Scam me once.

Summary

Podcast Summary: Hacking Humans – “Scam Me Once”

Episode Overview

In the "Scam Me Once" episode of Hacking Humans, hosted by N2K Networks, Dave Buettner and Joe Kerrigan delve deep into the intricate world of social engineering scams, phishing schemes, and criminal exploits that are increasingly targeting both individuals and organizations. Released on May 22, 2025, this episode not only shares gripping real-life scam stories but also features an insightful interview with Alex Hall, a trust and safety architect at Sift, who provides expert analysis on the evolving threat landscape of job-related scams.

---

1. Opening Anecdotes: Chickens, Dogs, and Unexpected Threats

The episode kicks off with a light-hearted yet revealing conversation about insider threats, illustrated through a personal story shared by co-host Maria Vermazis. Maria recounts the heartbreaking incident where her family's pet dog, described as a "mass murdering psychopath," slaughtered 13 chickens on Easter Sunday.

Maria Vermazis [01:07]: “Somebody let this dog, who is apparently a mass murdering psychopath of a dog... and she just went downstairs and just killed all 13 of the chickens.”

This anecdote serves as a metaphor for trusted insiders betraying expectations, setting the stage for discussions on more sophisticated forms of deceit in cybersecurity.

2. Real-World Scam Stories from the Scam Subreddit

The hosts transition into sharing two compelling scam narratives sourced from Reddit's scam subreddit, highlighting the variety and ingenuity of modern scams.

a. Preventing a Crypto Investment Scam

A bank teller narrates an encounter with a customer attempting to scam the bank by claiming to need a $9,000 deposit to unlock $90,000 from a fraudulent crypto account. The teller's skepticism and prompt action prevent the scam from succeeding.

Joe Kerrigan [14:25]: “I grabbed my phone and showed him the numerous crypto scams posted on Reddit. I said his biggest blessing is losing a couple of hundred dollars and not thousands.”

b. Impersonation of a Police Officer for DWI-Related Scams

Another story details a scam where an individual posing as a Sergeant Shane Kitchens contacts a scam victim, claiming their relative with a DWI is about to be released pending a payment for an ankle monitor. The scam exploits emotional vulnerability, nearly extracting $3,500 from the victim.

Joe Kerrigan [17:48]: “This is a scam, Obviously. This person pretending to be the police officer...”

This narrative underscores the importance of verifying official communications, especially those requesting urgent financial actions.

c. Fake Quilting Orders on Facebook

Maria shares a personal experience where a scammer attempts to deceive her wife through a cloned Facebook account, asking for a deposit to order a quilt. The immediate suspicion and verification by family members avert a potential scam.

Maria Vermazis [22:49]: “This is a Facebook account that's just being used to scam people. And fortunately, my wife did not get scammed.”

d. DoorDash Driver's Massive Fraud

A case involving a DoorDash driver who, along with accomplices, stole $2.5 million by exploiting backend access to manipulate orders and payments. This fraudulent scheme highlights vulnerabilities in service platforms' operational systems.

Maria Vermazis [24:59]: “He faces a maximum of 20 years in prison.”

e. Google Second Factor Authentication Scam

The episode addresses Google-related scams where fraudsters impersonate support to extract authentication codes, allowing unauthorized access to victims' accounts.

Maria Vermazis [27:44]: “Google will never call you to help you reset your password. That's not how this works at all.”

3. Expert Interview: Alex Hall on Job Scams and AI

A significant portion of the episode features an interview with Alex Hall, Trust and Safety Architect at Sift. With 17 years of experience, including a period as a former fraudster, Alex provides a dual-perspective analysis on the rising menace of job-related scams exacerbated by AI technologies.

a. The Dual Nature of Job Scams

Alex outlines two primary categories of job scams:

1. Malicious Job Seekers: Individuals leveraging AI and social engineering to secure positions for nefarious purposes, potentially becoming insider threats.

2. Fake Job Listings: Scammers posting bogus job advertisements to collect personal information, facilitate identity theft, or perpetrate financial fraud.

Alex Hall [40:11]: “These job postings are being written with AI... fraudsters are taking that information... which might result in synthetic ID fraud, might result in identity theft.”

b. Protecting Job Seekers

Alex advises job seekers to meticulously verify job postings by:

• Checking company LinkedIn pages and official websites.
• Scrutinizing email addresses and communication channels.
• Verifying phone numbers and directly contacting companies through known service lines.

Alex Hall [42:33]: “Verify and then contact directly...”

c. Mitigating Organizational Risks

For organizations, Alex emphasizes the integration of fraud prevention technologies within recruitment processes to detect suspicious behavior early. This includes:

• Analyzing geolocation and device data during application submissions.
• Monitoring application velocity to identify bot activities.
• Implementing strict authentication measures during interviews and onboarding.

Alex Hall [47:04]: “Looking at behaviors that are suspicious, looking at geolocation, device intelligence...”

He also highlights the catastrophic potential of insider threats, urging organizations to monitor access and interactions within their systems diligently.

Alex Hall [48:08]: “Fraudster takes over an employee's account... the damage can be catastrophic.”

4. Managing Deceased Loved Ones’ Accounts and Associated Scams

The hosts share personal experiences regarding the management of deceased relatives' online accounts, shedding light on how scammers exploit these situations.

a. Facebook Legacy Accounts

Both Dave and Maria discuss the vulnerabilities of legacy contacts on Facebook, where scammers imitate deceased individuals to manipulate or extract information.

Dave Buettner [34:27]: “There's a lack of sensitivity around all this from these companies.”

b. Emotional Manipulation and Data Security

These stories highlight the necessity for platforms to implement more secure and sensitive handling of deceased users' accounts to prevent exploitation.

5. Final Thoughts and Cultural Shifts in Recruitment

Concluding the episode, the hosts and Alex stress the urgent need for cultural shifts within organizations to prioritize cybersecurity in recruitment and HR processes. Separating recruiting from HR functions and integrating advanced fraud detection measures are recommended to safeguard against evolving threats.

Alex Hall [50:35]: “Job scams are taking off... It's more important than ever that the consumers become educated.”

---

Key Takeaways

• Vigilance is Crucial: Whether you're a job seeker, an organization, or managing a loved one’s digital legacy, staying informed and cautious can prevent falling victim to sophisticated scams.

• Technological Tools Matter: Leveraging advanced fraud prevention technologies and integrating them into recruitment and operational processes can significantly mitigate risks.

• Awareness and Education: Continuous education on emerging scam tactics, especially those enhanced by AI, is essential for both individuals and organizations to stay ahead in the cybersecurity landscape.

---

Notable Quotes

• Maria Vermazis [01:07]: "Somebody let this dog, who is apparently a mass murdering psychopath of a dog... and she just went downstairs and just killed all 13 of the chickens."

• Joe Kerrigan [14:25]: "I grabbed my phone and showed him the numerous crypto scams posted on Reddit. I said his biggest blessing is losing a couple of hundred dollars and not thousands."

