Jim Love (4:44)

So John, tell us a little bit about you and how you got to where you are.

John (4:49)

Certainly I started at immigration, working in modern war crimes and then I applied to the Ontario Provincial Police because they wanted to stay within the province of Ontario instead of going to the RCMP where worked general patrol. And that's where I started getting exposure to frauds. Then I transferred to a major crime office in a county, Leonard county and with the new detectives they put you in frauds and sexual assaults. So I cut my teeth at that level. Then eventually I entered into the anti rockets branch and the unit is the Economic Crimes and Corruption unit. So I started there in 2015 and that's where we look at major economic fraud. And as technologies evolved we started to see more cyber enabled Frauds. And then I did three seconds over to the Canadian Fraud center as a law enforcement liaison officer working with law enforcement nationally and internationally. And that's where they gave me a lot of exposure to the globalization of cyber fraud and how one victim in a small town could be targeted by organized fraud groups around the world. So it really opened my eyes to how complex and the scale of these cyber frauds that are occurring around the world.

Jim Love (6:08)

Yeah, it's really interesting. And from the Canadian aspect of it, I've just been so aware of how many groups have been here in our own province of Ontario. There are a lot of. I guess you can work anywhere, it's telecommuting, but it's just amazing. And I don't know if it's the same in Ireland. Is there a reason why we're targeted at all?

John (6:35)

Yeah, I think the scale and the ability of fraud as a service and the use of technology allows really anyone around the world to be targeted as a victim. So although we see it in Canada, I think based on countries with larger population, they're being hit at the same rate as we are. Anyone and everyone is essentially a target online and through social media with the deceptive techniques. So when we look at Canada and our population of 40, 41 million, we see the exact same thing at scale in the US or in Ireland or Europe. So the organized fraud groups have just figured out how to really use social engineering. I think that's where a lot of people really get victimized.

Deirdre (7:22)

Yeah, absolutely, I agree. And it lowers the barriers to entry where your traditional crime. There are geographical or environmental constraints when it comes to online fraud. They're removed. And then you have the ability to increase your own technical video capacity by using online services to help you to perpetrate the crime. So it does lower that barrier to entry for a lot of criminals and remove the graphic strengths. And we would see very high levels here in Ireland as well. Obviously, police service won't have the full picture, but there's a lot of really interesting surveys being done to estimate the true scale of it. We use some figures here, like a housing incidence a day, and our population is only 5 million.

Jim Love (8:08)

Yeah. So I guess the question that people have is how do you. How is this type of individual fraud perceived and dealt with by law enforcement? And I mean that because it's one thing if a company gets ransomware or is robbed or things like. Police have been dealing with that for decades in terms of corporate robbery and things like that, but the explosion of individual fraud, the ability to handle Just that many cases. How do you cope with that?

John (8:51)

It's a real challenge. I know within the OPP and a lot of police services, we're looking at a victim centric approach on how we handle an individual that contacts a detachment and says I've lost significant amount of money. It's not even the loss of the funds, it's a loss of their trust in society as a whole. We're seeing these spoofing where they're purporting to be law enforcement or government or trusted businesses and I think it makes people become recluse. And when we do deal with that and a victim comes in, we try and provide them supports on how to help them rebuild their lives and their confidence. It's a really challenging situation, especially when we're dealing with elderly people and we look at the grandparents scams. There's a sense of safety that's lost. The volume is extraordinary that we're seeing across Canada. So to try and manage it at scale is a very delicate balance on how do we support the victims, can we disrupt what the bad actor's doing, can we help recover any funds? Can we help the victims get back on their feet? And then how do we hold those people that are committing these offenses accountable, especially when they're using technology that masks who they are? It's a real challenge. But I think when you would look at the Australian model, they've really figured out how to hold organizations and institutions accountable and how to compensate the victims and how to support them. That model is really interesting to see what's happening because there's been a decline in cyber fraud in Australia as a result of legislative changes and changes with organizations.

Deirdre (10:24)

I think that's a good point. With a lot of, with crime even in general, it's a whole of society or a whole of government approach that you need to follow to actually prevent, disrupt and support those who have been affected. So similarly to Canada, Ireland has a very victim centric approach. We've all followed a community policing model and the victim is at the centre of everything that we do. And I think inherent in that then is that challenge around providing those individual supports whilst dealing with the incidents at scale and providing the kind of expertise, like specific expertise in order to deal with these incidents, plus having the general expertise around victims and shoot.

