Gold bars and bold lies.

Summary

Hacking Humans: Gold Bars and Bold Lies Hosted by N2K Networks | Released on December 19, 2024

In the latest episode of "Hacking Humans," hosted by Dave Buettner, Joe Kerrigan, and Maria Vermazas from N2K Networks, the trio delves deep into the intricate world of deception, influence, and social engineering within cybercrime. Titled "Gold Bars and Bold Lies," the episode unpacks sophisticated scams that exploit unsuspecting individuals and organizations, highlighting real-life cases and providing invaluable insights into recognizing and preventing such fraudulent activities.

---

1. VIN Swap Scams and Listener Insights

The episode kicks off with a discussion on VIN swap scams, a prevalent issue in the automotive market. Listener Sherman Habibian shares his firsthand experience:

Sherman Habibian [01:53]: "I saw this come across the news feed today when I was looking for a story for today, and it was a VIN swap scam. ... the police have arrested him."

Habibian recounts purchasing a seemingly legitimate GMC truck on Facebook Marketplace, only to discover it was stolen upon attempting registration. His diligence in requesting the seller's driver's license and capturing a photo of the fake ID played a crucial role in the perpetrator's arrest. However, the financial loss remains unresolved, hinting at a larger network behind the scam.

The hosts then address a listener correction regarding FinCEN reporting, emphasizing that while certain aspects are mandatory under the Bank Secrecy Act and the Patriot Act, proactive information sharing remains voluntary. Additionally, the conversation touches on the novel idea of paying taxes with cryptocurrency, a topic generating mixed sentiments among the hosts.

Dave Buettner [05:07]: "Voluntary taxes, really."

Joe Kerrigan [05:18]: "Yeah, it just sounds like a bad idea to me."

---

2. Social Engineering Attack on a KnowBe4 Employee

Joe Kerrigan narrates a compelling story about Stu Shaurman, CEO of KnowBe4, detailing a thwarted social engineering attack targeting an employee, David B.:

Joe Kerrigan [06:14]: "And it is the title of this is Real Social Engineering. Attack on knowbefore Employee Failed."

David B., the VP of Asia Pacific in Japan, received a call from someone impersonating the head of HR, Ani. The scammer employed tactics like claiming a poor phone connection and requesting urgent financial transfers, including a demand for 30,000 Singapore dollars to access his account. David's familiarity with KnowBe4's internal security protocols, such as the Phish Alert button, and his knowledge of Ani's personal preferences (like her favorite local dish) raised suspicions, leading him to terminate the communication.

Dave Buettner [07:00]: "Yeah, that's why it's being targeted."

This case underscores the importance of contextual knowledge and internal security measures in detecting and preventing sophisticated social engineering attempts.

---

3. The Rising Tide of Gold Bar Scams

Maria Vermazas introduces a disturbing trend: gold bar scams targeting affluent individuals, particularly in wealthy regions like Montgomery County, Maryland. She recounts the plight of a 75-year-old couple who were deceived into handing over $36,700 in gold bars to someone they believed was affiliated with the Federal Deposit Insurance Corp. (FDIC).

The scam unfolded through a series of escalating fraudulent interactions starting with a deceptive text message about their Apple ID being compromised. The situation quickly spiraled into more severe threats, including accusations of child pornography and warnings about Russian missile suppliers, coalescing to pressure the victims into transferring substantial funds into gold bars.

Maria Vermazas [12:53]: "Another gold bar scam, which I'm... amazed to see these and saddened."

Despite the significant financial loss amounting to $6.6 million in Montgomery County alone, the investigation revealed that the perpetrator, Yong Xian Huang, a 23-year-old who only speaks Cantonese, acted as a mule, potentially unaware of the broader criminal operations.

Joe Kerrigan [21:54]: "Yeah, he's a mule."

This segment highlights the complexity and scale of modern scams, emphasizing how easily gold bars can be leveraged for large-scale fraud due to their high value and ease of transport.

---

4. Insights from the FBI on Generative AI in Fraud

Briefly touching upon a public service announcement from the FBI's Internet Crime Complaint Center (IC3), Dave Buettner discusses the emerging threat of generative AI being exploited for financial fraud. The episode highlights how AI-driven phishing emails have become more sophisticated, making them harder to detect with perfect grammar and automated scalability.

Dave Buettner [31:07]: "...crucial to verify the identity of the person calling you..."

Hosts advise listeners to adopt traditional security measures such as creating secret words or phrases with family members and being vigilant about imperfections in images and videos as AI-generated content becomes more prevalent.

---

5. Catch of the Day: Impersonation Scams and Old Tactics

The episode concludes with a humorous yet cautionary Catch of the Day, where the hosts craft an elaborate advanced fee scam email purportedly from an FBI agent named Chad B. Yarbo. The spoof email mirrors official communications with references to specific U.S. Code sections, adding a veneer of legitimacy to the fraudulent message.

Joe Kerrigan [39:37]: "It's basically a trunk box scam, right?"

This segment serves as a reminder of the enduring effectiveness of traditional scams, even in the age of advanced technology, by capitalizing on fear and authoritative impersonation.

---

Key Takeaways and Recommendations

1. Vigilance Against Sophisticated Scams: The episode underscores the need for constant awareness and skepticism, especially when dealing with unsolicited financial requests involving unusual methods like gold bars.

2. Internal Security Measures: Organizations should strengthen internal protocols, such as KnowBe4’s Phish Alert button, to empower employees to recognize and respond to potential threats effectively.

3. Public Awareness and Education: Sharing real-life scam stories and listening to expert advice, such as the FBI's recommendations, can arm individuals and communities with the knowledge to protect themselves.

4. Integration of Security Tools: Leveraging integrated security tools, as promoted by sponsors like KnowBe4, can enhance an organization's ability to detect and counteract social engineering attempts in real-time.

---

Notable Quotes

• Sherman Habibian [01:53]: "He found a GMC truck for sale on Facebook. Marketplace, negotiated a deal... the police have arrested him."

• Dave Buettner [05:07]: "Voluntary taxes, really."

• Joe Kerrigan [06:14]: "An attack on KnowBe4 Employee Failed."

• Maria Vermazas [12:53]: "Another gold bar scam, which I'm... amazed to see these and saddened."