• Alex Hall [40:11]: “These job postings are being written with AI... fraudsters are taking that information... which might result in synthetic ID fraud, might result in identity theft.”

• Alex Hall [47:04]: “Looking at behaviors that are suspicious, looking at geolocation, device intelligence...”

• Alex Hall [50:35]: “Job scams are taking off... It's more important than ever that the consumers become educated.”

---

Conclusion

"Scam Me Once" offers a comprehensive exploration of the multifaceted nature of modern scams, blending personal anecdotes with expert insights to equip listeners with the knowledge to recognize and thwart deceptive tactics. Whether through personal vigilance or organizational policy enhancements, the episode underscores the collective responsibility in combating the ever-evolving landscape of cybercrime.

Transcript

[Dave Buettner]

You're listening to the Cyberwire Network, powered by N2K.

[Joe Kerrigan]

Hello, everyone, and welcome to N2K, CyberWire's hacking humans podcast, where each week we look behind the social engineering scams, phishing schemes and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Buettner and joining me is my co host, Joe Kerrigan. Hey there, Jo.

[Maria Vermazis]

Hi, Dave.

[Joe Kerrigan]

And our N2K colleague and host of the T Minus Space Daily podcast, Maria Vermazes. Hello, Maria.

[Dave Buettner]

Hi, Dave. And hi, Joe.

[Joe Kerrigan]

We've got some good stories to share this week. And later in the show, Maria speaks with Alex hall, trust and safety architect at sift. They're talking about job scams. Let's jump right into things here, Joe. Before we get to our listener follow up, we have some much more important follow up, I do say so myself. So it's been a little while.

[Maria Vermazis]

Right?

[Joe Kerrigan]

Bring us up to date on the chickens.

[Maria Vermazis]

Well, the last time we talked about the chickens, all those chickens are gone, Dave.

[Joe Kerrigan]

All those chickens are gone.

[Maria Vermazis]

Insider threat, Dave and Maria. It was a terrible. They're all day, terrible day.

[Dave Buettner]

Insider threat. So they were murdered by other chickens?

[Maria Vermazis]

Other. Other animals?

[Joe Kerrigan]

Somebody you don't know? Snake issue in your house?

[Maria Vermazis]

Nope. It was a trusted insider, Dave. It was one of the dogs in my daughter's house. Somebody let this dog, who is apparently a mass murdering psychopath of a dog, and she just went downstairs and just killed all 13 of the chickens. That was. It wiped them out. We were. This happened on Easter Sunday, the night of Easter Sunday. We were all devastated.

[Joe Kerrigan]

Oh, my God.

[Maria Vermazis]

That's a little.

[Dave Buettner]

I don't know. I just had to.

[Joe Kerrigan]

Right. Did you wait a couple days to see if any of them, you know.

[Maria Vermazis]

Well, if it had been Friday, Dave, I would have waited to Sunday.

[Joe Kerrigan]

Okay, fair enough.

[Maria Vermazis]

So, of course, the next day the Pope passes away. Yeah, Monday morning. And I actually had.

[Joe Kerrigan]

Correlation is not causation.

[Maria Vermazis]

Right. Generate a picture of.

[Dave Buettner]

Okay, okay.

[Maria Vermazis]

Pope Francis walking into heaven with 13 little chickens.

[Joe Kerrigan]

Okay.

[Maria Vermazis]

It was very nice. And my daughter, in order, made a meme of the, you know, the Anakin Skywalker killing the younglings, but put her dog's face over Anakin's face.

[Joe Kerrigan]

Now, is this a problematic dog or was it just a crime of opportunity?

[Maria Vermazis]

Well, all dogs are dogs of opportunity. If you leave, if any food hits the floor and everybody has a dog knows this. If a dog gets a chance to eat some food, they're gonna eat it. This dog is a. This dog, she's part Beagle a lot.

[Alex Hall]

Beagle.

[Maria Vermazis]

Beagle. So it's not against her nature. The funny thing is. Well, not really funny, but the next thing, we have since replaced these chickens and now we have another 12 chicks that we managed to get. So we have chickens again. And there is now a cover over top of the containment unit for the chickens so the dog can't get in. Even if the dog does get into the basement, which she's not allowed to be in. But the thing is, when we brought these little peeps into the house, they come in like a little Dunkin Donuts, munchkin case, maybe a little bit bigger, and you can cram 11 chicks in there.

[Dave Buettner]

The dog got confused. Like, those are munchkins, obviously, right?

[Maria Vermazis]

Yeah. Well, as soon as, as soon as we walk in, my daughter comes into the house. I was actually already there. And she comes in the house and she has the, the chicks in the thing and the dogs hear the chickens and they go. And they sit down right in front of her like she's got treats for them.

[Joe Kerrigan]

Oh, no.

[Maria Vermazis]

And I'm like, yeah, I don't think you understand how this works. So we took the chickens downstairs and put them into the, into the container, into, you know, the, the, the.

[Joe Kerrigan]

It's not.

[Maria Vermazis]

What, it's not a kennel, it's not a crate. It's like a pen that's built up. It's a garden.

[Joe Kerrigan]

Like a little mini coop.

[Maria Vermazis]

Yeah. They're only gonna be there until they can go outside and the coop is finished. So we're still working on the coop. Actually, we got ourselves a little bit more time due to this. But yeah, we have, we're still chicken people, Dave. We still have 12 chickens.

[Joe Kerrigan]

Wow.

[Maria Vermazis]

I mean, I can't tell you how devastatingly sad it was for me to hear that these chickens had been removed from the ear. I was really sad. I mean, like, it was so impactful.

[Joe Kerrigan]

Yeah.

[Maria Vermazis]

And you know, they're chickens.

[Joe Kerrigan]

Well, but you know, they get into your heart, right? They're cute little fluffy little things and you want the. And you have plans for them. You know, I have plans for them.

[Maria Vermazis]

To be long term chickens. These are egg chickens, Dave.

[Joe Kerrigan]

They're egg chickens.

[Maria Vermazis]

So. Yeah. So I was over there last weekend feeding the, you know, playing with the, the new chickens and, and feeding them. And they're, they're all. I can't tell the difference between these chickens and the old chickens, but still. Okay, I like them.

[Joe Kerrigan]

What does a baby chick cost these days?

[Maria Vermazis]

Like 5, 5 to $10. Somewhere in there. It's not not as cheap as it used to be.

[Joe Kerrigan]

Yeah.

[Dave Buettner]

What is five to $10?

[Maria Vermazis]

Huh?

[Alex Hall]

Each chick.

[Maria Vermazis]

Yes.

[Dave Buettner]

Wow. A lot more expensive than I thought they were.

[Maria Vermazis]

Okay, so that dog did a lot of financial damage too.

[Joe Kerrigan]

His dog working it off now.

[Maria Vermazis]

Free dog.

[Joe Kerrigan]

Yeah.

[Maria Vermazis]

There's no such thing as a free.

[Joe Kerrigan]

Dog washing the car. Right, Right.

[Maria Vermazis]

Well, now she's spending all the time out by the shed where there's a groundhog under the shed. And she's looking for this. Looking for the groundhog.