John (11:02)

I think when you look at, when we look at what we've done in the op, we've created a community service engagement officers and we've created a PowerPoint presentation that allows people in the organization to provide these presentations and awareness piece to their community and they can tailor it to the needs of the community. And so when we call it the community mobilization model, when we actually see that there's a victim that's been targeted with this, then we, we bring in services in the community to help support that person, go through that sort of the triage of the event, the post event, and help them try to get back on their feet. So I really think doing podcasts like this or bringing awareness out, I think that's the key to having people recognize what is coming at them and how to reject these sort of social engineered frauds that are coming at them and then reported to the police or the Canadian E Fraud Center. And I really think having a community based approach really does help mitigate the amount of victimization that we see, at.

Jim Love (12:08)

Least help them cope with it. It's one of the things that I think we're all aware of and I've said this before and probably, maybe the audience is maybe bored of hearing of it, but I do keep bringing it up. My father told me he'd been defrauded. And my father's a very. Well, he's dead now, but he was a very intelligent man, he was well educated, he was a big person in the community. And middle of the night, two in the morning. And this is the old style grandparents scheme. Middle of the night, two in the morning. And we have. One of my brothers has been in trouble, there's no doubt about that. He's had some issues and things like that. We're a wide big family, adopted some of the kids had tough upbringings, but my parents brought them along. So middle of the night, gets a call, needs bail or whatever it was. And it took him years to tell me this because he was ashamed and he knew after he sent the money, he knew it was wrong, but he didn't know what to do. And I think that shame part of it is one of the things that I think these crooks depend on. And so the community piece is big. But how do we, are we breaking through that shame barrier with what we're trying to do?

John (13:28)

I think we see some positive changes. We see organizations like Interact or the major financial institutions actually putting information out there, whereas before it wasn't communicated as much. For instance, even on Amazon I went to order something and boom, I pop up. This could be a fraud or here are signs. I think we're doing better at communicating that. When you're looking at the elderly that are targeted or older people, we're seeing a cognitive decline. We're seeing, they're sensitive to maybe their family members are at the edge where they put them in server assisted living. And it's that loss of independence and that loss of sense of pride. And so I think they hold that in oftentimes and not tell their children. And it's a real challenge breaking down that, that stigma. When we look at the grandparents scam investigations we've had in Ontario and we had one particular victim who lost $600,000, I think it was the west coast because she had cognitive decline, couldn't remember the day before. So it's a real challenge as people start to lose their cognitive ability. And you're right, there is, there is that insecurity piece that we see.

Deirdre (14:37)

Do you think as well that we put out a lot of messaging but people still feel, yeah, but I wouldn't fall for that. I think there's some interesting that we think we're communicating but maybe we're not always communicating enough or in the right way through the right channels. And really emphasizing that anyone can fall for these because get a call in the middle of the night, you have very little time to think. There is an emotional response that's going to make you way more susceptible to calling. You're not super immune just because you're more educated or more formed than someone else. You're still subject to these social engineering tricks they do. They're used because they work.

Jim Love (15:19)

I think everybody's subject to this. And again I've told this story before. I'm extremely cautious. I run a cybersecurity podcast. I'm going to be hacked. That's not, it's not if or when I'm going to be hacked, if I haven't already been. But I try to be as careful as possible. I do everything I can be as careful as possible. Saw a note from my other brother and he's had some family problems and his mother in law was dying. There was just a whole pile of hurt that was going on in his life. And I get a note from, I see his name and I click on it and I go oh my God, I don't click on stuff. And but so everybody can be set up. And as I think is my interview with Operation Shamrock pointed out there are PhDs who are working with fraudsters. These are not. I think everybody still thinks of the Nigerian prince, some guy in a room and it's really done poorly and bad spelling and all this sort of stuff. These are very sophisticated crime units that, that, that do this and they're knowledgeable they know what buttons to push and how to get you to react. And I think the other thing I think is you guys tell me, but I think they take more time than people think as well. This isn't just iPhone. You scam you. These people really work at it.

