fixed, he's calling all his contacts that he could remember. He was asking other friends, who do you see that I'm connected to? And trying to let them know not to become a victim of the scam. But those are the kind of things that can happen. In reality, there's no perfect foolproof thing that we can do. But other. But there are things that are being done constantly. Like for example, Gmail is trying to filter before these even get to our inbox, but they still sneak through. There are tools that we can have on our devices. Anti malware, anti phishing, antivirus. And it's all about adding in layers and layers and layers so that we can prevent these things from happening. And of course, training to be able to spot how are we being attacked and sharing these stories like Raj just said, like, we need to tell each other, we need to train. We need to train our children, our family members, our friends, colleagues and so forth on this is how it's happening. This is what to do if you spot it and then have a layering of tools in place to help prevent it. And then if it does happen, then it's kind of. It's really tough. But the best thing we can do is disconnect from the Internet, run anti malware, antivirus, anti ransomware detection and tools like this. And this is usually when it gets more into like an IT professional, a certified information security professional's role where they'll start doing diagnostic on the machine and recovery and things like that to help us. But the Real magic is trying to prevent it from happening in the first place. Then, of course, having backups of our very important information in a good space just in case we lose everything. If we have it on like an external thumb drive or a hard drive somewhere, some form of clean storage, then we can at least restore our life, our digital life, and we're not really stuck in the mud. And that's what happens a lot of times is these folks get compromised individually or corporations, and they have no backup or anything like this to restore. So it's either pay the ransom, you know, pay the fee, pay the whatever, the extortion scam, or you, you kind of lose everything or can't run your business. But it's really a layered approach.
Noah Michelson
Do you recommend then having backup storage something that isn't the cloud? Because the cloud is also susceptible. So you're saying you literally should have a physical hard drive in addition to the cloud.
Raj Punjabi
Should I get like a floppy disk from the 90s completely?
Danny
Yes. No. So. Well, if you'd like. But I would say my personal preference is to have some form of physical backup.
Noah Michelson
Okay.
Danny
Cloud is okay, but it can still. There still can be problems there. So, for example, if you're backing everything up on the cloud and things aren't set up properly, I've seen where ransomware, so forth, can get through to the backup and encrypt that and lock it down as well. So good providers will segment and have things prevented, but it's just a matter of preferences. So any backup is better than no backup. And then I would add an extra step, which is at least to some frequency backup on a physical device that's not, you know, it's backed up and then removed from the Internet just so that you have it as an extra, you know, security blanket.
Noah Michelson
I like that.
Raj Punjabi
Okay, so if we do feel like we are, we've gotten scammed or we're getting scammed, who is the first person we're calling? Like, who is zaddy? Who's going to help us out here? It's not the cops, I believe, is it the cops?
Danny
Well, in my experience, the cops are really to help it not happen to someone else, okay. Versus to be real preventative to us. Right. So, for example, in the, the story I gave earlier, if it's a bank claiming to be a bank, hang up, go call the bank. For example, if it's your mobile phone company, whoever it is, the institution, okay, Go see them if you can. If you can't call them on a separate, look up the number and Call them from a separate means. And then of course it's, it's always good practice to call and I've had to do this personally, call the local police and then contact the FBI and report it it with them as well. But that's rarely a remedy. It's more of an alert system so that they can get on it and know that it's, that it's happening. But first, first line is to call the institution that's in question because they'll be able, they'll be the ones to be able to help you quickly and hopefully reduce any damages that can happen. If it's money theft or someone trying to take over your, you know, account, cell phone account or something like that.
Raj Punjabi
Okay, on a scale of me to Jeff Bezos, how rich do I have to be to have someone like you on retainer so if I ever get scammed, I can just call?