[Joe Kerrigan]

Okay.

[Maria Vermazis]

And I told her, I told my daughter what you said, maria, we need to get a Jack Russell terrorist.

[Dave Buettner]

Yeah. I've been sore tempted with the at least two groundhogs that I have in my yard. So borrow a neighbor's. Not groundhog. The Jack Russell. Yeah, I don't need any more groundhog.

[Joe Kerrigan]

Yeah. I've got beavers in my backyard, so.

[Alex Hall]

That's right.

[Maria Vermazis]

You're right up against the lake, though.

[Joe Kerrigan]

Yeah. Yeah. Beavers are. They're fun. Although, you know, they're wild animals and they're like, I don't know, 20 pounds of muscle and razor sharp teeth. So you give them their space.

[Maria Vermazis]

Right? Because every, like every five to 10 years you read about a story where a beaver kills somebody.

[Joe Kerrigan]

Yeah.

[Maria Vermazis]

Like, and you're like, they died from what?

[Joe Kerrigan]

Who killed.

[Maria Vermazis]

What killed them?

[Joe Kerrigan]

Beaver.

[Maria Vermazis]

Beaver.

[Joe Kerrigan]

Yeah. Usually it's a beaver bite where the beaver just happens onto an artery and the person bleeds out, but.

[Dave Buettner]

Oh, well, those teeth. Yeah, well, I mean, it's exactly the teeth.

[Joe Kerrigan]

It's. It's the teeth. They are razor sharp.

[Dave Buettner]

Okay. So I was having this conversation with my kid the other day about humans being at the top of the food chain. We don't have any predators now. I need to amend that to beavers being a human predator. Okay.

[Maria Vermazis]

That's going to be tonight. You look like food to the beaver. It's just that your leg looks like a tree trunk and.

[Dave Buettner]

Yeah, we will. They will kill you. Okay, got it.

[Maria Vermazis]

Beavers cannot stand a tree trunk.

[Joe Kerrigan]

No, it's. But you can hear them out there at night sometimes chewing on things.

[Maria Vermazis]

That's hilarious.

[Joe Kerrigan]

Yeah. I'm serious. It's like a clicking sound that you hear with their little teeth. I also had an idea, completely unrelated. Well, no, that's a lie. Totally related. Which is somebody needs to make a saw blade or a drill bit that imitates the teeth of a beaver. So if there's a tree that's blocking your view and it's on public land. Right. You want that tree down, you go out there with your beaver bit.

[Dave Buettner]

And then you have plausible deniability.

[Joe Kerrigan]

Right? You take look at this. That tree went down. Must have been beavers. What a shame. Oh, well, my view's back. You know, I think it's a. You know, it's a marketable idea, maybe a niche. I don't know. Anyway, we have a show to do, right?

[Maria Vermazis]

We have already gone down the rabbit hole.

[Joe Kerrigan]

Many, many, many, many, many.

[Maria Vermazis]

Right.

[Joe Kerrigan]

All right, let's get.

[Maria Vermazis]

Thank you for listening to the chicken chat.

[Joe Kerrigan]

That's right. We have a item of follow up from Jim. Joe, you want to do the honors?

[Maria Vermazis]

Hi, guys. In the past couple of shows, you have mentioned money launderers and couriers as part of the scams, but they are often scam victims too. This is correct. And we had. I had a story about a guy who got busted for laundering money. And I think at the end of the story, I mentioned that he was expendable. But one of the reasons he may have been expendable is because this guy may have actually been a victim of scams. Some people are told they are processing payments, which is true. A. It's like a. Like a fake job. Often the payments into the victim's account are fraudulent, and by the time they are clawed back, the victim has already transferred the money to the scammer in a way that cannot be clawed back. Which is. Means that money's gone. So if, you know, if they send you the money, you go out, withdraw the money, buy cryptocurrency, and send that off. Then they claw back the money. You're not clawing back the cryptocurrency.

[Joe Kerrigan]

Right, Right.

[Maria Vermazis]

And in scams that use use a courier, the courier is often not in on the scam. There was an unfortunate case where a scam victim was shot in shot an innocent Uber driver. I remember that case. We talked about that here. It was just a Uber driver who was doing Uber deliveries, and they were using that for. For the scam. And I have a friend who does Uber who is an Uber driver, and he did a couple of Uber deliveries and then stopped.

[Joe Kerrigan]

Oh.

[Maria Vermazis]

Because he was pretty sure he was doing something that would have put him in jail.

[Joe Kerrigan]

Oh.

[Maria Vermazis]

So he was like, yeah, I'm not doing this anymore.

[Joe Kerrigan]

Yeah.

[Dave Buettner]

Oh, my gosh.

[Maria Vermazis]

Wow.

[Joe Kerrigan]

By the way, speaking of clawbacks, I learned recently that the Social Security Administration can claw back a payment from a bank account that has been closed.

[Maria Vermazis]

Okay.

[Dave Buettner]

How? What special magic powers? My goodness.

[Joe Kerrigan]

Well, I guess when you're in the government, right?

[Maria Vermazis]

So you can deal with that money back.

[Joe Kerrigan]

So as I've spoken about before. You know, a couple months ago, my father passed away, and my brother and I went and closed one of his bank accounts at a local bank. Closed it out, you know, took care of everything. So this bank account is done. It is closed. It is buttoned up. And I got a call about a week later from very nice woman at the bank who said, could you please bring us a check for this amount? Your father accidentally got a Social Security payment that he was not entitled to, which is a common thing to happen. You know, someone will pass away depending on the timing the Social Security payment comes, but you're not entitled to payments after someone has died. So Social Security clause, that payment back, that's fairly routine. In this case, it timed out that the account had been closed, but Social Security was like, nope, we're taking our money. So they took it from the bank. And the lady at the bank said, can you please come bring us a check for this amount? Which I did, of course, but why not?

[Maria Vermazis]

You say no?

[Dave Buettner]

Well, that's a different.

[Joe Kerrigan]

I briefly thought about that. I don't know. I suspect there are probably people who would try to fight it, and I don't know if the bank then tries to transfer the troubles between you and the Social Security Administration.

[Maria Vermazis]

Right.

[Dave Buettner]

But, yeah, fraud issue at that point, I would imagine so, yeah.

[Joe Kerrigan]

Yeah. I think what surprised me about it was that the Social Security Administration just went and took their money back. That they didn't send me a bill or a letter or that it became between me and the bank, not me and the Social Security Administration. So. Surprising. I don't know. My knowledge of how those kinds of payments work is limited. And I suppose it wouldn't surprise me if the federal government had special power when it comes to those sorts of things.

[Dave Buettner]

So if anybody does, yes, it would be them.