John (16:42)

That's really interesting you mentioned that because it is a business for them and they put a lot of time and effort. They choose their people. They're quick to be able to pivot. They come up with a very sophisticated script. When we look at TV shows and movies, they're really authentic. When you see them about how policing operates, these bad actors will embrace that. They'll talk very authoritatively. When they develop their script on how they're going to pitch it to the victims. They use terminologies that law enforcement would use, especially in this grandparents scam. You know, they prey on that sense of urgency, like Deirdre was saying in the middle of night. And we as humans, we want to help out our loved ones. We want to solve that problem and we'll do anything to protect our loved ones. And when that chaotic call or message comes in, it's at fight or flight. How do we go about triaging it and making things right? And I think a lot of people have the good nature in them and then it's only after they've been victimized that they realize, oh my God, there was all these red flags that were went along with it. Maybe the terminology wasn't right. It's very exhausting to hear some of these things from the victims because you just see that sense of trust that evaporates. And now they feel so vulnerable afterwards. Like when we're talking about the corporate aspect versus the individual aspect.

Deirdre (18:07)

I think shame is a huge piece. Yeah. And what you should be doing is you should be taking action, reporting. Whereas actually like everyone is eating, going, maybe I'm wrong, maybe I didn't get scammed. Maybe I'm right. You're trying to maybe justify your actions or hide what went wrong. It's a natural human emotion, very difficult to overcome.

Jim Love (18:27)

Yeah. And are police forces set up to take. If they actually. If we could convince people to report quickly, do we have the breadth to be able to take that amount of. There's a lot of people being scammed out there. Would we be able to even take the number of calls?

John (18:44)

What's interesting you mentioned that because we've seen the numbers of reporting, the numbers of losses just escalate. When I started the Canadian Fraud center, the reporting that we received in 2020 was 164 million in reported losses. As of 2024, we're talking about 648 million in losses. My friend Dave Coffey, who does media for the Toronto police and awareness, he said Toronto police last year had reports of over almost 400 million in reported losses. When we look at the states, we're talking about $17 billion in losses. So just in Ontario alone, that's a staggering amount of money that's lost. So when we look at what the calls for service, the officers or the detectives have, they're being overwhelmed with petty crime or domestic violence and what have you, the human trafficking. And then to add on cyber on top of that, it's a lot. So that education piece internally is a big thing and we'll really work on that. And then we're working on that support mechanism. It's a real challenge at scale to handle all these victims coming in. And that's why when we look at Operation Shamrock, that website that they host is incredible. Aaron west is doing such a great job and they just put so much good literature out there. The Canadian Fraud center website is very great as well. When we look at what to do if you're a victim. So they have these steps within the op. Each detachment has mental health nurses and support mechanisms. So we identify a victim that has these needs, we can start support them and then we can start conducting that investigation at the same time. So it is a real challenge in working up at scale, at least in our organization to try and tackle these investigations.

Deirdre (20:20)

And very much the same in Ireland. In my time in Angarda, she Okona, we put a lot of effort as well in that education piece internally so that when somebody does prevent to report the crime, that people ask the right questions, record the right information, support in the right way. And I think that's as important as anything else because what you don't want is that experience where someone reports and they have a negative experience or they're not. They don't believe there's anything that can be done for them. They don't feel it was worth their while. So they're very similar here. And I would say also just recent crime figures will see fraud reporting up. So I do think that's a positive reporting.

Jim Love (20:57)

So one of the things that. And maybe we should just do take a brief breather and just go through this grandparent scheme. Just quick outline of how it works in the modern sense. Like I said, I think I had until I actually read your notes, John. I had a vision of and talked to Operation Shamrock. I had this idea that it was still the old Western Union phone in the middle of the night thing, but it's much more sophisticated. Can you just give us a bit brief rundown of how this plays out? What would the average experience look like or sound like?

John (21:30)

