Gold bars and bold lies.

Summary

Podcast Summary: Hacking Humans – "Gold Bars and Bold Lies"

Podcast Information:

• Title: Hacking Humans
• Host/Author: N2K Networks
• Description: Deception, influence, and social engineering in the world of cybercrime.
• Episode: Gold Bars and Bold Lies
• Release Date: June 19, 2025

---

Introduction and Follow-Up

The episode opens with Dave Buettner and Joe Kerrigan welcoming listeners to "Hacking Humans," a podcast dedicated to unveiling the intricacies of social engineering scams and cyber exploits affecting organizations globally.

Key Quote:

• [00:14] Dave Buettner: "Welcome to N2K, CyberWire's Hacking Humans podcast, where each week we explore the social engineering scams, phishing schemes, and criminal exploits impacting organizations worldwide."

Before delving into main stories, the hosts address recent developments and listener feedback, ensuring accurate information dissemination.

VIN Swap Scam Incident

Joe Kerrigan recounts a recent VIN swap scam case from Nevada, where a man named Sherman Habibian fell victim to purchasing a stolen GMC truck via Facebook Marketplace. The police intervened during the VIN verification, leading to the arrest of the scammer.

Key Quotes:

• [01:32] Joe Kerrigan: "A guy in Nevada found a GMC truck on Facebook Marketplace, negotiated a deal, but when he went to register it, the cops pulled him over and discovered the car was stolen."
• [03:19] Maria Vermazes: "Jeez."

The incident highlights the importance of verifying vehicle identities at official VIN inspection stations to prevent similar scams.

Listener Correction on FinCEN and Cryptocurrency Taxes

A listener, Lippard, clarifies misconceptions regarding FinCEN reporting and the use of cryptocurrency for tax payments.

Key Quote:

• [03:54] Listener Voice: "Banks are required to submit suspicious activity reports to FinCEN under the Bank Secrecy Act and respond to law enforcement requests under the Patriot Act. What is voluntary is participation in Patriot Act Section 314."

The hosts discuss the complexities and potential risks associated with using cryptocurrencies for tax payments, emphasizing the increased likelihood of fraud.

Social Engineering Attack on KnowBe4 Employee

Joe Kerrigan shares a compelling story from Stu Shauerman, CEO of KnowBe4, about a failed social engineering attempt targeting a VP named David B. The scammer impersonated the head of HR, attempting to extract funds under false pretenses.

Key Quotes:

• [06:01] Joe Kerrigan: "The scammer started by impersonating the head of HR, Ani, and even spoofed her phone number."
• [10:39] Joe Kerrigan: "Have a password or ask some knowledge-based authentication... like, what are you doing this weekend?"

Dave Buettner adds practical advice on recognizing red flags, such as unfamiliar protocols like the "Phish Alert Button," and the importance of verifying identities through established channels.

Gold Bar Scams in Maryland

Maria Vermazes presents a disturbing case of a gold bar scam involving a 75-year-old couple in Bethesda, Maryland. Believing they were securing their funds with the FDIC, the couple was manipulated into transferring $36,700 into gold bars, only to realize it was a sophisticated scam.

Key Quotes:

• [17:30] Maria Vermazes: "The couple was told to convert over $200,000 each into gold bars and hand them over to an FDIC representative to prevent their money from funding Russian missile suppliers."
• [21:33] Joe Kerrigan: "They're basically targeting wealthy counties because gold bars are easy to move and universally valuable."

The police intervened by setting up a sting operation, resulting in the arrest of Yong Xian Huang, a young courier who was unknowingly part of the scam. Montgomery County alone has reported losses totaling $6.6 million from such scams, indicating a widespread issue.

FBI's Warning on AI in Financial Fraud

Dave Buettner discusses a recent FBI public service announcement highlighting the burgeoning use of generative AI in financial fraud. The FBI warns about AI-generated text, images, and voice cloning that enhance the sophistication and success rates of scams.

Key Quotes:

• [31:14] Maria Vermazes: "Don't say it on a podcast."
• [32:21] Dave Buettner: "The dead giveaways that used to be there in phishing emails are gone because AI can make them sound perfect and grammatically flawless."

The hosts emphasize the need for heightened vigilance and better verification methods, such as secret phrases and scrutinizing communication for subtle imperfections.

Catch of the Day: Trunk Box Scam Impersonating FBI Agent

Joe Kerrigan introduces the "Catch of the Day," a deceptive voicemail message impersonating an FBI agent named Chad B. Yarbo. The scammer uses official-sounding language and legal references to intimidate victims into complying with fraudulent requests.

Key Quotes:

• [36:19] Dave Buettner: "They intercepted two consignment boxes with large sums of money and backup documents bearing your name as the beneficiary."
• [38:46] Joe Kerrigan: "If you start talking to them, they're just going to say you need to pay this fee and this fee and this fee."

The hosts analyze the scam's components, noting the inclusion of real legal codes to lend authenticity and the use of outdated grammar to target vulnerable individuals.

Conclusion and Final Remarks

The episode wraps up with the hosts reiterating the importance of skepticism and verification in all financial dealings. They encourage listeners to share their experiences and stay informed about evolving scam tactics.

Key Quote:

• [35:11] Joe Kerrigan: "There's a lot that goes into that system. But know that it does get logged and it does help them go after the things that they do."

Listeners are reminded to utilize resources like the FBI's Internet Crime Complaint Center (IC3) for reporting and seeking assistance.

---

Notable Quotes with Timestamps:

• [00:14] Dave Buettner: Welcome to the podcast.
• [01:32] Joe Kerrigan: Details of the VIN swap scam.
• [03:54] Listener Voice: Clarification on FinCEN reporting.
• [06:01] Joe Kerrigan: Description of the social engineering attack.
• [17:30] Maria Vermazes: Overview of the gold bar scam.
• [31:14] Maria Vermazes: Advice on secret phrases.
• [36:19] Dave Buettner: Introduction to the trunk box scam.

---

Key Insights:

• Scammers' Tactics Evolve: From VIN swap scams to sophisticated social engineering attacks, scammers continuously adapt their methods to exploit victims.
• AI as a Double-Edged Sword: While AI enhances legitimate cybersecurity measures, it also empowers scammers to create more convincing and scalable fraud attempts.
• Importance of Verification: Establishing secret phrases and independently verifying identities are crucial steps in preventing falling victim to scams.
• Gold as a Target: Gold bars offer anonymity and ease of transport, making them an attractive asset for financial fraud.

