How political donations can be deceiving.

Summary

Podcast Summary: Hacking Humans – "How Political Donations Can Be Deceiving"

Released on October 31, 2024 by N2K Networks

In this gripping episode of Hacking Humans, hosted by Dave Buettner, Joe Kerrigan, and Maria Varmazas, the trio delves deep into the deceptive tactics employed in political donations and various cybercrime schemes. The discussion is rich with real-world examples, expert insights, and compelling quotes that shed light on how seemingly benign actions can mask nefarious intentions.

---

1. Car Insurance Scams: The "Swoop and Squat" Tactic

The episode kicks off with an engaging discussion about dash cam technology and its role in exposing fraudulent activities. Joe Kerrigan introduces the concept of the "swoop and squat" scam—a deceptive insurance fraud where multiple perpetrators collaborate to create fake car accidents.

Key Points:

• Swoop and Squat Mechanism: Involves staged rear-end collisions where one driver intentionally causes a rear-end impact while an accomplice blocks any chance of escape, forcing victims to incur damage and file fraudulent insurance claims.
• Victim Impact: Victims, often unaware they’re being scammed, find themselves facing multiple fraudulent claims.

Notable Quote:

Joe Kerrigan [03:32]: "In the traditional swoop and squat, the first driver would pull directly in front of you and then brake check you."

The hosts emphasize the importance of dash cams in protecting oneself against such scams, highlighting real incidents where dash cams provided crucial evidence to thwart fraudulent claims.

Dave Buettner [08:29]:

"I think a dash cam is a good way to protect yourself here against this kind of a scam."

---

2. Political Donation Text Scams Exploiting the Vulnerable

Transitioning from automotive fraud, the discussion shifts to political donation scams rampant during election seasons. Maria Varmazas highlights how excessive and intrusive political text messages are not merely nuisances but targeted attacks on vulnerable populations.

Key Points:

• Target Population: Primarily affects elderly individuals, especially those with dementia, who are more susceptible to manipulation.
• Mechanism: Repeated text messages encourage small, frequent donations, cumulatively amassing significant sums.
• Impact on Families: Many victims are unaware of the extent of their donations, with children discovering unauthorized financial commitments post-facto.

Notable Quote:

Maria Varmazas [15:58]: "These frequently text messages are highly effective, but it's also extremely predatory."

A staggering example is shared of an 80-year-old donor who, through relentless text appeals, contributed nearly $440,000 over a year, highlighting the predatory nature of these tactics.

Maria Varmazas [17:53]:

"People who are extremely vulnerable, namely dementia patients in their 80s and 90s, are overwhelmingly responding to these text messages."

The episode underscores the urgent need for protective measures and heightened awareness to safeguard the elderly from such exploitative practices.

---

3. Personal Phishing Scams via Social Media

Dave Buettner shares a personal experience with a Facebook phishing scam, illustrating the ever-evolving nature of social engineering attacks.

Key Points:

• Scam Description: A message purportedly from a Facebook friend requesting assistance in resetting a password, aiming to capture the victim’s multifactor authentication (MFA) codes.
• Response Strategy: Immediate password change and heightened security measures to prevent unauthorized access.

Notable Quote:

Dave Buettner [32:47]: "I didn't send them a code. Just to be clear, the code that would be sent to me would not be my friend's code. It would be my code."

This segment serves as a crucial reminder of the vigilance required in managing personal information on social platforms.

---

4. AI-Driven Phone Scams: A New Frontier in Social Engineering

The hosts explore groundbreaking research from the University of Illinois, Urbana-Champaign, where AI technology is leveraged to execute sophisticated phone scams.

Key Points:

• Technology Utilized: OpenAI’s Real-Time API allows AI agents to impersonate official entities convincingly.
• Scam Execution: AI-driven agents guide victims to imitation websites, harvesting personal and financial information seamlessly.
• Cost and Efficiency: At a mere 75 cents per incident, these scams boast a 60% success rate for Gmail credential theft and 20% for bank transfers.

Notable Quote:

Joe Kerrigan [35:15]: "His particular brand of chaos cannot be captured by an algorithm."

The discussion brings forth the urgent need for enhanced AI safeguards to prevent such vulnerabilities from being exploited by malicious actors.

Maria Varmazas [36:03]:

"These AI systems need better guardrails. OpenAI was sent a copy of this, and they said that they have multiple layers of safety."

---

5. Copyright Infringement Scams Targeting Authors

Maria Varmazas recounts a disturbing scam targeting self-published authors, falsely claiming to represent the Library of Congress and urging recipients to secure their copyrights.

Key Points:

• Scam Tactic: Fraudulent emails assert that the recipient’s works are at risk of infringement and pressurize them into paying for unnecessary copyright registrations.
• Misrepresentation: The scam misleads authors into believing they must comply with demands to protect their intellectual property.
• Legal Realities: In reality, copyright protection is automatic upon creation, and the Library of Congress does not enforce such claims directly.

Notable Quote:

Joe Kerrigan [43:09]: "It is not required that you register it with the Library of Congress."

Maria provides an example of a self-published author receiving an email titled "Urgent Matter" from a dubious domain, highlighting the red flags that distinguish legitimate communications from scams.

Maria Varmazas [46:12]:

"So they're preying on ignorance here."

The hosts advise authors to verify the authenticity of such communications and understand the true mechanisms of copyright protection to avoid falling victim to these scams.

---

Conclusion: The Necessity of Vigilance and Awareness

Throughout the episode, Dave, Joe, and Maria emphasize the critical need for awareness and proactive measures to combat the sophisticated tactics employed by scammers. From leveraging technology like dash cams and password managers to advocating for better protections against AI-driven scams, the hosts provide actionable insights to help listeners safeguard themselves and their loved ones.

Final Takeaway:

Maria Varmazas [28:16]: "Anything that would protect someone from being preyed on in these kinds of political action campaigns would help everybody, regardless of age and cognitive ability."

The episode closes with personal anecdotes and reinforcing the theme that vigilance and informed actions are paramount in navigating the complex landscape of modern cyber threats.

---

Notable Resources Mentioned:

• YouTube Demonstration: AI-Driven Phone Scam (Link to be provided in show notes)
• CNN Report on Political Donation Scams: Detailed Story (Link to be provided in show notes)

For more insights and to stay ahead in the world of cybersecurity, tune into Hacking Humans by N2K Networks.