Yeah. So we started to see this trend in Europe and then it trends became trans international, where it started hitting Canada and the U.S. and so what we are experiencing in Canada has been, is we see these older people that still have landlines. And so the bad actors behind the scenes will essentially look up Canada411 and identify a postal code and identify an area that they want to target. And based on Canada411, you have a phone number, you have an address, and you have a name. So that's perfect information to start off with these frauds. So the bad actors will have couriers in and around that area ready to attend the residence. So what happens is there'll be a phone call that's unexpected at any time of the day where the elderly person or the older person will get the call indicating that it's from a grandchild. And so I'll use an example. They'll say, hey, Grandma. Yeah, hi. Who's this? It's your favorite grandson. Who is it? It's Johnny. Oh, hi, Johnny. What's happening? My throat's a little sore. I had to go to the to get some medicine. You wouldn't believe what happened to me. I went with a friend. There was a car accident and we rear ended a pregnant woman or got in a car accident. And the police attended the scene. They found some sort of drugs or contraband in the car. As a result, me and my friend have been arrested. Now the police tell me that I'm going to be released on bail, but we need bail money. Would you be okay to talk to the officer? And then the second party involved in this will come with a very authoritative voice and they'll say, this is officer, I'm with this detachment. And they'll use police jargon and be very authoritative. And they'll say there's a gag order in place for we need bail payment immediately in order for your family member to be released. And the victim will start thinking is, okay, I can't say anything, can't call mom or dad because they're going to be upset. That's why the grandchild's called me. Now there's instructions on to get funds and it's normally under a $10,000 threshold. And so they'll direct the victim to go to their local financial institution and try and withdraw money out of the atmosphere. And they'll get a certain amount because there's a limit. And then they'll go inside and they'll talk to the teller. And sometimes they're on the phone with a bad actress the whole time or they've been told what to say to the financial institution. So for instance, you need money out to help your grandchild pay for a car. Or we had one victim that's wired $30,000 in Montreal on the guys that it was for her sister's funeral. So they come up, they teach the victims to come up with some sort of story in order to get the maximum amount of money out. They go back home and then they contact the bad actors. And the bad actors say there's a career that's going to pick it up, put it in the envelope and put this incident number on the envelope and hand it over. And that's how the initial grandparents camp starts. And then there's. They asked for more money and we can talk about that. I'm not sure if Ireland's seen the same sort of pitch, but that's what's happening in Canada.

Deirdre (24:32)

Similar. We had a wave of them, I think around 2021 and 2023 with a similar kind of approach. I'm not sure if they had the couriers pick it up. Ireland is a smaller geographical location, but definitely that, that. Not so much being on bail but being like, I'm just, I'm stuck, I've had a crash or I've had a medical emergency and can you get me some money? Similar approach, but not, I don't think so much on the bail. More recently it's been other kind of fraud and scams. Maybe we'll talk about that later. Yeah, definitely a lot of public awareness building at that time.

Jim Love (25:14)

Yeah. And how do they bridge from that to the big money? You said they're taking hundreds of thousands of dollars in some cases.

John (25:22)

Yeah. And so what we see is the second attempt. They'll know that there's a chance that police have been called and maybe waiting for the couriers and what have you to be arrested. So what they'll say to them is they'll say there's been a change in the court process. We found additional information. The jeopardy has risen now for your grandchild in order to get them out of jail, the bail is set at a higher amount. So they'll say put money into a professional career service like our Purelator or UPS or FedEx. And just the caveat is these Professional career services. It's against their policy to send cash in the mail. So they'll tell them to wrap it up a certain way. They'll maybe put it into an item, package it up and then they'll send it. And what they're doing is they're sending to rental properties or abandoned locations and then another person in this organized crime group will pick up the funds. At that point we're also seeing if they don't have careers or if they don't have any capacity to intercept, they'll use cryptocurrency. So the victims will take the cash out, they'll go to the cryptocurrency ATM machine. And Canada is number two in the world for the most amount of cryptocurrency machines, which is really interesting. So the ability to just take your cash out of your regular ATM and then go to a crypto ATM and they'll normally get QR codes and they just scan it and they put their money in and then it's gone. Or they'll wire transfer or e transfer the funds to a synthetic account that the bad actors have created using identity compromised information. So that's how they get the big money.

Jim Love (26:57)

And is it similar. There's similar things happening in Ireland, Deirdre? Because I'm always amazed at how they get this much money from. Ok, it just, it's a lot.

Deirdre (27:09)

I'm not working in a policing context anymore, so I don't have detailed information around the current kind of methods of operation. But from what I see, it's probably more relying on money mules. I'm really interested around the cryptocurrency piece because I'm not sure with the older population in Ireland that they would have, for the vast majority that they would have that competency to actually do that. But certainly there is an issue with students allowing their accounts to be used. And even now you would still see that in surveys that people probably don't really understand the impact of what they're doing if they were allowing money moved through their account. But that's probably a more likely scenario in Ireland. And then for larger amounts, I think it's more building a relationship with somebody in a trust piece of rather than the kind of what you were describing, John, from what I can see and from what I know, slightly different. But again, you're getting the same kind.

