Former CIA Official on Avoiding Credit Card Scammers

Summary

WSJ Your Money Briefing

Episode Summary: "Former CIA Official on Avoiding Credit Card Scammers"

Date: November 24, 2017
Host: JR Whalen & Ann Marie Fertolli
Guest: Dr. Eric Cole, cybersecurity expert and former CIA technology director

---

Episode Overview

In this episode, the Your Money Briefing team interviews Dr. Eric Cole, former CIA technology director and cybersecurity expert, about the growing threat of credit card scams—particularly heightened during the holiday shopping season. With consumers expected to spend more than ever, Dr. Cole provides actionable tips to avoid falling victim to digital thieves, discusses the effectiveness of institutional versus personal defenses, and offers advice for those who suspect they've been compromised.

---

Key Discussion Points & Insights

The Evolving Threat Landscape

• Persistence and Growth of Scams

  • Despite advancements in security, scams are not decreasing.
  • Cybercrime is appealing to adversaries because there are limited laws, it's geographically unbounded, and law enforcement has substantial challenges catching scammers.
  • Quote: "From an adversary's perspective, it's a very good time to be in cybercrime because... it's very hard for adversaries to catch you." — Dr. Eric Cole (01:16)

• Government and Institutional Roles

  • Government primarily focuses on large-scale cyberattacks; crimes targeting individuals often go unaddressed unless they affect millions.
  • Large organizations, such as banks and companies like Equifax, are frequent targets but sometimes still make basic security errors.
  • Quote: "These big companies that you think should know better just are letting their guards down or not focusing in on the right areas." — Dr. Eric Cole (02:33)

Why Consumers are Vulnerable

• Hackers' Advantage
  • Hackers only need to exploit one vulnerability, while organizations must secure all possible entry points.
  • The typical security posture is just 80-90% effective, leaving enough room for breaches.
  • Quote: "For that organization to protect themselves, they need to find all the vulnerabilities. So... they're only doing it 80 or 90%, which is enough for the adversary to sneak in." — Dr. Eric Cole (03:13)

Best Practices for Holiday Shopping

• Mobile Device Safety

  • Avoid using public Wi-Fi networks (like those in malls or coffee shops) when shopping online—prefer to shop over cellular data or secure home networks.
  • Many mobile apps, sometimes built in countries like Russia, contain backdoors enabling access to your microphone, photos, and data.
  • Regularly review app permissions under privacy settings and remove unused apps, which can pose hidden risks.
  • Quote: "Be very careful of apps... a lot of these apps are being built in Russia and have back doors... they get access to your microphone, your pictures..." — Dr. Eric Cole (04:04)

• Practical Steps

  • Turn off Wi-Fi on your phone when out in public to reduce exposure.
  • Check what permissions each app has—especially access to camera, microphone, and location.
  • Take stock of apps you've installed and remove those you haven't used in months.
  • Quote: "My best advice is get rid of those extra apps. Most people have five or six pages of apps they haven't used for four or five months." — Dr. Eric Cole (06:16)

• Coupon and Deal Apps

  • Discount and location-based coupon apps can track consumer behavior and location—users must weigh convenience against privacy risks.
  • Quote: "Anything that can be used for good can be used for evil. So as long as they accept that that information is being given away, then it’s okay." — Dr. Eric Cole (07:10)

• Cash and Card Use

  • Using cash at stores has certain advantages, but if using cards, credit cards are safer than debit cards for in-store purchases.
    • Credit cards offer more legal protections; debit cards withdraw funds immediately and offer less recourse if compromised.
    • Quote: "If you use credit cards, it's the credit card company that's out the money and there's laws that protect you. When you're holiday shopping this season, credit card, credit card, stay away from the debit." — Dr. Eric Cole (08:08)

Limiting Exposure & Damage

• Ongoing Battle

  • The dynamic between security professionals and hackers is a perpetual arms race.
  • Individuals should accept that incidents may happen and focus on minimizing the damage by limiting the personal data stored on devices.
  • Quote: "Probability of getting hacked is very high. Focus on controlling and minimizing the damage." — Dr. Eric Cole (09:46)

• Recommended Device Settings

  • Under privacy settings (especially on iPhones and Android devices), restrict access to location services, camera, and data for apps whenever possible.