Danny
That's a good question. And it's actually, it's a tough one because most corporations have some form of cybersecurity and IT team internally. I'm sure you folks have a fairly robust team and most individuals don't. So the only real option that I've seen right now is for individuals, if they really care about it, is to call standalone consultancies, IT firms, things like that, that specialize in this kind of thing and they can work with them at that basis. But it is generally a little bit of cost preventative for the individual to have something like this. So one of the things I like to teach when I'm speaking or you know, even talking to students and things like this is take as much of it as we can in our, what's called our cyber hygiene. The basics, do it ourselves, learn how to spot things, how to set up multi factor authentication, how to back up our data, how to set up a credit freeze for your credit report so that no one can open new accounts in your name, set up monitoring just in case it does happen. You can get alerted and these types of things, having antivirus tools on our computers and our devices, anti malware and so forth, and then hopefully that means we got a large portion of our cyber hygiene in place. Then we only need to reach out to a consultant or to an IT or security professional if something really, really bad happens. And hopefully that doesn't happen given the fact that we've been so focused on training and cyber hygiene.
Raj Punjabi
That's smart. Let's take a quick break and we'll be right back. This episode is sponsored by hers.
Noah Michelson
Here on the show we often talk about how to be the best version of ourselves, and there are so many paths to getting there. That's definitely true of weight loss. Everyone deserves to have a strategy that is tailored to their specific needs. So if you want some extra help, check out hers.
Raj Punjabi
Weight Loss by HERS aims to be realistic, not restrictive, and it's focused on giving you access to a personal solution. Not a one size fits all solution, but a plan that's right for you.
Noah Michelson
Hers is changing the game by providing access to GLP1 weekly injections with the same active ingredient as Ozempic and Wegovy, as well as oral medication kits too.
Raj Punjabi
HERS connects you with a medical provider too, who will create a personalized treatment plan tailored to your needs.
Noah Michelson
If prescribed, you'll get the medication as part of a doctor developed weight loss program, including ongoing care and online support at no additional cost.
Raj Punjabi
Through hers. Weight loss plans are more affordable. There's no hidden fees, no access fees and no membership fees, and everything is shipped straight to your door.
Noah Michelson
So if you're thinking of going on a weight loss journey, find an option that works for you with hers.
Raj Punjabi
Start your free online visit today at fourhers.com wrong that's F O R H.
Noah Michelson
E-R-S.com wrong for your personalized weight loss treatment options. That's forhers.com wrong hers weight loss is not available everywhere. Compounded products are not FDA approved or verified for safety, effectiveness or quality. Prescription required restrictions apply. WeGovy and Ozempic are not compounded.
Raj Punjabi
My dad works in B2B marketing. He came by my school for Career.
Danny
Day and said he was a big ro as man. Then he told everyone how much he.
Raj Punjabi
Loved calculating his return on ad spend.
Danny
My friends still laugh at me to this day.
Fred
Not everyone gets B2B, but with LinkedIn you'll be able to reach people who do. Get $100 credit on your next ad campaign. Go to LinkedIn.com results to claim your credit. That's LinkedIn.com results. Terms and conditions apply. LinkedIn the place to be to be.
Raj Punjabi
When the energy is high and the music is right, pushing past your limits becomes that much easier. Take a reggaeton run or strength class on the Peloton Tread and you'll quickly see why these are the workouts you've been searching for. Every day brings new challenges from expert coaches who train and speak the same language as you do. Level up your workouts with Peloton Tread. Find your push. Find your power peloton visit1peloton.com foreign.
Noah Michelson
If we have given $15,000 to a hacker because we thought it was our bank or something else. We're screwed, though, right? Most of the time you're not going to get that money back. Or. Or is there a way to.
Danny
Yeah, that's hard. A lot of. A lot of times that's exactly. I've seen the money just go away and it's hard to get back sometimes. I've also seen it, though, when it's caught soon enough, they are able to claw the money back, but that's very rare. That's why this prevention is so important. And security awareness training and the scammer, understanding how think like a hacker, think like a scammer to beat a scammer, and staying on top of it, because it is so, so very hard to get the money back once it goes out.
Noah Michelson
I think this is also something, too, that is so emotional if it does happen to you. I've seen people on my Facebook feed who say they got scammed. They are so embarrassed. And the thing they say is, I never thought it could happen to me. And they're so sheepish about actually talking about it. And that prevents us, again, from talking about this, from letting other people know how to prevent it, because if it does happen, we don't want to admit that we were, quote, unquote, dumb enough to fall for it. And that's really tough, too.
Danny
We're more like the Guardians of the Galaxy. Right. Like, we're here to help each other.
Noah Michelson
Yeah.