Conclusions: The episode underscores the necessity for individuals and organizations to stay vigilant against evolving scam techniques. By understanding the tactics employed by scammers and implementing robust verification protocols, one can significantly reduce the risk of falling prey to such deceptive schemes.

Transcript

[Maria Vermazes]

You're listening to the Cyberwire Network, powered by N2K.

[Dave Buettner]

Hello, everyone, and welcome to N2K, CyberWire's hacking humans podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Buettner, and joining me is Joe Kerrigan. Hey, Joe.

[Joe Kerrigan]

Hi, Dave.

[Dave Buettner]

And our N2K colleague and host of the T Minus Space Daily podcast, Maria Vermazes. Maria.

[Maria Vermazes]

Hi, Dave. And hi, Joe.

[Joe Kerrigan]

Hi, Maria.

[Dave Buettner]

We've got some good stories to share this week, and we will be right back after this message from our show sponsor.

[Sponsor Voice]

And now a few thoughts from our sponsors. At Threat Locker, the tactics used by cyber criminals are becoming more and more advanced every day. The shift from a default allow approach to a default deny is more critical than ever. This is where ThreatLocker comes in. Stay tuned for how ThreatLocker allow listing and ring fencing has your back.

[Dave Buettner]

All right, before we dig into our stories this week, we have a few bits of follow up here. You want to start us off? Joe?

[Maria Vermazes]

Yeah.

[Joe Kerrigan]

I saw this come across the news feed today when I was looking for a story for today, and it was a vin swap scam. We've been talking a lot about vin swap scams, right? This is an actual case of a guy in Nevada. He lived in Las Vegas. His name is Sherman Habibian, and he found a GMC truck for sale on Facebook Marketplace, negotiated a deal, and then when he went to register it, cops pulled up behind him and said at the. At the VIN verification or the VIN inspection site. And they lit him up, you know, and he's like, oh, sure enough, the car had been stolen. Now, the good News is that Mr. Habibian had asked for the driver's license of the guy that was selling the car for him, and the guy gave him a fake ID and he took a picture of it, but that was enough evidence to find the guy, and the police have arrested him. I don't know that Mr. Habibian will get his money back, though, because it took three days for the police to find him. And that money is probably already into somebody else's hands. The cops are saying this is a. He's a middleman, a guy that goes out and sells the car, takes the cash and goes. So there's somebody else behind this who is making the money here. And the person that got arrested is just, you know, a person of opportunity.

[Dave Buettner]

Huh? And do we, we think that maybe the truck will find its way back.

[Listener Voice]

To Its rightful owner.

[Joe Kerrigan]

Oh, the truck is going back. Yes. Okay, that, that is, that is probably going to happen because it is a. It was a stolen vehicle when Mr. Habibian bought it and took it to the VIN inspection station. They say at the VIN inspection station they see this happen about three times a week. Three times. That's a lot.

[Maria Vermazes]

Jeez.

[Joe Kerrigan]

And they recommend that if you're going to do this, if you're going to buy a truck from somebody, do it at the VIN inspection station, that you can have the VIN inspected there, make sure it's valid, make sure it's not a stolen car, make sure that all the VINs match up, and then you can go ahead with a transfer. And if they say, no, no, we're not going to the VIN inspection station, you say that I'm not buying the car from you.

[Dave Buettner]

Oh, that's good. No, that's a great advice. Huh. Okay, well, we got another bit of follow up. Some kind clarification and correction from one of our listeners.

[Maria Vermazes]

This is appreciated.

[Listener Voice]

That's right.

[Dave Buettner]

This is from someone who goes by Lippard on Mastodon, who I believe follows me on Mastodon. And they write, listening to the latest hacking humans. It's not accurate to make a blanket statement that bank participation in FinCEN reporting is voluntary. Banks are required to submit suspicious activity reports to FinCEN under the Bank Secrecy act and to respond to law enforcement requests under the Patriot Act. What is voluntary is participation in patriot act section 314. Proactive information sharing between financial institutions and with law enforcement. Okay. Also raised on this episode is whether you can pay taxes with cryptocurrency. You can for state taxes in Colorado and Utah, but virtually no one does it, which does surprise me.

[Maria Vermazes]

Voluntary taxes, really.

[Dave Buettner]

And I just can't help thinking like paying your taxes in cryptocurrency would be some kind of a red flag, right?

[Joe Kerrigan]

Yeah. It just sounds like a bad idea to me.

[Dave Buettner]

Right. It's like pulling up to the IRS headquarters and trying to pay your taxes in rolls of pennies, you know?

[Maria Vermazes]

Oh, you know, someone's done it.

[Joe Kerrigan]

That does sound like someone's done that. I'm Free Stater Melissa's compliance.

[Dave Buettner]

Yeah. Yeah, it's interesting. I mean, you know, we're gonna, we'll see what happens with the coming administration because incoming President Trump has said that he's going to be very friendly with cryptocurrency. So I suspect we could see more access to those options with his coming administration.

[Listener Voice]

So time will tell.

[Maria Vermazes]

And more scams.

[Dave Buettner]

Yes, and a lot more Scams.

[Joe Kerrigan]

It will probably result in more scams.

[Listener Voice]

Probably.

[Dave Buettner]

Yep, probably. All right, well, we would love to hear from you. If there's something you'd like to share with us, you can email us. It's hackinghumans2k.com let's jump into our stories here. And, Joe, why don't you start things off for us?

[Joe Kerrigan]

Dave, I have a story from none other than Stu Shauerman, CEO of KnowBe4, a longtime sponsor of the show.

[Dave Buettner]

That's right.

[Joe Kerrigan]

And it is the title of this is real Social engineering. Attack on KnowBe4 employee failed.

[Listener Voice]

Foiled.

[Joe Kerrigan]

Foiled.

[Listener Voice]

Sorry.

[Joe Kerrigan]

Yeah, it says foiled. For some reason, whenever I see the word foiled, I read it failed.

[Dave Buettner]

Okay, you failed at reading foiled.