[Joe Kerrigan]

We'll be right back after this message from our show sponsor. And now a few thoughts from our sponsors at ThreatLocker. The tactics used by cybercriminals are becoming more and more advanced every day. The shift from a default allow approach to a default deny is more critical than ever. This is where Threatlocker comes in. Stay tuned for how ThreatLocker allow listing and ring fencing has your back. All right, well, let's move on to our stories here. I actually have two stories this week. These are both from the scam subreddit over on Reddit. Two very different stories. One of them is a little familiar, and one of them is one that I had not heard before. The first one comes from someone who is actually a bank teller who writes. I'm just going to quote what they wrote here. They said, I had a customer come in today and he had a check that he wanted to deposit. By the way, this happened in Canada. Super normal, no red flags. He asked about how long the hold will be. Still no red flags. Since we're in Canada and we celebrate Victoria Day, the banks are closed on Monday, so his five business day hold will take us to May 21st. I told him that, and he said he needs at least $9,000 released right away. Now I'm even more curious, and I asked why he said he needs 10% to send his to his crypto account so he can withdraw the $90,000 that his crypto account has generated. So the teller who is the hero in this story says, skeptical. I asked what account, how he opened it, the website, the whole ordeal. To my surprise, he told me he clicked on a. Wait for it, Facebook ad.

[Dave Buettner]

No.

[Joe Kerrigan]

Deposited a couple of hundred dollars back a few months ago, and now it's generated $90,000. But in order to get the 90,000, he needs to deposit 9,000. Yeah. No, I told him he's being scammed. I grabbed my phone and showed him the numerous crypto scams posted on Reddit. I said his biggest blessing is losing a couple of hundred dollars and not thousands.

[Maria Vermazis]

9,000.

[Alex Hall]

Yeah.

[Joe Kerrigan]

Turns out the investment advisor is based out of Brussels, had yelled at the customer. This teller said the customer was 75 years old and vulnerable, but thank goodness he came to the bank to talk about it and it saved him $9,000. So, you know, I think that one's pretty straightforward as to what was going.

[Dave Buettner]

On there on the teller. Yeah.

[Joe Kerrigan]

Yeah. Good for the teller. Interesting that it all came through a Facebook ad. Not surprising. Yeah, not surprising, but good that it got stopped in the middle. This next one, though, is more interesting. Cause I don't recall us seeing something like this before. And I'm curious for both of your takes on this. So in this one, a family member gets arrested for a dwi. Okay.

[Maria Vermazis]

Like, really arrested?

[Joe Kerrigan]

Really arrested.

[Maria Vermazis]

Okay.

[Joe Kerrigan]

Yeah.

[Dave Buettner]

Driving under the influence. Driving with.

[Maria Vermazis]

Driving while intoxicated.

[Dave Buettner]

While intoxicated. Okay. Yep.

[Joe Kerrigan]

Right. So the details of that aren't terribly important, but this person is, you know, cooling off in the slammer while things are getting worked off.

[Maria Vermazis]

Like Otis from Mayberry.

[Joe Kerrigan]

Exactly. So this person who is in jail had listed the person who wrote this account on his visitation list. And the person who wrote this account got a phone call from a Sergeant Shane Kitchens saying that the family Relative with the DWI would be released with an ankle monitor, but they needed someone to pay for the ankle monitor deposit. Now, this person who got the call, he said, I'm broke as hell. So I gave him his mom's number. So called the mom and spoke for about 15 minutes. And the police officer was doing all sorts of rapport building, saying that these sorts of things happen, that they should file a complaint, that he would help her with the complaint and, you know, there should be no charges, all this, that and the other thing. But then he said between the bail and the payment to the ankle monitor company, it was going to be around $3,500, and asked for the mom to pay with Venmo, PayPal, or Zelle. Mom was suspicious. She said that this police officer should call the lawyer. The police officer said, okay. Called back a few minutes later and said, I talked to the lawyer. And the lawyer said, pay it. Wow. Yeah.

[Maria Vermazis]

Okay.

[Joe Kerrigan]

All right. Good enough.

[Maria Vermazis]

Wow.

[Dave Buettner]

Halsey. Geez. All right. My goodness.

[Joe Kerrigan]

Called back from the jail's number. Jail's phone number.

[Maria Vermazis]

Right.

[Joe Kerrigan]

Okay. Now, in the meantime, the mom has looked up Officer Shane Kitchens and found that it was a name that had been used many times from scammers doing the same thing. And the mom hung up. So this is a scam, Obviously. This person pretending to be the police officer, nearly scammed this person out of $3,500 by saying it was for bail money and the ankle monitor.

[Dave Buettner]

Yeah.

[Joe Kerrigan]

What I'm curious about, and I'm wondering on for what you both think about this. I mean, it seems to me like this is taking advantage of some kind of public records flow, like someone got incarcerated.

[Dave Buettner]

Yeah, Yeah.

[Maria Vermazis]

I know that in some towns, some small towns, every arrest is published in the news, in the newspaper.

[Joe Kerrigan]

Right.

[Dave Buettner]

Yeah. But how quick is. This was quick, though? I mean, same day, day after. I mean, that's a very fast. That's. There's got to be, you know, something digitally published somewhere. I mean, local newspaper for me is, you know, weekly, if I'm lucky. So, yeah, somebody's watching the feeds and going through this.

[Joe Kerrigan]

That's. That's a lot. Right. Or maybe an insider who's in on the deal of sending, you know, sending along information about people who have just been booked.

[Maria Vermazis]

Right. That is also a possibility.

[Joe Kerrigan]

Yeah. But I had not heard of this particular type of scam before of taking advantage of someone who. A family member of someone who's been put in jail temporarily. Right. And then taking advantage of that very emotional situation.

[Dave Buettner]

And we're sure that family Member was for sure arrested and not the one perpetrating this scam. Right. Saying, oh, I've totally been arrested, believe me on this.

[Maria Vermazis]

Ah, that's an excellent point.

[Joe Kerrigan]

I hadn't thought of it.

[Dave Buettner]

I'm hard up for money.

[Maria Vermazis]

Yeah, it's like the old fake kidnapping scam.

[Dave Buettner]

Yeah, I'm totally being held for ransom. Please pay this guy. Yeah, I tried that with my dad.

[Maria Vermazis]

He said, keep him.

[Dave Buettner]

Yeah, yeah, I'm gonna. I'm gonna choose to believe that the first part of the story is true, that the person was arrested for realsies. But then, yes, that is fascinating that somebody is watching these arrests. I just. I didn't think paperwork worked that fast. So that's the part where I'm wondering, maybe this. The guy faked it, the whole thing. I was totally arrested, and this Officer Kitchens guy is conveniently scamming Mom. You gotta wonder.

[Joe Kerrigan]

B. Could be. I mean, I. I don't know. I tend to think that it is what it appears to be, which is someone's keeping an eye on the records. Someone somehow has access to the arrest records. And it could be. You know, that may be a daily bulletin. You know, like our police forces around here put out a daily crime blotter.

[Dave Buettner]

Oh. Oh, that could. This might really vary by location about how modern the police are in your jurisdiction and maybe like state, if you're in the US like state privacy laws about arrests. I wonder, because I know some states are much more open about that than others. So that. That. This is an interesting little rabbit hole we could go down. I'm so curious if our listeners have any insights on this.