Danny
To protect each other and. And to share information with each other. Not to be embarrassed about these things, because we are all being attacked. And most of these attacks are just blanket attacks. The bad guys are just, like, casting a big net out there and then seeing who they can grab. And then, of course, there's a smaller portion where it's called, you know, kind of spear fishing or whaling, where they go for a very specific individual, because I think there's a big prize to be had there. But for most of us, it's just mass campaigns that are being sent out.
Raj Punjabi
And some of the scams are really elaborate. That's why we shouldn't be embarrassed. I heard of the scam. I don't know anyone personally that's gone through it, but I was reading about it where if you pick up the phone and you say hello and you start talking, they can actually get your voice, capture your voice, and kind of use it to scam someone else close to you so they can get some kind of mechanism that sounds like you, and then they'll call someone else and pretend to be their child or parent or whatever and be like, I need $5,000.
Noah Michelson
And the thing I heard especially is, you're never supposed to say the word yes, because they also take that, and then they use that to answer other questions for other things.
Raj Punjabi
Oh, no.
Noah Michelson
So if someone calls you and says, is this Raj? You're not supposed to say yes.
Danny
Oh, no, no. You just said it. And this is being recorded.
Noah Michelson
And, I mean, our voices are out there. We're scre.
Danny
But for the average person, all joking aside, it is very true. And I was speaking again at a different conference, and someone said some crazy stat, like any video like this or on YouTube or they called you and they're recording it. It's just mere seconds that's needed, because with tools now, like AI and all of these things, it can replicate how we speak. And I was actually having a conversation with a chief technology officer friend of mine, and he said, you're not going to believe this, but that happened to my mother. Someone called and said, hey. And it sounded like it was her grandson, my friend's son, and identical. Hey. I'm stuck in somewhere in South America on vacation. I need $5,000 to get out, or they're not going to let me out. Grandma, can you please wire it to me? And she turns to her left, and luckily, grandson's just sitting.
Raj Punjabi
Oh, my God. Thank God.
Danny
And, yeah, and she got super fortunate because, again, that's heartstrings, emotional urgency. You and a lot of folks will go for that. And luckily she, you know, so, hey, grandson's right here. You know, this is definitely not you on the other end of the line, but that's why we have to be so careful and verify, like, as much as we possibly can, even in those heightened emergency situations. And that's what they're taking advantage of, is it's not our instinct to hang up the phone when you hear a loved one on the other line. That sounds like they're in trouble, right?
Noah Michelson
That happened to my grandma. Oh, no, it wasn't. So it was my cousin, her grandson. He wasn't on the phone, but it was someone calling from Mexico. And they said, your grandson is on spring break. He's been arrested. We'll let him go if you wire us $5,000. And my grandma. And they said, you cannot tell anyone. If you tell anyone, he won't be able to get out.
Raj Punjabi
Okay, that's crazy.
Noah Michelson
Same thing. My uncle, my grandma's son, my cousin's father was our chief of police.
Raj Punjabi
Oh, wow.
Noah Michelson
He happened to be visiting her. And she was acting really weird. And he said, what is going on? And she said, I'm not supposed to tell you this, but Jesse's in Mexico, my cousin, and he's in jail. And he was like, he's not in Mexico. And so when they called back to get her routing numbers, he picked up the phone and he said, I know what you're doing. But she was very close to doing it because she was so scared.
Raj Punjabi
Oh, that's awful.
Danny
It was terrifying.
Noah Michelson
Yeah. Yeah. They're so savvy. Don't you sometimes kind of wish that it was like the days of landlines and, like, mailing a check to pay for your gas bill or whatever?
Raj Punjabi
Yeah, I do.
Noah Michelson
Like, I. I think technology is incredible and it lets us do such great stuff, but at the same time, it's also terrifying.
Raj Punjabi
No. Every time I deposit.
Danny
Yeah. Is the reward worth the risk?
Noah Michelson
Right, right.
Raj Punjabi
Every time I deposit a check mobile, I'm like, what is happening here? This is Black mirror Evil. Like, it's so easy. I don't have to go to the bank. It's so awesome. But I'm like, this can't be good.
Noah Michelson
And I'm so trusting now, too. It's always like, hold on to your check for three days to make sure that I actually went through. And I don't. I'm like, I'm sure it's fine.