• Joe Kerrigan [21:54]: "He's a mule."

• Dave Buettner [31:07]: "...crucial to verify the identity of the person calling you..."

• Joe Kerrigan [39:37]: "It's basically a trunk box scam, right?"

---

Conclusion

"Gold Bars and Bold Lies" offers a deep dive into the evolving tactics of cybercriminals leveraging social engineering and high-value assets like gold bars to execute sophisticated scams. By dissecting real-life cases and integrating expert insights, the episode serves as a crucial resource for individuals and organizations aiming to bolster their defenses against the ever-changing landscape of cyber threats.

For more detailed discussions and updates on the latest in cybercrime, tune into "Hacking Humans" by N2K Networks.

Transcript

[N2K CyberWire]

You're listening to the Cyberwire Network, powered by N2K.

[Dave Buettner]

Hello, everyone, and welcome to N2K, CyberWire's hacking humans podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Buettner, and joining me is Joe Kerrigan. Hey, Joe.

[Joe Kerrigan]

Hi, Dave.

[Dave Buettner]

And our N2K colleague and host of the T Minus Space Daily podcast, Maria Vermazes. Maria hi, Dave.

[N2K CyberWire]

And hi, Joe.

[Joe Kerrigan]

Hi, Maria.

[Dave Buettner]

We've got some good stories to share this week, and we will be right back after this message from our show sponsor.

[Maria Vermazas]

But first, a word from our sponsors at know. Before, we're not talking conspiracy theory when we say it's all connected. When it comes to infosec tools, effective integrations can make or break your security stack. Though not as common. The same should be true for security awareness training. Not only does KnowBeFor deliver the world's largest library of security awareness training, but they also provide a way to integrate the various elements of your existing security stack to help you strengthen your organization's security culture. Stay with us, and in a few minutes, we'll hear from our sponsors at KnowBe4 about how you can integrate security awareness with your tech stack like never before.

[Dave Buettner]

All right, before we dig into our stories this week, we have a few bits of follow up here. You want to start us off?

[Sherman Habibian]

Joe?

[Dave Buettner]

Yeah.

[Joe Kerrigan]

I saw this come across the news feed today when I was looking for a story for today, and it was a VIN swap scam. We've been talking a lot about vin swap scams, Right. This is an actual case of a guy in Nevada. He lived in Las Vegas. His name is Sherman Habibian, and he found a GMC truck for sale on Facebook. Marketplace, negotiated a deal, and then when he went to register it, cops pulled up behind him and said at the VIN verification or the VIN inspection site, and they lit him up, you know, and he's like, oh. Sure enough, the car had been stolen. Now, the good News is that Mr. Habibian had asked for the driver's license of the guy that was selling the car for him. And the guy gave him a fake ID and he took a picture of it, but that was enough evidence to find the guy and the police have arrested him. I don't know that Mr. Habibian will get his money back, though, because that it took three days for the police to find him. And that money is probably already into somebody else's hands. The cops are saying this is a, he's a middleman, a guy that goes out and sells the car, takes the cash and goes. So there's somebody else behind this who is making the money here. And the, the, the person that got arrested is just, you know, a person of opportunity.

[Sherman Habibian]

Huh.

[Dave Buettner]

And do we, we think that maybe the truck will find its way back.

[Sherman Habibian]

To its rightful owner?

[Joe Kerrigan]

Oh, the truck is going back. Yes, that is probably going to happen because it was a stolen vehicle when Mr. Habibian bought it and took it to the VIN inspection station. They say at the VIN inspection station they see this happen about three times a week. Three times. That's a lot.

[N2K CyberWire]

Jeez.

[Joe Kerrigan]

And they recommend that if you're going to do this, if you're going to buy a truck from somebody, do it at the VIN inspection station, that you can have the VIN inspected there, make sure it's valid, make sure it's not a stolen car, make sure that all the VINs match up, and then you can go ahead with a transfer. And if they say, no, no, we're not going to the VIN inspection station, you say that I'm not buying the car from you.

[Dave Buettner]

Oh, that's good. No, that's a great advice. Huh. Okay, well, we got another bit of follow up. Some kind clarification and correction from one of our listeners. This is appreciated. That's right. This is from someone who goes by a Lippard on Mastodon who I believe follows me on Mastodon and they write, listening to the latest hacking humans. It's not accurate to make a blanket statement that bank participation in FinCEN reporting is voluntary. Banks are required to submit suspicious activity reports to FinCEN under the Bank Secrecy act and to respond to law enforcement requests under the Patriot Act. What is voluntary is participation in patriot act section 314B. Proactive information sharing between financial institutions and with law enforcement. Okay. Also raised on this episode is whether you can pay taxes with cryptocurrency. You can for state taxes in Colorado and Utah, but virtually no one does it, which does surprise me.

[N2K CyberWire]

Voluntary taxes, really.

[Dave Buettner]

And I just can't help thinking like paying your taxes in cryptocurrency would be some kind of a red flag, you know?

[Joe Kerrigan]

Yeah, it just sounds like a bad idea to me.

[Dave Buettner]

Right. It's like pulling up to the, to the IRS headquarters and trying to pay your taxes in rolls of pennies, you know?

[N2K CyberWire]

Oh, you know, someone's done it.

[Joe Kerrigan]

That does sound like someone's done that.

[N2K CyberWire]

I'm Free stater.

[Joe Kerrigan]

Malicious compliance.

[Dave Buettner]

Yeah. Yeah, it's interesting. I mean, you know, we're gonna. We'll see what happens with the coming administration, because incoming President Trump has said that he's going to be very friendly with cryptocurrency, so I suspect we could see more access to those options with his coming administration. Time will tell.

[N2K CyberWire]

And more scams.

[Dave Buettner]

Yes, and a lot more scams.

[Joe Kerrigan]

It will probably result in more scams.

[Sherman Habibian]

Probably.

[Dave Buettner]

Probably. All right, well, we would love to hear from you. If there's something you'd like to share with us, you can email us. It's hackinghumans2k.com let's jump into our stories here. And, Joe, why don't you start things off for us?