[Joe Kerrigan]

I did. I've been foiled by foiled.

[Dave Buettner]

That's right.

[Joe Kerrigan]

The person is named. We're just gonna call him David B. Apparently, and he is the vp.

[Listener Voice]

Hold on, hold on.

[Dave Buettner]

It's not me.

[Joe Kerrigan]

No, it is not you. Okay, I didn't even take that connection, Dave.

[Dave Buettner]

Yeah, keep going.

[Joe Kerrigan]

He is the VP of Asia Pacific in Japan, and he experienced this sophisticated attack where late one night, he got a call from somebody impersonating the head of hr, Chro, if you will. And they started with phone calls, and all he could hear was, the connection is bad. The connection is bad. And they're spoofing the chief hr. His name is Ani. They're spoofing Ani's phone number. So in one of the calls, the scammer says, look, I'm on a plane, and it's not letting me do WhatsApp audio or video. Let me just text you this information, right? And David says, okay, fine. And he starts this conversation with this scammer. And at some point in time, the scammer asked for some money. He says, I need at least 30,000 Singapore dollars in my account because I can't access my account. And David says, I got to hit the fish alert button, right? Which is a Know before product that everybody who works at Know before should know about. And this guy pretending to be the HR guy didn't know about it. So David was like, huh, that's. Well, that's a little odd. So he starts asking about. About. About plans for dinner in. In Singapore, and. And knowing that Ani has this love for this. This local dish that's only available in Singapore, I guess. But the. The scammers didn't know anything about it. So Ani was like, okay, fine. I know this is a scammer, and I'm done. And he terminates the call and blocks the guy or terminates the text conversation and blocks the guy. So that's how it works. When it works. Well, this guy reached out. David recognized a couple of red flags like you don't recognize. First off, here's something where I should. If I were a regular user of our products, I would be hitting the fish alert button. I'd be using some interface and the guy doesn't know about it. So there's two things right there, right. I think I should hit the Phish alert button. And the guy doesn't respond with anything that, you know, like, yeah, all right, that's what we need to do here. And then when he doesn't know the dish. This comes to a discussion that I had yesterday, actually. I was on a meeting with some local people out of Howard county, and we were talking about the capability of us to be impersonated like us, the three of us.

[Listener Voice]

Okay.

[Maria Vermazes]

Because nobody could ever imitate you, Joe.

[Joe Kerrigan]

Yes, they could, very easily. Just by taking the last five minutes of audio where I was sitting here droning on about this story.

[Dave Buettner]

Yeah.

[Maria Vermazes]

And then in person, your words, but not your essence.

[Joe Kerrigan]

Yes, that's right. Yeah. And that's kind of my point here, is it could sound like me. And I've actually had this conversation with everybody in my family. And another person on the meeting yesterday said they'd done the same thing where I will never call and ask you for money. That's not going to happen. If I'm going to ask you for money, I'm going to be there in person. I'm going to make the effort. Right. Hopefully I never have to ask anybody for money.

[Dave Buettner]

Right. Yeah.

[Joe Kerrigan]

But, yeah, I'm not going to call and ask you for money. And if I do, that's probably a scammer. So think like that. Think, think in terms of, of how, how you would if someone's calling you. And even if you think you know them, these, these voice modifiers are getting really good and almost real time. So have a password or ask some knowledge based, do some knowledge based authentication. You know, hey, what are you going to do with the, this weekend with the trip or something like that, or. My favorite thing that I was thinking of today is somebody calls you from your bank. I was thinking this on the way over, and this doesn't really apply to an interpersonal thing, but somebody calls you from your bank and says, hey, I'm from your bank. And you go, bank of America. And they say, yes, I don't have an account with bank of America. So you pick an account, a bank where you don't have an account and ask if they're from that.

[Maria Vermazes]

Yeah. Yep. I remember as a kid. Yeah, I remember as a kid there was a advice. I think kids are still being given this advice. Have a password between you and your parents. If somebody says, hey, I'm here to pick you up after school. They don't let people do that anymore, but when I was a kid, they did. They used to just let anybody pick up a kid.

[Dave Buettner]

They're like a stranger, Billy. Yeah.

[Maria Vermazes]

As long as they know the password.

[Joe Kerrigan]

He says you're. He says he's your uncle.

[Maria Vermazes]

Yeah, yeah, yeah, I'm sure. I'm sure he's related to you somehow. He looks like you. Yeah. So I actually had that conversation with my mom. Hey, do you remember that password that we talked about when I was a kid? She didn't remember, but I got to refresh her memory. It was a nice little trip down memory lane.

[Joe Kerrigan]

I'd like to know what the password was.

[Maria Vermazes]

I'm not telling you.

[Joe Kerrigan]

Because I'm going to send someone to abduct Maria or her mom.

[Dave Buettner]

You tried to social engineer me just now. Kidnapped Maria's mom would have been a.

[Maria Vermazes]

Very, very bad one.

[Dave Buettner]

Just to teach her a lesson. Kidnap her mom?

[Joe Kerrigan]

Yeah.

[Maria Vermazes]

What?

[Dave Buettner]

Yeah, you never should have shared that password, Maria.

[Joe Kerrigan]

A better mom puts up much less of a fight than she does.

[Maria Vermazes]

Oh, my God. Can we leave my mom out of this?

[Dave Buettner]

Too late, too late, too late.

[Joe Kerrigan]

I would never harm a hair on your mother's head, Maria.

[Maria Vermazes]

Listen, have you ever pissed off a Greek lady? I don't recommend it.

[Dave Buettner]

No, probably. Probably not. Probably. Probably would not go well.

[Joe Kerrigan]

Probably just as bad as making an Irish woman mad, which I do on a regular basis.

[Dave Buettner]

Oh, I see. I see. Yes, yes, I understand. All right, well, we will have a link to that story in the show notes. Maria, what do you have for us this week?

[Maria Vermazes]

Another gold bar scam, which I'm amazed to see these and saddened. Just to be clear. This was one I.

[Dave Buettner]

Let me interrupt you for a second, Maria, before you get into this. Have either of you ever laid hands.

[Listener Voice]

On a gold bar?

[Joe Kerrigan]

Funny.

[Maria Vermazes]

And sure, I've never even seen one.

