Nothing but the spoof.

Summary

Hacking Humans Podcast - Episode Summary

Episode Title: Nothing but the spoof.
Date: July 30, 2026
Hosts: Dave Bittner, Joe Kerrigan, Maria Varmazes
Podcast by: N2K Networks

---

Overview of the Episode

This episode delves deep into the evolving landscape of deception, influence, and social engineering in cybercrime. The hosts explore recent high-profile scams, updates on fraud tactics (including AI and agentic AI in scams), notable news reports, and reflect on the increasingly industrialized and globalized nature of scam operations. The discussion features practical advice, firsthand accounts, and a dose of humor, providing a comprehensive look at why even savvy individuals fall prey to sophisticated social engineering.

---

Key Discussion Points & Insights

1. FBI Impersonation Scams and the Double-Dip Threat

• Source: Official FBI warnings.
• Scheme Breakdown:
  • Scammers impersonate FBI officials, contact previous scam victims, and present as offering support or recovery services.
  • Utilization of deepfake videos, cloned voices, spoofed websites (fake IC3 portals), and social media profiles.
  • Victims are lured through various communication platforms: email, phone, social media, and encrypted messengers.
  • Data from original scams is leveraged for more believable second-wave attacks, making the scams particularly effective.
• Memorable Quote:
  "They call this a recovery or a double dip scam. Trying to get more information or more money from someone who has already been scammed. So basically kicking them when they're down." – Dave (05:21)
• Advice:
  • The real IC3 (Internet Crime Complaint Center) does not operate on social media or request money for recovery.
  • Always contact the FBI (or any law enforcement) using official numbers, never the contacts provided by incoming messages or calls.
• Timestamps:
  • Main topic start: [04:35]
  • Deepfakes and scam mechanics: [05:45]
  • Defensive advice: [07:44]
  • Discussion on spoofed sites and search ads: [08:53]

2. Amazon Scam — The Human Cost

• Source: BBC story of Dorian Jones, a 70-year-old charity volunteer conned by a tailored phone scam.
• Scheme Breakdown:
  • Dorian is contacted about suspicious Amazon purchases—details appear accurate, including items in his Amazon cart.
  • Scammers knew personal details: family, schooling, and even staged calls with apparent "Amazon staff" verification.
  • Techniques included social engineering, social proof (multi-caller authentication), and believable technical jargon ("your IP address is corrupted").
  • End result: £1,800 stolen across 12 small transactions.
• Insightful Quotes:
  • "It was so authentic. They got the better of me, hook, line, and sinker." – Dorian Jones (12:14, paraphrased by Joe)
  • "These scams don't work on you because you're dumb. They work on you because you're human." – Joe (18:35)
• Advice:
  • Amazon will never ask for remote access or payment outside official platforms.
  • Genuine companies rarely ask you to perform suspicious technical actions or use alternate payment methods.
  • Speaking up about being scammed reduces stigma and helps others.
• Timestamps:
  • Story introduction: [11:27]
  • Personal details used in scam: [13:20]
  • Multi-caller authentication: [15:18]
  • Takeaways and reflection: [18:26]

3. Scam Gangs as Corporate Enterprises – The UN Report

• Source: UN Office on Drugs and Crime, covered by Reuters and Bloomberg.
• Key Revelations:
  • Asia-Pacific scam gangs stole between $88B and $114B in 2025, eclipsing many nations’ yearly GDP.
  • These scam organizations increasingly mirror legitimate multinational corporations—departments for recruitment, laundering, data brokerage, etc.
  • Targeting and recruiting globally, moving into European and African markets, and employing native speakers for hyper-localization.
  • Massive use of trafficked labor; workers from at least 80 countries (and likely more) are forced into scam operations.
  • Scammers exploit generative AI for translation/localization, and agentic AI for automated, scalable social engineering and money movement.
• Memorable Quotes:
  • "They're saying that the scam networks are resembling more and more multinational businesses... we've got scam compounds that are bigger than a lot of the ones that are funding our 401ks." – Maria (20:06)
  • "Agentic AI is being used now to automatically find targets and conduct sophisticated social engineering campaigns..." – Maria (26:02)
• Concerns:
  • Jurisdiction shopping: scammers move to regions with weak enforcement/corruption.
  • Scale outpaces traditional law enforcement; AI automates and accelerates attacks.
  • Defensive strategies may shift to "poisoning the well" with false information online to evade agentic AI targeting.
• Timestamps:
  • UN report introduction: [19:13]
  • Corporate-style scam structure: [20:06]
  • Globalization and trafficking: [22:44]
  • Agentic AI implications: [26:02]
  • Discussion on defensive tactics: [27:16]

4. Catch of the Day: Scambaiting with a Personal Touch

• Listener Submission: A tongue-in-cheek text exchange where a scammer is trolled using podcast references.
• Highlights:
  • The scammer tries a variant of the "wrong number" luring method, eventually inviting the target for a meal in New York.
  • The responder repeatedly references podcast jokes and reveals they host a show about scammers.
  • The scammer’s response quickly shifts to insult after being exposed.
• Timestamp: [31:59]
• Memorable Quote:
  "Do they have good dips in New York? My friend Dave loves them, and I want to give him a nice present." – Listener "Don" (33:13, as read by Maria)
• Spirit: Playful, community-oriented; shows the value in mocking scam attempts for educational purposes.