[Joe Kerrigan]

Dave, I have a story from none other than Stu Shaurman, CEO of KnowBe4, a longtime sponsor of the show.

[Dave Buettner]

That's right.

[Joe Kerrigan]

And it is the title of this is Real Social Engineering. Attack on knowbefore Employee Failed.

[Sherman Habibian]

Foiled.

[Joe Kerrigan]

Foiled.

[Sherman Habibian]

Sorry.

[Joe Kerrigan]

Yeah, it says foiled. For some reason, whenever I see the word foiled, I read it failed.

[Dave Buettner]

Okay, you failed at reading foiled.

[Joe Kerrigan]

I did. I've been foiled by foiled.

[Dave Buettner]

That's right.

[Joe Kerrigan]

The person is named. We're just gonna call him David B. Apparently, and he is the vp.

[Sherman Habibian]

Hold on, hold on.

[Dave Buettner]

It's not me.

[Joe Kerrigan]

No, it is not you. Okay, I didn't even think that. Connection, Dave.

[Dave Buettner]

Yeah, keep going.

[Joe Kerrigan]

He is the VP of Asia Pacific in Japan, and he experienced this sophisticated attack where late one night, he got a call from somebody impersonating the head of hr, Chro, if you will. And they started with phone calls, and all he could hear was, the connection is bad. The connection is bad. And they're spoofing the chief hr. His name is Ani. They're spoofing Ani's phone number. So in one of the calls, the scammer says, look, I'm on a plane, and it's not letting me do WhatsApp audio or video. Let me just text you this information. Right? And David says, okay, fine. And he starts this conversation with this scammer. And at some point in time, the scammer asked for some money. He says, I need at least 30,000 Singapore dollars in my account because I can't access my account. And David says, I got to hit the fish alert button, right? Which is a Know before product, okay, that everybody who works at Know before should know about. And this guy pretending to be the HR guy didn't know about it. So David was like, huh, that's. Well, that's a little odd. So he starts asking about. About about plans for dinner in, in Singapore and knowing that Ani has this love for this, this local dish that's only available in Singapore, I guess. But the, the scammer didn't know anything about it. So Ani was like, okay, fine, I know this is a scammer and I'm done. And he terminates the call and blocks the guy. Or terminates the text conversation and blocks the guy. So that's how it works. It works. Well, this guy reached out. David recognized a couple of red flags like you don't recognize. First off, here's something where I should. If I were a regular user of our products, I would be hitting the Phish alert button. I'd be using some interface, and the guy doesn't know about it. So there's two things right there, right? I think I should hit the Phish alert button, and the guy doesn't respond with anything that, you know, like, yeah, all right, that's what we need to do here. And then when he doesn't know the dish. This comes to a discussion that I had yesterday, actually. I was on a meeting with some local people out of Howard county, and we were talking about the capability of us to be impersonated like us, the three of us.

[Dave Buettner]

Okay.

[N2K CyberWire]

Because nobody could ever imitate you, Joe.

[Joe Kerrigan]

Yes, they could, very easily. Just by taking the last five minutes of audio where I was sitting here droning out about this story.

[Dave Buettner]

Yeah.

[N2K CyberWire]

And then in person, your words, but not your essence.

[Joe Kerrigan]

Yes, that's right. Yeah. And that's kind of my point here, is it could sound like me. And I've actually had this conversation with everybody in my family. And another person on the meeting yesterday said they'd done the same thing where I will never call and ask you for money. That's not going to happen. If I'm going to ask you for money, I'm going to be there in person. I'm gonna make the effort. Hopefully I never have to ask anybody for money, right?

[Sherman Habibian]

Yeah.

[Joe Kerrigan]

But, yeah, I'm not gonna call and ask you for money. And if I do, that's probably a scammer. So think like that. Think, think in terms of, of how, how you would. If someone's calling you and even if you think you know them, these, these voice modifiers are getting really good at almost real time. So have a password or ask some knowledge based. Do some knowledge based authentication. You know, hey, what are you going to do with the, this weekend with the trip or something like that, or. My favorite thing that I was thinking of today is somebody calls you from Your bank. I was thinking this on the way over, and this doesn't really apply to an interpersonal thing, but somebody calls you from your bank and says, hey, I'm from your bank. And you go, bank of America. And they say, yes, I don't have an account with bank of America. So you pick an account, a bank where you don't have an account and ask if they're from.

[Dave Buettner]

That right?

[N2K CyberWire]

Yeah. Yep. I remember as a kid.

[Dave Buettner]

Yeah.

[N2K CyberWire]

I remember as a kid, there was a advice. I think kids are still being given this advice. Have a password between you and your parents. If somebody says, hey, I'm here to pick you up after school. They don't let people do that anymore, but back when I was a kid, they did. They just let anybody pick up a kid.

[Joe Kerrigan]

They're like a stranger. Billy.

[Dave Buettner]

Yeah.

[N2K CyberWire]

As long as they know the password.

[Joe Kerrigan]

He says, you're on. He says, he's your uncle.

[Dave Buettner]

Yeah.

[N2K CyberWire]

Yeah, I'm sure he's related to you somehow. He looks like you. Yeah. So I actually had that conversation with my mom. Hey, do you remember that password that we talked about when I was a kid? She didn't remember, but I got to refresh her memory. It was a nice little trip down memory lane.

[Joe Kerrigan]

I'd like to know what the password was.

[N2K CyberWire]

I'm not telling you.

[Joe Kerrigan]

Because I'm going to send someone to abduct Maria or her mom.

[Dave Buettner]

You tried to social engineer me, just now kidnapped.

[N2K CyberWire]

Maria's would have been a very, very bad.

[Dave Buettner]

Just to teach her a lesson. Kidnap her mom.

[Joe Kerrigan]

Yeah.

[Dave Buettner]

What?

[Joe Kerrigan]

Yeah.

[Dave Buettner]

You never should have shared that password, Maria.

[Joe Kerrigan]

How better mom puts up much less of a fight than she does.

[N2K CyberWire]

Oh, my God. Can we leave my mom out of this?

[Dave Buettner]

Too late, too late, too late.

[Joe Kerrigan]

I would never harm a hair on your mother's head, Maria.

[N2K CyberWire]

Listen, have you ever pissed off a Greek lady? I don't recommend it.