[Dave Buettner]

Joe.

[Joe Kerrigan]

I laid hands.

[Maria Vermazes]

This is what gets me about these.

[Joe Kerrigan]

A friend of mine and I were talking and he was talking about how he has some gold bars laying around as you do. And I was like, I'd like to see them.

[Dave Buettner]

Okay.

[Joe Kerrigan]

And he showed them to me and they are 1 oz bars. They are small bars.

[Dave Buettner]

So like the size of A fun size Hershey bar.

[Joe Kerrigan]

Is that like, not that big?

[Dave Buettner]

Okay.

[Joe Kerrigan]

And he has gold and silver.

[Maria Vermazes]

Oh, really?

[Joe Kerrigan]

It's not an unusual amount. You know, it's not like all my money is tied up in gold and silver.

[Dave Buettner]

Right.

[Joe Kerrigan]

Because that's not. But it is a. How can I say this? It's something he has that he wants to have around the house.

[Dave Buettner]

Yeah.

[Joe Kerrigan]

And.

[Maria Vermazes]

Okay, well. Yeah.

[Dave Buettner]

Just in case.

[Joe Kerrigan]

Just in case.

[Dave Buettner]

Right, right.

[Joe Kerrigan]

So I get it. And who knows? Maybe one day he'll be. He'll be. Right. But I think if you're. If you're looking at that kind of thing, the thing to have lying around the house is iron and lots of it.

[Listener Voice]

Really?

[Joe Kerrigan]

Yeah.

[Dave Buettner]

Go on.

[Joe Kerrigan]

Yeah. If civilization collapses.

[Maria Vermazes]

Screw my story. I want to hear this.

[Joe Kerrigan]

Gold's not going to be of much worth. Iron will be much more useful also much more accessible.

[Dave Buettner]

Like. Okay, well, I mean.

[Joe Kerrigan]

Yeah, I guess it would be more for smelting. Yeah. For forging, probably. You probably wouldn't be able to smelt. Yeah. You need a lot of civilization smelt.

[Dave Buettner]

Yeah.

[Maria Vermazes]

Save some bronze while we're at it.

[Joe Kerrigan]

Right.

[Dave Buettner]

Joe is holding back to us. He's actually paving the sidewalk up to his new home in gold bars.

[Joe Kerrigan]

That's right.

[Maria Vermazes]

I always thought they were sort of brick sized. You're telling me they're Hershey bar size.

[Joe Kerrigan]

I mean, the 1 ounce ones there are brick ones.

[Dave Buettner]

Oh, yeah. I mean, the bricks are the ones you see in movies. And like whenever somebody talks about Fort Knox, you see these gold bricks.

[Maria Vermazes]

That's my mental model of them.

[Dave Buettner]

Yeah.

[Maria Vermazes]

I've never seen a real one in person. Yeah. I don't even know where I would get one. Like, how do you even acquire these? I have no idea.

[Dave Buettner]

That's a good question, Joe. Do you know where you buy. Where does one get a 1oz gold bar? Can you go to the bank and.

[Joe Kerrigan]

A 1 oz gold bar.

[Maria Vermazes]

Is it on Amazon?

[Joe Kerrigan]

I don't know that I'd buy it on it. You can go to a gold dealer and buy it. Some jewelers may have it.

[Dave Buettner]

Yeah.

[Listener Voice]

Oh, a jeweler.

[Dave Buettner]

Okay, that makes sense.

[Joe Kerrigan]

Yeah. But you know, make sure that you're paying. If it's just a gold bar, make sure you're not paying very much over the price of an ounce of gold when you buy it. I mean, like when you go to buy jewelry that is so overpriced.

[Dave Buettner]

Yeah. Interesting.

[Joe Kerrigan]

And don't buy diamonds. Diamonds are a scam.

[Dave Buettner]

All right, so I'm sorry, Maria. That was a. That was a. That was much More of a rattle than I thought it was going to be. So back to you.

[Maria Vermazes]

I'm still stuck on blacksmithing. That's just where my. I know a few people who work a forge and have an interesting conversation with them later. I was just, I'm just amazed by the proliferation of gold bar scams because as we've all been talking about. Okay, Joe, you're the exception, Dave, and I don't know how you know where one gets these and yet there's so many scams with these now, I guess to avoid wire fraud because people have caught onto that a little bit more. So I just, I think if anyone just comes in asking for a gold bar at this point, that's a giant red flag that something bad is going on. But anyway, anyway, so there's this, this new story about yet another gold bar scam. This is happening in you all's neck of the woods. In Maryland and Bethesda. There was a couple that had given 36, $7,000 in gold bars to a person that they believed was with the FDIC or the Federal Deposit Insurance Corp. They had been told that this money was going into a safe locker. But they started to suspect after some time when people went quiet that maybe that money was not so safe. So they went to the police. And here is the story that unfolded. As you can imagine, it was a scam. This, 70. These, this couple of 75 year olds were initially targeted by one of the bazillions of text scams that we all tend to get nowadays. This one said that their Apple ID had been compromised and that someone had made a small unauthorized purchase with their Apple ID for around a hundred dollars. So not a catastrophic amount for most people, but enough that you're going, okay, well that's not good. So the text message advised them to call an Apple rep. And then when they were on the phone with the Apple rep, they got passed along that chain that we've talked about so many times where it just kind of kept escalating at every step. So first the scammer Apple rep told them to download a remote access app on their computer. So the next scammers I guess could see what was going on on their computer. And then the couple was told that their Charles Schwab account had been hacked. So then they get passed along again, this time to a Charles Schwab representative. I don't know why an Apple guy would have the Charles Schwab guy's right phone number, but apparently they do. They all are, they're all buddies and Then Charles Schwab said, well, actually, $41,000, $41,500 of your money has already been used to purchase child pornography. You've been compromised. You're being reported now if, to the Federal Trade Commission. So again, now they're being passed along again. And at this point, the couple's then told they need to start withdrawing huge sums of money over $200,000 a piece, convert it to gold bars, and then hand it over, as mentioned earlier, to the FDIC for safekeeping, or else hackers would take their money and then use it to fund Russian missile suppliers. So we've.

[Listener Voice]

Wow.