Transcript

[Maria Varmazas]

You're listening to the Cyberwire Network, powered by N2K.

[Dave Buettner]

Hello, everyone, and welcome to N2K, CyberWire's hacking humans podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Buettner, and joining me is Joe Kerrigan. Hey, Joe.

[Joe Kerrigan]

Hi, Dave.

[Dave Buettner]

And our N2K colleague and host of the T Minus Space Daily podcast, Maria Varmasis. Maria.

[Maria Varmazas]

Hi, Dave. And hi, Joe.

[Dave Buettner]

Hi, Maria. Hi, Joe. Hi, Maria.

[Joe Kerrigan]

I don't feel it's right to say, hello, Maria, until Maria's been introduced.

[Dave Buettner]

Yeah, that's good.

[Maria Varmazas]

I don't exist until my name is said. It's true.

[Joe Kerrigan]

That's right.

[Dave Buettner]

So there's three of us. Are there nine combinations of how we can all say hello to each other? Is that how that works?

[Joe Kerrigan]

6.

[Dave Buettner]

Don't answer. Okay, Joey. Joe couldn't help himself. All right, we've got some good stories to share this week. We'll be right back after this message from our sponsor.

[Sponsor Representative]

But first, a word from our sponsor. Knowbefore, where would infosec professionals be without users making security mistakes, working less than 60 hours per week, perhaps actually having a weekend every so often? We get it. User behavior can be a challenge, but users can also be an infosec professional's greatest asset once properly equipped. What do we mean by that? Well, stay with us, and in a few minutes, we'll hear from our sponsors at knowbefore on that very question.

[Dave Buettner]

All right, let's get started here. Joe, you have the honors. Why don't you start things off for us?

[Joe Kerrigan]

Dave, you're a dash cam guy, right?

[Dave Buettner]

I am a dash cam guy, yes. I have a dash cam in my car.

[Joe Kerrigan]

Excellent. I saw on Facebook, because we're friends on Facebook one time you posted a video, look at this wild driver. And they're like, please don't be Lisa. Please don't be Lisa. And it wasn't.

[Dave Buettner]

But the thing I posted on Facebook, because we all see wild drivers every day, especially Maria, where she lives in Massachusetts.

[Maria Varmazas]

No, dash cams don't capture what's going on behind the wheel, though. So, you know.

[Dave Buettner]

That's right. So. No, what was unusual. The thing I posted was I saw the same crazy driver two days in a row.

[Joe Kerrigan]

Okay.

[Dave Buettner]

Doing the crazy things right in front of you. But. But anyway, yes, I have a dash cam, and I enjoy having it.

[Joe Kerrigan]

So there is a video going around.

[Dave Buettner]

And when.

[Joe Kerrigan]

The first time. The first time I saw this video on. It's on various apps. I was like, this looks very staged. It looked very staged to me. But it turns out it is not. It's now actually making the news. And there is a YouTube video that I will put a link to in the show notes. I won't do it. Somebody else will. But I've copied it here. And it is a video of a woman driving. She's talking to her husb, and she then becomes the victim of a swoop and squat. That is what this scam has been called. I've heard it called that a long time ago. I don't know if it has a new meaning. But in the traditional swoop and squad, what would happen is there would be two drivers in cahoots. And the first driver would pull directly in front of you and then brake check you.

[Dave Buettner]

Okay.

[Joe Kerrigan]

The second driver would sit right next to you, so you had nowhere to go.

[Dave Buettner]

Oh, okay.

[Joe Kerrigan]

And if you rear ended the first driver, the second driver would just keep going. He was an accomplice, but he made sure that you didn't have a viable alternative of veering into the other lane to miss the guy that was about to do the swoop and squat. Oh, so that's not what happens in this video, though. What happens in this video is somebody pulls in front of the driver and she manages to stop the car. She's on the phone with her husband. She manages to stop the car without hitting them. The driver then puts the car in reverse and slams into her car.

[Maria Varmazas]

Oh, my God.

[Joe Kerrigan]

Then puts the car back into drive, drives forward a little bit and stops. And then there's some shenanigans going on inside the car, Right. Where they're. They're changing positions in the driver's seat, and a woman gets out, and then another person gets out. And then, like, five people eventually get out of this car.

[Dave Buettner]

It's like a clown car, right? Yeah, that's what I'm thinking.

[Joe Kerrigan]

I'm like, how many people are getting out of this car?

[Maria Varmazas]

What is going on? Wow.

[Joe Kerrigan]

So here's what's going on. Then they exchange insurance information. Then. Oh, they. One of the guys in the car says she was driving. She doesn't speak any English.

[Dave Buettner]

Okay.

[Joe Kerrigan]

So you can't question the person who was driving. And actually, it doesn't look like this woman who. Who couldn't speak any English wasn't. Was driving. There's somebody else driving. And then they swap drivers. Or that's what the victim thinks anyway.

[Dave Buettner]

Right.

[Maria Varmazas]

So here's how they put a trash bag up yeah. In the video, they put a trash bag up to cover the rear window. That's so shady. Geez.

[Joe Kerrigan]

Right?

[Dave Buettner]

Yeah.

[Joe Kerrigan]

Why are you doing that?

[Maria Varmazas]

Wow.

[Joe Kerrigan]

So then. So here's how this works. This is just an insurance scam, right. Because if in most states, if you rear end somebody, it is always your fault.

[Dave Buettner]

Right?

[Joe Kerrigan]

Right. Even if you're on a hill and the guy in front of you is driving a manual transmission and he takes his foot off the clutch and goes to put his car into first gear and drive away and he bumps into you. That's your fault. Do you know that?

[Dave Buettner]

Oh, oh, oh, oh. I see what you. So someone's, someone's going uphill on a hill.

[Joe Kerrigan]

Right.

[Dave Buettner]

They drift backwards to hit you.

[Joe Kerrigan]

Yep.

[Dave Buettner]

It's your fault. It's your fault because you're too close.

[Joe Kerrigan]

Because you park too close. You're supposed to be able to. You're supposed to park or stop so you can still see their tires. That' that's what they told us in driver's ed back in, back in the 80s, Dave.