[Dave Buettner]

No, Probably. Probably not. Probably. Probably would not go well.

[Joe Kerrigan]

Just as bad as making an Irish woman mad, which. Which I do on a regular basis.

[Dave Buettner]

Oh, I see. I see. Yes. Yes, I understand. All right, well, we will have a link to that story in the show notes. Maria, what do you have for us this week?

[N2K CyberWire]

Another gold bar scam, which I'm. I'm amazed to see these and saddened. Just to be clear, this was one.

[Dave Buettner]

I'm going to interrupt you for a second, Maria, before you get into this, have either of you ever laid hands on a gold bar?

[Joe Kerrigan]

Funny. You sure?

[N2K CyberWire]

I've never even seen one, Joe.

[Joe Kerrigan]

I laid hands.

[N2K CyberWire]

This is what gets me about these.

[Joe Kerrigan]

A friend of mine and I were talking and he was talking about how he has some gold bars laying around as you do. I was like, I'd like to see them.

[Dave Buettner]

Okay.

[Joe Kerrigan]

And he showed them to me and they are 1 oz bars. They are small bars.

[Dave Buettner]

So like the size of a fun size Hershey bar.

[Joe Kerrigan]

Is that like, not that big?

[Dave Buettner]

Okay.

[Joe Kerrigan]

And he has gold and silver.

[N2K CyberWire]

Oh, really?

[Joe Kerrigan]

You know, it's not an unusual amount. You know, it's not like all my money is tied up in gold and silver.

[Dave Buettner]

Right.

[Joe Kerrigan]

Because that's not. But it is a. How can I say this? It's something he has that he wants to have around the house.

[Dave Buettner]

Yeah.

[Joe Kerrigan]

And.

[N2K CyberWire]

Okay, well. Yeah.

[Dave Buettner]

Just in case.

[Joe Kerrigan]

Just in case.

[Dave Buettner]

Right, right.

[Joe Kerrigan]

So I get it. And who knows? Maybe one day he'll be. He'll be right. But I think if you're. If you're looking at that kind of thing, the. The thing to have lying around the house is iron and lots of it.

[Sherman Habibian]

Really?

[Joe Kerrigan]

Yeah.

[Dave Buettner]

Go on. Yeah.

[Joe Kerrigan]

If. If civilization collapses.

[N2K CyberWire]

Screw my story. I want to hear this.

[Joe Kerrigan]

Gold's not gonna be of much worth. Iron will be much more useful.

[Dave Buettner]

Also much more accessible. Like. Okay, well, I mean.

[Joe Kerrigan]

Yeah, I guess it would be more for smelting.

[Dave Buettner]

Yeah.

[Joe Kerrigan]

For forging, probably. You probably wouldn't be able to smelt. Yeah. You need a lot of civilization smelt.

[Dave Buettner]

Yeah.

[N2K CyberWire]

Keep some bronze while we're at it.

[Joe Kerrigan]

Right.

[Dave Buettner]

Joe is holding back to us. He's actually paving the sidewalk up to his new home. In gold bars.

[Joe Kerrigan]

That's right.

[N2K CyberWire]

I always thought they were sort of brick sized. You're telling me they're Hershey bar size?

[Joe Kerrigan]

I mean, the 1 ounce ones there are brick ones. Yeah.

[Dave Buettner]

Oh, yeah. I mean, the bricks are the ones you see in movies. And like whenever somebody talks about Fort Knox, you see these gold bricks.

[N2K CyberWire]

That's my mental model of them.

[Dave Buettner]

Yeah.

[N2K CyberWire]

I've never seen a real one in person. Yeah. I don't even know where I would get one. Like, how do you even acquire these? I have no idea.

[Dave Buettner]

That's a good question, Joe. Do you know where you bought one? Where does one get a 1oz gold bar? Can you go to the bank and.

[Joe Kerrigan]

A 1 oz gold bar? Is it on Amazon? I don't know that I'd buy it on it. You can go to a gold dealer and buy it. Some jewelers may have it.

[Dave Buettner]

Yeah, a jeweler. Okay, that makes sense.

[Joe Kerrigan]

Yeah. But you know, make sure that you're paying. If it's just a gold bar, make sure you're not paying very much over the price of an ounce of gold when you buy it. I mean, like when you go to buy jewelry that is so overpriced.

[Dave Buettner]

Yeah, yeah, Interesting.

[Joe Kerrigan]

And don't buy diamonds. Diamonds are a scam.

[Dave Buettner]

All right, so I'm sorry, Maria, that was a, that was a, that was much more of a rattle than I thought it was going to be. So back to you.

[N2K CyberWire]

I'm still stuck on blacksmithing. That's just where my. I know a few people who work at Forge. Have an interesting conversation with them later. I was just, I'm just amazed by the proliferation of gold bar scams because as we've all been talking about. Okay, Joe, you're the exception, Dave, and I don't know how you know where one gets these. And yet there's so many scams with these now, I guess to avoid wire fraud because people have caught onto that a little bit more. So I just, I think if anyone just comes in asking for a gold bar at this point, that's a giant red flag that something bad is going on. But anyway, anyway, so there's this, this new story about yet another gold bar scam. This is happening in you all's neck of the woods. In Maryland and Bethesda, there was a couple that had given 36, $7,000 in gold bars to a person that they believed was with the FDIC or the Federal Deposit Insurance Corp. They had been told that this money was going into a safe locker. But they started to suspect after some time when people went quiet that maybe that money was not so safe. So they went to the police. And here is the story that unfolded. As you can imagine, it was a scam. This couple of 75 year olds were initially targeted by one of the bazillions of text scams that we all tend to get nowadays. This one said that their Apple ID had been compromised and that someone had made a small unauthorized purchase with their Apple ID for around $100. So not a catastrophic amount for most people, but enough that you're going, okay, well that's not good. So the text message advised them to call an Apple rep and then when they were on the phone with the Apple rep, they got passed along that chain that we've talked about so many times where it just kind of kept escalating at every step. So first the scammer Apple rep told them to download a remote access app on their computer. So the, the next scammers, I guess could see what was going on on their computer. And then the couple was told that Their Charles Schwab account had been hacked. So then they get passed along again, this time to a Charles Schwab representative. I don't know why an Apple guy would have the Charles Schwab guy's right phone number, but apparently they do. They all. They're all buddies. And then Charles Schwab said, well, actually, $41,000. $41,500 of your money has already been used to purchase child pornography. You've been compromised. You're being reported now if, to the Federal Trade Commission. So again, now they're being passed along again. And at this point, the couple is then told they need to start withdrawing huge sums of money over $200,000 a piece, convert it to gold bars, and then hand it over, as mentioned earlier, to the FDIC for safekeeping, or else hackers would take their money and then use it to fund Russian missile suppliers. So we've.