Jim Love (27:59)

Of impact, but it's the same thing. You build a relationship, you create a situation, you break down the barriers. You use psychology or you use psychology effectively to get people to do things they wouldn't otherwise do. That's social engineering at its highest level. What should we be doing about this? I've recommended, like I said, that I think we have to have the talk with our parents, which is really a strange situation. Used to be you had the talk with your children. Now the talk with our parents and with other vulnerable people in our communities. As cybersecurity professionals, a lot of my audience work in cybersecurity. What can we be doing that would help either to stop this or at least slow it down?

John (28:50)

So while we were launching our investigation in the OP project Sharp, we wanted to figure out how we can get the information out to that specific demographic. And we were looking at the older Canadians. And you mentioned this earlier, there's so much information coming at you on social media, on the news or what have you that getting that piece out that resonates with the people is very challenging. So my task with this investigation was to come up with a very robust media and social media and awareness campaign. And to see over my shoulder here, I came up with a plaque card that is almost like the lock it or lose it. Red is bad, green is good. So what we did is we launched our one week fraud prevention initiative and we worked really closely with the RCMP because they're across Canada with their placing municipal partners with the Canadian Anti Fraud Center. And so it was a joint effort. And we did podcasts, we did radio interviews, we did newsprint, we put out media releases, we did a live chat. We came up with that graphic in the background and we used it on social media. But then we figured how do we get to the granular level? So we work with Ministry of Long Term Care in Ontario. We work with different groups that help elderly folks or older folks. We worked with Canada211 to put that information out there. We work with the Canadian Bankers association to educate the tellers at the branches. So it was all these sort of layers that we put together that really tried to put the information out there. We were able to get funding to put advertising on the back of buses across Ontario. And we took that model based on in Vancouver where they had big advertisements on bus stops and a QR code. So it was that awareness piece. But I think to get back to the speaking to your older family members is to come up with that code word that's only specific to your family. It could be whatever. It could be the word blue so you know who these people are. And to try and target the education to the children so that they can have that discussion with the older adults and we found that to be very impactful.

Jim Love (30:59)

So are there unique ways that you've. Oh, sorry. Are there interesting things or unique things you've seen?

Deirdre (31:07)

From my perspective, what I would say is the awareness piece, everything you said, John. Absolutely true. And we, we do it here as well. But from my current role now in cyber security sector, I think one of the challenges we have is we're deeply technical people trying to make that translation into language for people to understand what's happening and understand what they can do and what's in their control to do in a way that's not intimidating. And I think that's a challenge because I think especially with an older population, if you start talking about, sure, it's a safe website, HTTPs, checking that, checking for the padlock and all, it can be a little intimidating if they're not on social media or technology every day. So I think there is a challenge there for us all the time. They get better and better at explaining the risk and what's within their control to do. But certainly like that is what we're doing on a daily basis. We work very closely with Ngarde Sheikhona because we would get a lot of reports of phishing attempts, emails, SMSes, scans going on and we would share them on Guarda Sheikhon and we work with them around crime prevention advice and how to tackle them together and it's factored out better. It has to be a layered approach. It can't be one organization on their own.

Jim Love (32:24)

And what I guess the question is, what's next in all of this? What are you seeing that's new that you or that's coming up or ideas that you think or people should be watching out for.

John (32:35)

I think from what we're seeing is the bank investigator scam or bank imposter scam and it has a very similar MO to the grandparent scam where that shock you're getting call from a financial institution saying that there has been a suspicious transaction, your card's been compromised. And in eastern Ontario we're seeing the victims being told to take their bank card that's been compromised and put in a envelope and put your PIN number and the courier is going to come pick it up and they'll secure your funds in a government controlled bank account until this investigation's completed and the sting operations been uncovered. And so again they're targeting the older population and statistically from the Canadian Fraud center we see that elderly folks or older people are getting hit 33% more than the average. And that could be a secondary fraud. There's almost like a list. If you've given money out now, you're going to be hit with another type of fraud. I see the bank investigator scam really jumping up. When we look at the numbers in 2023 for the emergency grandparents scam, because we did so much awareness, the reporting to the Canadian anti fraud thinner really jumped up. So it went up to $11 million in reported losses during that year. And I think that was because we're telling the people, report your police report to the Canadian Anti Fraud Center. But when we look at the fraud categories that we saw at the Canadian Anti Fraud center, they have 30 different fraud pitches. Now some of the frauds are merging to one title, like extortion frauds. But I think the biggest fraud loss that we're seeing is investment frauds and crypto investment frauds. Again, you may have some older people that are fixed income and want to raise their investments and so they're looking at these angles. So that's a trend that we're seeing here in Canada.