Raj Punjabi
Oh, I hold onto it.
Noah Michelson
See, I don't.
Raj Punjabi
In my heart.
Noah Michelson
Yeah, I'm a mess.
Raj Punjabi
You've succumb.
Noah Michelson
I have. I trust. I trust our technical overlords. And it's not smart.
Raj Punjabi
I've read the things we post on social media can put us at risk for being scammed. What things in particular would you advise we don't post about?
Danny
That's a. That's a very good question because I think it impacts almost all of us, right across all ages. Early on, I wasn't too worried about these things. And then as I started to see, and I mean, years ago when. When these social media platforms first came out, like Facebook and so forth, and then I started to think, well, wait a minute, this is like a public bulletin board. You know, anyone across the planet can search for this. So one of the first things did is say, okay, let's go back in and change our privacy settings inside of these platforms. So if we don't want the world to see it, it, let's make it so that only our friends and family, like, first connections can see these things.
Noah Michelson
Right.
Danny
That in terms of a layered approach that starts to Thin down or reduce the amount of attack surface that we have or information that a bad guy could get. And then recently I saw some things where people were scamming. If you recall, a little while ago, people were doing these quizzes like, hey, what's your favorite this, what's your favorite that? And really what they were doing is harvesting your information. So if they went in somewhere and did like a password recovery, for example, right. It would say like, hey, what's your first pet's name? Yeah, your dog's name. And they're like, oh, there it is. You filled it out in that quiz, right? You know they got it from you. So really, general rule of thumb is don't put anything on social media that could be compromising, like personal identifiable information, but also reduce who can see what you put on social media. And more and more, I'm personally thinning out social media applications that I have to reduce the amount of attack surface that that exists because to our previous conversation a few seconds ago, I just don't want the reward is not worth the risk. So it's really a layered approach of decide how much do you really want the account? Two, don't put things on there that you wouldn't want someone to get. And then I guess the third bit is to set your security settings so that only people you want for the, for the most part, will ever be able to see what you put on social media. And it's really a risk kind of tolerance and mitigation exercise. Like, what are you willing to tolerate?
Raj Punjabi
So I'm trading likes on my bikini photos for security.
Noah Michelson
Security.
Danny
Yeah.
Raj Punjabi
It's worth it.
Noah Michelson
I think it is worth it. I also think it's smart too. Like you said, if you're not using some of these apps, get rid of them. I mean, now you've got WhatsApp, you've got blue sky, you've got Twitter.
Raj Punjabi
I like Attack Surface, like, exactly. That's in smart radio.
Noah Michelson
So many places that people can attack you. And if you're just not using them, what's the point? Yeah, yeah. As a scam expert, tell us some things that you would never do. Just lay it out.
Danny
Shame us.
Noah Michelson
Yeah, shame us.
Danny
Okay, so in some of these, we've covered. We've covered a lot of. One is I wouldn't give any banking information over. Like if someone called me or texted me or emailed me asking, hey, can you give me this information? No matter who they pretended to be or how realistic it seemed to be, I wouldn't give them the information because that's just opening ourselves up for really bad situation, as we discussed today. And then secondly, I wouldn't give the information, but then I would also hang up, disconnect the communication channel and I would go right back to who the source is and see if it was really them. Because there's even situations where it looks like it's from a bank. They have all your information. You're like, I don't even have a bank account with this particular bank. So not giving out the information and then verifying, being very, very cautious about clicking on everything. So it's more of a. Not that I wouldn't do it because sometimes things are legitimate. So you want to try to verify is this legitimate so that you can conduct business or if you're sharing things with friends and family. But it's really about just not giving in to the requests with all this urgency. Especially if you take one step back and you say, if I do what they want me to do, am I willing to suffer a complete loss or all the damages that can go along with this? And if the answer is no, I'm not willing to tolerate that, then discontinue the communication and verify with the institution and, or the authorities that you're dealing with the right, right people. And it's not a scammer. So it's really. And that is a very good question because it's more about what we shouldn't be doing and that is giving out all that information and complying with the, you know, with the thief. And I wouldn't click those random QR codes that you see around the city saying, you can win a prize if you, you know, just put your camera up here. And that's just another form of a link designed to take advantage of our neglig diligence and our, and the urgency and a little bit of our desire to get something, you know, like, oh, I want a prize. It rarely is a prize.