[Dave Buettner]

Wow.

[N2K CyberWire]

Right. So child pornography threats and Russia, Russian missile supplier threats, all in one story. That would terrify a lot of people, understandably. So that's the point here.

[Joe Kerrigan]

When you hear child pornography, or as I like to prefer to call it, csam, because it's not as jarring as the. What it actually is. And when you hear that, immediately you're like, what? You're. No, I'm not involved. You become immediately defensible because this is one of the most reprehensible things that people get busted for.

[N2K CyberWire]

Agreed.

[Joe Kerrigan]

Right. Nobody wants to be associated with this at all. So even mentioning this is going to have a real impact on your thinking capability.

[Dave Buettner]

Yeah.

[N2K CyberWire]

You're gonna want to clear that up right away. Whatever it takes. I'm dropping everything. I'm getting this cleared up right now because I don't want any of this near me because no reasonable person ever would. So you're gonna do whatever it takes to just get this to go away.

[Joe Kerrigan]

Right. And while you're still worried about that, they pile on with the Russian missile suppliers.

[N2K CyberWire]

Right. Which we've talked about stories like this where when we read it back, it just sounds so funny to hear it in this context. But with the.

[Joe Kerrigan]

It doesn't feel that way.

[Dave Buettner]

I'm imagining, like, the scammers with one of those big wheels that you spin that goes click, click, you know, like, what's it gonna be? Russian missile suppliers. All right.

[Joe Kerrigan]

You know, like, who's the next one? Iranian. I hate the bargain avoidance.

[N2K CyberWire]

Yeah.

[Dave Buettner]

Just in the call center, they're like, spin the wheel. Yeah.

[N2K CyberWire]

Oh, my God. So then there's subterfuge. That's Always layered in with this where, you know, don't tell anyone about this because then you'll compromise this whole mission that we've got you on because we need you to participate and cooperate. Otherwise this all goes south and then you're implicated. So of course they're not supposed to, they're not talking about it to anybody who could help them. And then the additional subterfuge of, hey, there's going to be this handoff. It's going to be very spy movie. We're going to have you do, you know, buy these gold bars, hand them to this FDIC person who's going to ask you for a password. The passcode is 2525. And as long as he knows it and you know it, then you know it's legit. And even though it's in like an Old Navy parking lot, this is a completely legitimate transaction when you hand this money over to a total stranger. Anyway, so eventually the, as we mentioned at the top, the police did get involved because they kindly told this couple, hey, you are getting massively scammed. The police actually worked with this, this couple and created a situation where the scammers would come back to do another pickup basically of the gold bars. And a young police detective posed as a 75 year old woman. And I guess the person doing the pickup did not question this whatsoever and just sort of fell for it themselves. And when the scammer picked up the gold bars and went back to New York City where they were based, they were arrested. And the thing that I found interesting about this person, his name is Yong Xian Huang. He's 23 and speaks only Cantonese. And his attorney is saying basically because he speaks no English, how on earth could he be involved in a scam as complicated as this? He's just a patsy. And I questioned if even he knew what he was doing. Maybe he was just told, go to this place, show this number and drive. He may not even know what he was doing.

[Joe Kerrigan]

Yeah, he's a mule.

[N2K CyberWire]

Yeah, essentially. Exactly.

[Dave Buettner]

I mean, he got hired for a courier job.

[N2K CyberWire]

Yeah, he had no idea. So thankfully, it sounds like this particular scam the police are trying to investigate more. Who's at the center of it? We can probably take some wild guesses, but in Montgomery county alone, they've actually uncovered a number of these stories that we've talked about on the show. They said that gold bar scams have totaled $6.6 million in losses already that they've seen. And this is just in that one county. So this is a lot of money, and people live in that county. I went to the fdic. What was that?

[Joe Kerrigan]

I have family lives in that county.

[N2K CyberWire]

I mean, I'm just. If this is just one county, you've got to wonder how much money is flowing in gold bars in these scams all over the country. I mean, this is quite a lot of money. I went to the FDIC's website also, because I was just curious what I know they know about all these scams. So they actually have something front and center on their website, just sort of reminding people what the FDIC does and does not do. And they make a point of saying, we will never send you unsolicited correspondence asking for money, and we will never threaten you. No government agency will ever demand that you pay by gift card, wiring money, or digital currency. I think they should probably add gold bars to that list. And the FDIC would never contact you asking for personal details such as bank account information, credit and debit card numbers, Social Security numbers, or a password. So, I don't know. Gold bars just should be a red flag for anybody at this point. But this is just wild that this. These keep. These keep happening. There's so many around the country, and Montgomery county seems to be focusing on them a lot. But I'm sure there are other places where it's even worse.

[Joe Kerrigan]

At one point in time, Montgomery county was like, in the top five wealthiest counties in the country.

[Dave Buettner]

Yeah.

[Joe Kerrigan]

Very wealthy.

[N2K CyberWire]

I'm sure that's why it's being. Yeah, that's why it's being targeted. Yeah, for sure.

[Dave Buettner]

I mean, I guess also, gold bars are comparatively easy to move around the world. Right. Sort of universally valuable. Yeah.

[Joe Kerrigan]

And it's, you know, not only that, but I can take a gold bar and modify it so it doesn't have the same numbers on it. I can take the. I can have the gold. I can do something to the gold bar that makes it not the same thing. Right. Like, you can't do this with like $100. I can smelt it, right?

[N2K CyberWire]

Just take it to your forge friends, right.

[Dave Buettner]

Maybe throw in a little iron.