[Dave Buettner]

Okay.

[Joe Kerrigan]

I don't know if this is still the case. I would think that if you had enough, enough room and you had a dash cam, you could demonstrate. No, I gave this guy plenty of room.

[Dave Buettner]

Well, it doesn't matter because there aren't any manual transmission cars anymore.

[Joe Kerrigan]

I know.

[Maria Varmazas]

I was just going to say that.

[Joe Kerrigan]

There was a great story in Baltimore where this woman got carjacked. These two kids attacked her, stole her keys, knocked her down, ran over to her car and couldn't drive it away because it was a stick shift.

[Maria Varmazas]

Yeah.

[Joe Kerrigan]

So anti theft device. So what they do is they pack a car full of people and then they pull out in front of somebody and try to get them to rear end them. And in this case, even if they don't get you to rear end them, they just back up and simulate a rear ending. Now, these people immediately drove away after the exchange of information. Right. They're just going to go and file an insurance claim. That's what they're going to do. And they're all going to say, we all have whiplash from this incident.

[Dave Buettner]

And it's like five against one, Right?

[Joe Kerrigan]

Well, it's five of them filing medical claims. And there is talk this has been going on for a while. The video is really telling because it's obviously insurance fraud. In this video. It's not very well executed insurance fraud, especially when the. The victim has a dash cam here. If you didn't have a dash cam. If she didn't have a Dash cam. I don't know that she'd have a case because she wouldn't have any evidence. The other people would have all the evidence. They'd have five people saying she rear ended us. And what they're. What they're going to do is they're going to file a claim with the insurance company for medical benefits, and then they're going to. Or for pain and suffering as well, and then they're going to give that money to somebody else. These people are actually paid about $500 to sit in one of these cars and get hit and potentially get really injured. Right.

[Dave Buettner]

You can relate real life. Crash test dummies.

[Joe Kerrigan]

Yep.

[Maria Varmazas]

Oh, my God.

[Joe Kerrigan]

So not only. I mean, there's somebody exploiting these people, right?

[Maria Varmazas]

Yeah, obviously. How desperate do you have to be that you'd be willing to put your life on the line for this?

[Joe Kerrigan]

Just think about Marie. You want to make quick 500 bucks or die. Here's all you had. Don't worry, you're not going to die. Trust me.

[Maria Varmazas]

I don't know. Haven't seen the driver here, man.

[Dave Buettner]

Wow.

[Joe Kerrigan]

So, yeah, it's. I don't know. This made me think. I think I might need to get a dash cam.

[Dave Buettner]

Right?

[Joe Kerrigan]

Yeah.

[Maria Varmazas]

Yeah. This has got me thinking the same thing, honestly.

[Dave Buettner]

Geez.

[Joe Kerrigan]

So I can start posting videos of crazy Dave Bittner driving around.

[Dave Buettner]

That's right.

[Maria Varmazas]

We can.

[Dave Buettner]

Competing dash cam. I can have my dash cam rebuttal.

[Joe Kerrigan]

Right. So one of the things that I'm always terrified of is around here we get these motorcycle, not gangs. It's not an organized group.

[Dave Buettner]

Right.

[Joe Kerrigan]

It's not like a club or anything, but it's like 40 guys on these crotch rocket motorcycles, and they will come out of like, Baltimore City, and you'll be on Interstate 70 heading west, and they'll pass you at like 150 miles an hour, right?

[Maria Varmazas]

Yes. Yeah. They're everywhere.

[Joe Kerrigan]

The first one that goes by is terrifying, right?

[Dave Buettner]

Yes, it is.

[Joe Kerrigan]

When I see them coming up on my rearview mirror, I just go. I say to my wife, here they come, Motorcycle. And she goes, oh, geez. And the whole time I'm watching, I'm like, don't die. Don't die. Don't die while I'm watching. So, I mean, this is one of the reasons I haven't gotten the dash cam is because I don't want to be around. I don't want to be filming this. But I think, you know what? I'll just not save the video if that happens. Or maybe I will and provide it to Somebody I don't know anyway. But yeah, this. A dash cam is a good way to protect yourself here against this kind of a scam.

[Dave Buettner]

You think that if someone. If a group of. If the same group of five people make half a dozen medical claims in the same day.

[Joe Kerrigan]

Right.

[Dave Buettner]

Someone would be onto them.

[Joe Kerrigan]

But who knows? I don't think that's what happens.

[Dave Buettner]

Maybe not.

[Joe Kerrigan]

I think that the people who are behind this are actually using multiple people. They'll swap out another five people, put them in a car.

[Dave Buettner]

Right.

[Joe Kerrigan]

Say you want to make 500 bucks. And for each one of them that gets in the accident, they get like 10 grand or something like that. So it's not a big insurance loss. It winds up being like a $50,000 insurance loss. But it's still significant enough of a problem that if this becomes an issue that, yeah, there's going to be increased costs for everybody. There already is increased cost for everybody.

[Dave Buettner]

Yeah. I have a vague recollection too, that there's some mechanism when you're in some kind of accident like this, that there's some bit of very quick money that you can. Like if you say the right combination of words, you can say, I want my blah, blah, blah money. And I don't remember what it is, but you'll get a certain amount and it might be $500, like right away. You'll get it while everybody's trying to figure everything out. And so I wonder if there's a component of that in that as well. And who. You know, again, this is a vague recollection of mine. It may not even be a thing anymore. But you know that they. Relying on this not making its way all the way through the system.

[Joe Kerrigan]

No, they're settling. They're settling very quickly with the insurance company because they're not going to.

[Maria Varmazas]

It might be a specific insurance company too, that does this that you're talking about. Yeah. I wonder if certain states are more prone to this.

[Joe Kerrigan]

Also, I will tell you that in this ABC video, they say they do target women driving alone more than anybody else.

[Maria Varmazas]

Right. Because they're not gonna wanna fight back as much if somebody's accusing them of something. Cause you feel like you're in your. I think it's safe to say that.

[Joe Kerrigan]

A woman is less prone to road rage.

[Maria Varmazas]

Also that. But if you get five people saying, hey, you hit me.

[Joe Kerrigan]

Yeah. Thinking about me and my wife. And of course, I think Dave and I are the. Are married to the tales of that distribution.

[Maria Varmazas]

No comment from.