[Maria Vermazes]

Right. So child pornography threats and Russian missile supplier threats all in one story. That would terrify a lot of people, understandably. So that's the point here.

[Joe Kerrigan]

When you hear child pornography, or as I like to prefer to call it, csam, because it's not as jarring as the. What it actually is. And when you hear that, immediately you're like, what? You're. No, I'm not involved. You become immediately defensible because this is one of the most reprehensible things that people get busted for.

[Maria Vermazes]

Agreed.

[Joe Kerrigan]

Right, Agreed. Nobody wants to be associated with this at all. So even mentioning this is going to have a real impact on your thinking capability.

[Maria Vermazes]

Yeah, you're gonna want to clear that up right away. Whatever it takes. I'm dropping everything. I'm getting this cleared up right now because I don't want any of this near me because no. No reasonable person ever would. So you're going to do whatever it takes to just get this to go away.

[Joe Kerrigan]

Right. And while you're still worried about that, they pile on with the Russian missile suppliers.

[Maria Vermazes]

Right. Which we've. We've talked about stories like this where when we read it back, it just sounds so funny to hear it in this context, but.

[Joe Kerrigan]

But it doesn't feel that way.

[Dave Buettner]

I'm imagining, like, the scammers with one of those big wheels that you spin that goes click, click, click, you know, like, what's it going to be? Russian missile suppliers. All right.

[Joe Kerrigan]

You know, like, who's the next one? Iranian.

[Maria Vermazes]

I hate the bargain.

[Joe Kerrigan]

Avoidance.

[Dave Buettner]

Yeah. Just in the call center. They're like, spin the wheel. Yeah.

[Maria Vermazes]

Oh, my God. So then there's subterfuge that's always layered in with this where, you know, don't tell anyone about this, because then you'll compromise this whole mission that we've got you on because we need you to participate and cooperate. Otherwise this all goes south and then you're implicated. So, of Course they're not supposed to. They're not talking about it to anybody who could help them. And then the additional subterfuge of, hey, there's going to be this handoff. It's going to be very spy movie. We're going to have you do, you know, buy these gold bars, hand them to this FDIC person who's going to ask you for a password. The passcode is 2525. And as long as he knows it and you know it, then you know it's legit. And even though it's in like an old Navy parking lot, this is a completely legitimate transaction when you hand this money over to a total stranger. Anyway, so eventually, as we mentioned at the top, the police did get involved because they kindly told this couple, hey, you are getting massively scammed. The police actually worked with this, this couple and created a situation where the scammers would come back to do another pickup, basically of the gold bars. And a young police detective posed as a 75 year old woman. And I guess the person doing the pickup did not question this whatsoever and just sort of fell for it themselves. And when the scammer picked up the gold bars and went back to New York City where they were based, they were arrested. And the thing that I found interesting about this person, his name is Yong Xian Huang. He's 23 and speaks only Cantonese. And his attorney is saying basically because he speaks no English, how on earth could he be involved in a scam as complicated as this? He's just a patsy. And I questioned if even he knew what he was doing. Maybe he was just told, go to this place, show this number and drive. He may not have even known what he was doing.

[Joe Kerrigan]

Yeah, he's a mule.

[Maria Vermazes]

Yeah, essentially. Exactly.

[Dave Buettner]

I mean, he got hired for a courier job.

[Maria Vermazes]

Yeah, he had no idea. So thankfully, it sounds like this particular scam the police are trying to investigate more. Who's at the center of it? We can probably take some wild guesses, but in Montgomery county alone, they've actually uncovered a number of these stories that we've talked about on the show. They said that gold bar scams have totaled 6 and $6.6 million in losses already that they've seen. And this is just in that one county. So this is a lot of money and people live in that county. I went to the fdic. What was that?

[Joe Kerrigan]

I have family lives in that county.

[Maria Vermazes]

I mean, I'm just. If this is just one, one county, you've got to wonder how much money is flowing in gold Bars in these scams all over the country. I mean, this is quite a lot of money. I went to the FDIC's website also because I was just curious what I know they know about all these scams. So they actually have something front and center on their website, just sort of reminding people what the FDIC does and does not do. And they make a point of saying, we will never send you unsolicited correspondence asking for money, and we will never threaten you. No government agency will ever demand that you pay by gift card, wiring money or digital currency. I think they should probably add gold bars to that list. And the FDIC would never contact you asking for personal details such as bank account information, credit and debit card numbers, Social Security numbers, or a password. So, I don't know. Gold bars just should be a red flag for anybody at this point. But this is just wild that this. These keep. These keep happening. There's so many around the country, and Montgomery county seems to be focusing on them a lot. But I'm sure there are other places where it's even worse.

[Joe Kerrigan]

At one point in time, Montgomery county was like, in the top five wealthiest counties in the country.

[Dave Buettner]

Yeah.

[Joe Kerrigan]

Very wealthy.

[Maria Vermazes]

I'm sure that's why it's being. Yeah, that's why it's being targeted. Yeah, for sure.

[Dave Buettner]

I mean, I guess also, gold bars are comparatively easy to move around the world. Right. Sort of universally valuable.

[Joe Kerrigan]

Yeah. And it's, you know, not only that, but I can take a gold bar and modify it so it doesn't have the same numbers on it. I can take the. I can have the gold. I can do something to the gold bar that makes it not the same thing. Right. Like, you can't do this with like $100. I could smelt it. Right.

[Maria Vermazes]

Just take it to your forge friends.

[Joe Kerrigan]

Right.

[Dave Buettner]

Maybe throw in a little iron.

[Joe Kerrigan]

Yeah, I've seen, actually, I've seen people that have. Have these. These gold forges in. In their house. They're like small ovens that just get really, really hot with it with a graphite crucible inside of it. So you could. You can do this and then pour in. Pour the gold directly into some other mold and make another ingot that doesn't have any tracking information on it and then move that wherever you want. I mean, it. It's pretty easy to do this. I mean, it doesn't require a lot of skill to move this stuff around. It's like. It's almost like cryptocurrency, except it's less trackable.

[Maria Vermazes]

It's very Primitive. And I don't mean that disparagingly. It's just.

[Joe Kerrigan]

Right.

[Maria Vermazes]

We're talking about smelting and crucibles.

[Joe Kerrigan]

It's very low level, Right?