Raj Punjabi
Yeah.
Danny
So just be very, very cautious.
Raj Punjabi
And we talked a lot about what we should be doing. And you use the term cyber hygiene. What would you say is the number one tool of cyber hygiene? If we're going to walk away with.
Danny
Something today from this podcast, it's probably our own. Our own, you know, kind of intuition would be the number one tool. But from the things that we can do, there is real magic and basic cybersecurity hygiene. And that is, I would recommend, folks, and I always do this is go look at all your accounts, make sure that you have multi factor authentication or two step authentication verification on all your accounts so that if someone does get your username and password, you need an extra code that shows up up on your phone through like Google Authenticator or Microsoft's products. There's tons of them, an app. If the bad guys don't have that, it's going to make it extremely difficult for them to then log into your account. And that's probably where I see the most financial damage, the most reputation damage happen is from these account takeovers. Because people don't have multi factor authentication on their accounts. Then the second bit would be to even though you have multi factor authentication, it's still good practice to use a password manager tool. There are a lot of them out there that help you to also remind you to create very strong passwords so you're not reusing passwords across multiple accounts. Where if someone were able to get them and then they just daisy chain and go across your different accounts and try to get in. If they find one that doesn't have multi factor authentication, it makes it easy for them to get in. Having data backup, regular backup, so that if you do get hit with something like ransomware, you have the ability to restore all your files, get back up and running, get working without having to pay the ransom. That's probably your best medicine yet. That's where I see most folks don't have some form of backup and they're scrambling to try to pay the, the ransom. And it's usually some form of, of crypto coin, Bitcoin or something like that. They demand a payment and for some reason, at least in the instances I've seen that upwards of $500,000 sometimes they're demanding depending on who they're dealing with. So having MFA having backups, make sure your software on your, on your devices is updated so that there's not a known vulnerability that they can compromise. Have up to date anti malware antivirus tools on your, on your machines. And then really the last bit is training understanding like these conversations we're having today, which is how are the attacks happening so that you can spot them. Because most of the damaging or irreversible damage that I've seen happen is people aren't aware that they can happen. And the way that they find out it can happen is, is the moment that it does happen to them. And a lot of times, you know, like they say, once the, the cheesy saying would, once the toothpaste is out of the tube, it's hard to put it back in. And that's where the real damages come. So training and then the basic cyber security hygiene basics go a long, long way for all of us individually and as corporations. And then it's good to train, be it children, our parents, our grandparents, folks that may be an older demographic of ours, because they don't even know these things can happen. And like we spoke about the beginning of the call, they might just trust who's on the other line because that's their kind of culture. And then they become a victim.
Noah Michelson
I have to say, if someone was like, give me $500,000 or I'm keeping all your photos of your dog, or my nude photos from 12 years ago or whatever, she's like, you can have them start an only bag. I will just not have an identity anymore because I couldn't afford that chaos.
Raj Punjabi
This is so helpful. I feel like now with armed with this information, the only person that's going to scam me is Anna Delvey. That's it.
Danny
It.
Raj Punjabi
And I will gladly let her completely.
Noah Michelson
If she wants it, she can have it.
Raj Punjabi
That's it. That's it. But everyone else, down with you. Cyber scammers.
Noah Michelson
Jeremiah, this has been so great. Thank you so much for being here.
Danny
Yeah, thank you both. I appreciate it. And just the opportunity to. To be able to share because it's horrible when you receive these phone calls of bad things happening to good people. And a lot of times they're just not aware of how these attacks are happening. So hopefully it's helps, you know, just helps one person avoid these things. I'll be happy as well.
Noah Michelson
It's time for better in five. These are your top five takeaways from this episode.
Raj Punjabi
Number one, online scams have doubled in the last five years, and everyone from young people to older folks are at risk.
Noah Michelson
Number two, the number one tip off that you might be getting scammed is that someone wants something from you and they want it immediately.
Raj Punjabi
Now, now, now. Number three. Number three, if something feels fishy during a phone call with your bank or another financial institution, hang up and call them back directly.
Noah Michelson
Number four, always think twice or three times, four times before you click on a link in your email or scan a QR code.