Deirdre (34:28)

I think there's an underlying thing. So we see some of the same kind of things here and there's an underlying theme around very limited time to think or this fear of missing out. So even if you focus on those things as your red flags, if either of those things are present, then I think you should be concerned. There's probably an opportunity as well. Just trends that we would see is there are certain times where particular frauds are going to surface. So in Ireland, and it might be the same in Canada, when we have elections and a new government is formed, one of the early things they'll do is put together a program for government and that's where they will make promises around specific schemes and grant schemes, what they're going to do. And I think there's an opportunity around those particular times to specifically raise awareness because grants for heating your home or make a transition to green energy, older people will be particularly interested in those. And if they're getting SMS to their phones at the same time as they're hearing on the radio, it feels real. I think there's opportunities for law enforcement and for everyone involved cybersecurity to raise awareness around those peak times as well, to try and prevent some of this.

John (35:35)

And I think it's the really important aspect of all this is that reporting, when you report to your law enforcement, it goes back to Sir Robert Peel, the police of the public and the public, their police. So police won't know what's happening until they get Those reporting from the public and maybe see new trends and little nuances that change. And when we looked at the emergency grandparents scam, it was really important for us to have the victim's report. And why did that help? We knew the bad actors who were using prepaid phones and phone numbers. And so when, and let's not kid ourselves, they know personal security on their own end. So they're only going to have a number for a certain amount of time before they think it's maybe heated up and they'll transition to a new one. So by reporting that new number, then we can work with our telecommunications companies and say, here's a bad number that we've identified. Please disrupt it. So I think reporting skinny fraudster is really important as well because they have this disruption program. So if you have a bad email, a bad phone number, a bad website, a bad bank account by sending that out. And of course, the Anti Fraud center complies with privacy constraints and laws. But we can send that information out as a lead to these organizations where they can now do their own investigation and deplatform these customers or clients. I think that's really the other piece that is is crucial. And when you talk to Aaron west in Operation Shamrock, that disruption piece is a real huge piece to their success.

Deirdre (37:01)

With that reporting piece as well. What's really important is that then that for your policing, for your policing management to allocate resources effectively and efficiently to where you're going to get the best impact. You need to know where your incidents are occurring. And if you don't have those reports of fraud, it's not going to get the resources that it needs. So I think from an internal and external perspective, that reporting is really important.

Jim Love (37:28)

Yeah. And it's a bit like whack a mole. And John, you said it, we talked about the grandparent scheme. Deidre, you said there are other ones in Ireland. There are new ones that are constantly coming up and they will evolve. It's the same as with ransomware or any other threat. As soon as you find a way to hold this one, they come up with. These people are very creative and they do an incredible job at advancing this. The question I have is how we can cope with that volume of it. There are other ones and I'll give you a couple that I think are going to come your way. One is you mentioned a QR code that's out in the streets now. If you see a QR code on the street, do not click on it. Do not unless you're absolutely certain where it comes from because that's another scam. The other one that we're seeing in Canada, I don't know if you see it in Ireland we have a national broadcaster, the cbc. You will find articles from the CBC that look identical to the CBC telling you that a famous Canadian investor has. Has found a way to make a million dollars overnight and it's approved by the CBC and they're very good at this. So I think we have an explosion and just as we're wrapping up, is there any way we can deal with this?

John (38:42)

I think there is. I think it's that communication, that outreach piece. I think it's that disruption piece as well. So for instance, when I was at the Canadian and we would get different organizations reach out and say I have been spoofed. The bad actors will pay for search engine optimization. And so within the Canadian Fraud center we had one member that was solely responsible for disruption and then notifying various. So they, they have an ability to send off the websites for disruption. I think, I think trying to report and trying to disrupt. I think it's a big piece, but it's also letting the public know where is legitimate authoritative location for that information. So to go to that instead of relying on the top search engine results or like you said, the QR code having that pause and think should I scan that in? I've seen a video in the US of crime prevention officer ripping off a QR code, a parking meter and the bad actors had just slapped that on there. So it's really incredible. It's a real challenge. As we evolved in society and technology.