[Dave Buettner]

Yeah.

[Maria Vermazes]

It's kind of impressive that we've all gone full circle on this.

[Joe Kerrigan]

Right.

[Dave Buettner]

Joe, you and I are around the same age. Do you recall in science class when you were coming up sort of casually playing with mercury?

[Joe Kerrigan]

No.

[Dave Buettner]

We did.

[Maria Vermazes]

I was not allowed to do that. No. We heard the stories, though.

[Joe Kerrigan]

Was that in elementary school? You heard that?

[Dave Buettner]

No, this was in high school.

[Joe Kerrigan]

No, in high school, we. We were told that now in high school, they actually gave us radioactive material.

[Dave Buettner]

Yeah. It explains a lot about both of us. But I'm not joking.

[Joe Kerrigan]

They brought in little. I remember what they looked like. They were little tiny discs with radiation in them.

[Dave Buettner]

Right, right.

[Joe Kerrigan]

Radioactive stuff in them.

[Maria Vermazes]

Did you lick it or.

[Joe Kerrigan]

You weren't even allowed to eat anything while you were in the class.

[Dave Buettner]

We had a hot tub full of mercury. And actually, we had. So here's the thing. You get a little container of mercury. Okay.

[Maria Vermazes]

A little. Don't do this.

[Dave Buettner]

No, don't do. Ladies and gentlemen, mercury is a neurotoxin, in case you.

[Joe Kerrigan]

Yeah.

[Dave Buettner]

It's very hard these days. If you spill mercury, the fire department comes and, you know, it's a hazmat situation. But it used to be, you know, mercury. Just Mop it up. Yeah. Get a paper towel.

[Joe Kerrigan]

Get a paper towel.

[Dave Buettner]

Clean that up, toss it up.

[Maria Vermazes]

It's like a liquid slinky. You can just pass it between.

[Dave Buettner]

Yeah, exactly. And let me just tell you, it is very fun to play with. So one of the fun things that we did in science class is you could. Because you could float quarters on it. Right. Cause it's so dense.

[Maria Vermazes]

Oh, my God.

[Dave Buettner]

That you can float heavy things on the mercury. So that's the kind of thing we would do.

[Joe Kerrigan]

You put that quarter right back in your pocket.

[Dave Buettner]

Yeah. Or your mouth. We just lick this clean. There we go. Mm. Wow.

[Maria Vermazes]

It's amazing you both are still alive.

[Listener Voice]

I know.

[Dave Buettner]

I know. We are both much, much smarter.

[Joe Kerrigan]

I'm gonna tell you another horror story.

[Dave Buettner]

So. But here's how I'm gonna bring this home. One of the kids in the school, one of the girls floated a gold ring in the mercury.

[Joe Kerrigan]

Yes.

[Dave Buettner]

And it turns out mercury is also highly reactive. Well, a highly reactive is overstating it. They are reactive. It doesn't. Like, the gold didn't disappear, but the gold changed. The gold absorbed the mercury, reacted with the mercury, and it makes the gold Very brittle. Where gold is typically fairly strong.

[Joe Kerrigan]

Right. And soft.

[Listener Voice]

Right.

[Dave Buettner]

So she gets, you know, gets the little tweezers and gets the gold ring out of there, and it's a different color and has a different patina to it, and it crumbles in her hand, and she's like, oh.

[Maria Vermazes]

Why did she have that bright idea in the first place as it was?

[Dave Buettner]

Well, I mean, I bet it was curiosity.

[Joe Kerrigan]

Well, I know gold's pretty dense. Will my gold ring float on top of it?

[Dave Buettner]

Exactly. Exactly. I mean, how many of those kinds of active chemical reactions do you see in a given day? Not very many.

[Joe Kerrigan]

I didn't know that gold was reactive with mercury for some reason.

[Dave Buettner]

Yeah. So it turns out there is a way to remove the mercury from the.

[Listener Voice]

Gold and get the gold back.

[Dave Buettner]

But it ain't gonna be in ring.

[Listener Voice]

Form anymore when you.

[Dave Buettner]

When you get it back. So, anyway, that's my story, Joe. What's your story of dangerous chemicals?

[Joe Kerrigan]

I got a chemistry set when I was a kid.

[Dave Buettner]

Of course you did.

[Joe Kerrigan]

You know what was in that chemistry set?

[Listener Voice]

Oh, I don't know.

[Dave Buettner]

Arsenic, cyanide.

[Joe Kerrigan]

Ferrocyanide. Dave, it was ferrocyanide.

[Dave Buettner]

Cyanide.

[Joe Kerrigan]

I opened that up, or I. It had a little key on the side of it. My dad's looking through it with me. He goes, oh, this will kill you, cyanide. It'll kill you very quickly not to have all the fun. I was, like, terrified of this thing. I was like, you know, it's like, you know, the old. The old adage. You're not afraid that you're going to jump off, fall off the building. You're afraid you're going to jump. You know, I know I don't want to use that stuff, but.

[Dave Buettner]

Yeah.

[Joe Kerrigan]

What if one day I get really stupid? You know, I don't even want it around. I don't know what happened to the chemistry set I just got thrown into the trash at one point in time.

[Dave Buettner]

It's in a landfill somewhere. Yeah.

[Joe Kerrigan]

Ferrocyanide leaching out into the land.

[Dave Buettner]

Yes. Yeah. Just seeping into.

[Maria Vermazes]

I'm sure there's no problem with that.

[Joe Kerrigan]

I hope not.

[Maria Vermazes]

That's great.

[Joe Kerrigan]

I don't know if ferrocyanide and cyanide are the same thing. It was very, very dark blue. I do remember that.

[Dave Buettner]

Huh. What did it taste like?

[Maria Vermazes]

I'm jealous. All my generation got was microplastics.

[Dave Buettner]

Right, right. All right, well, you know what? This is a great time for us to take a break. We're gonna take a Break to hear for a message from our sponsor. We'll be right back after this.

[Maria Vermazes]

So.