[Dave Buettner]

I would say my wife and I, one of us is much more liable to experience. This is according to my children who have been alone in the car with me and with my wife. And I remember one time my son, when he was still in his car seat, saying to me, he says, dad, do you use the horn in your car very much? And I said, no, I don't. I, you know, I might toot every now and then if, you know, we're at a stoplight and the person in front of me, you know, doesn't notice that the light has changed, maybe I'll give the thing a little toot and, you know, something like that, or for safety reasons. And he says, uh huh. Mom uses her horn all the time, right? He says, when mom drives, she's a potty mouth. Well, son, you know, everybody's different. And your mother has a lot of very admirable qualities. And patience behind the wheel is a great experience.

[Joe Kerrigan]

I have is my wife called me one time when she was driving and she was close to our house, and there's a very busy intersection close to our house that has a turn only lane, and somebody didn't turn and tried to merge with her. And I hear her go issue a string of comments, and I hear her horn blow on the phone. And then half a second later, I hear her horn coming across through the trees.

[Dave Buettner]

That's funny.

[Joe Kerrigan]

And I'm like.

[Maria Varmazas]

There she is.

[Dave Buettner]

Early warning system. Honey's almost home. I can hear the horns from a quarter mile away, like a freight train whistle in the distance. Here she comes. All right, well, it's an interesting case here. And what we really need is a dash cam sponsorship.

[Joe Kerrigan]

Hey, I'll be happy to sign up for the. We can even have Joe's dash cam.

[Dave Buettner]

Video of the week.

[Maria Varmazas]

Oh, my God.

[Dave Buettner]

Right? Little side podcast. Yeah, Joe rates your dash cam videos.

[Joe Kerrigan]

There you go.

[Dave Buettner]

There we go. All right, let's move on. Maria, what do you have for us this week?

[Maria Varmazas]

Well, there's something happening in a few weeks in the United States that I think most of us are aware of. It's this election thing.

[Joe Kerrigan]

Dave refers to this as silly season.

[Maria Varmazas]

Yeah, indeed.

[Dave Buettner]

I can't wait for it to be over.

[Maria Varmazas]

Yeah, I'm gonna have to.

[Dave Buettner]

It's stressful, I know.

[Maria Varmazas]

And this whole story is just gonna press that bruise, so just brace yourself. I'm sorry. I'm sure anyone in the United States, you two included, have been a flurry of political text messages. Whether you like them or not, whether you want them or not, they're just arriving at your phone, all strict spam for me. They don't even circumvent your spam. Cause for me, no matter how many.

[Joe Kerrigan]

Really they have a couple of times, but I am not getting like a snowstorm of them right now. I get em and I'm getting them from both parties too.

[Maria Varmazas]

Same here. I get it. What about you, Dave?

[Dave Buettner]

I got one yesterday. I'm looking at it right now and they've sort of, they've amped things up because I'm not responding. It says we asked six times if you support VP Harris, but you still didn't complete the poll. I'm like, back off, man. No, no, I did not.

[Maria Varmazas]

Desperate ex girlfriend right there. It's just too much.

[Joe Kerrigan]

I got one right here that says. So that's it, huh? Your membership expired after all these years. Please renew. I don't know if that's a political one. Breaking Kamala just crushed her CNN Town Hall. $15 for Elon Musk Dark Maga hat. Anyway, like I said, I'm getting it from both parties.

[Maria Varmazas]

Yeah, yeah, I do too. I enjoy it a lot because it's a remarkable. You just swap out the names and the calls to action are remarkably similarly desperate. But the, the common thread is that they are extremely frequent, extremely annoying. Nobody likes these. And as you both have noted, they have really ramped up in the weeks right before the election. And who wants this? If you ever were to click one of those text message links, those calls to action, they usually will solicit a small dollar donation amount. Of course they will take any amount of money that you'll give them, but they're usually after five or ten dollar donations at a time. With the idea being hopefully people will engage with these text messages and donate it at high frequency. And so you've read off some really great examples. I don't think I need to go into more detail. But yeah, they're crazy with these personal appeals. The urgency, it often sounds very much like somebody related to one of the campaigns is directly talking to you, making an appeal to you. And it really gets into that emotional core. And the question that I've been having with friends and family is who in the hell finds these text messages effective? Who is this working on? Because it's not working on, I think any of us, but it's working on somebody. Because clearly the political machines as they are, as the wheels turn, they wouldn't be investing all this time and money in it if it was not incredibly effective. So CNN did a little digging into this one and they put out a report answering this exact question. Who are These text messages reaching and how are they actually effective? And the answer is sadly, probably about as bad as you might imagine, if not worse. People who are extremely vulnerable, namely dementia patients in their 80s and 90s, are overwhelmingly responding to these text messages.

[Joe Kerrigan]

Really?

[Maria Varmazas]

Yeah. So yeah, that was definitely just. Yeah, they followed the example of just one donor, but there are lots of them that they traced. So here's an example of one 80 year old Republican donor and how he became single handedly one of the largest grassroots donors to the Republican election cycle going on right now. So it started with a $250 donation that he made in September 2022 to his state senate race. Because off cycle year. Right. So 2022 was that, was that senate race in the course of just one month with those text messages, then incoming because you know he made that donation, he donated 344 additional times, adding up to $10,000. That's just in the first month. In a few more months, by December, he donates an additional 2,000 times. Now he has donated over $100,000. Now a little fast forward again to May 2023. He's now made over 5,700 donations to total over $200,000. And by the time you hit the one year mark from his initial 2022 October donation, so again now we're October 2023, he has totaled 15,000 donations, making around $440,000 in all that he has donated. That's almost half a million dollars.

[Dave Buettner]

Right? Wow.

[Joe Kerrigan]

Now aren't there caps on how much you can donate?

[Maria Varmazas]

That's a great question. I don't mean per transaction or in all.

[Joe Kerrigan]

In all, I thought. Is there a limit on how much an individual can donate to a political candidate in a year?

[Dave Buettner]

There are directly, yes.

[Joe Kerrigan]

Okay.

[Maria Varmazas]

These are for political action campaigns though.

[Dave Buettner]

Win Red, remember, money is speech, Joe.

[Joe Kerrigan]

So.

[Maria Varmazas]

Right.