[Joe Kerrigan]

Well, I know we have some listeners who are, if not current, former law enforcement. So I'm sure they will share with us what the spectrum of possibilities are when it comes to this sort of thing and information sharing. So we look forward to hearing that. All right, we will have a link to both of those stories over on again, the scam subreddit, if you want to check them out for yourself. Let's move on to Joe's story. Joe, what do you got for us?

[Maria Vermazis]

Well, Dave, not to be outdone with your two stories, I have three stories today.

[Joe Kerrigan]

You know what that means for you, Maria?

[Dave Buettner]

I have one.

[Maria Vermazis]

She has an interview, though.

[Dave Buettner]

Actually, I have zero. So there you go. Buffer overflow to zero.

[Maria Vermazis]

So someone tried to scam my wife. Oh, guess what platform. Guess the platform that they started on. Come on, take a guess.

[Dave Buettner]

Facebook.

[Maria Vermazis]

Yeah, my wife has a Facebook page where she showcases her quilting work. And somebody said, hey, That's a beautiful quilt. Can I buy it from you? And she was like, no, this is mine, but I can make you one. My wife doesn't like making quilts for people, so.

[Joe Kerrigan]

Does she make them for. For the chickens?

[Maria Vermazis]

She does. She likes making quilts for the chickens for. For the grandkids that you.

[Dave Buettner]

Okay.

[Maria Vermazis]

Like, you know, and. And she's. She's much more interested in. In doing the actual quilting, not putting. In putting things together.

[Alex Hall]

So.

[Joe Kerrigan]

So in other words, she. She is in this to be a quilter, not a small business person.

[Maria Vermazis]

Yes, we'll say that for now.

[Joe Kerrigan]

Okay.

[Dave Buettner]

I think I just found your wife's Facebook page, by the way. I'm looking at it right now. It's very lovely work.

[Joe Kerrigan]

Yeah, it's beautiful stuff.

[Dave Buettner]

Wow.

[Maria Vermazis]

So it's. This person says, okay, well, you can make me that way. How much would that cost you? And my wife goes, I don't want to make people quilts. That's not what I want to do. And I said, well, then just. I mean, like, how much would it cost you? How much would it be worth to you to actually make this and then double that and tell her that's what it's going to cost? Right, right. So she gives her this price that she thinks is just outrageous. And the woman goes, that sounds. Sounds great. I'll take it. And she goes, great, send me a $200 deposit by Venmo, and I'll go out and buy the fabric and we can talk about picking colors. This woman has an address close by. And then she sends back a thing, a little picture that says, something's wrong. I need your email address. Right. And it's a picture of the Venmo interface with a pop up over top of it that says, please kindly provide an email address. And my wife goes, ah, that doesn't look right.

[Alex Hall]

My.

[Maria Vermazis]

My daughter looks at it. I looked at it. I found out this is a Facebook account that has been cloned from another Facebook account. This is a Facebook account that's just being used to scam people. And fortunately, my wife did not. Did not get scammed. She immediately thought this was suspicious when I said, anytime the workflow, the regular workflow goes off, you're being scammed. Yeah, that's it.

[Dave Buettner]

Yeah.

[Maria Vermazis]

So it's. So she was. She stopped communicating with the person immediately. Today. I actually got on there because I'm an administrator on that page. I deleted the contact and blocked the person. But I'm still fearful that somebody thinks I can get this woman. So we have to Be vigilant. The second story I have is actually also kind of short. It has to do with a DoorDash driver who. In San Francisco, or actually, I don't know if he was in San Francisco, but the company is in San Francisco. Has pleaded guilty to stealing $2.5 million from DoorDash.

[Joe Kerrigan]

Wow.

[Dave Buettner]

Dang.

[Maria Vermazis]

How do you do that?

[Joe Kerrigan]

That is a lot of French fries. It is.

[Maria Vermazis]

That's billions of French fries, wouldn't it? I mean, maybe not billions.

[Joe Kerrigan]

It's a lot.

[Dave Buettner]

Billions and billions served.

[Joe Kerrigan]

But he had.

[Maria Vermazis]

He had a couple of accomplices. And the way this worked was he also had access to the back end. So he had compromised doordash. And what he would do is he would order a bunch of food under a compromised account and then he would take that order on the back end that he had access to and assign it to one of his conspirators who would then mark it as if they had delivered it. And then very quickly he would go in and change the status of the order from delivered to pending. And then he could very quickly assign that to another one of his conspirators. And he could do this multiple times with a single large order. So in very short order, he was just, you know, they were just raking in money hand over fist on this. Well, he's gonna be a guest of possibly the. Well, he's pleaded guilty, so I don't think he's been sentenced, but he faces a maximum of 20 years in prison.

[Joe Kerrigan]

Wow.

[Maria Vermazis]

Which if. If you do the math, is only $125,000 a year for the. For the $2.5 million he stole. And that's for three of them. So now you're talking about like, you know, $40,000 a year. That's what you made.

[Joe Kerrigan]

Yeah.

[Maria Vermazis]

If you're going to spend that much time in prison, I don't know, maybe if you. If you get a plea deal, you get less.

[Dave Buettner]

There's easier ways to earn 40k a year. I just gotta say.

[Maria Vermazis]

There is. I think you can do it at McDonald's.

[Joe Kerrigan]

Yeah, true.

[Dave Buettner]

Depending on where you live. Yeah.

[Maria Vermazis]

And the last story I have is actually from the Irish Star. It's all over the place. But I picked the Irish Star and it's a story about a. The writing in the story is not the best. I'm gonna say it that this is from the Reach media. They own like the Irish Star and a lot of the Mirror websites. Like, I initially saw this on or also saw this on the Mirror Us as well. But the story Reads like a tabloid newspaper. Big scam alert. Oh, this is new, but it's really nothing new. But Google has actually made an announcement about this, and it's about people calling you for the Google Second Factor authentication code when they're resetting your password. And the thing is, Google will never call you to help you reset your password. That's not how this works at all. And good luck getting the. Getting them to answer the phone for help on your Gmail account if you don't pay them any money.

[Dave Buettner]

Probably. Even if you do, good luck.

[Maria Vermazis]

Yeah, even if you do, you might. Well, I think if you do, you get some kind of tech support. But it. Yeah, it's the standard thing where they call you, they say, hey, it's me. I'm from Google tech support. I'm gonna send you a code. I need you to read the code back to me. And then they try to reset your password. Google sends you the code, you give them the code, they reset your password to something they know. And they have your Google account, which, if it contains your Gmail account that you're using for other services, you've just given them the keys to your kingdom. So it's really, really, really important to not give out. Protect your email address. Protect the email address that you use for all your services, because that is the single basket of eggs, if you will.

[Joe Kerrigan]

Yeah.

[Maria Vermazis]

That can.

[Dave Buettner]

Not to get back to the chickens thing.

[Maria Vermazis]

Not to get back to chickens. Right. By the way, not a single egg have these chickens laid yet.

[Dave Buettner]

Oh, they're too young.