[Sponsor Voice]

Let'S return to our sponsor. ThreatLocker. ThreatLocker is a zero trust endpoint protection platform that strengthens your infrastructure from the ground up. Where traditional cybersecurity tools require you to create a list of things you don't Want to Run, ThreatLocker enables you to easily curate an allow list of everything you need in your environment and network and block everything else by default. With ThreatLocker, allowlisting and ring fencing, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker provides zero trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware. The ThreatLocker Zero Trust endpoint protection platform deploys in a learning mode that analyzes the operations of your company using machine learning to assist you in developing your allow list for approved applications, what they can do on the endpoint, what can interact with your data, and even east and west network traffic. We thank ThreatLocker for sponsoring our show.

[Dave Buettner]

Okay, my story this week comes from our friends at the FBI. This is a public service announcement that they put out about a week ago. This is from the IC3. The what is the Internet Crime Complaint Center. And this is a warning about how criminals are using generative AI for financial fraud. And so the FBI goes through a number of different things that they're seeing. Obviously AI generated text, that's probably the most obvious one. And Joe, you and I have talked about this and Maria as well, where the dead giveaways that used to be there in lots of phishing emails are gone.

[Joe Kerrigan]

Are gone.

[Dave Buettner]

Yeah, yeah. Because AI can just make it sound.

[Joe Kerrigan]

Perfect and grammatically perfect.

[Dave Buettner]

That's right, that's right. And it also allows the scammers to operate at a higher velocity. They can send more stuff because the AI engines can just generate multiple multiple versions.

[Joe Kerrigan]

And it can be automated.

[Dave Buettner]

Right. You can say to the AI, you know, generate 50 versions of an email that does this and it'll do it. Which makes them harder to catch in spam filters. They also talk about AI generated images. These are for things like social media profiles, for fake ID documents. I never really thought about this. Someone could have the AI generate probably a pretty convincing looking like government employee id.

[Listener Voice]

Right?

[Dave Buettner]

Photos. They use them to make images of celebrities, folks who are famous on social media. All those kinds of things the AIs can do. Of course, we already talked about voice cloning in Joe's story, so that's available. And even just recently now the video tools have become much more widely available than they were before. And so people can again make depictions of public figures. But, you know, even people you might know, you can take a photo and turn it into a moving image now and make it look like somebody you know. So the FBI has some tips here to protect yourself. And number one on the list is create a secret word or phrase with your family to verify their identity. As we talked about earlier in the show, such a good idea.

[Maria Vermazes]

Don't say it on a podcast.

[Joe Kerrigan]

Don't share it with your podcast co host.

[Dave Buettner]

Once more, Maria, what's yours with you? You and your mom.

[Maria Vermazes]

And that point I'm still not telling you. And that is not the phrase.

[Dave Buettner]

Getting back to the FBI here, they say look for imperfections in images and videos, particularly hands and feet. There's teeth, eyes, ears. There's just little things that don't seem quite right.

[Joe Kerrigan]

Those will all go away.

[Maria Vermazes]

Stuff in the background.

[Dave Buettner]

Yeah.

[Joe Kerrigan]

All those tells will disappear.

[Dave Buettner]

Yep, Yep. They say verify the identity of the person calling you by hanging up, researching the contact of the contact of the bank or organization, and call the phone number directly. And of course, they say never share sensitive information with people you've met only online or over the phone. Don't send money, gift cards, cryptocurrency or other assets. And we're going to add gold, gold to people you do not know.

[Maria Vermazes]

And maybe also mercury or iron. I don't know.

[Joe Kerrigan]

Right.

[Listener Voice]

I hadn't thought about.

[Dave Buettner]

Yeah. I wonder what mercury goes for these days. I don't know. Probably is as expensive to handle the transport of it is.

[Listener Voice]

It's very heavy also.

[Dave Buettner]

But tasty. And they say if you believe you've been a victim of financial fraud, please file a report with the FBI's Internet Crime Complaint center that [e-mail] and give them as much information as possible. I know from experience and talking to the folks in the FBI that I've had the opportunity to interview that you probably should not expect a rapid reply from the FBI when you put something into this system simply because they are so overwhelmed.

[Joe Kerrigan]

There's a lot that goes into that system. Yeah.

[Dave Buettner]

And they just don't have the resources to directly respond all the time. But know that it does get logged and it does help them go after the things that they do. They do use the information. They do work on it. So if you submit something, it is helpful, even if it might not be completely satisfying with the response that you get. So we will have a link to that in our show notes. It's actually direct, I guess you call it a press release from the FBI. And there's quite a lot of good information in there. And it's one of those things pretty concise. It also is authoritative. So it's a nice thing to send around to your friends and family to say, look, here's what the FBI says and maybe you'll help prevent them from getting scammed. All right, let's move on to our catch of the day.

[Joe Kerrigan]

Dave, Our catch of the day comes from someone who just goes by a. Fonzie. Yeah.

[Dave Buettner]

A.

[Joe Kerrigan]

They didn't provide us with, with their actual name, so. But they say this, they thought this was a funny one. And it's. I'll give you. I'll. I'll do a little spoiler, Dave. It looks very much like an advanced fee scam, but it's got a lot of moving parts.

[Dave Buettner]

Okay, it goes like this.

[Listener Voice]

Attention. We sincerely apologize for sending you this sensitive information via email instead of certified mail, post mail, phone or face to face conversation. It's due to the urgency and importance of the security information of our citizens. I am Assistant Special Agent in Charge Chad B. Yarbo from the Federal Bureau of Investigation field intelligence groups. We intercepted two consignment boxes at Dallas Fort Worth International Airport, Texas. The boxes were scanned but found out that it contained large sum of money and also some backup documents which bears your name as the beneficiary. Receiver of the money investigation carried out on the diplomat that accompanied the boxes into the United States said that he was to deliver the fund to your residence as overdue payment owed to you. Meanwhile, we cross check all legal documents in the boxes. But we found out that your consignment was lacking an important document and we cannot release the boxes to the diplomat until the document is found. Right now we have no other choice than to confiscate your consignment according to Internal Revenue code in Title 26. Also contain reporting requirement on Form 8300 Report of cash payment over $10,000 received in a trade of business money laundering activity may violate 18 U.S. 1956, 18 U.S. 1957, 18 U.S. 1960 and provision of title 31 and 26 U.S. 60501 of the United States Code. This section will discuss only those money laundering and currency violation under the jurisdiction of the irs. Your consignment lacks proof of ownership. Your consignment lacks proof of ownership certificate from the joint team of IRS and irc. Therefore, you need to reply back immediately for direction on how to procure this certificate to enable us relieved the charge of evading the law on you, which is punishable offense in the United States. You are required to reply within 72 hours. At that point, I will walk you through the process of clearing and claiming the money. Failure to comply may lead to your arrest, interrogation and or you being prosecuted.