[Dave Buettner]

You could, yeah, the political action committees, I guess once, once seems to me that, and I don't mean to step on your story here, Maria, but it seems like word got around that they had a live one on the line.

[Joe Kerrigan]

Right?

[Maria Varmazas]

Yeah, yeah, I agree. It's so I just, just a corollary to the story. His son found out about it around this time when he found out that his father had donated around, you know, half a million dollars, pretty much all of his life savings to Win Red, the political action committee. And he appealed all of this to the Federal Election Commission and to Win Red, and he was able to get a third of that money back. So $151,000 back, but the rest of it's just gone. So yeah, which was just a gut punch to read that one. And before anyone hate mails me, both Win Red and ActBlue use these tactics, which are both the Republican and Democratic Political Action Committees. Both organizations have complaints filed against them with the Federal Trade Commission. But I should note that CNN says Win Red has seven times the number of complaints than ActBlue does in terms of this kind of predatory behavior. And Win red specifically has 500, excuse me, they have 800 complaints filed against them in the last two years alone. And their data goes from, I think October 2022 to June 2024. So this is even before Kamala Harris entered the race. So there was this quote that CNN has in the story. I'm just going to read it directly because this just blew me away. Often coming in at five or ten dollars at a time. Contributions from the small sampling of donors alone added up to more than $6 million over the last five years, the majority of which ended up with Trump and a long list of other Republican candidates. So $6 million from people that they believe are dementia patients, people who are 80, in their 90s with dementia. And CNN also followed up with many of the families, again, the children, in this case of many of these folks with dementia who had no idea that their parents had donated pretty much their entire life savings, pensions, Social Security, all that kind of stuff to these political campaigns. And in many cases, the children would say that mom and dad were actually upset if Donald Trump himself didn't respond to my appeals because they believed they were actually speaking directly to the candidates. Those personal appeals were very effective on them.

[Dave Buettner]

Right?

[Maria Varmazas]

Yeah.

[Dave Buettner]

And I got one from Nancy Pelosi a week ago. Hey, she's desperate to hear from you. Right. Why haven't you responded to my personal appeal?

[Joe Kerrigan]

You haven't seen any stock tips, that's why.

[Maria Varmazas]

Oh God. And one thing that as a former marketer, every time I've seen the websites for these things, I do click through once in a while, which is a very bad idea. I try to remove the tracking info. But I'm curious how these pages work. The text on the pages and the interactive elements on the pages are all as frictionless as possible. And they're trying to sort of shunt you through as quickly as they can without really realizing that you're signing up for often a recurring donation and that they have your information pre populated. And a lot of times the recurring donation boxes are pre checked. And also it's not entirely clear that they have been filled out already. So you in many cases may not even realize that you've signed up for a recurring donation. And again, these things are highly tracked. So every time you click a text message through or answer a phone call or respond to an email, it just begets more activity from these little action clubs. So.

[Dave Buettner]

Right.

[Maria Varmazas]

For those of us with full cognitive facilities, all of these touch points are extremely annoying, to put it mildly. But if you don't have your full cognitive abilities, if you have short term memory issues, you might forget that just an hour ago you had donated. And so in that case, these frequently text messages are highly effective, but it's also extremely predatory.

[Joe Kerrigan]

Yeah, seems that way.

[Maria Varmazas]

Yeah. And I have to say, as I was reading through the CNN story, this reminded me a bit of gaming microtransactions and the term whaling. Are you both familiar with what that means with whaling in microtransactions?

[Dave Buettner]

Sure.

[Joe Kerrigan]

Whaling in casino terms.

[Maria Varmazas]

Casino or even mobile games where the idea being you do all these tiny microtransactions on these games that are otherwise free, where only 1 to 2% of players will make up almost 75% of a game's revenue. So you get somebody who doesn't realize that they're hooked in and then they just give tons and tons of money. And that seems to be what's happening here. A corollary. So a coworker of ours here at NTK actually sent this story over and a corollary story that he sent shout out to Bennett was that there's some research going on right now about whether or not seniors are more vulnerable in this case to scams, not just because of situations like dementia, but also because of brain changes. And that the jury is still out on that one. But there is some research to suggest that actually the scam spidey sense does sort of diminish with age due to a physical change in the brain. But sort of controversial take on that one. But the argument is really anything that would protect someone from being preyed on in these kinds of political action campaigns would help everybody, regardless of age and regardless of, you know, cognitive ability. So, yeah.

[Dave Buettner]

Yeah. You know, anybody who has been through the terrible experience of a loved one going through this sort of emotional or not emotional.

[Joe Kerrigan]

Cognitive.

[Dave Buettner]

Cognitive decline. Thank you. Joe knows how hard it is. And you know, there's that saying that the children become the parents.

[Maria Varmazas]

Yep.

[Dave Buettner]

And that is true. But the children become the parents. But the parents are still legal adults with all the financial powers and rights that they have always had. So if you have an uncooperative parent Or a parent who simply wants to maintain their privacy. It's hard to know that any of this is going on, much less have any control or oversight over it.

[Maria Varmazas]

Yeah, yeah, I've been through that myself with my father before he died, and it was exactly that I didn't want to mother hen my own father, which was really just very difficult. And, yeah, I mean, one suggestion I had read was sort of having a taking the keys conversation about finances with your parents, as if. As if the taking the keys conversation about cars is easy. That one's excruciating. I've been through that one, too. But trying to get financial power of attorney from somebody, I mean, you have to respect someone's independence and respect the fact that they are an adult and that this is a choice they may very much be aware that they're making. But, yeah, I mean, that feels like putting the onus on the child and the parent. It's really these PACs or POSs, frankly, doing this kind of predatory stuff. But, yeah, the numbers are astounding.

[Dave Buettner]

Yeah, I did have success, or maybe I frame it as a good experience with my father. We were at the bank together one time taking care of some things, going through some things in the safe deposit box. This, that and the other thing. And one of the employees at the bank who was helping us said, how would you feel about. Said to my father, how would you feel about us allowing your son to have certain notifications on your accounts so that if something goes wrong, he'll be notified? And so, for example, if withdrawal over a certain amount happens, if something unusual happens, they can send me a message that says, hey, heads up. Something weird is going on with your father's bank account. And that went very well because I think it didn't feel like I had an undue amount of control or I was trying to tell him what he could or couldn't do, but it was just a backup set of eyes in case something went out of whack. Yeah.