What To Do If Scammed

• Immediate Action Steps

  • Cancel all your credit cards—not just the compromised one.
  • Assess what other information may have been leaked, and take steps to contain further exposure.
  • Focus on credit cards and your identity as primary avenues for fraud.
  • Quote: "Even if you think it might only have been one credit card, I would recommend going in and canceling all of your credit cards." — Dr. Eric Cole (10:27)

• Phone Scams

  • Report scam attempts to your phone provider for network-wide blocking.
  • Quote: "Cell phone companies are really good at blocking and stopping these adversaries... reporting it is really key." — Dr. Eric Cole (11:04)

Holiday Season Risks

• Heightened Threats
  • The volume of transactions and bustling nature of the holiday season make it a prime time for scammers; more activity creates more opportunities for fraud.
  • Quote: "Just like the holiday season is really good for retail stores, it's really, really good for adversaries..." — Dr. Eric Cole (11:36)

---

Notable Quotes & Memorable Moments

• "Hackers only need to find one vulnerability. For an organization, it's all vulnerabilities—they need to find all of them." (03:13)
• "I actually disconnect my wireless when I go out in public." (04:46)
• "If you use a debit card in a store and the adversary steals the information... there's no law or protection." (08:08)
• "Probability of getting hacked is very high. Focus on controlling and minimizing the damage." (09:46)
• "First steps I always say is drink and pray. Not necessarily in that order..." (10:27)
• "Reporting it [phone scams] is really key." (11:04)
• "Just like the holiday season is really good for retail stores, it's really, really good for adversaries..." (11:36)

---

Timestamps for Important Segments

• Scam Trends & Difficulty in Law Enforcement: 01:16–01:39
• Roles of Government & Big Institutions: 01:53–03:13
• Why Defending is Harder than Attacking: 03:13–03:39
• Safe Mobile Shopping Practices: 04:04–05:38
• Managing App Permissions & App Risk: 06:16–07:10
• Cash vs. Card (Importance of Using Credit not Debit): 07:50–08:39
• Limiting Device Vulnerabilities: 09:07–09:46
• Immediate Actions after Being Scammed: 10:27–11:01
• Phone Scam Response: 11:01–11:24
• Holiday Season’s Increased Risk: 11:24–11:56

---

Tone and Language

• The conversation is practical, candid, and sometimes wry, emphasizing common-sense approaches to digital security while recognizing the persistent, evolving nature of cyber threats.
• Dr. Cole interweaves serious advice with relatable humor (“First steps I always say is drink and pray. And not necessarily in that order...”) and clear language.

---

Takeaways

• Be hyper-vigilant about network connections and app permissions, especially during the holidays.
• Prioritize credit cards over debit cards to leverage legal protections.
• Regularly declutter and audit mobile devices for unused or risky apps.
• Prepare for possible scams by knowing the quickest response steps.
• Recognize that perfect prevention is impossible; focus on limiting your exposure.

---

This episode provides a blend of expert insight and everyday wisdom to empower listeners to protect themselves from the most relevant and rising forms of credit card scams, especially during the busy holiday shopping season.

Transcript

[Small Business Owner]

Access to affordable credit helps me pay my employees, but I don't really need it.

[Retail Industry Advocate]

Inflation is killing me, but who cares? Big retailers are making record profits. That's why we support the Durbin Marshall credit card bill.

[Small Business Owner]

See banks and credit unions help small businesses make payroll. This bill would cut the vital resources

[Retail Industry Advocate]

they need while increasing megastore profits. They deserve it, don't they?