[Dave Buettner]

In a court of law for tax.

[Listener Voice]

Evasion and or money laundering. We will also dunk you in Mercury.

[Joe Kerrigan]

No, I made that part up.

[Listener Voice]

You are also instructed to desist from further contact with any banks or persons in the United States, the United Kingdom or any part of the world regarding your fund because your payment has been confiscated by the Federal Bureau of Investigation here in the United States. Yours in service, Agent Chad B. Yarbo, Assistant Special Agent in Charge, FBI Dallas Area Division.

[Joe Kerrigan]

Pretty good.

[Dave Buettner]

So pretty good.

[Joe Kerrigan]

It's basically a trunk box scam, right?

[Dave Buettner]

That's what I was going to say. Yeah.

[Joe Kerrigan]

If you start talking to them, they're just going to say you need to pay this fee and this fee and this fee and this fee.

[Dave Buettner]

You know trunk box scams go back to like pirates. Yeah.

[Joe Kerrigan]

It's very old school.

[Dave Buettner]

Hundreds of years old. Yeah.

[Maria Vermazes]

And they still work. Amazing.

[Joe Kerrigan]

Yeah.

[Dave Buettner]

There's basically no punctuation in this either.

[Maria Vermazes]

No, no.

[Joe Kerrigan]

And here's my thinking. Why is it like this? Why did they not use the generative AI to produce this? Is that because they are still just writing these themselves in the hopes of getting someone who. Uh. We'll skip over all the things because we've, we've heard that in the past that part of the reason these things work is because of their bad grammar.

[Listener Voice]

Right.

[Joe Kerrigan]

That somebody who is going to overlook the grammar is the same kind of person that will fall for these scams. So it's like self selection. Um, so maybe that's a value to the scammers.

[Dave Buettner]

Yeah. The only other thing I can think of is that it might somehow make it more likely that it'll get through some kind of spam filter by having.

[Listener Voice]

Odd run on sentences.

[Dave Buettner]

It could be.

[Maria Vermazes]

I don't know, maybe. I mean, what about the huge long codes of provisions and titles? I mean, does that actually scare. I mean, does anyone believe that? I mean. Oh yeah, USC 18, 1957. I'm intimately familiar with that one. I definitely know what this is referring to.

[Dave Buettner]

That part strikes me as being copy pasted off of the IRS website or something just to throw some legalese in there.

[Joe Kerrigan]

Yeah.

[Dave Buettner]

Make it seem more official.

[Joe Kerrigan]

I didn't take the time to look at these codes Maybe I should have. You know.

[Maria Vermazes]

Maybe you should.

[Listener Voice]

Maybe I should.

[Joe Kerrigan]

Maybe the listeners can go look them up. But no, it's just there to make it seem legit. These are probably real codes. These are probably real sections of the US Code.

[Dave Buettner]

Oh, you know what? Chad Yarbo is actually an FBI person. Yeah. I'm looking up here. On September 23rd of 2024, he was named assistant Director of the Criminal Investigative Division. Yeah.

[Joe Kerrigan]

So they've done the research on this.

[Maria Vermazes]

Can you Google any of this? Yeah, it'll come up as very plausible. And you go, oh, this must be real.

[Listener Voice]

Yeah.

[Dave Buettner]

So he's actually AT headquarters in D.C. but he did recently serve in the Dallas field office. So really, There you go.

[Joe Kerrigan]

So they're actually impersonating a real FBI agent.

[Listener Voice]

Right.

[Joe Kerrigan]

I wonder if that's legal.

[Maria Vermazes]

Maybe this email's real. Maybe this is actually happening. Oh, my God.

[Joe Kerrigan]

It's not at all legal.

[Dave Buettner]

Wouldn't it be funny if that was the thing that they got busted for impersonating an FBI?

[Joe Kerrigan]

Yeah. Maybe Chad Yarborough will hear this podcast and go, hey, somebody's impersonating me and using my name as a trunk box scam and advanced fee scam.

[Dave Buettner]

That's the last straw.

[Joe Kerrigan]

Yeah. Let's go find out who this is.

[Dave Buettner]

Right. Since I got my promotion, right? I have resources. Now that I'm at headquarters, there's no more messing around with the Chadster.

[Maria Vermazes]

I hope Chad listens to this podcast.

[Joe Kerrigan]

I want to come on the show.

[Maria Vermazes]

I would love that so much, Chad. Please reach out if you listen.

[Dave Buettner]

Yeah. Yes, Chad, thank you for your service to our country. Please don't come at us.

[Joe Kerrigan]

Thanks, Chad.

[Dave Buettner]

Sir. Yeah. All right, as always, we would love to hear from you. If there's something you'd like us to consider for our catch of the day, you can send it to us. It's hackinghumans2k.com.

[Sponsor Voice]

And, of course, we want to thank this week's sponsor, ThreatLocker. Go to threatlocker.com HH and check out their Zero Trust endpoint protection platform. That's the words threat, threat, and locker with no space.com HH where you can request a demo and neutralize the threat of malware running on your devices.

[Dave Buettner]

That is hacking humans. Brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans2k.com we're privileged that N2K CyberWire is part of the daily routine of the most influential leaders and operators in.

[Sponsor Voice]

The public and private sector.

[Dave Buettner]

From the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies, N2K makes it easy for companies to optimize your biggest investment your people. We make you smarter about your teams.

[Listener Voice]

While making your team smarter.

[Dave Buettner]

Learn [e-mail] this episode is produced by Liz Stokes. Our executive producer is Jennifer Ibin. We're mixed by Elliot Peltzman and Trey Hester. Our executive editor is Brandon Karp. Peter Kilpe is our publisher. I'm Dave Buettner.

[Joe Kerrigan]

I'm Joe Kerrigan.

[Maria Vermazes]

And I'm Maria Varmazes.

[Listener Voice]

Thanks for listening, Sam.