[Maria Varmazas]

It feels more objective in a way, too. It's not, oh, that Maria, she worries about me too much, which was my dad.

[Joe Kerrigan]

Right.

[Maria Varmazas]

It's the bank, and they're serious people, so they would be looking out for that.

[Dave Buettner]

Right. And I think the fact that it came from the bank helped too, because I think certainly my father, being old school, the bankers are people in somewhat. A bit of authority, you know, when it comes to money. You know, that's why they're bankers and you're not. So.

[Maria Varmazas]

Yep.

[Dave Buettner]

Yeah.

[Maria Varmazas]

Yeah.

[Dave Buettner]

So, yeah, this is heartbreaking. And it's a shame. But I guess the answer here is just vigilance with your folks or your loved ones who maybe falling victim to this, keeping in good communication. And it's when someone's a dementia patient, I wonder if there's any onus on the caregivers to be checking in on these sorts of things. Again, they're still adults and they still have all their rights.

[Maria Varmazas]

And do you want the ultimate gut punch? Honestly, I debated even mentioning this, but in many cases this was, this behavior was one of the first signs that the parent was in cognitive decline that, you know, the children had no idea their parents were doing this. And it was sort of like a once they found out, giant red flag that something wasn't right, which absolutely broke my heart. Cause again, I've been there, so.

[Joe Kerrigan]

Well, it's good to know my mom's cognition is pretty good.

[Dave Buettner]

Well, I mean, I don't know.

[Joe Kerrigan]

I'm not giving any of those.

[Dave Buettner]

I don't know. I don't know if you had any experiences like this, Maria, but I know, you know, we dealt with this with my mother and before she passed away. And it was one of those things where once the diagnosis came that there was serious cognitive decline, a whole bunch of other things snapped into place from before that. You know, I was like, oh, yeah, that's why, that's why, you know, that's why my mom was worried that my dad was going to run away with the waitress at Golden Corral. You know, like, we laughed.

[Joe Kerrigan]

Right?

[Maria Varmazas]

Yeah, yeah, right, right.

[Dave Buettner]

Just like, yeah, yeah.

[Maria Varmazas]

My extremely logical father, who was a physics PhD, was starting to take a lot of physical risks doing things that his like trying to climb mountains that he was physically no longer capable of doing or being extremely illogical and saying and doing things that were just completely irrational. And it was completely out of character for him. And that was for us a big red flag that something was going on. But it was so unlike him. It was really heartbreaking. And that was sort of the beginning of it when suddenly these huge risks were like, you would never do this. What are you doing?

[Dave Buettner]

Right.

[Maria Varmazas]

Yeah. Yeah.

[Dave Buettner]

All right. Well, we will have a link to that story from CNN in our show notes. Before we get to my story, why don't we take a quick break to hear a message from our sponsor?

[Sponsor Representative]

We were talking about making users into an asset for security professionals. Simply put, users want to do the right thing. They're often just lacking the knowledge to do so. That's one of the reasons KnowBefore has released security Coach a Real time security coaching tool that takes alerts from your existing security stack and sends immediate coaching to users who've taken risky actions. For example, imagine a user has visited a high risk website or tried to open a document containing malware. Existing security tools will likely block that action, but the user might not understand why. Security Coach analyzes these alerts and provides users with relevant security tips via email or Slack, coaching them on why the action they just took was risky. Help users learn from their mistakes and strengthen your organization's security culture with Security Coach. Learn more about security [e-mail] SecurityCoach that's NoBefore.com SecurityCoach.

[Dave Buettner]

All right, we are back, and I have two stories here. The first one is a bit of a quickie. This is actually something that happened to me on Facebook. I got a message from. Right, right. The rancid dumpster fire that is Facebook. I got a message from someone that I was already friends with on Facebook. Private message. It said. I'll quote it here. It said, I'm trying to reset my password on my Facebook. They told me they're going to send to a friend, so I picked you. Please help me send the code you receive from them.

[Joe Kerrigan]

Hmm. So you got this message.

[Dave Buettner]

I got this message.

[Maria Varmazas]

They're really trying.

[Joe Kerrigan]

They're trying to break into your account, right?

[Maria Varmazas]

They're really trying it. Cute.

[Dave Buettner]

Yeah, they're trying to break into my account. And I looked up this scam because obviously I knew this was a scam, but this was the first time I'd seen this particular wording of this kind of scam. And one of the things the research showed was that typically this happens when they already have your username and password that they're looking to get. They've already gotten past that, so they're looking for the multifactor authentication code. So just for nothing, the first thing I did was I went in and changed my Facebook password.

[Joe Kerrigan]

Right.

[Dave Buettner]

Obviously, I didn't send them a code. Just to be clear, what's going on here is the code that would be sent to me would not be my friend's code. It would be my code.

[Joe Kerrigan]

Right. To reset your password.

[Dave Buettner]

To reset my password, yep. Right. So obviously I didn't respond to this. And just for grins, I went ahead and reset my own password just to be careful.

[Maria Varmazas]

Smart.

[Joe Kerrigan]

Using a password manager. Of course.

[Dave Buettner]

Using a password manager. Of course. Yes. A randomly generated, very long, very random password from my favorite password manager. So, yeah. But my other story comes. This is actually from the register on the other side of the pond. And this is about some researchers at the University of Illinois, Urbana. Champagne.

[Joe Kerrigan]

Oh, I know those guys who have.

[Dave Buettner]

Done some work on OpenAI, specifically using OpenAI's Real Time API, which is designed for real time voice interactions. So this is the part of OpenAI or ChatGPT, I should say, that allows you to have a real time conversation with ChatGPT. And I don't know. Have either of you spent any time playing with this?

[Joe Kerrigan]

Yes, and it's pretty good.

[Dave Buettner]

It's pretty good.

[Maria Varmazas]

Are we out of a job? Are we screwed? No, I have not. I'm too afraid.

[Joe Kerrigan]

I don't think we're. No, because I'll say things like, last week, I always said I want to advocate for somebody getting caned. OpenAI will never say that.

[Dave Buettner]

Right.

[Maria Varmazas]

It's a very specific term.