---

Additional Notable Quotes & Moments

• "If I go right now to Google and look for FBI IC3 Complaint center... do I get a fake ad as a top result?" – Joe (08:57)
• "The real IC3 is secure, but they've spun up fake IC3 websites..." – Dave (07:02)
• "Amazon says that it never asks customers to download software, share remote access to devices, or make payments outside of its website or app." – Joe (15:58)
• "I would gladly [poison data for AI training]. Like, let's just do it. Why not?" – Maria (27:44)
• "The scale and sophistication of these criminal networks now really does outpace traditional law enforcement approaches." – Maria (30:52)

---

Practical Takeaways

• Check URLs directly and avoid interacting with organizations via social media links or non-official channels.
• Never trust inbound calls for urgent security matters; always verify via a known, official number.
• Be alert for signs of social engineering: credible background knowledge, multi-person social proof, or pressure to act quickly.
• Recognize that being a scam victim is a human error, not a personal stupidity. Share stories to inform others.
• Understand the global scale: Scams are now industrial operations, increasingly sophisticated, and crossing borders with technology and human trafficking.
• Prepare for AI-driven scams: Stay skeptical, poison your online data if desired, and know that AI can now translate and tailor scams for maximum credibility.

---

Humor & Humanity in the Face of Crime

The hosts frequently use humor to explore dark topics (e.g., "blockchain nightmare" as a band name, jokes about scammer corporate retreats, or making stew from an unwanted rooster), reminding listeners that resilience and community knowledge-sharing are essential tools in combating social engineering.

---

Related Resources

• Official FBI Internet Crime Complaint Center: [ic3.gov]
• BBC Reporting – Dorian Jones’s Scam Story
• United Nations Office on Drugs and Crime – 2025 Asia-Pacific Scam Report

---

For more listener stories or to contribute your own “Catch of the Day,” email: [e-mail]

---

This episode demonstrates that cybercrime’s true danger lies in its exploitation of our trust, not our technical ignorance – and the best defense is vigilance, verification, and community support.

Transcript

[A]

You're listening to the Cyberwire Network, powered by N2K.

[B]

Hello, everyone, and welcome to the Hacking Humans podcast, where each week we look behind the social engineering scams, phishing schemes and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Buettner and joining me is Joe Kerrigan. Hey, Joe.

[C]

Hi, Dave.

[B]

And our N2K colleague from the T minus Space Cyber Briefing, Maria Vermazes. Maria.

[A]

Hi, Dave. Hi, Joe.

[B]

We've got some good stories to share this week, but first, Joe, do we have any follow up?

[C]

I do have a chicken update, Dave. We haven't had one of those in a while.

[B]

Okay. All right, all right, we'll allow it.

[C]

Over the course of the last week, I have finished the construction of the coop.

[B]

Okay.

[C]

There are a couple little things I have to put on the inside to manage droppings, if you will.

[B]

So this is Coop 2.0.

[C]

Coop 2.0.

[B]

All right.

[C]

And it is looking really good. I'm actually very happy with how it turned out. My wife says it looks great. We have friends in from out of town and they said, ooh, that's really, really good looking. The neighbors across the street use the word, use the description. It looks professional.

[B]

Oh, wow.

[A]

If not, that's a handsome coupe.

[B]

So people from far and wide are keeping praise on you about your chicken coop crafting skills.

[C]

Yes, I am going to. I did not design this coop. This is from a place called Camera. The guy's name is Third coast something or other.

[B]

Okay.

[C]

He sells the plans online. They're pretty good plans. So I bought the plans, followed the plans, made the coop, and now all I have to do is build the run and then I can move the chickens into the new run.

[B]

Okay.

[C]

So. Yep.

[B]

How are the chickens feeling about the new coop?

[C]

They. They. I hope. I don't know. They haven't seen it.

[B]

They haven't said anything.

[C]

They haven't said anything about it to me.

[A]

They haven't flown it?

[C]

No, they haven't flown it.

[B]

They're still laying eggs.

[C]

Yeah, they're still laying eggs. Lots of eggs.

[B]

I still haven't flown it.

[C]

I brought. Hey, I brought you some eggs today, Dave.

[B]

I know. Thank you very much.

[C]

Those are washed. They need to go in the fridge.

[A]

So mail some up to Massachusetts. What are you doing, Joe?