Raj Punjabi
And number five, practicing preventative cyber hygiene is going to be your best tool for protecting yourself against scams.
Noah Michelson
Okay, my friend, have you actually been good at preventing cyber scams?
Raj Punjabi
No. I mean, we learned so much stuff today. I'm freaked out and empowered all at once, as per usual. Here's the thing. I have not been practicing the best cyber hygiene. And now that I'm aware of what I can do with my apps, et cetera. I'm gonna do them. This is my hard earned money and hard earned identity. And yeah, I picked up a lot of really great tools. What about you?
Noah Michelson
You've been working hard for this. I loved the idea of sort of leaning into the human side and I loved what he said about how emotional this can be. And so often if we just took a breath and just paused before we did something and if we thought, what's gonna happen if I push this button? What's gonna happen if I click this link? We could actually save ourselves a lot of heartache.
Raj Punjabi
I've never thought before doing anything, so I'm gonna start doing that too.
Danny
No.
Noah Michelson
And you've got these lights flashing at you and like you said, sometimes it's like you're gonna win a prize.
Raj Punjabi
Yeah.
Noah Michelson
It just makes you wanna click on stuff.
Raj Punjabi
Yes.
Noah Michelson
It's very sort of like the monkey part of our brain is like, click no more though. We are done with that. And until next time, as long as there are things to get wrong, we're going to be right here to help you do them better.
Raj Punjabi
Stay safe, y'all.
Noah Michelson
Do you have something you think you're doing wrong? Email us at amidoing it wronguffpost.com and let us know.
Danny
Clogged drains are such a drain. Stagnant water Tug of wars with tangled hairs.
Fred
Plumber on speed dial.
Danny
It's time to tell your plumber to lose your number because Tubshroom lets you say goodbye to clogged tub, sink or shower drains forever.
Fred
Tubshroom's patented design catches hair and debris while your water flows freely.
Danny
Over 10 million people trust Tubshroom to.
Fred
Make home life easier.
Raj Punjabi
Join them.
Danny
Visit TubShroom.com that's tub S-H-R-O-O-M.com My dad.
Raj Punjabi
Works in B2B marketing. He came by my school for career day and said he was a big roas man.
Danny
Then he told everyone how much he.
Raj Punjabi
Loved calculating his return on ad spend.
Danny
My friends still laugh at me to this day.
Fred
Not everyone gets B2B, but with LinkedIn you'll be able to reach people who do get $100 credit on your next ad campaign. Go to LinkedIn.com results to claim your credit. That's LinkedIn.com results. Terms and conditions apply. LinkedIn the place to be.
Raj Punjabi
To be Every idea starts with a problem. Warby Parker's was simple. Glasses are too expensive. So they set out to change that. By designing glasses in house and selling directly to customers. They're able to offer prescription eyewear that's expertly crafted and unexpectedly affordable. Warby Parker glasses are made from premium material like impact resistant polycarbonate and custom acetate, and they start at just $95, including prescription lenses. Get glasses made from the good stuff. Stop by a Warby Parker store near you.
Fred
Hey marketers, your marketing plan deserves more than just reach it needs real connection. Podcast advertising with Acast puts your brand in the ears of your perfect audience when they're paying most attention. And with more than 1 billion listens every quarter, we know your next customer is listening to Acast podcasts no matter what app they're using. Target audiences like paid social with cinema like attention, whether it's by demographics, interests, or your own first party data. Connect with the right people with Acast. Visit go.acast.com ads to get started today.
Podcast Summary: "A Hacker's Guide To Staying Safe From Scams"
Am I Doing It Wrong?, hosted by Raj Punjabi-Johnson and Noah Michelson from HuffPost, delves into the pervasive anxieties surrounding everyday life challenges. In this episode, titled "A Hacker's Guide To Staying Safe From Scams," released on November 21, 2024, the hosts bring in expert Jeremiah Baker to shed light on the escalating threat of online scams and provide actionable strategies to safeguard against them.
[02:20] Raj Punjabi: "Welcome to Am I Doing It Wrong? The show that explores the all too human anxieties we have about trying to get our lives right."