[Dave Buettner]

There's no way that AI can possibly compensate for the Joe Factor.

[Joe Kerrigan]

Right. Job security.

[Dave Buettner]

That's right. That's right. His particular brand of chaos cannot be captured by an algorithm. Yeah. So these have gotten very good. And one of the ways that they're very good is there's very little delay anymore in the response.

[Joe Kerrigan]

Right.

[Dave Buettner]

So it used to be you'd put in a question, it would sit there and chug for a few seconds and then come up with a response. These days, there's a little pause, but not much. Yeah.

[Joe Kerrigan]

A lot of times it steps on me. Like it starts talking before I'm done.

[Dave Buettner]

Yeah. And it'll also use sort of like connecting phrases to buy time for itself. You know, like, it'll say, oh, that's interesting that you asked me that, and then get to the answer. And it's buying time for it to come up with a more, you know, plausible answer.

[Joe Kerrigan]

Right.

[Dave Buettner]

So what these researchers have done is they used these AI agents using an API to impersonate companies and officials to steal personal information, such as bank details through phone scams. So this is a proof of concept, and there's actually a YouTube video that I'll link to here that has a demonstration of what's going on here. And perhaps our audio editors can put a little cut of what this is all about, what it sounds like. Hello?

[Maria Varmazas]

Hello, this is John from Bank of America. I understand your concern. Your security is our top priority to verify your identity.

[Dave Buettner]

But basically, you know, it starts off with sounds like a customer service kind of thing. So as we talked about, you know, you go to Google and say, google, what's the number for Wells Fargo? And Google comes up with a number, there are at least equal odds Right. Now that that number is not Wells Fargo.

[Joe Kerrigan]

Right. Wouldn't it be great if someone trying to scam Wells Fargo had got wind up with one of those numbers and just started, like, trying to scam some scammer.

[Dave Buettner]

Right.

[Joe Kerrigan]

That was hilarious.

[Maria Varmazas]

Eating its own pillow.

[Joe Kerrigan]

Right?

[Maria Varmazas]

Yeah.

[Dave Buettner]

So how this works is you get on what seems to be a customer service call, and the agent on the other end, which is actually the ChatGPT agent, responds and steers you toward a imitation website, a lookalike website that gets you to log in, provide your personal information, your username, your password. It prompts you ahead of time. It says things like, oh, it looks like we're going to have to. For security's sake, we're going to have to send you a code. So when that code comes through, please read it off to me. And of course, it's your multifactor authentication code that the real bank is sending you. You read it off to the AI, and the AI takes your voice and converts it and plugs it into the website. And now they have access to your banking information. So the researchers here have found that the cost of this scam is about 75 cents per incident. And they found that for trying to steal Gmail credentials, they had a 60% success rate. And with bank account transfers, it succeeded 20% of the time. Now, this is not against real people. They were doing tests in the lab to see how successful it was, but still 20% of the time to try to get money transferred from a bank account at 75 cents a shot. Yeah, that pays off as long as.

[Joe Kerrigan]

You'Re transferring more than 20 bucks, right?

[Dave Buettner]

That's right.

[Joe Kerrigan]

Or whatever. $15.

[Dave Buettner]

Yeah. So they're saying this system is pretty easy to put together. They said they only used about 1,000 lines of code. And what they're saying is that these AI systems need better guardrails. OpenAI was sent a copy of this, and they said that they have multiple layers of safety.

[Joe Kerrigan]

Here it comes. Everybody's safety is our number one concern. Shut up.

[Dave Buettner]

Yeah. The researchers say that there needs to be more layers here to protect people, that this was far too easy to implement. And if they can do it, then for sure the bad guys are already onto it. So, yeah, we will have a link to that story and the research here in the show notes, as well as that YouTube that demonstrates it actually happening.

[Joe Kerrigan]

I have looked at the author's names, and, no, I don't know any of these guys.

[Dave Buettner]

Okay, very good.

[Joe Kerrigan]

But I have been to uiuc.

[Dave Buettner]

Oh, okay. Terrific. All right, well, it is time to move on to our catch of the day.

[Joe Kerrigan]

Dave. Our catch of the day comes from Reddit and it is an inquiry from somebody at libraries of congress.com.

[Dave Buettner]

Right. There's more than one, right?

[Joe Kerrigan]

And multiple libraries.

[Dave Buettner]

Yeah. So the library that's the main one. So they opened up a few branches. You know, so some of the backstory before I read this, this was sent to the scam subreddit and it is from someone who has written a number of self published books.

[Joe Kerrigan]

Okay.

[Dave Buettner]

And they went through a company that helps people publish self published books. And part of their concern is that the company they went through to help them publish their books might be in on this, might be trying to get more money from them for us.

[Joe Kerrigan]

So it's a shady self publishing company, Correct?

[Dave Buettner]

Correct. You know, a vanity publishing kind of thing. So this is a letter that this author received and as Joe pointed out, it comes from inquiryibrariesofcongress.com and it's titled Urgent Matter and it says, we hope this message finds you well. We are writing to address an important matter concerning your books. The Library of Congress has recently received an infringement case related to your works, which requires immediate action to prevent further complications, it is crucial that your books are properly copyrighted, not only to protect your intellectual property, but also to comply with Title 17 of the US Code. Without copyright protection, you may face serious consequences, including removal of your books from publication platforms, inability to claim damages in case of unauthorized reproduction or distribution, loss of control over how your work is used, adapted, or shared by others. Conversely, securing copyright for your books grants you exclusive rights as the author, including control over reproduction, distribution and adaptations. This legal protection ensures that you maintain ownership of your work and can pursue legal action in the event of infringement. If you have already registered your copyright, please provide us with the copyright number and feel free to disregard this email. If not, we strongly urge you to consult with our legal team to ensure that your copyright registration is completed promptly. Taking action now will safeguard your works from potential legal and financial setbacks. We look forward to your prompt response and attention to this critical issue. Best regards, the Library of Congress, 101 Independence Avenue, Washington, D.C. all right, so.

[Joe Kerrigan]

I have a question.

[Dave Buettner]

Yeah.

[Joe Kerrigan]

My understanding. You might know this, Dave. My understanding of copyright is that you own copyright the moment you create something.

[Dave Buettner]

That is true.

[Maria Varmazas]

Yes. And that's true.

[Joe Kerrigan]

It is not required that you register it with the Library of Congress.

[Dave Buettner]

Also true.

[Joe Kerrigan]

But you can register it with the Library of Congress.

[Dave Buettner]

Yes.

[Joe Kerrigan]

Is that right? And then that makes it official. So if you Say somebody's infringing on my copyright. Now you have the government saying, yeah, here's when he filed the copyright.

[Dave Buettner]

Yep. Makes it easier, right? Yep.

[Joe Kerrigan]

So first off, they're writing you about an urgent matter where somebody. They. The Library of Congress has said you're infringing on somebody else's copyright.

[Dave Buettner]

No.

[Joe Kerrigan]

Isn't that what it says?

[Dave Buettner]

No, no. It's not saying that you're. All it's saying is that your books are not properly registered with us.

[Joe Kerrigan]

It says the Library of Congress has recently received an infringement case related to your works.

[Dave Buettner]

Recently. Right.

[Joe Kerrigan]

So does that.

[Dave Buettner]

First off, I read that to mean that someone else was infringing on your works.

[Joe Kerrigan]

Oh, okay.

[Dave Buettner]

So this is a call to protect yourself from.

[Joe Kerrigan]

Got it.

[Dave Buettner]

These dastardly folks who are out there making illegal copies of your books.

[Joe Kerrigan]

Either way, Library of Congress doesn't do that.

[Dave Buettner]

They do not.

[Joe Kerrigan]

It's incumbent upon you, as the copyright holder can go out and find infringing works and then take them to court and you take them to civil court.

[Maria Varmazas]

Right, yeah. Also for a self published book, do you think the Library of Congress has time to be chasing down copyright infringement? I don't think so.

[Joe Kerrigan]

No. No. They don't chase it down for anything.

[Maria Varmazas]

No, I know. Especially not for. Yes. I'm just saying.

[Joe Kerrigan]

Yeah, right. So, yeah, that's what struck me is that the Library of Congress does not concern itself with copyright infringement. That is entirely out of the author.

[Dave Buettner]

No, the other part that struck me is where they say, we strongly urge you to consult with our legal team. I'm imagining the picture like the Library of Congress with the big pillars out front down in D.C. where we've all seen that. And then next to it is this big, tall, like, brutalist architecture building. That's where the legal team hangs. The official Library of Congress copyright enforcement legal eagles.

[Maria Varmazas]

The legal eagles, is it? My understanding for my friends who publish books is you're lucky if your publisher even does this stuff for you when you're actually properly published.

[Joe Kerrigan]

So there is some kind of brutalist structure down in that neighborhood that you can see from 395. Yeah, it's like it's got water coolers all over it. And I think it might just be like.

[Dave Buettner]

Yeah, there's a bunch of, like, FBI headquarters is brutalist. Yeah, there's a bunch of them.

[Joe Kerrigan]

All those buildings are so ugly.

[Dave Buettner]

They are of their time.

[Maria Varmazas]

Yeah, that's a very polite way of putting it. Yes. Of their time.

[Joe Kerrigan]

Right.

[Dave Buettner]

So I think what's going on here is that there are Companies who will register your copyrights as a service.

[Joe Kerrigan]

Yep.

[Dave Buettner]

And then this, they go after people they find. They probably found this self published author. And so for the price of a stamp and a photocopied letter or an email, I guess in this case, yeah. They're hoping to get a few hundred bucks to do something that is in fact free, which is registering your things. And look, it is a legitimate service to do this as a service for.

[Joe Kerrigan]

Someone, but it's literally filling out a form and providing a copy of the work.

[Dave Buettner]

Correct?

[Joe Kerrigan]

That's it.

[Dave Buettner]

Yeah. Yeah. So it is scammy but not technically illegal. Yeah.

[Maria Varmazas]

Misrepresentation.

[Joe Kerrigan]

Although they are saying they are the Library of Congress. That might be illegal.

[Dave Buettner]

That is probably illegal, right? You are correct.

[Joe Kerrigan]

You are correct.

[Maria Varmazas]

Yeah. Sort of like with the house buying process I just went through where I got all this mail trying to get me to pay for documentation that was free. And they were saying that basically I needed to buy it. And it's like, no, that's freely available. I already have it. Thank you.

[Joe Kerrigan]

Yeah.

[Maria Varmazas]

So they're preying on ignorance here.

[Dave Buettner]

Yeah, yeah. There's another one that makes the rounds. If you have a. If you own a company, you will be bombarded with folks who want to help you protect your trademarks.

[Joe Kerrigan]

Right.

[Dave Buettner]

And will remind you that your trademarks.

[Joe Kerrigan]

Have expired and you must comes inside of every Uline catalog.

[Dave Buettner]

Right.

[Joe Kerrigan]

That's what I can't forget is I started up a company with three of my friends. It was just a software development company for a game. Never really took off. But as soon as we filed that company, Uline catalogs all over the place.

[Maria Varmazas]

Yes. Every year. Those bricks.

[Dave Buettner]

Yep.

[Maria Varmazas]

I get them too.

[Dave Buettner]

Right, right. The poor postal carrier.

[Joe Kerrigan]

I'm not shipping anything. Literally, I'm not. What we'll produce is a website that people will play a game on. There's no need for anything out of Uline.

[Sponsor Representative]

We want to thank all of you for listening. And of course, we want to thank our sponsors at KnowBefore. They are experts in helping users do the right thing through new school security awareness training.

[Dave Buettner]

All right, well, we would love to hear from you. If there's something you'd like us to consider for the show, you can email us. It's hackinghumansn2k.com and that is our show, brought to you by N2K Cyberwire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumansn2k.com we're privileged that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector. From the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies, N2K makes it easy for companies to optimize your biggest investment your people. We make you smarter about your teams while making your teams smarter. Learn [e-mail] this episode is produced by Liz Stokes. Our executive producer is Jennifer Iban. We're mixed by Elliot Peltzman and Trey Hester. Our executive editor is Brandon Karp. Peter Kilpie is our publisher. I'm Dave Buettner.

[Joe Kerrigan]

I'm Joe Kerrigan.

[Maria Varmazas]

And I'm Maria Varmazas.

[Dave Buettner]

Thanks for listening.