[B]

Oh, yeah, let's mail some eggs. What could possibly go wrong if you

[A]

put an egg and just wrote an address on it? Would USPS mail it?

[B]

Well, I don't know, but I do remember back in the day that David Letterman did an experiment. Did that very experiment.

[A]

Yes. Like, mailed a roll of tape. Right.

[B]

He did a Pop Tart. Yes. They wrote an address on a Pop Tart, and it did arrive. Yeah.

[A]

Mail a raw egg to me. Let's see what happens.

[B]

Yeah. All right.

[A]

Please don't do that. Please don't actually do that.

[C]

If I hard boil it, If I don't wash it. If I don't wash it, it'll probably be fine.

[A]

Oh, and the. And the. Yeah, let's see what happens.

[C]

You know, it might be a little messy when you get it, but you can scrub them off and put them in the fridge.

[B]

Sounds appetizing. Yeah. All right. Well, congratulations, Joe. I'm glad the chickens are happy, and I wish them well. You'll have to send us some pictures when. When you have a chance.

[C]

Yeah, when everything's done, I'll send pictures.

[B]

All right.

[C]

I got to get the run done, but, you know, the coop took me, like, two months already. Oh, way longer than I expected.

[B]

What do you do with the old one?

[C]

Well, actually, the old one's too small, and we're giving that to my daughter because she has taken some eggs from my hutch because we have a rooster, and she does not have a rooster, and she has some broody hens. So she has filled up a couple of nesting boxes in her coop with my eggs, which are fertilized, and she is having the hens hatch the eggs out. And we were looking at them last night. They look. We're kind of candling them with her cell phone camera, and you can see this is not a regular egg anymore. It looks like something's going on inside, so maybe some.

[B]

All right.

[C]

But we have reached the decision that we are disposing of the rooster.

[B]

Oh.

[C]

Yep. He's gonna.

[B]

Quite a euphemism.

[C]

Yes. Yeah.

[A]

Rooster stew. Have you picked out the red wine yet? What's the.

[C]

No. But my son has looked up Kokavin recipes, and we are going to try it. My friend Joel, who's actually sitting with us in the studio today, has said that roosters are very tough, but I'm like, we'll try it with the coqavin recipe because it is designed for a recipe for birds that are old. It's a recipe designed for birds that are old.

[B]

Oh, okay. Yes.

[C]

Yep. We'll see how it goes. We might just order pizza.

[B]

Right? That didn't work out.

[A]

Modern problems require modern solutions.

[C]

There's $25 worth of wine we won't be getting back.

[B]

All right, well, congratulations.

[A]

Thank you.

[B]

And I'll tell you what. Let's take a quick break here before we get to our stories. We'll be right back after this message. All right, we are back. I am going to start things off for us here. And my story this week comes from the FBI. They've put out a notice, a warning, that scammers have been impersonating FBI personnel and claiming to help victims at the Internet Crime complaint center, the IC3, which we've talked about here many times. Yep. So the IC3 is the FBI's sort of inbound portal for reporting things to the FBI. Right.

[C]

It's like a clearinghouse, if you will.

[B]

Yeah. So these scammers are going after folks who have already been defrauded. So they call this a recovery or a double dip scam. Trying to get more information or more money from someone who has already been scammed. So basically kicking them when they're down. Yes. And they say that they're using AI generated deepfake videos of fake FBI officials.

[C]

When they say fake FBI officials, do they mean, like, they're impersonating people?

[B]

I think actually just making up FBI officials. I don't know. I don't. It could be.

[A]

I mean, how many people do work for the FBI that the average person knows offhand? I mean, Mulder and Scully?

[B]

I. I. So I'm not sure right now.

[C]

Off the. Off the top of my head, I can only name one.

[B]

Yeah, Yeah, I know. A bunch. But I'm.

[A]

You're a little special, Dave. But we knew that. Yes.

[B]

Yeah. Yeah. They're using fake social media profiles. They're using spoofed websites that look like the ic3.gov site. And they're using. Of course they're spoofing their caller IDs.

[C]

Yeah.

[B]

And they're cloning voices during the phone or video calls. They've said that the victims are contacted via email, phone calls, social media ads, forums, or, wait for it, Facebook, messenger or Telegram.

[A]

No.

[B]

After filing or discussing an IC3 complaint.

[C]

Okay, quick question. How are the scammers knowing that they have an IC3 complaint?

[B]

Because they're submitting their complaints to the fake IC3 website.

[C]

There it is.

[A]

Okay, so it's not a conspiracy. It's not like the real IC3 is getting data harvested off of it.

[B]

The real IC3 is secure, but they've spun up fake IC3 websites, and they're collecting information from these folks, asking them for their contact information. They're asking them for details on the scam. They're asking them how much they Lost financially. And so that's a lot of information for a scammer to have to come into the relationship with. And they're taking advantage of folks. So the FBI, in their notice here, is emphasizing that the IC3 has no social media presence.

[C]

Yeah.

[A]

Right. So please do notC3 on Twitter and expect them to get on the case. It's not them. Right. Okay.

[B]

They say they do not contact complainants through social media, messaging apps or online chats, and they do not charge fees or request payment to recover stolen funds.

[C]

Yes.

[B]

And they say they will never, ever ask for cryptocurrency gift cards or wire transfers.

[C]

You know, we here at the FBI need you to go out and buy some itunes gift cards for us.

[B]

Right, Exactly.

[C]

I'm stuck in a meeting and I need to do this for my granddaughter who's having a party this weekend, and I just don't have time to go out and get one.

[B]

That's right. They say legit follow up only comes from FBI personnel at the local field offices or other law enforcement officials when additional information is needed. But I guess that's the trick, right, is how do you know the inbound call is from someone legit?

[C]

Right.

[B]

And we do what, Joe, you always recommend, which is call them back on

[C]

the known good number.

[B]

Right, Right.

[C]

Yeah.

[B]

Thank them, tell them you'll call them back and then don't call them back on a number they give you.

[C]

Right.

[B]

Call them back on a number you look up.

[C]

Yep.

[B]

And be careful about that.

[C]

Yes.

[A]

It's like. Except it's getting tough.

[C]

Isn't unspoken part of the story here that, that, that I think I know the answer to. But if I go. If I go right now to Google and look for FBI IC3 Complaint center or whatever, I Google FBI complaint and do I get a fake ad as a top result that says register your [e-mail]?

[B]

Yeah.

[C]

You know, and that's some scam website.

[B]

Well, check it out, Joe.

[C]

Well, hey, type it in.

[B]

You're sitting right here.

[C]

I got a computer right here in front of me.

[B]

What are we waiting for? You can do that?

[C]

You don't even need technology.

[A]

Yeah, yeah, yeah.

[C]

IC3, it takes me to ic3.gov. Okay, so. And then there's FBI.gov. all right, so.

[B]

No, but you have an ad blocker running, don't you?

[C]

No, I don't.

[B]

Oh. What?

[C]

This is not a computer. I'm allowed to install software.

[A]

I'm sure it also will depend on your browser, your browsing history, the search engine you're Using.

[C]

Right.

[A]

And also, let's not discount the fact that a lot of people now look things up through AI agents instead of going to search, so.

[B]

Right, right.

[A]

Yeah. There's that option, too.

[B]

So the FBI recommends typing ic3.gov directly into your browser and make sure that that URL ends in dot and not biz or IO or anything else they say. Avoid sponsored search results and links sent by unknown contacts. And of course, report impersonation scams with as many details as you can gather up. So this I would see as being a very effective scam. I can imagine a lot of folks, if you get an inbound call from someone claiming to be from the FBI, who has a bunch of information that you've already submitted, believing that you're submitting it to the FBI, they could easily take you down that path.

[C]

Absolutely. This is. I can absolutely see how people fall for this. Yeah, yeah. Just by not paying attention to a URL, they already. They're already bought in. They already believe everything that's going on.

[B]

Right.

[C]

Even though they've given the scammers all the information. Yeah, this. This is like a. A follow on scam that's not associated with the original scam. These guys are just out here fishing for other scam victims and then capitalizing on that.

[B]

Yeah. Yep. All right, well, we will have a link to that story in our show notes. Joe, what do you have for us this week?

[C]

My story comes from the BBC, from Holly Ratley over at BBC.

[B]

The Biebs.

[C]

The Biebs, right. And this talks about. I love how the BBC characterizes people. This is retired charity volunteer Dorian Jones. He's 70 years old.

[A]

Retired from being a charity volunteer.

[C]

No, he's a charity volunteer now. He works at a hospice, but he has retired from some other job.

[A]

Okay.

[C]

But now he's a volunteer, so he's a good guy. What they're trying to tell you is he's a good guy. And really, I want to say I agree that Dorian's a good guy, because Dorian came forward with this story, and the story is about how he got scammed by some Amazon scammers. And his quote is, it was so authentic. They got the better of me, hook, line, and sinker.

[A]

And you said he's a hospice volunteer. He's automatically a good guy for that. That's.

[C]

Yeah, that's a tough job, you know?

[A]

Yeah, yeah.

[C]

It's. You know, it's not. It's. And this is how he spends his free time.

[B]

This is.

[C]

He doesn't get any money for this.

[B]

Right.

[A]

That's a good egg. Yeah.

[C]

Yeah. So. So he got a phone call one day from somebody fraudster telling him that his Amazon account was being used to buy two smartphones. So he goes to his Amazon account and he sees, hey, there are two smartphones in my shopping cart.

[B]

Oh.

[C]

So it looks like these guys had access to his Amazon account.

[B]

Huh? Interesting.

[C]

But he, at some point in time said he got suspicious during the call because there was a very crackly line. It was not, you know, low quality lines. The scam center that this scam is being run out of is, you know, buying their phone services from the. From the lowest bidder.

[A]

Well, I mean, I don't know, sometimes you can get a bad connection, but whatever.

[C]

Yeah, but one of the things that was. Was convincing was this scammer was on the money about every question that he asked during a two hour long conversation.

[A]

What?

[C]

Yeah, the profile. He says, Dorian says the profile of what he knew was me. About me was incredible. My son, my family, my schooling. The caller even advised him to hang up regularly because they were, quote, being listened to by a scammer.

[A]

He said to me, oh, my God,

[C]

your IP address has been corrupted. Hence your phone has been compromised. So I thought I was in safer hands. Now, tech savvy people here, your IP address is corrupted. They what?

[B]

That.

[A]

No, it sounds. But to the average person, that sounds plausible enough, techie enough, and especially if you add in for many of us, we now have WI fi calling at home, or your landline is voip. It all sounds related enough that if you're not super familiar with this, you're going to be like, those words sound like they're in the correct order, I believe.

[C]

Correct. Now, the guy's 70. He didn't grow up having a TCP or an IP address.

[A]

Like, listen, the graybeards who are 70 are the ones who made all this, so.

[B]

Right, that's a good point.

[C]

I'm not that, Joe. I didn't say that. I've had IP addresses for a very long time.

[A]

I'm sorry to hear that.

[C]

Right. Yes. So he said that this call caught him off guard. He grew kind of suspicious, however, when he was given directions to type numbers into his phone keypad to, quote, cancel the scammers. And then he received fake messages pretending to be from his bank. His wife. His wife was in the background going, dorian, that sounds like a scam.

[A]

Good for you, honey.

[C]

Right?

[A]

Listen to your.

[C]

That isn't right. But he. He was still enthralled by these scammers. And then he Got a second call from another scammer who was pretending to also be from Amazon. But he says, well, let me validate the. The. Let me validate the guy you're on the phone with.

[B]

I'll.

[C]

I'll. I'm an official staff member, so let me authenticate the first caller. Which they did by holding the phones next to each other and authenticating each other.

[A]

Wait, wait, wait. Hang on. There's two phones.

[B]

Yeah.

[C]

I don't. I don't know. Maybe they. Maybe. Maybe they had his wife's phone number. Two.

[A]

Okay. I was like, how many phones this guy have? Okay, got it.

[B]

Have a landline?

[C]

It could have a landline. That's right. The end game here was that this double scam led to the original caller stealing 1800 pounds out of Dorian's bank accounts in 12 separate transactions. Interesting that it was done in 12 separate transactions so it didn't set some triggers off.

[A]

Right.

[C]

Amazon says that it never asks customers to download software, share remote access to devices, or make payments outside of its web website or app. And Amazon is helping Dorian secure his accounts. So Dorian has now canceled his bank cards and contacted the police, but he's still waiting to see if he can get the money back. I don't know that he'll be able to get much of that money back. Chances are that money has already moved on. Frankly, a loss of 1,800 pounds is not a devastating loss, I don't think.

[A]

Well, it depends on the person.

[C]

Right. It depends on the person. But, I mean, you're getting off pretty cheap here. There were stories I was sifting through today where people lost $200,000, $250,000, their entire retirement savings. So I think, yeah, while 1800 pounds is not something I'd be happy if I lost, I mean, if you're a

[A]

pensioner on a fixed income, that could be like. It could set you months and months of money. Yeah. That's not small. Yeah. And what's interesting to me is I'm not trying to gotcha Amazon on this. I just. I. I can't help but just reflect that they don't ask people to make payments outside of their website or app. But I've seen many websites where you can pay via Amazon and it's not an Amazon. I mean, that's not an uncommon thing.

[C]

Right.

[A]

And that's not. And that's not scammy. It's a normal thing. But I feel like those kinds of things do muddy the waters a bit, even though that's a legitimate way of doing E Commerce.

[C]

Amazon is being a payment processor for other.

[A]

Yeah, I mean, they are. I mean, I was just thinking to myself, they're everywhere. Even if you don't think you're on Amazon, you can still pay through Amazon. So.

[B]

Yeah, right, right. I'm just imagining the second scammer in the cubicle next to the first scammer.

[C]

Sure. Absolutely.

[B]

One guy sort of leaning back in his chair and indicating, I got a hot one. I need some backup here.

[C]

Yep.

[A]

Yeah.

[C]

That is probably exactly what happened.

[B]

Yeah.

[C]

Something not that far from that man. Dorian said he wanted to make others aware of these sophisticated scams. He says, beware. They're out there to catch you. So first off, Dorian, thank you very much for coming forward. I know Dorian, avid listener of hacking humans. Maybe it might be, and I hope he is. But I really appreciate people who go through this kind of loss, and instead of shutting up about it, they come out here and they go, hey, look what happened to me. Here's how this worked. Here's how it went down. Here's how I was tricked.

[A]

Right.

[C]

And it's. We. We say this. We haven't said this in a while, but we do say this very often. These scams don't work on you because you're dumb. They work on you because you're human.

[B]

Right.

[C]

It is not. This is not a failing on your part. This is a moral failing on the scammer's part.

[A]

Yes.

[C]

These guys are bad dudes who are doing this. It is not because you're. You're. You're falling victim to somebody else's scam, somebody else's evil actions.

[B]

Yeah, yeah. All right. Well, we will have a link to that story in the show notes. We're going to take a quick break here. We'll be right back after these messages. And we are back. Maria, you're up. What do you got for us?

[A]

Well, I have a report from the United nations that is making the rounds in all the major news outlets like Reuters and Bloomberg. So I wanted to take a look at it and see what the report said. The headline is asia Pacific scam gangs have stolen over $88 billion in 2025. And this comes from a new report from the United nations office on drugs and crime. They estimate scam gangs stole between 88 billion and $114 billion from victims across Asia Pacific in 2025. So that's just the Asia Pacific region.

[C]

Right.

[A]

Only, by the way, which. So again, that is an unbelievable amount of money for just one region of the world in just one Year. So that's crazy. And it's worth noting that that number, that range of numbers is larger than the annual GDP of many countries in this world.

[C]

Yes.

[A]

So the sub headline to this report is really that scam operations are becoming corporate enterprises. And that's kind of what this report is drilling into. They are, they're saying that the scam networks are resembling more and more multinational businesses. So think of all the businesses like on the New York Stock Exchange or whatever. And we've got scam compounds that are bigger than a lot of the ones that are funding our 401ks.

[C]

Right.

[A]

Which is just blows my mind in a bad way when I think about that. And these criminal organizations are running like ye olde corporate in the way that they actually operate in some ways. So criminals who are in these worlds can actually plug into a larger criminal ecosystem where they can get specialist groups within their world that are like a department that works on victim recruitment and there's another department that works specifically on money laundering, other ones that work on data brokerage, others work on specifically human trafficking and others work on cryptocurrency movement. So you don't have to be just a criminal who does all the things. You can be a specialist criminal and you can then, you know, work with your buddy in a different department and you know, cross the silos and break down barriers and think outside the box and synergize, but in a corporate, cynical, scammy way.

[C]

Yeah, Henry Ford would be proud.

[A]

Right. I wonder if specialization plans and like, you know.

[B]

Yeah.

[A]

How corporate is this? And the. Some of the recruiters in these sort of corporate criminal ecosystems, apparently, according to the Reuters story on this, say that they're seeking recruits from outside of Asia to expand into new markets. So they're going super duper multinational. And the UN has seen recruitment advertisements linked to the scam industry's communications channels targeting people with German, Polish, Dutch, Spanish, Italian, French, Swedish, Norwegian and English language skills. So not all at the same time.

[C]

They're looking to expand.

[A]

They're looking to land and expand. Right. I'm sure they had like a big corporate rally, like a sales kickoff meeting with swag, and they were like, listen, we've conquered apac.

[C]

What do you think their T shirts say?

[A]

Right. I bet they've got free T shirts. Maybe they've got like, you know, do they have like a fancy trip they send their top scammers on in Cancun? Like these are our top performers.

[B]

They get sent to countries that have, that don't have extradition agreements.

[C]

Right.

[A]

Yeah. And like I'm laughing and making fun of this. Cause this is, you know, there's a dark humor to this. But I mean, we've talked about it many times on the show. These scam compounds continue to rely on trafficked workers. Like these are people who are enslaved. So there's nothing funny about that.

[C]

No.

[A]

And the UN report says that victims from at least 88. Zero countries have been identified in scam compounds, which is.

[C]

So there are 80 people from 80 countries, like physically in the scam compounds to conduct scams outside to their home countries.

[A]

That is a much larger number of countries than I would have thought.

[C]

I don't know is a bigger, newer number than we'd seen before. Because we, we've seen in the past. These guys were like, they had like Chinese, Vietnamese, Laotian, Cambodian. They were all sticking local because that was easy to lure those people to the, to the, the scam centers in like Myanmar. And now they're, they're actually, they actually have victims from 80 countries, which has to go beyond Asia.

[A]

Oh, yeah. I mean, I think there was a report, like an in depth report. I want to say Bloomberg did it. And we cover some months ago where there was a gentleman from a country in Africa where he got kidnapped. Yeah. So it sounds like we, they've, they've not only expanded into Africa. I'm sure they've, I'm sure this is absolutely global. I, I don't know. If you had asked me to, to guess how many countries were involved, I would have said 80.