[Money Matters Announcer]

Tell Congress, stop the Durbin Marshall money grab for corporate megastores paid for by the Electronic Payments Coalition. This is yous Money Matters from the Wall Street Journal.

[JR Whalen]

Welcome to youo Money Matters. I'm JR Whalen with Ann Marie Fertolli in New York. At the top of many consumers minds this holiday season is where to buy the perfect gift. Also top of mind should be how to avoid being scammed by credit card thieves. So what steps can consumers take to protect themselves? Dr. Eric Cole is a cybersecurity expert and is former technology director at the CIA and he joins us now to discuss. So Eric, the threat of scams is present year long, but it's very pronounced at this time of the year. Has the occurrence of scams, has it come down at all or been corralled at all in the past couple years?

[Dr. Eric Cole]

Unfortunately, no. And the reason is from an adversary's perspective, it's a very good time to be in cybercrime because there's not a lot of laws and you can commit it from anywhere in the world and it's very hard for adversaries to catch you. So they basically can commit these crimes with very little chance of getting caught.

[JR Whalen]

Wow. It's just advantage criminals.

[Dr. Eric Cole]

Exactly. Wow.

[Ann Marie Fertolli]

Eric, when you were at the CIA, I would imagine that heading off scammers as a method of national defense was pretty commonplace. Where does protecting consumers rank in terms of government responsibility or consumer responsibility?

[Dr. Eric Cole]

Typically, from a government perspective, they're really concerned about large scale attacks. So we often are scared with North Korea right now with physical nuclear weapons. But what we don't realize is they have cyber nuclear weapons that can do just as much damage. So the government's really looking at much bigger attack vectors. However, if those attacks are targeting a large number of people, then they will get involved. The problem is when the adversaries target individual consumers, that's usually too small for the government. And but if they can target 10 or 20 million, that can still be a very significant crime.

[Ann Marie Fertolli]

So are there bigger institutions like banks for example, that pay closer attention to this?

[Dr. Eric Cole]

They should. The problem is, so should a company like Equifax. I mean, they're a Big company, you would think they have really, really good security. And not to try to throw them under the bus, but I will. They made some very basic mistakes. They had servers visible from the Internet. They had known exposure points. They didn't fix it. And. And the consumer data was available. So these big companies that you think should know better just are letting their guards down or not focusing in on the right areas.

[Ann Marie Fertolli]

Right. I think about when we hear in the news every other week or so that a big company has been targeted and all of this information is now at risk or made public or potentially hacked into and taken advantage of.

[Dr. Eric Cole]

Exactly. And the problem is the adversaries really have the upper hand. Because for the adversaries to break into a bank or to break into a organization, they only need to find one vulnerability. For that organization to protect themselves, they need to find all the vulnerabilities. So what often happens is a lot of that visibility. They need to really understand those exposures. They're only doing it 80 or 90%, which is enough for the adversary to sneak in.

[JR Whalen]

Now, there's also. I mean, the danger also resides in a consumer's house or even right in their hand. Eric, you have a book coming out in January titled Online Danger, how to protect yourself and your loved ones from the evil side of the Internet. A lot of us will be shopping via a mobile device during the holidays. Right in our hand. What are some of the tricks to keep in mind when shopping with our phones or our tablets to keep the bad guys on the Internet at bay?

[Dr. Eric Cole]

The first and most important is make sure you're very careful of what wireless networks you connect to. I would recommend only doing that at your house. If you're out in public, in the mall, in a coffee shop. Do not connect to those wireless networks. I actually disconnect my wireless when I go out in public. Or also, be very careful of apps. Everybody has apps these days. And what we're finding is a lot of these apps are being built in Russia and have back doors built in that the companies don't even realize. So you put them on your phone and they get access to your microphone, your pictures, and anything else to basically spy on you.

[JR Whalen]

All right, let me go back for a minute. Okay. So you're a former CIA guy. You turn off your wireless access when you go out to the mall.

[Dr. Eric Cole]

Yes, absolutely.

[JR Whalen]

So we should all strategize and do all of our shopping research up front. I mean, it makes sense. I don't think I ever thought about that. To turn off the access so simply Texting people, that opens up your phone to an opportunity. For somebody who might be lurking around a mall, in terms of being a

[Dr. Eric Cole]

cybercriminal, texting via the cellular network is okay. It's the wireless that's of concern. But the bigger issue is most people never looked at their phone to see what have access to the location and the camera. So we've seen a lot of child abductions increase around the holiday season because you have crowded malls, you have kids that parents normally let them go by themselves, and the adversary can just track their location, see where they are, and basically target them.

[JR Whalen]

So it's the WI fi network that's more or less the threat here. Keep it to the cellular side, is what you're saying?

[Dr. Eric Cole]

Absolutely.

[Ann Marie Fertolli]

We're speaking with Dr. Eric Cole about ways to protect against credit card scammers this holiday season. And. And you're listening to your Money Matters from the Wall Street Journal.

[JR Whalen]

Welcome back, everybody. Eric, Consumers are expected to spend more than $900 on gifts this season. That's the most since 2007. And I'm sure a lot of folks like me, they have a bunch of shopping apps on my phone. You mentioned to try to be aware of which apps could be tied to Russian origin or to places that have nefarious backgrounds. Is there a clear way to know if your app is.

[Dr. Eric Cole]

Not until after it's installed. But once it's installed for the iPhone, for instance, you can go in if you go under privacy, and you can see exactly what access that app has if it accesses your camera, your pictures, your microphone. Because what people don't realize is once you give those apps that access, they can use those resources whenever they want without asking for permission. And my best advice is get rid of those extra apps. Most people have five or six pages of apps they haven't used for four or five months.

[JR Whalen]

That's me.

[Dr. Eric Cole]

Yeah, you want to get rid of those, because those are the ones that are lurking. You're not watching them, and they can easily hurt you.

[Ann Marie Fertolli]

I think also of apps that give offers for deals or coupons, even in apps. So sometimes I'd see people in stores or even friends or family members will pull up the app in the store, at the register to access the coupon. Is that something we shouldn't do?

[Dr. Eric Cole]

It's all about accepting risk. If you're okay with those apps knowing where you are, tracking what you're doing, and what you're shopping, then it's okay. But most people only look at the functionality. They think it's awesome. That they're walking down the street and they can get an advertisement for a local restaurant, or as they're shopping, they can get their coupons. But what they don't realize is anything that can be used for good can be used for evil. So as long as they accept that that information is being given away, then it's okay.

[JR Whalen]

Right.

[Ann Marie Fertolli]

And you see that coupon, and sometimes the store's right there and you want to walk right in.

[Dr. Eric Cole]

Exactly. And these are only going to be getting worse over time because consumers realize if you have your phone with you and they know your location, it is amazing for target marketing.

[JR Whalen]

Sounds like my best friend is the ATM machine. And paying by cash protects me on a few levels.

[Dr. Eric Cole]

Absolutely. But ATM machines are great. The one thing to be very careful of is that debit card, that ATM card, only use it in the machine, never use it for in store purchases.

[JR Whalen]

Really?

[Dr. Eric Cole]

Yeah. Because if you use it in a store and the adversary steals the information, not only are there no laws or protection, but the money comes out of your account instantly when the fraudster hits. If you use credit cards, it's the credit card company that's out the money and there's laws that protect you. So when you're holiday shopping this season, credit card, credit card, stay away from the debit.

[JR Whalen]

So the credit card sometimes puts you on the hook for $50 or something like that. Even though there could be $1,000 run up in charges, there are no laws on the debit card side?

[Dr. Eric Cole]

That is correct. They can run up the charges. Now, most banks are pretty good at protecting their consumers, but it's not a requirement. They don't have to honor it.

[JR Whalen]

Okay, wow. Now, we talked about what you do with your apps in terms of turning off access to various parts of your phone. Are there specific ways to take your cell phone or your tablet and protect it from hackers? What are the settings on the more global side of the phone that can be done?

[Dr. Eric Cole]

The main ones are all under privacy. I'm an Apple person, but I know Android has similar functions. If you go under privacy, what you really want to look at is location services, people tracking where you are, camera people being able to turn that on, and data access. Can they get to your email, your pictures or other information?

[JR Whalen]

You know, it sounds like this is just a matter of time when the next hack or next scam is. Is announced. It just. Do you get the feeling that it's a game of cat and mouse and it's just who can stay ahead of who can the government stay ahead of the Criminals. Can the criminals stay ahead of the government? It's just. Is it an ongoing race?

[Dr. Eric Cole]

That's exactly what it is. Because adversaries want to break in. So whenever hackers break in, we then figure out a way to defend against them. They don't stop. So then they figure out a way around it. We then defend against it. They figure a way around it. So, yeah, it's this constant battle. And what you really have to look at as a consumer and is probability of getting hacked is very high. Focus on controlling and minimizing the damage. So when it happens, how do you reduce your exposure? Limit the information on your phone, Limit the information that's on your computer. Make it harder for the adversary to hurt you.

[Ann Marie Fertolli]

Eric, let's say you've already been scammed and you realize that this has happened. What are the first steps you should take?

[Dr. Eric Cole]

Jokingly, my first steps, I always say, is drink and pray. And not necessarily in that order, but you're probably looking for something more technical. First thing to do is immediately go in and control the damage. So even if you think it might only have been one credit card, I would recommend going in and canceling all of your credit cards. Also look at what other information might have been compromised and try to reduce that exposure. In most cases, really the best thing you could do is focus on the credit cards and identity to limit somebody from committing fraud against your account.

[Ann Marie Fertolli]

And what about on the phone? If you are prey to a phone

[Dr. Eric Cole]

scam, typically, then you want to go in and contact the provider. Typically you can't change your number very easily, but they can go in and do a lot of blocking on their end. Cell phone companies are really good at blocking and stopping these adversaries. And if one person reports them, they usually block them for everyone else. So reporting it is really key.

[JR Whalen]

Is the strength of the overall threat from hackers and scammers. Is it the same throughout the year or does it actually grow in the holiday season because of the number transactions and shoppers out there?

[Dr. Eric Cole]

It actually increases during the holiday season because it's all about targets and availability. So just like the holiday season is really good for retail stores, it's really, really good for adversaries because the more frequent amount of use of a credit card, the easier it is for me to steal it.

[JR Whalen]

So the bad guys fish where the fish are.

[Dr. Eric Cole]

Exactly.

[Ann Marie Fertolli]

Wow.

[JR Whalen]

That's Dr. Eric Cole, former CIA technology director, joining us here in our studio. Dr. Cole, thanks for being with us.

[Dr. Eric Cole]

My pleasure. Thank you.

[JR Whalen]

And thank you for listening to youo Money Matters I'm JR Whalen, along with Ann Marie Fertoldi at the Wall Street Journal.

[Money Matters Announcer]

Is Alexa part of your life? Then make your Money Matters part of your flash Briefing on the Amazon Echo the Wall Street Journal. Listen ambitiously.

[Small Business Owner]

Access to affordable credit helps me pay my employees, but I don't really need it.

[Retail Industry Advocate]

Infliction is killing me, but who cares? Big retailers are making record profits. That's why we support the Durbin Marshall credit card bill.

[Small Business Owner]

See banks and credit unions help small businesses make payroll. This bill would cut the vital resources

[Retail Industry Advocate]

they need while increasing megastore profits. They deserve it, don't they?

[Money Matters Announcer]

Tell Congress, stop the Durbin Marshall money grab for corporate megastores paid for by the Electronic Payments Coalition.