Transcript

A (0:02)

You're listening to the Cyberwire Network, powered by N2K.

B (0:15)

Hello, everyone, and welcome to N2K, CyberWire's hacking humans podcast, where each week we look behind the social engineering scams, phishing schemes and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Buettner, and joining me is Joe Kerrigan. Hey, Joe.

C (0:31)

Hi, Dave.

B (0:31)

And our N2K colleague and host of the T Minus Space Daily podcast, Maria Vermazes. Maria.

A (0:37)

Hi, Dave. And hi, Joe.

B (0:39)

We've got some good stories to share this week. We got any follow up first? Joe, what do we got?

C (0:44)

We don't have any follow up. Nothing new about the chickens. They're just maintaining. But I do have an interesting thing. I almost put this in my story, and I guess I'm gonna do kind of a short story today. So may this will be. I'll do the first story, then the. Then I'll do another story later on. But anyway, this actually happened to me. I was sitting in my office doing what Dave does best, minding my own business, and my phone rings. And it's the old house phone that now rings on my cell phone, thanks to an app, okay? And I answer the phone, and I debated answering as Mabel Johnson, but I didn't do that. I just answered it. And this very gruff guy says, joe Kerrigan. I'm like, yes, this is Joe. And he goes. He then says, this is deputy so and so. I can't remember. He gave me a name. And he said, badge number. This from the Sheriff's county or. He didn't say deputy. He said sergeant. Sergeant so and so from the Carroll County Sheriff's Department. Badge number, this. So I get out my notebook, right? And I write down Carroll County Sheriff's Department. I go, let me get your name again. And he goes, he goes, you know, he tells me his name and then his badge number, and I'm like, okay, the last name again. He goes, you got it this time. I mean, you're really getting frustrated with me. I'm like, look, I'm just writing this stuff down, all right?

B (2:04)

Yeah.

C (2:05)

And I said, I got it. Let me read it back to you, make sure I got it right. And he's getting frustrated with me. And he goes, yeah, I'm calling about a missed jury duty. And he says, we sent this to your address. And he reads out an address that is not correct, but is a past address.

B (2:29)

Summary

Podcast Summary: Hacking Humans – "The voice on the other end."

Podcast: Hacking Humans
Host: N2K Networks / CyberWire
Episode: The voice on the other end
Date: February 19, 2026
Theme: Deception, influence, and social engineering in modern cyber crime

Episode Overview

This episode delves into the enduring impact of social engineering, highlighting how even security-savvy individuals can experience a physiological response to authority-based scams. The team features stories centered around scams targeting the elderly and vulnerable, emphasizing both technological and human-factor exploits. The conversation includes personal anecdotes, analysis of current fraud trends, and practical advice for both individuals and caregivers.

Key Discussion Points & Insights

1. Personal Encounter with an Authority Scam (Jury Duty Scam)

[00:44–08:44]

Joe Kerrigan recounts a recent call claiming to be from the Carroll County Sheriff's Department, accusing him of missing jury duty.
- The scammer used an outdated address and was aggressive when Joe requested further details.
- Joe describes going through the motions: writing down details, reading them back, and telling the caller he'd be verifying with the Sheriff's Department—prompting the scammer to admit, with expletives, that it was a scam before hanging up.
- Despite his expertise, Joe notes feeling a real adrenaline response:
  
  "Even though I knew it was a scam, there was still that little thing in the back of my mind that I got nervous about it. The adrenaline fired off." (Joe, [04:08])
- He highlights how the scam’s invocation of authority can override even strong skepticism.
Discussion focuses on why these scams are effective, the cues that mark law enforcement legitimacy, and the importance of independently verifying such calls.
- Advice: Always call back official numbers found independently, not those given by the caller.

2. Analysis of a Vishing Scam Targeting Apple Pay Users

[09:45–12:45]

Dave Bittner discusses an Apple Pay vishing scam:
- Victims receive an email (appearing from Apple) about a blocked transaction, instructing them to call a “support” number.
- On the call, scammers impersonate Apple staff to harvest Apple ID credentials and financial data.
- Key red flags:
  - Sender’s email is not from an Apple domain.
  - Big tech companies rarely encourage direct phone contact.
- "The last thing in the world a big tech company wants you to do is call them." (Dave, [12:09])
- The hosts remind listeners never to call numbers from suspicious emails and always check official sites for support channels.

3. Romance Scams: Insights from Australian Federal Police Guidance

[12:53–19:06]

Dave shares a resource from the Australian Federal Police that's “one of the best” guides on romance scams.
- Key scam pattern: Initial contact, trust building, excuses, creating a crisis/opportunity, request for money, and then vanishing or repeating.
- Advice for self-protection:
  - Don’t move the chat to new platforms.
  - Verify identities (with caveats about reverse image searches and AI-generated personas).
  - Never send money or share accounts.
  - Discuss with trusted friends/family to break isolation.
- Maria emphasizes the targeting of the isolated and lonely, noting how tactics like love bombing are emotionally manipulative.
- "They try to find people who are already very isolated and that makes it harder. Especially the love bombing ... it feels so soothing." (Maria, [15:19])
- Joe points out the limitations of standard advice:
  - Regarding reverse image search:
    