[Maria Vermazis]

I know it takes months, but.

[Joe Kerrigan]

Yeah.

[Maria Vermazis]

So don't just be vigilant. And I mean, Google is going so far as to put out press releases about this. So apparently these guys are ramping up these attacks.

[Joe Kerrigan]

Huh.

[Dave Buettner]

I think anybody who's actually tried to contact Google or, I don't know, Facebook for actual issues that they're having with their account can tell you getting an actual human to help you with really urgent things is nigh impossible. So they would be proactively calling you for something should set off every alarm. So. Yes.

[Joe Kerrigan]

Can I. Can I just share a quick story? Sure. A little. I'm going off on a little bit of a rant. So as I mentioned earlier in the show, my father passed away. So we've been dealing with a lot of things with his estate and just taking care of accounts and this, that and the other thing, all the normal stuff you do when a loved one passes on. And one of the things that I've been working on is he had an account with Comcast Xfinity, as they like to call themselves these days.

[Maria Vermazis]

They're still Comcast.

[Joe Kerrigan]

Yep. So he had both Internet and cable TV at his condo. And so we're gonna be selling the condo, but it's gonna be a few months. And we have a family member who is sort of house sitting at the condo while it's, you know, while these transitions are happening.

[Maria Vermazis]

Right.

[Joe Kerrigan]

So we wanna leave the Internet on and we wanna leave some cable TV on. But I just wanted to dial it down, right? Cause the Comcast bill is like $300 a month, and that's too much for, you know, whatever. The person who's house sitting doesn't need gigabit Internet. Right. So I get online with Comcast and I log in. I have an account. I have access to the account. And really the only way to do business with them is through their little chatty thing. Their chatbot.

[Maria Vermazis]

Right.

[Dave Buettner]

So you're on the chatbot.

[Joe Kerrigan]

Right. And it's like, hi, thanks for contacting Comcast. How can I help you? Hi, I have a relative who recently passed away. I would like to reduce the service level in their home while we're in the process of selling the home. Great. So what I hear you saying is you'd like to reduce your costs. Yes, that's correct. I have a loved one who passed away, and so I'd like to reduce the monthly costs of the bill. Great. Give me just one moment while I look at your bill.

[Dave Buettner]

Okay, great, Great.

[Joe Kerrigan]

That sounds good.

[Maria Vermazis]

I love how you're making the chatbot sound like it doesn't get.

[Joe Kerrigan]

It comes back, it says, good news, I've got a great deal for you.

[Maria Vermazis]

I knew this was, I can reduce.

[Joe Kerrigan]

Your cost by $50 a month and add another mobile line to your account. What do you think of that?

[Dave Buettner]

No, no.

[Joe Kerrigan]

And I'm sitting there, I'm like, my deceased father does not need another mobile line added to his account. That is, as a friend of mine said when I described it, that is one hell of a long distance call.

[Dave Buettner]

God bless it.

[Joe Kerrigan]

So I just cut it off there. I said, no, thank you. I will pursue other options. And because I was seething with rage.

[Maria Vermazis]

Right.

[Dave Buettner]

Yes.

[Joe Kerrigan]

Just at how ill equipped this stupid AI powered ghoul of a chatbot was. I mean, dealing with it just couldn't.

[Maria Vermazis]

Comcast never dealt with the death of a customer before. I mean, they are one of the biggest providers in the world.

[Joe Kerrigan]

Well, so transferring the account from my father to me was routine, quick and painless.

[Maria Vermazis]

Okay.

[Joe Kerrigan]

There's like one form I filled out online a couple days later, accounts transferred. So I credit them with that.

[Maria Vermazis]

Okay.

[Joe Kerrigan]

But actually having something adjusted was outside of the scope of what their chatbot could handle. So yeah, yeah, since then I have made another run at it and sure, we cut the bill in half and all is good and I can't wait to sell the place and, and closed the account with Comcast. And as I'm reminded why they are one of the most hated consumer facing companies in the United States. It's just sad.

[Dave Buettner]

It's just sad. Yeah, that reminds me. So I think I mentioned last week that I had to re. Re up my Facebook account that has been dormant for over five years. I close it, I close it down. And I lost my father almost nine years ago to the day. And after my dad died, I made myself his legacy contact because I had seen accounts of friends of mine who have, who have died get taken hijacked after their deaths, which is, and there's nothing quite like having a friend who died in their 20s or 30s from tragic circumstances, having their page become a zombie. It's just, it's the worst. And I didn't want that to happen to my dad's Facebook account even though he barely used the thing. And I gotta say, the language that Facebook uses when you do the legacy contact thing, even if the person is deceased, is in that weird first person. Like, I am making you my legacy contact because I trust you. And it was very weird getting these messages from my dead dad in my Facebook account. And I was like, there's got to be a better way for this. Nothing quite like popping into Facebook after years of being away and seeing that the first thing that comes up is those messages from my dad after his death. Like, oh, there's a lack of sensitivity around all this from these companies. And of course there's no one to talk to.

[Joe Kerrigan]

Yeah, no, it's crazy. My wife forwarded me. She's been keeping an eye on his phone because you keep his phone account open because as you're settling things, some people will try to call that sort of thing. Anyway, he got a voicemail message about an account and my wife forwarded it to me as a text message. And so, you know, sitting there minding my own business, text message pops up and it's from my dad and I'm like, that's the, you know, it's just a weird jolt of a feeling, you.

[Maria Vermazis]

Know, I have a similar story. Yeah, My uncle passed away a couple of years ago and his wife still had access to the Facebook account. And made some posts as him or some comments as him. And my cousin saw that and he replies, dad, oh my God. Because we all have that really dark sense of humor.

[Joe Kerrigan]

Yeah. Coming to you from the great beyond. Right. Death has not slowed me down.

[Dave Buettner]

There's Facebook here too.

[Joe Kerrigan]

You know what? Let's take a break for this is a good opportunity for us to take a break, hear a message from our sponsor, and we'll be right back after this message. Stay with us. So let's return to our sponsor, Threat Locker. Threat Locker is a zero trust endpoint protection platform that strengthens your infrastructure from the ground up. Where traditional cybersecurity tools require you to create a list of things you don't want to run, Threat Locker enables you to easily curate an allow list of everything you need in your environment and network and block everything else by default. With ThreatLocker, allowlisting and ring fencing, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker provides zero trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware. The ThreatLocker Zero Trust Endpoint Protection platform deploys in a learning mode that analyzes the operations of your company, using machine learning to assist you in developing your allow list for approved applications, what they can do on the endpoint, what can interact with your data, and even east and west network traffic. We thank Threat Locker for sponsoring our show. All right, we are back. And Maria, you do not have a story this week. What do you have for us?

[Dave Buettner]

Yeah, in lieu of a story, we're actually running an interview that I did pretty recently with Alex hall, who is the trust and safety architect at Sift. And he has a really interesting background which he gets into in the interview. So I don't want to spoil it, but he was talking to me about job scams, both the kinds that affect job seekers as well as organizations that are trying to hire people and keeping, you know, potential insider threats out. So here's that interview.