[Joe Kerrigan]

Yeah, I've seen, actually, I've seen people that have. Have these. These gold forges in. In their house. They're like small ovens that just get really, really hot with a. With a graphite crucible inside of it. So you could. You can do this and then pour in. Pour the gold directly into some other mold and make another ingot that doesn't have any tracking information on it and then move that wherever you want. I mean, it's pretty easy to do this. I mean, it doesn't require a lot of skill to move this stuff around. It's almost like cryptocurrency, except it's less trackable.

[N2K CyberWire]

It's very primitive. And I don't mean that disparagingly. It's just we're talking about smelting and crucibles.

[Joe Kerrigan]

It's very low level. Right.

[N2K CyberWire]

It's kind of impressive that we've all gone full circle on this.

[Joe Kerrigan]

Right.

[Dave Buettner]

Joe, you and I are around the same age. Do you recall in science class when you were coming up sort of casually playing with mercury?

[Joe Kerrigan]

No.

[Dave Buettner]

We did.

[N2K CyberWire]

I was not allowed to do that. No. We heard the stories, though.

[Joe Kerrigan]

Was that in elementary school? You heard that?

[Dave Buettner]

No, this was in high school.

[Joe Kerrigan]

No, in high school, we. We were told that. No, in high school, they actually gave us radioactive material.

[Dave Buettner]

Yeah. It explains a lot about both of us. But I'm not joking.

[Joe Kerrigan]

They brought in little. I remember what they looked like. They were little tiny discs with radiation in them.

[Dave Buettner]

Right, right.

[Joe Kerrigan]

Radioactive stuff in them.

[N2K CyberWire]

Did you lick it or.

[Joe Kerrigan]

You weren't even allowed to eat anything while you were in the class.

[Dave Buettner]

We had a hot tub full of mercury. And actually we had. So here's the thing. You get a little container of mercury. Okay. A little.

[N2K CyberWire]

Don't do this.

[Dave Buettner]

No, don't do. Ladies and gentlemen, mercury is a neurotoxin, in case you.

[Joe Kerrigan]

Yeah.

[Dave Buettner]

It's very hard to do this these days. If you spill mercury, the fire department comes and, you know, it's a hazmat situation, but it used to be, you know, mercury. Just mop it up. Yeah. Get a paper towel.

[Joe Kerrigan]

Get a paper towel.

[Dave Buettner]

Clean that up, Toss it up.

[N2K CyberWire]

It's like a liquid slinky. You can just pass it between.

[Dave Buettner]

Yeah, exactly. And let me just tell you, it is very fun to play with. So one of the fun things that we did in science class is you could. Because you could float quarters on it. Right. It's so dense.

[N2K CyberWire]

Oh, my God.

[Dave Buettner]

That you can float heavy things on the mercury. So that's the kind of thing we would do.

[Joe Kerrigan]

You put that quarter right back in your pocket.

[Dave Buettner]

Yeah. Or your mouth. We just lick this clean. There we go. Mm. Wow.

[N2K CyberWire]

It's amazing you both are still alive.

[Joe Kerrigan]

I know.

[Dave Buettner]

I know. We are both much, much smarter.

[Joe Kerrigan]

I'm going to tell you another horror story.

[Dave Buettner]

So. But here's how I'm going to bring this home. One of the kids in the school, one of the girls floated a gold ring in the mercury.

[Joe Kerrigan]

Yes.

[Dave Buettner]

And it turns out Mercury is also. Gold are highly reactive. Well, highly reactive is overstating it. They are reactive. It doesn't, like the gold didn't disappear, but the gold changed. The gold absorbed the mercury, reacted with the mercury, and it makes the gold very brittle. Where gold is typically fairly strong. Right.

[Joe Kerrigan]

And soft.

[Dave Buettner]

Right. So she gets, you know, gets the little tweezers and gets the gold ring out of there, and it's a different color and has a different patina to it, and it crumbles in her hand, and she's like, uh, oh, why did.

[N2K CyberWire]

She have that bright idea in the first place as it was?

[Dave Buettner]

Well, I mean, I bet it was curiosity.

[Joe Kerrigan]

Well, I know gold's pretty dense. Will my gold ring float on top of it?

[Dave Buettner]

Exactly. Yeah, exactly. I mean, how many of those kinds of active chemical reactions do you see in a given day? Not very many.

[Joe Kerrigan]

I didn't know that gold was reactive with mercury for some reason.

[Dave Buettner]

Yeah. So it turns out there is a way to remove the mercury from the gold and get the gold back, but it ain't gonna be in ring form anymore when you get it back. So, anyway, that's my story, Joe. What's your story of dangerous chemicals?

[Joe Kerrigan]

I got a chemistry set when I was a kid.

[Dave Buettner]

Of course you did.

[Joe Kerrigan]

You know what was in that chemistry set?

[Sherman Habibian]

Oh, I don't know.

[Dave Buettner]

Arsenic, cyanide, ferrocyanide.

[Joe Kerrigan]

Dave, it was ferrocyanide.

[Dave Buettner]

Cyanide.

[Joe Kerrigan]

I opened that up. Or I. It had a little key on the side of it. My dad's looking through it with me. He goes, oh, this will kill you, cyanide. It'll kill you very quickly not to.

[N2K CyberWire]

Have all the fun.

[Joe Kerrigan]

I was, like, terrified of this thing. I was like, you know, it's like the old adage. You're not afraid that you're going to jump off, fall off the building. You're afraid you're going to jump. You know, I know I don't want to use that stuff, but what if one day I get really stupid, you know, I don't even want it around. I don't know what happened to the chemistry set. I just got thrown into the trash at one point in time.

[Dave Buettner]

It's in a landfill somewhere. Yeah.

[Joe Kerrigan]

Ferrocyanide leaching out into the land.

[Dave Buettner]

Yes. Yeah. Just seeping into.

[N2K CyberWire]

I'm sure there's no problem with that.

[Joe Kerrigan]

I hope not.

[N2K CyberWire]

That's great.

[Joe Kerrigan]

I don't know if ferrocyanide and cyanide are the same thing. It was very, very dark blue. I do remember that.

[Dave Buettner]

Huh. What did it taste like I'm jealous?

[N2K CyberWire]

All my generation got was microplastics.