    "It's a good way to eliminate somebody as a scam. But them passing this wicket does not mean it's not a scam." (Joe, [16:06])

4. DOJ Case: Insider Bank Fraud Targeting the Elderly

[19:22–25:46]

Joe covers a DOJ press release: a bank employee exploited insider access to steal over $2M from elderly clients (ages 90–103).
- The employee set up new online bank accounts for victims with no previous online presence, then transferred funds and laundered them via options trading.
- Key quote:
  - "These are nonagenarian centenarians—I mean, that's pretty old. He's not targeting people in their 70s or 80s. He's going for people older than that." (Joe, [21:59])
- Dave reflects on the vulnerability of people with no online footprint and the challenges in detecting such fraud. Maria suspects an investigation may have flagged a surge in elderly clients suddenly enrolling in online banking.
- The employee faces a substantial sentence (up to 30 years).
- Hosts emphasize that systemic controls and oversight are essential, since victims may be defenseless.

5. Article Recommendation: “Caring for Mom is an Education in Scams and Fraud” by Nancy Rommelman

[27:12–37:07]

Maria introduces an article by Nancy Rommelman, describing her mother’s experiences with scams as she ages and suffers memory issues.
- Trusted professionals (like a longtime accountant) took advantage, as well as relatives and opportunistic scammers.
- Nancy’s story highlights how cognitive decline and loneliness make the elderly “easy prey.”
- Recommended action: Involve yourself in elderly family members’ finances sooner than you think necessary to avoid falling behind on scams.
- "Don't wait until decline is obvious. Don't wait until the problems are already building up. Try to get in front of it as best that, because people are really unscrupulous." (Maria, [31:24])
- Dave shares personal experience: the signs of cognitive decline often only become clear "in the rearview mirror," and shame or embarrassment may prevent elders from asking for help until it's too late.
- Discussion segues into the importance of empathy, vigilance, and early intervention for caregivers.

6. "Catch of the Day": A Cryptocurrency Scam Email (Australian Edition)

[37:50–41:57]

The team analyzes a scam email purporting to be from the Australian Tax Office, demanding disclosure of cryptocurrency held in a “non KYC decentralized wallet, commonly referred to as a cold wallet.”
- Technical analysis: The scam uses jargon incorrectly—no such thing as a “decentralized wallet,” and misuses terms like “cold wallet” and “KYC.”
- Quote:
  
  "This is just word salad." (Joe, [40:39])
- Joe notes that no agency could know you possess crypto in a cold wallet since that’s the point of such wallets.

Notable Quotes & Memorable Moments

Physiological response to authority

“Even though I knew it was a scam, there was still that little thing in the back of my mind that I got nervous about it. The adrenaline fired off.”
— Joe Kerrigan ([04:08])
On tech support vishing:

"The last thing in the world a big tech company wants you to do is call them."
— Dave Bittner ([12:09])
On romance scam tactics:

"They try to find people who are already very isolated ... love bombing ... it feels so soothing."
— Maria Varmazes ([15:19])
On insider bank fraud:

"He's not targeting people in their 70s or 80s. He's going for people older than that."
— Joe Kerrigan ([21:59])
Advice for caregivers:

"Don't wait until decline is obvious. Don't wait until the problems are already building up. Try to get in front of it..."
— Maria Varmazes ([31:24])
Deconstructing a crypto scam email:

"This is just word salad."
— Joe Kerrigan ([40:39])

Important Timestamps

[00:44] – Joe’s jury duty scam call: play-by-play and emotional impact.
[10:45] – Apple Pay vishing scam breakdown.
[13:04] – Australian AFP romance scam resource and tactics.
[19:22] – DOJ insider bank fraud case: elderly victims, methodology.
[27:12] – Elder care and scam article: real life perspective.
[37:50] – Crypto scam email analysis in “Catch of the Day.”

Podcast’s Tone & Delivery

The hosts maintain an informal, conversational, and often humorous tone—balancing serious discussion of fraud with personal anecdotes and banter. They are candid about their own vulnerabilities, making the advice approachable and relatable.

Practical Takeaways & Resources

Always verify any authority contact through official, independently sourced channels.
Don’t engage via numbers or emails provided in suspicious messages—seek out your own.
Romance/relationship scams thrive on isolation. Involve others you trust, and don’t move conversations to untraceable platforms.
Caregivers: Involve yourself in loved ones’ finances early to spot fraud before it escalates.
Be skeptical of technical or financial jargon in unsolicited communications—lack of accuracy is a major red flag.
Use available resources (like the AFP romance scam guide) to educate yourself and family.

Links Mentioned:

[Australian Federal Police romance scam resource] (link promised in show notes)
[Article: Caring for Mom is an Education in Scams and Fraud** – Nancy Rommelman on RealClearInvestigations]

For Listeners

Whether you’re tech-savvy or new to social engineering topics, this episode lays out why scams are effective, what the latest threats look like, and why no one is immune to manipulation. It also spotlights the vulnerability of the elderly, offering practical strategies for prevention at both the personal and caregiver level.