[Alex Hall]

So I do have a unique background in that of my 17 years of experience, about nine and a half of those years were spent on the other side. I was, I am a former fraudster, so I did operate on the other side. I started with check fraud, moved into credit card fraud, moved into account vulnerabilities and the account takeovers is what we call them in the industry. And from there I moved into things like identity theft and synthetic ID fraud. As far as the target industries go, I had a chip on my shoulder during that Time. And I found it to be an interesting challenge to find out where the vulnerabilities were within all of these different types of organizations. So it went from E commerce retailers to banks to iGaming platforms, all these different types of industries. And then in 2017, my daughter was born. I had my come to Jesus moment. And ever since then, I've been doing all that I can to make up for the misdeeds of my past. And so, yeah, everything in my professional career has culminated in the fact that I am working with Tasa over at sift, which is just amazing. I'm very honored to be here.

[Dave Buettner]

That's awesome. My daughter was also born in 2017, so that's amazing. Just twins.

[Alex Hall]

It's a good year.

[Dave Buettner]

It's a good year. It's such a good year. So thank you for joining me, Alex, and thank you for sharing about your story. You have a lot of expertise in what we're gonna be diving into today from both sides, which gives you such a great perspective on just a topic that we've talked a lot about on hacking humans, specifically about all these job scams that are AI fueled, specifically. But of course, not always. But certainly the AI is helping. There have been a bunch of stories about how people are either double or triple booking jobs or people from North Korea potentially getting jobs in IT departments at cybersecurity companies. I'm not going to name names, but the stories are out there. I guess I wanted to sort of get your thoughts on maybe the threat landscape right now for these kinds of job scams that are maybe being aided by AI, but maybe not only just what's going on there. I mean, is that cat and mouse game is quite a remarkable one.

[Alex Hall]

Sure. So as far as the landscape goes, I feel that it would be important to highlight the two sides, the two primary sides of the coin. So it would be to the case that you brought up where a person looking for a job for nefarious reasons down the line is leveraging AI and social engineering and deceit in order to get a job so that when they're in the back end of a platform, they're able to do whatever it is they're after doing. Now that breaks down into two further categories because we have the actors themselves operating independently, but we also have those actors who are being instructed by a higher power to them. You know what I'm saying? So, like the fraudster would manipulate them and they would essentially be plants or mules into an organization. So there's that category where people are just trying to get the jobs for bad reasons. Right. But then there's a secondary side of the coin where we have job listings that are being posted that are nefarious unto themselves. Right. So these job postings are going out, they're being written with AI. There's no intention or real job opening behind it. But what they do is they walk through the process with unsuspecting members of the general public. And as they go through the process of applying for a job and interviewing, there's, of course, requests for information, and fraudsters are taking that information, you know, elsewhere and having their way with it, which might result in synthetic ID fraud, might result in identity theft. In some cases, there's payments, information being collected. Yeah, it's a big jumbled spider web.

[Dave Buettner]

It sure is. And it's so fascinating that. Fascinating in a dark way, but fascinating that, you know, we have both job seekers who are potentially at risk as well as organizations that have to be on even higher alert than normal about potential insider threats from new hires or folks that might get hired and maybe lurk for quite some time before the threat is revealed there. One wonders how on earth what you're supposed to even recommend to people. I suppose maybe let's start with job seekers. How to make sure the job posting that you're potentially responding to is legit and that you're not going to be taken advantage of because you're already in such a vulnerable position looking for a job. I mean, it's. Talk about making a bad situation worse.

[Alex Hall]

Yeah. So typically, whenever we talk about scams, we typically say that there are some telltale signs. Right. The situation might be too good to be true if there's a $10,000 product, you know, being listed for sale for 100 bucks. Right. It's too good to be true and all of that different stuff. In the case of job scams, it takes a little bit more careful consideration because you might need to go look at the company's LinkedIn page and see who works there and maybe verify that you're speaking to the person who you should be speaking with. Conversely, you might go to their website and you might go to see if the job listing is really there. But I understand it would be weird to go through the job listing and then put in another application for the same position that you just put in for. So what would you do? I feel that what's most important is to scrutinize every communication. Right. So an email address typically wouldn't be coming from. Let's use a big box. Retailers just call it Acme Inc. Right. So acme.com if somebody's pretending to be Acme, their email address might be a variation of acne. Right. It might have replaced characters and letters. So I would scrutinize the email address where you're communicating. I would scrutinize the phone number. I would scrutinize and pay attention to every type of every piece of information that pops up during Zoom meetings. Most of these interviews are going to be done remotely. Scrutinize every piece of information, Verify to your best ability, every piece of information. And if you feel that something suspicious is going on, reach out to the company directly through their service line and tell them what's going on and just speak to them directly. And that correlates greatly with other pieces of scam prevention tactics that we suggest. For example, when people get these text messages that claim to be coming from financial institutions, don't respond to that text, don't call that number back, call the customer service listed on the website or a number that you're familiar with. So yeah, a lot of these elements, there's a lot of overlap. Verify and then contact directly.

[Dave Buettner]

Absolutely. Great. Always great advice there. And then flipping over to threats to organizations, this is where I'm always fascinated to see even stuff in my own personal LinkedIn feed where I'll see a software engineer who's trying to hire for his team and he finds out maybe five to ten minutes into the conversation, the candidate is clearly using like a deep fake AI in the real time to try and fake the, you know, the software screen. And I just kind of go, I can't believe we're here already in terms of what technology is able to do. And I know that there are a lot of solutions that organizations try to deploy to prevent being taken advantage of in this way. But is it fast? Is it keeping up with the threat? Is sort of the question that I have. And yeah, what do organizations need to know to not be taken advantage of?

[Alex Hall]

So in the case of deepfakes and generative AI, they are advancing, no doubt about it. But the technology does exist to look behind the scenes and see what's going on. For example, when somebody submits a resume or an application, it is possible to run that application through different types of fraud prevention technologies. It is possible to verify what device was used. It's possible to verify the geolocation of the device. It's possible to verify the velocity at which the form was filled in. So that that would be useful for like bot detection and copy and paste applications. Things like that it's possible to build out these, these frameworks and the technology does exist to circum to, to defend against generative AI and deepfakes. The problem is we don't typically aim those technologies at our, at our application, you know, process. And so we have to be very diligent in understanding exactly what information is available to us during these conversations. And because of the use of chat GPT, further reinforced with deep fake generative AI, it's even more important to understand the information that's happening off screen. Right. And off audio. Right.

[Dave Buettner]

Yeah.

[Maria Vermazis]

And so I feel that that's going.

[Alex Hall]

To be the most important item is, is looking at behaviors that are suspicious, looking at, again, geolocation, device intelligence, all these different items. I would really recommend pulling those into the process flow in order to identify what would be suspicious.

[Dave Buettner]

Yeah. And it sounds like potentially, hopefully at more advanced organizations, they recognize that this is a major entry point. These applications can be a major entry point for potential insider threats. But if that cultural shift has not happened, then that conversation maybe needs to be happening yesterday. But it certainly. It's a mindset shift.