[C]

Yeah, right. Yeah. I would not have guessed that high.

[A]

No, I wouldn't have either. That, that is, that number is very alarming to me, among all the other things. And so the, the, the UN report is asking, you know, what's being done about this, which, which is I think the question we're all asking, how can we possibly stem this? Not a huge surprise that there is pressure from law enforcement to stop this. But it's not doing a whole lot. We know. And we have talked about the crackdowns on this and we've talked about people doing amazing expose work on this. Crackdowns in Myanmar, Laos and Cambodia, which have disrupted some of these operations. Yeah, but it's a bit of a whack, a mole situation. The gangs just kind of pick up sticks and move to continue what they're doing. And the UN report describes that as jurisdiction shopping where they move their operations to countries that happen to have weaker enforcement and, or higher corruption or both really. And there's of course, an AI level to this report as well. You knew this was coming, right?

[C]

Yep.

[A]

Yeah, we mention it now, I think, in a lot of our stories that, you know, generative AI is making a lot of this worse. The scammers are using generative AI to make fake messages, fake social media profiles or profiles on any kind of, like, apps that they're using to get people, you know, your Scrabble app, they're using to scam you. They're making fake profiles on that. They're using generative AI to translate their scams convincingly into other people's native languages. So the game is not being given away as easily anymore with, like, the old stereotypical phishing language where it was like, hey, this is clearly not your first language.

[C]

Right. Also, they're taking people from countries, these 80 countries, and using them to scam back into those countries.

[A]

Yeah. And to localize so they. So they can. They can make a scam in a native language and then the person can localize it to make it sound even more convincingly local.

[C]

Right.

[A]

And the generative AI is also being used. I think you guys just both talked about it in your stories, to impersonate people to devastating effect. All but that now there's a new layer. The UN is warning that generative AI is old news. Agentic AI is really what's making things even worse now.

[C]

Right.

[A]

So agentic AI is being used now to automatically find targets and conduct sophisticated social engineering campaigns. So imagine using agentic AI to scrape all of the Internet really easily and say, build a profile of all of these people real quickly in an automated way based on everything that we can find on them on all of the Internet, including social media. Horrifying how much information we all willingly put out, but not just on social media, but that's out on public record about us. I mean, it's just horrific. And doing that at an automated scale, a machine scale, I mean, it keeps me up at night thinking about this.

[B]

I just did a story about this recently over on the Cyberwire about a tool that scammers could purchase that would basically go through all of the scraped information and target the most valuable victims.

[A]

Yeah, absolutely. And the advice for a lot of us for a long time has been, you know, be careful what you put out there, you know, and it's up to everyone's discretion to figure out what they're comfortable with. I can't help but wonder if now it's going to be maybe purposely poison the well a little bit to mess up the agent AI, like put some purposely false Info out there.

[C]

I have seen a lot of people trying to. Trying to get a groundswell, a grassroots effort to poison data on the Internet, specifically to corrupt AI models.

[A]

Yeah, I wonder if we're going to start seeing people doing that on social media too, to just try and mess this up. I would be serious. Yeah, that sounds like some fun mischief. I would gladly do that too. Like, let's just do it. Why not? Yeah, they won't know. The agentic AI the UN report is also saying is also accelerating the rate at which crypto theft and money laundering is happening. That's also not a big surprise.

[C]

Yeah. I imagine you can put agentic AI to work for moving money through tumblers at lightning speed.

[A]

Oh, yeah.

[C]

You can create a blockchain nightmare so big and so thick you might not be able to even unravel it.

[A]

A blockchain nightmare. That's a phrase.

[B]

New band name, man status.

[A]

New band name that's gonna be rattling around in my head for a blockchain nightmare.

[B]

That's awesome.

[A]

Yeah. Is that a meth nightmare? Please put that on merch. For our show, I would wear that.

[B]

The Metallica font.

[A]

Yes. I have a friend who does that. I'm going to ask him to make a logo for us. That would be amazing. And the UN underlines that, most importantly, agentic AI is now scaling fraud with much, much less, as you said, Dave, much less human involvement. So there's no point really anymore in sort of trying to bait the agent, which we all love doing. And seeing those videos of people trying to waste somebody's time who's trying to run a scam. There's no point in that anymore because the person on the other end doesn't exist. You're wasting the time of an AI agent. They can do it all day. So that whole hobby for some people is just going to go away real quick.

[B]

I wonder what would happen if you were on the line with one of these AI scammers, and you said to the scammer, you know, I'm just about ready to give you all my money, but first I'd like you to calculate the last digit of PI.

[C]

Right. I saw somebody on YouTube who was talking about this and understanding they were. When you use these agentic AIs, unless you're hosting them in house, which is very cost prohibitive, you have to buy tokens.

[B]

Right.