[Dave Buettner]

Right, Right. All right, well, you know what? This is a great time for us to take a break. We're gonna take a break to hear for a message from our sponsor. We'll be right back after this.

[Maria Vermazas]

Back to the concept of integrations. Knowbefor's security coach uses standard APIs to quickly and easily integrate with your existing security products from vendors like Microsoft, CrowdStrike, Cisco, and dozens of others. Security Coach analyzes alerts your security stack generates to identify events related to any risky security behavior from your users. With this information, you can set up real time coaching campaigns to target risky users based on those events from your network, endpoint identity or web security vendors. These campaigns enable you to coach your users at the moment the risky behavior occurs with contextual security tips delivered via Microsoft Teams, Slack or email. With 35 integrations and counting, Security Coach delivers the insight you need to improve your organization's security culture. Learn more about security [e-mail] SecurityCoach that's knowbe4.com SecurityCoach.

[Dave Buettner]

Okay, my story this week comes from our friends at the FBI. This is a public service announcement that they put out about a week ago. This is from the IC3, the Internet Crime Complaint Center. And this is a warning about how criminals are using generative AI for financial fraud. And so the FBI goes through a number of different things that they're seeing. Obviously AI generated text, that's probably the most obvious one. And Joe, you and I have talked about this and Maria as well, where the dead giveaways that used to be there in lots of phishing emails are gone.

[Joe Kerrigan]

Are gone. Yeah, yeah.

[Dave Buettner]

Because AI can just make it sound perfect, grammatically perfect. That's right. That's right. And it also allows the scammers to operate at a higher velocity. They can send more stuff because the AI engines can just generate multiple, multiple.

[Joe Kerrigan]

Versions and they can be automated.

[Sherman Habibian]

Right.

[Dave Buettner]

You can say to the AI, you know, generate 50 versions of an email that does this and it'll do it. Which makes them harder to catch in spam filters. They also talk about AI generated images. These are for things like social media profiles for fake ID documents. I never really thought about this. Someone could have the AI generate probably a pretty convincing looking like government employee id.

[Sherman Habibian]

Right.

[Dave Buettner]

Photos. They use them to make images of celebrities, folks who are famous on social media. All those kinds of things the AIs can do. Of course, we already talked about voice cloning in Joe's story. So that's available. And even just recently now, the video tools have become much more widely available than they were before. And so people can again make depictions of public figures. But, you know, even people you might know, you can take a photo and turn it into a moving image now and make it look like you know somebody you know. So the FBI has some tips here to protect yourself. And number one on the list is create a secret word or phrase with your family to verify their identity. As we talked about earlier in the show. Such a good idea.

[N2K CyberWire]

Don't say it on a podcast.

[Joe Kerrigan]

Don't share with your podcast co hosts.

[Dave Buettner]

Once more, Maria, what's yours with you, you and your mom?

[N2K CyberWire]

And I'm still not telling you. And that is not the phrase.

[Dave Buettner]

Getting back to the FBI. Here. They say you look for imperfections in images and videos, particularly hands and feet. There's teeth, eyes, ears. There's just little things that don't seem quite right.

[Joe Kerrigan]

Those will all go away.

[N2K CyberWire]

Stuff in the background.

[Dave Buettner]

Yeah.

[Joe Kerrigan]

All those towels will disappear.

[Dave Buettner]

Yep, yep. They say verify the identity of the person calling you by hanging up, researching the contact of the contact of the bank or organization, and call the phone number directly. And of course, they say never share sensitive information with people you've met only online or over the phone. Don't send money, gift cards, cryptocurrency, or other assets. And we're going to add gold, gold to people you do not know.

[N2K CyberWire]

And maybe also mercury or iron I don't know about.

[Dave Buettner]

Yeah, I wonder what mercury goes for these days. I don't know. Probably is as expensive to handle the transport of it is. It's very heavy also.

[Sherman Habibian]

But tasty.

[Dave Buettner]

And they say if you believe you've been a victim of financial fraud, please file a report with the FBI's Internet Crime Complaint center that [e-mail] and give them as much information as possible. I know from experience and talking to the folks in the FBI that I've had the opportunity to interview that you probably should not expect a rapid reply from the FBI when you put something into this system simply because they are so overwhelmed.

[Joe Kerrigan]

There's a lot that goes into that system.

[Sherman Habibian]

Yeah.

[Dave Buettner]

And they just don't have the resources to directly respond all the time. But know that it does get logged and it does help them go after the things that they do. They do use the information. They do work on it. So if you submit something, it is helpful, even if it might not be completely satisfying with the response that you get. So we will have a link to that in our show notes. It's actually direct, I guess you call it a press release from the FBI. And there's quite a lot of good information in there. And it's one of those things pretty concise. It also is authoritative. So it's a nice thing to send around to your friends and family to say, look, here's what the FBI says and maybe you'll help prevent them from getting scammed. All right, let's move on to our catch of the day.

[Joe Kerrigan]

Dave, Our catch of the day comes from someone who just goes by a. Fonzie. Yeah, A. They didn't provide us with, with their actual name, so. But they say this, they thought this was a funny one. And it's. I'll give you. I'll. I'll do a little spoiler, Dave. It looks very much like an advanced fee scam, but it's got a lot of moving parts.

[Dave Buettner]

Okay, it goes like this.

[Sherman Habibian]

Attention. We sincerely apologize for sending you this sensitive information via email instead of certified mail, post mail, phone or face to face conversation. It's due to the urgency and importance of the security information of our citizens. I am Assistant Special Agent in Charge Chad B. Yarbo from the Federal Bureau of Investigation field intelligence groups. We intercepted two consignment boxes at Dallas Fort Worth International Airport, Texas. The boxes were scanned but found out that it contained large sum of money and also some backup documents which bears your name as the beneficiary Receiver of the money investigation carried out on the diplomat that accompanied the boxes into the United States said that he was to deliver the fund to your residence as overdue payment owed to you. Meanwhile, we cross check all legal documents in the boxes. But we found out that your consignment was lacking an important document and we cannot release the boxes to the diplomat until the document is found. Right now we have no other choice than to confiscate your consignment according to Internal Revenue code in Title 26 also contain reporting requirement on Form 8300 report of cash payment over $10,000 received in a trade of business money laundering activity may violate 18 U.S. 1956, 18 U.S. 1957, 18 U.S. 1960 and provision of title 31 and 26 U.S. 60501 of the United States Code. This section will discuss only those money laundering and currency violation under the jurisdiction of the irs. Your consignment lacks proof of ownership. Your consignment lacks proof of ownership certificate from the joint team of IRS and irc. Therefore, you need to reply back immediately for direction on how to Procure this certificate to enable us relieved the charge of evading the law on you which is punishable offense in the United States. You are required to reply within 72 hours. At that point I will walk you through the process of clearing and claiming the money. Failure to comply may lead to your arrest, interrogation and or you being prosecuted in a court of law for tax evasion and or money laundering. We will also dunk you in Mercury.