Deirdre (39:45)

It'S going to get harder because it's going to be more difficult to spot. Like a lot of the language issues, threat actors will be able to overcome that with the use of the lens. They'll be able to better craft their messaging and make it feel more authentic to the geographical area that they're targeting. So this is going to get harder and harder to spot from that perspective. And I think also voice and video be harder to see that this is AI generated or inauthentic. And I was thinking about this earlier as well and I was thinking some of it is behavior change that you don't leave your house without locking the door, but you will click on a link without checking or QR code without checking the link first. So how do you start to automatically do these things without having to think about it? And think about probably comes from the younger generation but that upward pressure as well as the information campaigns and I think so there's the schools and targeting schools and building media literacy and digital literacy skills at an early age will protect that generation, but also help F4 the older generation as well.

John (40:45)

And Jim, you mentioned it on another podcast that I heard that there was a link that you got and you were able to put it in AI technology and it actually warned you and told you what the issue was. So I think that technological component really is important. But the other aspect is that private public partnership, police can't arrest or wait of cyber fraud. It takes concerted effort from government, from private business to social media companies to law enforcement to all to come together and combat that. I think that's the real solution here.

Jim Love (41:13)

Here it's all around us. Facebook is they will not do anything. I'm sorry, I'm not a big Facebook fan. A lot of older people are now on Facebook. Young kids aren't. And they will sell ads to anybody. They don't care. It's just obvious. And so there's so many places now that people are vulnerable. I guess it's a. It increases, increases the, the number of places that you can be attacked from. It's just astonishing. And yet I think John, thank you and Deirdre, thank you. I think you're going to have some hope on some of this, which I think is important. But if you had one wish, what would it be? If you could have one wish that you could make happen to make the public's life better, your job better, what would it be?

John (42:03)

I'll let you start Dietrich.

Deirdre (42:05)

Oh, thank you. The tough one. And I'm going to actually just build on the point John made around information sharing, actually how to share relevant, actionable information easily and quickly. Where it needs to go and who needs to see it. Because that information sharing is really key in cybersecurity more generally and it helps to build resilience and it helps to better learn how things are evolving in real time. So you can get that two way information sharing and public private partnerships, I think are in all of that. I would say.

John (42:43)

Yeah. I think building on that awareness and education piece, my wish would be that there would be more education put out to the public. And Dieter said talking to kids at a young age. I drive my kids to school and in the car we talk about things and it's amazing. My dad, sorry, my son was saying, I just got this text message. There's no way that this came from here. And as thank you. My years of droning on for stuff, they've picked it up. So I think having more that Private public partnership. Bringing up that awareness. I think that will help us through these. And your podcast, Jim, is incredible because you raise the bar on information sharing on here are the threats, here are the trends here. You should be aware of that. I think that's a real huge piece that I'd love to see more.

Deirdre (43:26)

Yeah, it's a real challenge, isn't it, when you're constantly being bombarded with all these reports. It's to get some kind of concise and actionable information. It's really important.

Jim Love (43:38)

Yeah, it's tough to sort through it all. Just last piece in this and then I'll let you guys go. But it's the idea of investment. It's easy to talk about feet on the street. It's not sexy to talk about fingers on the keyboard. So getting funding is and getting enough resources is always an issue. But if there's something I should be doing as an episode and we've had this first chat and I thank you both for it, what should I be doing next as an episode that we could make a big difference.

John (44:07)

I think it'd be really interesting talking about job scams. We're seeing a massive increase in that and it's targeting everyone that's vulnerable. Newcomers to Canada, maybe students get out of university, maybe we'll try and transition into another job opportunities. We've seen this erosion of work from home and I think that's really appealing to people. So when you see that coming into tax, hey, make this kind of money work from all and it's really utilizing crypto and digital transfer of funds around the world and then you don't even have to have bad action in Canada to facilitate it. And so when we look at the grandparents scam, we knew that in order to get the cash they would have to have some sort of money mule to move the through the system. But when you look at that sort of digital hit and you don't need anyone candidate and then you can use crypto to get it out, I think that's the real threat vector that we're seeing. That's a real chance challenge to try and recover those funds or hold people accountable in other parts of the world that may not work with Canada, the U.S. it's a real challenge. So I think that's one we've done these crypto investment scams. I think the other one, because I think you have a lot of people that are in business world listening to this is the business email compromise. And to me, in my humble opinion, I believe that's one or Two rivaling ransom attacks because it's so easy to get those funds.