[Alex Hall]

Absolutely. We didn't. Who would have thought that we would need to put fraud prevention in our, in our application process, you know?

[Dave Buettner]

Yeah, yeah, it's, it is crazy to think about. It's a, it's, it's remarkable how quickly we've gotten here. Alex, is there anything else that we want to make sure that you mention about either the nature of these kinds of fraud that we're seeing, these job. Job fraud, or anything else that you wanted to make sure that the audience hears about today?

[Alex Hall]

Yeah. I would probably elaborate on the story of, you know, exactly what these fraudsters are after once they gain access to the inside. Right. And one thing that I say when we talk about fraudsters. So in fraud prevention, we have this, there's this fraud method that we focus on called ATOs. It's account takeovers. Right. And when a fraudster takes over an employee's account, they're after certain things Right now in the case of a. I won't mention them by name, but a certain cybersecurity slash fraud story that took place in Vegas, we saw a tremendous loss after social engineering gave an outsider access to an insider account in those insider systems. During that, there was the opportunity to install ransomware or hijack systems or trigger different events downstream. I would hope that the listeners here realize that this is a very important thing to solve for giving someone access to the backend processes. Maybe they get a job that has the opportunity to trigger wire transfers or to edit billing and payment information or to handle invoices. But beyond that, maybe they have the opportunity to decision on front end transactions, right? Like in the case of becoming a fraud analyst or something like that. And they'll specifically watch out for or reverse decisions for transactions that are put in later on down the road. Point being granting access to somebody, to somebody on the inside. I'm sorry, granting someone access to internal operations extends well beyond just trying to get a quick cash out. They're in for the long game and the damage can be catastrophic. So I would highly recommend monitoring behaviors if anyone gets gets in and starts to seem suspicious or things just don't necessarily line up. I would put heavy emphasis on seeing exactly what systems they're accessing or how they're interacting with systems, seeing if any suspicious behavior is taking place.

[Dave Buettner]

Great advice, great advice. I just want to make sure I give you an opportunity. If there's anything else that we want to mention before we close out that it's over to you for that.

[Alex Hall]

I'll just close out by saying, yeah, job scams are taking off. The truth of the matter is a lot of consumers are. There's economic times for a lot of people. It's hard economic times for a great number of people and they are susceptible to the scams that are out there in the world. And these people are taking advantage of. By and large, fraudsters have taken a shift into targeting consumers directly. Not away from targeting merchants and retailers directly, but there's a continuous growth of the general public and consumers being targeted directly. It's more important than ever that the consumers become educated. And then on the ca, in the case of hiring, you know, potentially bad actors, it's more. It's equally just as important that our organizations become educated in exactly how expansive these types of methods can be, how much damage it cause, and really put thought strategic responsibility.

[Dave Buettner]

Excellent. Alex, thank you so much for your expertise and your time today. And thank you for speaking with me. I appreciate it.

[Alex Hall]

Thank you for having me, Maria.

[Dave Buettner]

And special thanks to Alex hall at Sift for speaking with me about job scams.

[Joe Kerrigan]

Yeah, boy, interesting. And they are. I mean, there's no slowing down, is there?

[Dave Buettner]

No. And I think one of my favorite insights from Alex was about how there needs to be a cultural shift for a lot of these organizations who are trying to hire about. Maybe they hadn't thought about HR as being a potential vector for these threats coming in, but their HR teams really need to be shored up. And given the Tools that they need to keep these threats away. So it was a really interesting conversation. So thanks again, Alex.

[Joe Kerrigan]

Yeah, we appreciate it, really.

[Maria Vermazis]

I am still of the opinion that recruiting does not belong in hr.

[Joe Kerrigan]

Recruiting does not belong in hr. Go on.

[Maria Vermazis]

That's a completely different take.

[Dave Buettner]

Yeah. Okay.

[Maria Vermazis]

And the reason I say it isn't is because the purpose of HR is to protect the company.

[Joe Kerrigan]

Right.

[Maria Vermazis]

And they are there. And please do not. This is a social engineering tact that companies use. They say, oh, we have an open door HR policy. And I am of the opinion you should never trust that. Never trust that HR is not there to service you. They are there to service the company and make sure the company stays out of legal hot water. And I think that portion of the business also is not compatible with recruiting. And I think recruiting should also be faster paced and not bound to as many HR systems and requirements as, as the rest of the HR department is.

[Dave Buettner]

Yes.

[Maria Vermazis]

I think recruiting should be its own thing. Different.

[Dave Buettner]

Yeah, I, I so misnomer on my part. I'm using HR and I probably should be saying more broadly recruiting or talent acquisition.

[Maria Vermazis]

You're right. Because the vast majority of companies, HR recruiting is a sub department of hr.

[Joe Kerrigan]

Yeah.

[Maria Vermazis]

So it's, you know, it's not. I don't think you misspoke at all. I'm just saying there does need to be a cultural shift and I think that cultural shift starts by separating recruiting and hr.

[Dave Buettner]

Yeah. I worked at a place where they were separate, so I'm sort of going, shame on me. Because I've been at places like that.

[Maria Vermazis]

Right. I worked at a place like that too. And I mean I was hired by that place. I got a call for my first interview on a Monday and had my job there the next Monday, which I've never heard of anybody else doing it. But because these guys had separated the recruiting from hr, the recruiting department's job was recruiting and getting people hired, getting.

[Dave Buettner]

Them in the door.

[Maria Vermazis]

That was it.

[Dave Buettner]

But then who does the onboarding is usually hr.

[Maria Vermazis]

Hr.

[Dave Buettner]

Right. Yeah. And then that's, that's a whole process where again, and Alex gets into some of this about the onboarding process for screening potential insider threats. So I'm going back to Alex's interview because he has a lot of good insights in that. But it's a, it's a great point, Joe, because yeah, they, I similar situation for me when many, many years ago when I was hired at a place where they were two separate orgs and my interview process was rigorous but quick. Like I got hired really fast and it was one of the best jobs I've ever had. But yeah, and then. And then onboarding was a completely separate team within hr. And yeah, good process. Highly recommend.

[Maria Vermazis]

Right.

[Joe Kerrigan]

And of course we want to thank this week's sponsor, ThreatLocker. Go to ThreatLocker.com HH and check out their Zero Trust Endpoint Protection platform. That's the words threat and locker with no space.com HH where you can request a demo and neutralize the threat of malware running on your devices is all right, well, you know what, gang? We are running long this week, so I am going to say we're going to skip over our catch of the day this week and we will save that for next week. So that is Hacking Humans brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans2k.com this episode is produced by Liz Stokes. Our executive producer is Jennifer Ivan. We're mixed by Elliot Peltzman and Trey Hester. Peter Kilpe is our publisher. I'm Dave Buettner.

[Maria Vermazis]

I'm Joe Kerrigan.

[Dave Buettner]

I'm Maria Vermazis.

[Joe Kerrigan]

Thanks for listening, Chickens.