[C]

And this guy was like, I know these are AI scammers, but how many tokens can I burn up in this process? And he's just trying to raise the cost the financial cost for these scammers?

[A]

Well, your point about it being expensive to do in house. I mean, if you are a multinational corporation making quarter of a trillion dollars a year, you probably are running it in house.

[C]

Yep. That's good. That's so they're probably not using something with guardrails on it, that's for sure.

[A]

Probably not. Oh, man. How deep does this go? Like, I'm sure what they're running is something home brewed and doing something real nasty. And I'm sure we'll be finding out more in time, and it's going to be horrifying. So, yeah, this new UN report kind of confirms what we've been learning about on the periphery, but it just solidifies it in a nice way. That nice way, it drives it home. That many modern scan operations, as we said, they function now more like multinational corps. They have departments, they have specialists, they have internal contributors, they have managers, they have recruiters, they have outsourced services. Probably not an HR department, but who knows? And the scale and sophistication of these criminal networks now really does outpace traditional law enforcement approaches. So if we ask ourselves the question, you know, is the world ready for industrial level scams? It's a moot point because we're already in it, sadly.

[C]

So I see one solution to this nukem.

[B]

Oh, yeah, that's good.

[A]

Okay. I was gonna say move to a cabin in the woods somewhere, but yeah, okay.

[C]

That's right.

[A]

Yeah, yeah.

[B]

Those are two extremes.

[C]

But I don't mind the move to a cabin in the woods somewhere.

[A]

You're already halfway there.

[C]

I know.

[B]

There's a cybersecurity researcher who I cross paths with from time to time, and he says there are scammers in the world who deserve to be visited by highly targeted missiles. Yeah, through the front door, right?

[A]

Yep. Yeah, yep. Agreed.

[B]

All right, well, we will have a link to that story in the show notes, and of course, we'd love to hear from you. If there's something you'd like us to consider for the show, please email us. It's hackinghumans2k.com Joe, Maria, it is time to move on to our catch of the day.

[C]

Dave, our catch of the day comes from a listener named Don who says, in my defense, I was left unsupervised. This may very well be my favorite catch of all time. And Maria, you're going to have to read the green text.

[A]

Oh, no. Okay, you want me to do the

[B]

other one or do you want to take a.

[C]

No, you can do the other one. I think everybody would much rather you do the other one. Maybe you can do a funny voice.

[B]

All right. It says, are you having a quiet night tomorrow?

[A]

Hey, is this Joe? You said you were getting a new number. How are the chickens?

[B]

I'm Serena. Are you my friend Elisa?

[A]

Nah, my name's Maria. So I didn't click on the wrong link this time. I'm very suspicious of this whole thing. What's going on?

[B]

My dear, I am so terribly sorry. I just double checked the number I entered earlier and realized I had mistyped it. I truly hope my mistake hasn't caused you any inconvenience.

[A]

No problem.

[B]

Thank you for your understanding. In my eyes, you are a truly kind and wonderful person. If you ever have the opportunity to visit New York, I would be absolutely delighted to treat you to a meal to make up for my earlier mistake.

[A]

Do they have good dips in New York? My friend Dave loves them, and I want to give him a nice present.

[B]

It's really delicious. If you like, I can recommend it to you. It is truly a pleasure to have met someone as lovely as you. May I ask which beautiful city you call home?

[A]

Well, I live in Boston, but I do a podcast out of Maryland.

[B]

That sounds like a beautiful place. I really love traveling.

[C]

Wait, which one? Maryland or Boston?

[B]

Yes.

[A]

Right, yes.

[B]

If I ever get the chance to visit your city, could I get in touch and ask you to show me around? What kind of show are you filming?

[A]

Probably not. The podcast is called Hacking Humans. We detail the scams people try to pull on others, mainly through electronic media such as texting. I'd better charge my phone before I screenshot this.

[B]

And then it says, f you, you a hole.

[C]

Right?

[A]

Laugh, cry. Emoji. In real life? In this case, yes.

[C]

By the way, I want to point out, don does have 100% charge on his phone.

[A]

Nicely done, Don. We need to send him a shirt.

[C]

Yeah.

[B]

Oh, that's hilarious.

[C]

All the references to our show in this one, Don. This is a work of art, my friend.

[A]

Thank you, Don. Thank you for making it me who gets to be the asshole in this one. I actually really enjoy that, so thank you.

[B]

Very nice. All right, well, again, we would love to hear from you. If there's something you'd like us to consider for our catch of the day, please do email us. It's hackinghumans2k.com. And that is our show. Brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans2k.com this episode is produced by Luke Liz Stokes. Our executive producer is Jennifer Ibin. We're mixed by Elliot Peltzman and Trey Hester. Peter Kilpe is our publisher. I'm Dave Bittner.

[C]

I'm Joe Kerrigan.

[A]

And I'm Maria Varmazes.

[B]

Thanks for listening.