[Dave Buettner]

No, I made that part up.

[Sherman Habibian]

You are also instructed to desist from further contact with any banks or persons in the United States, the United Kingdom or any part of the world regarding your fund because your payment has been confiscated by the Federal Bureau of Investigation here in the United States. Yours in service, Agent Chad B. Yarbo, Assistant Special Agent in Charge, FBI Dallas Area Division.

[Joe Kerrigan]

Pretty good.

[Dave Buettner]

So pretty good.

[Joe Kerrigan]

It's basically a trump box scam, right?

[Dave Buettner]

That's what I was going to say. Yeah.

[Joe Kerrigan]

And if you get, if you start talking to them, they're just going to say you need to pay this fee and this fee and this fee and this fee.

[Dave Buettner]

You know trunk box scams go back to like pirates. Yeah, yeah.

[Joe Kerrigan]

It's very old school.

[Dave Buettner]

Hundreds of years old. Yeah.

[N2K CyberWire]

And they still work. Amazing.

[Joe Kerrigan]

Yeah.

[Dave Buettner]

There's basically no punctuation in this either.

[N2K CyberWire]

No, no.

[Joe Kerrigan]

And here's my thinking. Why is it like this? Why do they not use the generative AI to produce this? Is that because they are still just writing these themselves in the hopes of getting someone who. We'll skip over all the things because we've, we've heard that in the past that part of the reason these things work is because of their bad grammar.

[Sherman Habibian]

Right.

[Joe Kerrigan]

That somebody who is going to overlook the grammar is the same kind of person that will fall for these scams. So it's like self selection. So maybe that's a value to the scammers.

[Dave Buettner]

Yeah. The only other thing I can think of is that it might somehow make it more likely that it'll get through some kind of spam filter by having.

[Sherman Habibian]

Odd run on sentences.

[Dave Buettner]

It could be.

[N2K CyberWire]

I don't know, maybe. I mean, what about the huge long codes of provisions and titles? I mean, does that actually scare. I mean, does anyone believe that? I mean. Oh yeah, USC 18, 1957. I'm intimately familiar with that one. I definitely know what this is referring to.

[Dave Buettner]

That part strikes me as being copy pasted off of the IRS website or something just to throw some legalese in there, make it seem more official.

[Joe Kerrigan]

I didn't take the time to look at these codes. Maybe I should have.

[N2K CyberWire]

You know, maybe you should.

[Joe Kerrigan]

Maybe I should. Maybe the listeners can go look them up. But no, it's just there to make it seem legit. These are probably real codes. These are probably real sections of the US Code.

[Dave Buettner]

Oh, you know what? Chad Yarbo is actually an FBI person. Yeah. I'm looking up here. On September 23rd of 2024, he was named assistant Director of the Criminal Investigative Division. Yeah.

[Joe Kerrigan]

So they've done the research on this.

[N2K CyberWire]

Can you Google any of this? Yeah, it'll come up as very plausible. And you go, oh, this must be real.

[Dave Buettner]

Yeah. So he's actually AT headquarters in D.C. but he did recently serve in the Dallas field office. So really? There you go.

[Joe Kerrigan]

So they're actually impersonating a real FBI agent.

[Sherman Habibian]

Right.

[Joe Kerrigan]

I wonder if that's legal.

[N2K CyberWire]

Maybe this email's real. Maybe this is actually happening.

[Maria Vermazas]

Oh, my God.

[Joe Kerrigan]

That's not at all legal.

[Dave Buettner]

Wouldn't it be funny if that was the thing that got busted for impersonating an FBI?

[Joe Kerrigan]

Yeah, maybe Chad Yarborough will hear this podcast and go, hey, somebody's impersonating me and using my name as a trunk box scam and advanced fee scam.

[Dave Buettner]

Mm. That's the last straw.

[Joe Kerrigan]

Yeah. Let's go find out who this is.

[Dave Buettner]

Right. Since I got my promotion, I have resources. Now that I'm at headquarters, there's no more messing around with the Chadster.

[N2K CyberWire]

I hope Chad listens to this podcast.

[Joe Kerrigan]

I would love to come on the show.

[N2K CyberWire]

I would love that so much.

[Dave Buettner]

Chad.

[N2K CyberWire]

Please reach out if you listen.

[Dave Buettner]

Yes, Chad, thank you for your service to our country. Please don't come at us.

[Joe Kerrigan]

Thanks, Chadster.

[Dave Buettner]

Yeah. All right. As always, we would love to hear from you. If there's something you'd like us to consider for our catch of the day, you can send it to us. It's hackinghumans2k.com we want to thank all of you for listening.

[Maria Vermazas]

And of course, we want to thank our sponsors at KnowBe4. They are experts at enabling a fully integrated approach to security awareness training.

[Dave Buettner]

That is hacking humans. Brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cyber security. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans2k.com we're privileged that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector. From the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. N2K makes it easy for companies to optimize your biggest investment, your people. We make you smarter about your teams while making your team smarter. Learn [e-mail] this episode is produced by Liz Stokes. Our executive producer is Jennifer Ibin. We're mixed by Elliot Peltzman and Trey Hester. Our executive editor is Brandon Karp. Peter Kilpe is our publisher. I'm Dave Bittner.

[Joe Kerrigan]

I'm Joe Kerrigan.

[N2K CyberWire]

And I'm Maria Varmazas.

[Dave Buettner]

Thanks for listening.