Deirdre (45:19)

In Europe we have the Network of Information Security Directives 1 good NIST 2 is now enforced and it's been transposed into Irish law and it puts significant obligations on the management board of companies actually in relation to their cybersecurity practices and they can be fined and held accountable for incidents in their organization. So actually that whole business email compromise for small and medium sized enterprises, I think that would be a really interesting one to do as well. And even exploring the different regulatory structures in different countries actually. So if you're operating in Europe, you will be subject to this legislation. It also has a very wide breadth. So we have 70 operators of essential services at the moment will probably have 4,000 entities go and a lot of them will be looking at this for the first time.

John (46:08)

And Deirdre, it's interesting you mention that because I had a major financial institution here reach out to me and had a victim that didn't feel comfortable reaching out to police. But I had that relationship and I was able to call Michael Crahan, who is the detective superintendent with Garda and call him on his personal phone and he was having bangers and mash and a pint at 6 o' clock and he was able to call the head of the financial institution, Ireland and was able to freeze the money. And so I grabbed that information in Canada and I shipped it over to him and as a result they arrested two Nigerians for money laundering in Ireland. So it's just the instant international connection that can really have success.

Jim Love (46:45)

I'm just amazed at the personal networks that you guys have because every I'm getting to know everybody, but everybody knows everyone. I see. I talked to Aaron West. John says, oh yeah, I know who Aaron every you're building such an effective personal network of law enforcement. I just find this astonishing, so important.

John (47:02)

And Aaron calls me one of her avengers. I have a meeting this next week with her with a bunch of detectives in the US and Canada and Europe. And so we talk about different trends and how we can put our brains together to combat things that we're seeing around the world. So it's really interesting. Sorry Dieter, can you say it's a.

Deirdre (47:17)

Lovely part of police posture actually that okay, policing organizations are very quite big, geographically dispersed. We've won police service in Ireland, but it's obviously spread across 500 odd stations. But it's always done all those personal connections, it's I'll do this for you out of hours because I know and Trust you and I do it for the victim but do it for you as well. And so lovely part of this culture. Personally, I think it would be interesting to delve a little bit more into why you the money mules piece because it's a younger generation that is often university students and they are more willing to take the risk for the financial rewards. They have a higher risk threshold. I think that would be a really interesting one to delve into. And again, there's an evidence based policing centre in the UK and the Met have a strategic intelligence unit and they have behavioral analysts and they look at things like when you put out like a parking fine, how can you structure the language so that people will actually reduce their speed? And I think that's something that will be interesting to explore in terms of cybersecurity advice as well is how can you tailor this and word it so that people actually follow the advice. Because some of the surveys that are coming out in Ireland at the moment would say maybe a third of people will look, have a strong password, will check links, but most people don't. So I think despite all of the communication that we're putting out, it's not actually changing behaviors. So how can you actually maybe bring those two disciplines together to get some traction?

Jim Love (48:50)

Interesting. Yeah. Using technology and maybe us using social engineering for a change. I think that's a really great thing. I think I'm going to try and do a program around that. If anybody's listening to this out there and you've got experts in it, get in touch with me. I'll go digging for some experts on social engineering. But I think that's one of the things maybe we should start. We should start using the tricks that the crooks are using. Good for you. Great stuff. Thank you both of you for doing this and I'll. I'm just glad you spent the time with us. And that's something that this program should try to do.

John (49:24)

Yeah. Showcases successes.

Jim Love (49:27)

Yeah. Sometimes you win by winning. You don't always have to. Everybody says you learn from your mistakes. You can learn from your mistakes all you want, but you can also learn from your successes.

Deirdre (49:38)

It also gives people confidence, isn't it? Okay, maybe in my case nothing can be done but I see has worked for other people that have been successful, operations that have been successful. It gives people confidence for it's worthwhile engaging and that you're not alone.

Jim Love (49:52)

Good stuff. Thank you guys. And what a beautiful note to leave it on. You're not alone. And that's our show. Let me know what you think you can reach me@technewsday ca or.com use the contact us link on the site. You can also find show notes there. And this episode came up rather quickly, so it might take me till next week to get some of the useful links that I'd like to post in there. But stay tuned for them. Thanks to our guest Deirdre and John for taking the time to share their expertise. But above all, thanks to you. You've taken the time to spend with us, and we're glad you did. I'm your host, Jim Love. David Shipley will be back with the Cyber Security News on Monday morning and I'll be back in the News Chair on Wednesday morning. Stay safe and above all, enjoy your weekend. Hug your loved ones.