Raj and Noah kick off the episode by posing a crucial question: Are you good at protecting yourself from scams? They both admit their vulnerabilities, setting the stage for a comprehensive discussion on cybersecurity.
[03:23] Raj Punjabi: "An anti scamming superhero. Let's go."
Jeremiah Baker, the author of Confessions of a Hacker, joins the conversation to share his 17 years of experience in ethical hacking. Danny explains how his work involves preemptively attacking clients' networks to identify and fix vulnerabilities before malicious actors can exploit them.
[05:26] Jeremiah Baker: "From what I've read recently is from 2019 to 2023, the amount of attacks, scams, cyber crimes, and so forth have doubled, and the amount of damages financially have also doubled."
Jeremiah highlights the alarming increase in cyber attacks, emphasizing that both the frequency and financial impact of these incidents have surged significantly in recent years.
[08:08] Noah Michelson: "Is there a particular group that we're seeing is actually experiencing these attacks more than others?"
Jeremiah responds by identifying young adults and teens as primary targets due to their high connectivity and status as digital natives. However, he underscores that "we are all targets," regardless of age or status.
[09:42] Raj Punjabi: "What are the most common types of online scams?"
Jeremiah outlines two primary objectives of scammers:
He recounts a vivid example where a private aviation company fell victim to a wire fraud scam resulting in nearly a million dollars lost due to an email account takeover.
[14:11] Noah Michelson: "Would you say that is the number one thing that would be a red flag then is that there's someone asking you for information or money and it feels heightened or urgent."
Jeremiah agrees, emphasizing that urgency and emotional manipulation are primary tactics used by scammers. He advises trusting one's intuition and verifying the legitimacy of any suspicious request through official channels.
[15:24] Noah Michelson: Shares a personal anecdote where he received a fraudulent call from what appeared to be Citibank, reinforcing the importance of verifying such communications.
[17:06] Raj Punjabi: "What else should we be looking for that can tip us off that something says scam?"
Jeremiah provides additional warning signs:
[26:30] Noah Michelson: "Do you recommend then having backup storage something that isn't the cloud?"
Jeremiah advocates for a layered security approach, which includes:
[44:23] Danny: "Something today from this podcast, it's probably our own intuition would be the number one tool."
Jeremiah reiterates the importance of intuition in recognizing and avoiding scams, coupled with robust cybersecurity practices.
[27:46] Raj Punjabi: "Who is the first person we're calling if we get scammed?"
Jeremiah advises:
He shares a poignant story of an individual who spent over a month trying to recover from an Instagram account takeover, illustrating the complexities involved in rectifying such breaches.
[34:46] Noah Michelson: "They're so savvy. Don't you sometimes kind of wish that it was like the days of landlines?"
The hosts discuss the emotional toll of falling victim to scams, highlighting feelings of embarrassment and shame that deter open conversations about such experiences. Jeremiah emphasizes the importance of community support and information sharing to empower others to protect themselves.
[35:50] Raj Punjabi: "It's like you're going to win a prize. It just makes you wanna click on stuff."
They touch upon the psychological tricks scammers use, like offering prizes or urgent appeals, which prey on human emotions to lower defenses.
At the end of the episode, Raj and Noah distill the discussion into five essential tips:
[48:44] Raj Punjabi: "Number one, online scams have doubled in the last five years, and everyone from young people to older folks are at risk."
[49:33] Raj Punjabi: "I've learned so much stuff today. I'm freaked out and empowered all at once."
Both hosts acknowledge the dual feelings of concern and empowerment after understanding the depth of cyber threats. They commit to applying the learned strategies to enhance their personal cybersecurity measures.
[50:25] Raj Punjabi: "But everyone else, down with you. Cyber scammers."
The episode concludes with a strong stance against cyber scammers, encouraging listeners to stay vigilant and support one another in the fight against online fraud.
In "A Hacker's Guide To Staying Safe From Scams," Am I Doing It Wrong? equips listeners with vital knowledge and practical tips to navigate the treacherous waters of online scams. With expert insights from Jeremiah Baker, the episode serves as a crucial resource for anyone looking to bolster their defenses against the ever-evolving landscape of cyber threats. By fostering awareness and promoting proactive security measures, Raj and Noah empower their audience to protect themselves and their communities from falling prey to scammers.
Notable Quotes: