Hacking Humans

A game of loans.

56 min
Apr 30, 2026about 1 month ago
Listen to Episode
Summary

This episode of Hacking Humans covers three distinct social engineering and fraud schemes: athletic lending fraud where a college football player impersonated NFL players to obtain $19.8M in fraudulent loans, scammers targeting families of incarcerated individuals through fake bail bond schemes, and an analysis of Amazon's trustworthy shopping report with skepticism about its effectiveness.

Insights
  • Athletic lending fraud exploited a small, identifiable market of eligible borrowers, making perpetrators highly traceable—suggesting greed and overconfidence rather than sophisticated criminal planning
  • Incarcerated individuals' families represent an exceptionally vulnerable target due to pre-existing emotional distress, legal system ignorance, and lack of trusted advisors, making them ideal scam victims
  • Public jail rosters and mugshot databases, while serving transparency purposes, directly enable scammers; removing them reduced fraud significantly, highlighting the tension between public records and public safety
  • Amazon's self-reported security metrics lack meaningful context and comparative benchmarks, making it impossible to assess whether their protections are genuinely effective or merely performative
  • Emotional duress and information asymmetry are more powerful fraud enablers than technical sophistication; scammers exploit existing fear rather than creating it
Trends
Targeting of financially vulnerable populations through identity impersonation in niche lending marketsExploitation of criminal justice system opacity and family desperation as primary fraud vectorsTension between public records transparency and scam prevention in government databasesCorporate security theater: companies publishing uncontextualized metrics to appear trustworthy without demonstrating actual effectivenessShift toward emotional/psychological exploitation over technical sophistication in modern fraud schemesRegulatory gaps in athlete financial products enabling predatory lending and fraudIncreasing sophistication of identity fraud using visual disguises (wigs, makeup, cultural markers) in virtual transactionsPublic-private coordination gaps in fraud prevention between platforms and law enforcement
Companies
Aaliyah Sport
Athletic lending company that provides loans to professional athletes; targeted by Luther Davis fraud scheme
All Pro Capital
Athletic lending company providing loans to professional athletes; victim of the $19.8M impersonation fraud
Sure Sports
Broker company that arranges athletic loans; facilitated fraudulent transactions in the Luther Davis case
Amazon
Published Trustworthy Shopping Experience Report claiming security measures; hosts counterfeit products and fake reviews
ThreatLocker
Cybersecurity sponsor offering default-deny execution controls and zero-trust enforcement
N2K
Podcast network that produces and distributes the Hacking Humans show
The Guardian
News outlet that published Daniel Kaplan's investigation into athletic lending fraud
Spectrum News
Local news outlet that reported on bail bond scams targeting families of incarcerated individuals
Capital One
Credit card company involved in dispute with Amazon over double-charging incident
Blood Cancer United
Charity organization (formerly Leukemia and Lymphoma Society) supported by guest Michelle Kellerman's fundraiser
People
Dave Bittner
Primary host of Hacking Humans podcast
Joe Kerrigan
Regular co-host discussing social engineering cases and providing analysis
Michelle Kellerman
Guest co-host filling in for Maria; discussed bail bond scams and Amazon security report
Luther Davis
Former Alabama football player (2010 National Championship) charged with impersonating NFL players for $19.8M fraud
C.J. Evans
Partner in athletic lending fraud; founder of Deed Chasers LLC used to register fraudulent companies
Daniel Kaplan
Reported on athletic lending fraud scheme targeting NFL players
Madison MacArthur
Reported on bail bond scams targeting families of incarcerated individuals in Columbus, Ohio
Sue
Australian listener who provided rooster behavior management advice to Joe Kerrigan
Quotes
"Every attacker counts on one thing, environments that trust too much. ThreatLocker closes that gap with default deny at execution."
ThreatLocker AdvertisementMid-episode sponsor read
"The emotional duress is already there. I wonder how you balance this because I do understand the sort of public good of having a database of people who've been incarcerated."
Dave BittnerDiscussion of jail roster public records
"It's a highly identifiable, highly traceable. People pay attention to this stuff. Yeah, I think, you know, if I was going to do this better, I wouldn't have used my buddy's LLC as the registration agent for my LLC."
Joe KerriganAnalysis of athletic lending fraud methodology
"They're already getting screwed. And then the buyer, they're kind of already pre-selecting a lot of stuff to the point where if Amazon Basics comes out with something that's a copy of your product, you just shouldn't even bother selling it anymore."
Michelle KellermanCritique of Amazon's seller incentive structure
"This feels like hubris, not intelligence. There you go. To go this path, you're already just too big for your britches at the start."
Dave Bittner / Joe KerriganDiscussion of why fraud perpetrators get caught through overconfidence
Full Transcript
You're listening to the Cyber Wire Network, powered by N2K. Hello, everyone, and welcome to the Hacking Humans podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner, and joining me is Joe Kerrigan. Hey, Joe. Hi, Dave. Maria is once again on vacation this week, so joining us is friend of the show, Michelle Kellerman. Michelle, welcome back. Gentlemen. We've got some good stories to share this week, but first, we've got some follow-up here. Actually, let's start with you, Michelle. You're still pitching your worthwhile charity here. What do you got for us? Just for the last sub-in, I believe, while I'm going to be doing this campaign, we are halfway through the Blood Cancer United Visionary of the Year charity fundraiser that I'm doing to support my best friend whose daughter had infant leukemia for the Blood Cancer United Society, formerly the Leukemia and Lymphoma Society. And we are halfway through and I am not halfway to my fundraising goal. Tragically. So anybody willing to donate would be very much appreciated. It goes to a great cause. This helps with treatment, with family support, with education, with any resource that somebody experiencing this may need. It's a wonderful foundation. All right. Well, we will have a link to that in the show notes. So listeners, please do step up and help out. All right. We got another bit of a follow-up here. Joe, this is for you. This is from listener Sue. In Australia. In Australia. Right. Who's keeping you straight with your chickens. Yes. Sue wrote in and sent an email, and actually you forwarded this to me almost immediately, which I think is great because I've already tried this. We'll talk about this in a minute. Oh. But it begins, hello, Joe, so you have an attacking rooster problem. If you remember a couple weeks ago, I talked about my wife getting attacked by one of the roosters. It wasn't so much you had the rooster attacking problem as your wife did. Well. You had it by extension. I guess it became your responsibility to mitigate. Right. It's my responsibility. Yeah. This is how you fix it. Okay. Okay. Take 10 minutes every day over a two-week period. She actually says fortnight, which I really appreciate. Okay. Over a fortnight period, wait for the hens and the rooster to go to bed. Then go to the hen house and grab the rooster by the legs with one hand. Pull the rooster into an upside-down position. He will flap about trying to right himself. This is a submissive position. Yeah, I'd say so. Right. I don't like being held up by my legs. I don't know anybody who does. Maybe, I don't know. I got a granddaughter that loves it. I was going to say, gymnasts, people who work at the circus. This kid, I will hold her upside down by her legs and she will do crunches. And she's like the only three-year-old I know that has abs. Yeah, I don't think I could do that. Yeah, I can't. When he runs out of puff flapping, put your other hand under his breast and right him and hold his legs at all times. spend the next 10 minutes touching his comb, waddle's beak, and neck area, and put the rooster back in with the hens. You'll probably only need to put the rooster in the submissive position three times, and then you have to do the picking him up every day and rubbing his comb and head for about two weeks. Okay. So what this does, I'm going to summarize here because I'm not really all that good at reading. What this does is lets the rooster know, number one, you're in charge. Yeah. right? That you're the actual power animal in the cage with them, right? You're not just the free ride for food. Right. Yeah. And also, it lets him know that you're not a threat, which is why you have to be nice to him. One of the things that he might be thinking is that something bad is going to happen to the hens when I pick them up, particularly this, she mentioned Snugglebug, who I talk about, who always hops up and wants me to pick her up. Yeah. And then I have another one, the other Americana hen, that has actually taken to me a little bit better. And it's okay for me to pick her up, too. The other three hens really don't want anything to do with me, and I'm fine with that. As long as I have my other two hens that still like to talk to me, that's fine. Okay. So, a snuggle bug may not be giving off any distress call, which would normally brings in the rooster and other hens to display this behavior. But still, seeing it can trigger a response, a protective response. I only, she says, Sue says she only had to do this on one occasion, did not, I did not spend time handling my rooster when he was young, which I also didn't do, specifically because when we were talking about it with my daughter, she said, don't handle the rooster. You don't want to do that. You want him to be unhandled so that he is more aggressive and protective. I didn't know that would mean he would attack people. So that's what's happened here. I was administering a tablet for Mason's eye worm to my rooster, and he took a chunk out of me, which when roosters fight, they don't just peck. They twist their beak in order to draw blood on the other rooster. Did this handling him, and she got a problem. Your wife also needs to put the rooster in a submissive position and have interactions with the rooster. He needs to learn that humans have more strength than him. Asian breeds will be more aggressive after, can be more aggressive. If after a fortnight of handling, he still attacks, then you need to get rid of him. Oh, and she also notes that Snuggle Bug is called a Chickababe. Chickababe. Chickababe? Chickababe. Yeah, I'm going to say Chickababe. She is the smallest, youngest, and gets picked on the most by the other hens. She's actually not the smallest. The Americana is the smallest. But she is the second smallest. She's definitely the smaller of the two breeds that we have. And the other two, we have three breeds. We have Easter Eggers, Olive Eggers, and Americanas. And I only know which ones are the Americanas. But I went into the coop on Tuesday night to feed them because, you know, they're out of food. They were low on food and water, so I had to feed them water. And while I go in there to feed them, this ingrate rooster starts getting uppity with me. Okay. And, you know, he puts his head down, he sticks his neck out, and he starts charging at me. And I, you know, I put a foot out to stop that, and that doesn't stop him from doing it. So I chased him around the run and pinned him down and reached under him, grabbed his feet, and took him out of the run. And I just held him upside down for a little bit. And he sure did try to reach up and peck my hand. He does not have the abs to do that, though. I did not anticipate the amount of work of chicken psychology that exists out there. Nor did I. I thought having chickens would be a lot easier than this, but it isn't. Well, not even that. I just figured, you know, the expectation is like they're dumb, so we're not going to try and figure it out. I understand like with dogs, they are working animals. They serve a purpose in a lot of situations. For other animals that we observe closely, like I used to volunteer with dolphins at the aquarium. Learn and, yeah, I used to moonlight. I like to do side quests. learning about the psychology of like the dolphins and stuff, but like chickens, I didn't expect that we were going to like have an analysis and like a tried and true. This is what they need to communicate in chicken. Right. Yeah. Well, you communicate, you communicate in chicken physically. Yeah. So it's, it's kind of, you can communicate with a dog verbally and they'll get it, but you know, your dog, you still need, you still need some kind of, there's some physicality involved, whether it's like posture, you know, because you bend down in front of a dog, the dog gets excited. Oh, we're going to play. Okay. Because that looks very much to them like a play bow. So there's, yeah, there's all kinds of dog psychology and then there's chicken psychology as well, I guess. So anyway, once he tired himself out, I just kind of held him upside down for, you know, maybe 30 seconds and saw him relax and just go limp. He ran out of steam really quickly. And then, you know, his eyes started closing. And once that happened, I flipped him over and I said, okay. And then I just started petting them a little bit and went back and I put them in the coop. Now, I haven't had the time because I'm going to classes two nights a week. So I'm not there every single night. I can get home at 1030 some nights. And the last thing I want to do with that is go out and grab a rooster by his feet and turn him upside down. I just want to go to bed. So I'm going to keep doing this and see if this is effective. but I probably won't be able to do it for two weeks until after class is in, which is about a month. But once I put him back, I was able to walk into the run with no challenge or anything. He was like, okay, well, so it is effective. Thank you, Sue, for sending this to me. It's a good thing you didn't choose to raise emus. Right, yeah. I do not want anything to do with them. Did I tell you about my one run-in with emus? No. Why? Why do I have a run-in with emus? I give up. I was, my son and I were doing a bike ride around the BWI trail, which is a great trail. It goes all the way around BWI airport. Yeah. And as we're riding up the, um, riding up one of the hills, I get the feeling that something's watching me. Right. And I look over. More than usual. Right. More than usual. Right. No, it's, it's actually a feeling. I don't know why we get that, but we do get that. Maybe it's something your peripheral vision triggers something. Yeah. Uh, but I get the, I get the feeling something's watching me. Now, look over at this fence line, and there in the fence line is this velociraptor-looking bird. It's an emu. Right. And he's just staring at me like, hey. In Maryland? So he's behind a fence? He's behind a fence, yeah. Okay. But, you know, he's menacingly staring at me like, you know, we went to war with Australians and we won. That's true. Yeah. Yeah, well, Clark's Farm has an emu near us. Yeah. They have one. I mean, you know, they can be nice. or trained or, I don't know, habituated, I guess, is probably the way to say it. Yeah, they're venomous too. They have a venomous spur on their legs. I would not want to get in a fight with an emu. No. But the cassowary is the one that'll really mess you up. Yeah, that'll kill you. That's a dinosaur. Right. You can't convince me of otherwise. They're all dinosaurs. I'm looking at my chickens and they look like... The cassowary is like straight line from dinosaur to cassowary. It was just hiding out the whole time. Yeah. survived the impact in the Yucatan. Right, through sheer force of will and disdain, it survived. Every attacker counts on one thing, environments that trust too much. ThreatLocker closes that gap with default deny at execution. Unknown software, blocked. Trusted apps, contained with ring fencing. Configurations? Verified with ThreatLocker DAC so you stay secure and compliant. ThreatLocker delivers the visibility and control CISOs need without adding operational pain, making zero trust real for teams of any size. Stop ransomware at its earliest point. Book a demo at ThreatLocker.com slash N2K. And we will now move on to our stories. And Joe, you're up. What do you got for us? I have got a banger this week, Dave. Okay. This one comes from Daniel Kaplan at The Guardian. And this kind of exposed something I didn't know existed. But it seems if you are a professional athlete, which I will never be. There's still time. No. No, there isn't. You could still be a bowler. I could maybe be a curler. Curler, yeah, sure, sure. Right. Yeah, somebody's dad is really great at that. Yeah. So there are borrowing products available to you from companies like Aaliyah Sport and All Pro Capital. And these loans are brokered through companies like Sure Sports. So I didn't even know this market existed. What do you mean by, yeah, help me understand, what's a borrowing product? It's a loan, essentially. Okay. Against what? Again, I don't know. Against what? Maybe against your contract? Against your athletic prowess. Right. Okay. Yeah. I don't, it doesn't go into enough detail. It really, I mean, this, I really want to look into what this is because, you know, one of my big concerns about professional athletes is you get these guys that are like between 18 and 22 years old and you just dump millions of dollars into their laps. Yeah. You know, and what are they going to do with that money? What happens? I know that all the leagues have financial advisors set up for them, but I'm concerned this might be a step too far in terms of what goes on. It's hard to handle. Right. Hard for me to handle. But currently, what I'm about to talk to is not agreed to. So everything in this story is actually alleged. But there is a football player named Luther Davis who was a college football player for Alabama He was part of the team that won the 2010 National Championship game Oh okay I don't know what that means because I don't follow college football or college sports or American football. Well, it's a real mystery, but based on the name, Joe, what do you suppose the National Championship game could possibly mean? Here's the thing, because they have like different bowls. I mean, after every January 1st, there's like 15 different bowl games. Yes, that's right. If your team has something close to a winning record, chances are you'll be invited to a bowl game. Okay, so then— But this is like the NCAA, like, league championship. Yes, there is a national championship game, which is— They win college football. Correct. Okay, so is there— They're considered to be the national champions. So are these people that have already played in bowl games, or are they— No, bowl games are after. Bowl games are after. And my record, I believe it's changed in the past few years in terms of like being more of a play in kind of thing like the Super Bowl. I want to say back in 2010, I believe it was still chosen by journalists. Yeah, I think it's journalists that rank these. And, you know, how arbitrary of a system is that? I mean, that's that just doesn't seem right to me. Well, I mean, it's it was originally college kids, you know, right. And you're in it for the love of the game at that point. Okay. Which is, we've long since dispatched. Yes. So Luther Davis and one of his partners, C.J. Evans, have both tentatively agreed to a plea deal in a scam where Davis would pose as current NFL players to obtain fraudulent loans from these lending companies, these athletic lending companies. Okay. 13 of them are alleged totaling $19.8 million. Wow. 19.8 million. The criminal information document, or as they say, CI document, only contains about three of these loans, totaling about $11.6 million. Okay. And it only lists the initials of the people that were impersonated in this scam. But The Guardian actually goes ahead and lists them out in the article. But they ran this scam from May of 2023 to October of 2024. And here's how they did it. first, Davis and Evans would register companies in Georgia, the U.S. state Georgia, with names closely related to the people they were impersonating. Or maybe they start a company with just the initials of the person they were impersonating. Then they would open bank accounts for these companies and create email addresses. And Evans is described in the court filing as being the founder and operator of a company called Deed Chasers LLC, which operated as the registered agent for these companies in the state of Georgia. So all these LLCs were started in Georgia and Deeds was the registering agent for them. Deed chasers, rather. Then they would get fake identification documents. I kind of think they would do this before setting up the bank accounts. It doesn't make, but you know, the order's not really important. But then they would fabricate financial statements and, you know, including personal finance statements. Then they would reach out to the brokers and provide fake documents for the loan, you know, evidence. Davis would attend loan closings virtually disguised as the athlete he was impersonating. He used wigs and makeups, makeup. And in one case, he actually wore a do-rag because the person he was impersonating is often seen on TV wearing a do-rag. Okay. So, you know. Sure. You think do-rag, You think this particular football player, these are all NFL players, by the way. Yeah. Well, whatever the person is known for, if they have a signature look, you want to emulate that. So this guy, they would go so far as to look like the person they were impersonating. They had driver's licenses. They had the NFL players' names on them. one of them had a fabricated driver's license number, and the other one was just a number for just some random woman in Georgia. So it was a real number. And there's a good chance they just fabricated the number and just hit on it, right? Yeah. That could be the case. But Davis and Evans have both notified the court that they intend to enter guilty pleas, and they have a hearing scheduled for April 27th, which will be after the drop date of this podcast. So at that time, you can hear about it. But they are charged with aggravated identity theft. Right, Michelle? Aggravated identity. That means they stole identities in order to commit other crimes, including conspiracy to commit wire fraud. And both these sentences, the latter, wire fraud, as we discussed last week, can carry a sentence up to 20 years in jail. So we don't know what the plea agreement says yet in terms of how much time they've agreed to. But I think these guys are probably going to do some time. I wonder how they got caught. Well, I was looking at the Sure Sports, the website for one of these services, and the contracts are very specific. You can only, they're only open to certain people. So, for example, for draft eligible players, it's only for the top 100 NFL draft prospects and the top 40 NBA draft prospects. It's for certain college athletes based on an expected revenue structure. there are only a certain number of people that could possibly get these loans. Right. A small number of people can get the loans and there's capital companies out there ready to provide the capital and then the brokers are there just to be the middlemen. Wow. Yeah, I mean, imagine you're one of these players and there's somebody out there, you know, gobbling, using your good name. Right. To gobble up money. Yeah, yeah. And, you know, I don't, I don't know. Again, I would, I think this is where I would just be like, yeah, I don't know who that is, but that wasn't me. That's not my signature. This is not, this is not a Joe Kerrigan problem. This is a, uh, what is it? Sports capital problem. Yeah. That's why I'm surprised that they would go this route. This is, you get caught. All other frauds, you want to blend into all the other things. You want to not be noticeable. There are only a certain number of people that can get these. It seems like a really unusual path to fraud. Yeah. Highly identifiable, highly traceable. People pay attention to this stuff. Yeah, I think, you know, if I was going to do this better, I wouldn't have used my buddy's LLC as the registration agent for my LLC. I would have just gone and gotten some LLC registered in Delaware and set it up that way. Because there are companies in Delaware that will just register any LLC. You don't have to ever show up. Yeah. I've done it. I did my LLC registration online. Yeah. I also wonder to what degree did these folks see their downfall just out of greed? In other words, they got away with it once. Right. They got $4 million and they go, we could do this again. Yeah, that was easy. Right. Right. And $4 million isn't quite enough to retire on. I need two yachts. Right. And... Well, you got to split it 50-50, Dave. That's true. Yeah. I mean, these were large loans. I think if I do this once, I just count my lucky stars and then try to spend all the time hiding the money. This feels like hubris, not intelligence. There you go. To go this path, you're already just too big for your britches at the start. Right. So, this doesn't surprise me at all, actually. Yeah. Interesting. Very weird. All right. Well, we'll see what happens. It seems like justice is going to be served. I wonder if the banks will get their money back or at least maybe some of it. Who knows? but it depends on how much of it they spent already. Yeah, actually, I'm really not that concerned about these banks or about these capital companies. I'm just not. I mean, I think they might be doing something exploitive and taking advantage of young, inexperienced people who just got NFL contracts or NBA contracts. They even have like bridge loans if you're between college and your draft based on your draft perspective. Yeah. It's crazy. That's nuts. All right. So, yeah, I don't feel bad about the finance people losing their money. But, you know, it is theft. And if they get it back, okay, that's fine. Yeah. All right. Well, we'll have a link to that story in the show notes. Michelle, you're up. What do you got for us this week? Mine is a very different target from who is being targeted for the scams. This comes from Spectrum News. Madison MacArthur wrote it for the local news in Columbus, Ohio, about people, scammers targeting families and loved ones of recently incarcerated people. Yeah. So basically they are, these scammers are calling families of loved ones who are recently incarcerated and they are saying, we can help get your loved one released. They help arrange the release by paying fees, by paying bonds, whatever. And obviously this is fraudulent, but they make it seem time sensitive. And they'll commonly request payments through gift cards, prepaid debit cards, wire transfer, or other non-traceable methods. They may also attempt to get sensitive financial information such as bank account or credit card details. It's apparently very rampant. So I started looking around, and it's a common enough scam that actually a county in Nebraska that's in Omaha, Nebraska, they stopped posting their jail role for who's in their county jails for any reason. Because people were targeting these specific individuals and their families. Because when you think about it, a lot of people, there are a lot of potholes in the criminal justice system. people. These are typically low income where you're getting jammed up for, you know, petty theft or smaller crimes because you don't have enough money, things like that. You don't have a good understanding of the legal system. And there are tons of fees just randomly about that you wouldn't know of and you wouldn't know that it's fraudulent or not. And it's a particularly gross, in my opinion, targeting tactic. But it makes sense because you have uninformed people doing something that's incredibly stressful, you have no idea, especially if it's your first time, how this stuff works, what to expect. That fear is already pre-included. They have to do nothing to bring it to the situation. And even if you have someone who's actually downright guilty, these scammers aren't targeting that person. They're targeting their family, right? Which, yeah, reprehensible. But these guys have no conscience. And then there's also, So I can understand from a family member's perspective, you don't feel like you have somebody to call and ask questions. It's not like the system is really welcoming to try and figuring out the system for people. They're not exactly going to be a sympathetic ear. Right. You'll be like, well, you know, this happened. I'm confused. Nobody's answering the phone being like, oh, let me help you out. Right. It's just there's already it's the perfect environment for taking advantage of people. Right. Yeah. Good news. Yeah. Yeah. It's really it's tragic. So, and court cases are public records. So out of curiosity, I started poking around the Maryland court public records. And if you have somebody's last name, that's all you need for information on everything, just the last name. And you can pull up court records for everybody with that last name. You can have their first name. You can talk, you can look for certain types of cases too, or courts of certain levels. So if you know something about a certain level, it's a free for all of information. Yeah, I'm just imagining that person whose loved one has been put in jail for whatever reason. And so, of course, they're despondent about that. And someone calls up and says, I can make this all better. We'll work, you know, I have your back. I am on your side. Or, you know, he's due to be released because they saw the court case saying like due to be released. And it's like, we're here to set up the ankle monitoring system upon his release. There are so many ways to get them if they don't know what the circumstances are. And like, oh, he can't be released until this is set up. Right. Right. Right. And there's so much fear that naturally comes from ignorance. If you don't know how any of this works and someone says, well, they're not going to let your loved one out unless you get this lined up ahead of time. What are you going to do? The scammer has to do next to nothing to make all the circumstances that are required to make somebody give money away. It already comes pre-installed into the situation. Right. Yeah. The emotional duress is already there. I wonder how you balance this because I do understand the sort of public good of having a database of people who've been incarcerated. Like, that makes a certain sense to me. But at the same time, if you've got people taking advantage of that for scams, how do you find the happy medium between those two things? The story from Nebraska they did say that after they took their public jail roll off the record after they stopped posting mugshots and who was currently incarcerated in their jail system scams dropped off drastically because it stopped being easy pickings So they did report that that was a very impactful solution Interesting And were they holding people in jail that had not been convicted yet or were they just, like, accused of a crime? Yeah, jail is for just being accused a lot of the time. It's not present, it's pre-conviction. So you can get picked up for a bunch of stuff. Yeah, yeah. You can get picked up for anything. You know, in France, they really take the presumption of innocence seriously. And I wish we did that here in this country more. like you're not allowed the media is not allowed to do a perp walk in France you can't just can't do it you can't say look at all these people we arrested and the reason you can't do that is because you're essentially dragging them through the mud when they haven't been convicted of any crimes and that happens here in the United States so much yeah it's yeah I don't I don't like that part of our justice system. That's an interesting point. I mean, should it be that your name is not public until there is actually a conviction? It's a hard balance. Yeah, that's another hard balance, because what if there are people that want to come and testify? And court records are public records here in the U.S. Yeah. And I get the court record thing of it, but definitely the publicity angle could be tamped down. So not having the jail role, not having part walks, not releasing identities to like the news or something. Like just not doing the publicity side. The public record side, you have to like really go out of your way forward to a degree. You have to know it's a little bit less tabloidy. Right. Whereas like doing the publicity angle, that is very inflammatory and is a lot more ripe for problems. I wonder too if like they could have it be a verification system, but not publishing a list. In other words, if I call the jail and say, hey, is Machine Gun Kerrigan in there today? And they'd say, yes, he is. Right. But they wouldn't just publish a list for people to poke through. Right. You know, kind of like if you call a hotel, you can't just say, connect me to room 513. They'd be like, well, who's in room 513? Right. And if you don't know that, they're not going to connect you. Huh. So it's just zeroing in on the most vulnerable people in the most vulnerable circumstances. And they have no advocates, at least with bank scams. Banks want to help you out. The jail is going to be like, stop bothering me. Right, right, right. Like they don't have a single friendly ear in the process unless they can afford a lawyer. And if they do, then this probably wouldn't be impacting them as much. They have the ability to afford counsel. Interesting. All right. Well, we will have a link to that story in the show notes. I tell you what, let's take a quick break here to hear from our show sponsor. We will be right back after this message. Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker Allow Listing, you stop unknown executables cold. With Ring Fencing, you control how trusted applications behave. And with ThreatLocker DAC, Defense Against Configurations, you get real assurance that your environment is free of misconfigurations. and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero-trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero-trust attainable even for small security teams. See why thousands of organizations choose ThreatLocker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo at threatlocker.com slash N2K today. And we are back. My story this week, I bring to you both and to our audience with a little bit of trepidation. Okay. I'm intrigued now. It is. So this is a report that was just published in the past couple days. This is Amazon's Trustworthy Shopping Experience Report. Jeez. From Amazon? Yes. So is this Amazon reporting on Amazon? Correct. Oh, okay. So we can trust this without any hesitation. Wait, are we certain that it's from Amazon? Because it's trustworthyshopping.aboutamazon.com. Good question, Michelle. It's not. We're not sure. Amazon.com. They could be just using Amazon's logo, although I don't know what would be in someone else's interest to make Amazon look good. Joe, click on the link. Yeah, hold on. I'm doing a quick who is lookup. Go ahead. All right. So this is a full report about what Amazon is doing, allegedly, on our behalf to make things better on Amazon. Before I dig in here, why don't we just go around the room here and ask, I'll start with you, Michelle. Have you, to what degree do you feel like your interactions with Amazon are satisfactory and legit and above board? Pretty well. My stuff usually doesn't come back as fraudulent. I also don't buy weird stuff. I'm not an impulse buyer. So I think I'm less susceptible to the, oh, that's cool or that's cuter. I would love that. I have taken steps to not be an impulse shopper on the whole. Joe? First, let me tell you, I think this is an Amazon domain. It is the registrant contact is hostmaster at Amazon Legal Department, Amazon Technologies Incorporated. Okay. Trust but verify, people. Second off, I have not had any problem with my shopping at Amazon. Yeah. So, you know, I order something, it comes, the agreed upon price is there. when I have a problem with the, like the last thing I had a problem with was a crappy vacuum cleaner I got for getting all the crumbs out of my toaster drawer. Because my wife is, does not let me keep a toaster on the counter. Nor- We're going to whistle past that. Right. Nor does she like it when it's still plugged in. Like she thinks that's a fire hazard and she will argue with me. And I'm like, no. And this is a source of consternation in the Kerrigan household, obviously. But moving the toaster constantly leaves some crumbs in the drawer. So I bought a vacuum cleaner. The vacuum cleaner did not work. I called Amazon and said, hey, this thing's a piece of crap. And they were like, I actually didn't even call them. I just used the app. You called? I used the app. I said, this thing just is not holding a charge and doesn't work. And they said, here's your $10 back. And I used that $10 to buy another one, which does work and works great. And sucks all the crumbs out of the toaster drawer. That is a specialized item. Yeah. A toaster vacuum. Well, it's just a little precision vacuum with a little brush on the front of it. So it just fits the need I have. But I did have early on in my Amazon usage an issue where they charged a credit card twice because I canceled an order. And they didn't release the first charge. Okay. And, you know, the credit card didn't have – I was buying something – I was buying a laptop. The credit card had a small limit. so because they didn't release the uh the first hold i couldn't buy the laptop because it was you know and i was very frustrated and i actually had amazon on the phone with i think capital one at the time and amazon's going we we haven't we have not charged your card twice and the person on capital one says amazon has charged your card twice and i've got a conference call going on I'm like, Amazon, did you hear what Capital One said? Yeah, yeah. Who are you going to trust? Right. Oh, man. Yeah, I guess my overall experience has been quite good as well. And I don't know that I've gotten any, what do you call it? What's the fake stuff? What do you call it? Rushing scams? No, no. When something's fake, when someone... Oh, counterfeit. Counterfeit. Yeah, that's the word I'm looking for. I don't think I've gotten any counterfeit items that I can think of. Overall, they're pretty efficient. I guess the things that annoy me most about Amazon are when I'm going to order something and they say, order now and it'll be here by tomorrow. And I'm like, oh, that's great. And I order now and it says, good news, it'll be here next week. And I go, wait, what just happened? That's irritating. But overall, I do get the thing I want and they make it relatively easy to return things. So I'm pretty pleased. I guess I'm wondering, like, Michelle, that sigh that you had at the outset when I announced what this story was about. I wonder how much are we sort of mixing in our minds Amazon and other places like Facebook Marketplace? When it comes to trustworthy shopping and Amazon, I think it's because the sigh was more of Amazon's practices of having the sponsored content first. And, you know, what they decide is going to be the thing that you should buy is I remember reading a story. It was like you have to go down like to halfway through the second page before you get what would be based on your search the best product because it's just all sponsored. And their incentive structure to the sellers is so like money based. And so for the seller, it's you're already getting screwed. And then the buyer, they're kind of already pre-selecting a lot of stuff to the point where if Amazon Basics comes out with something that's a copy of your product, you just shouldn't even bother selling it anymore because it will not get to it. So trustworthy shopping is like you got to be digging around, I think, for some weird stuff or some weird like Facebook advertisement for a weird Amazon product. But if you go straight through the Amazon portal or website portal, wow, straight through the Amazon website and landing page, I think it's a little bit harder to find and stumble across some fraudulent stuff. Yeah. I'll go through some of the things that they've outlined in this report here. They say that their core strategy and approach for trustworthy shopping is built on four pillars, proactive controls, advanced technology, enforcement against bad actors, and consumer education. They say that all new sellers have to complete identity verification before selling, and that includes government IDs, business credentials, bank statements, and address checks. Okay. Yep. Oh, fine. They have authenticity protections. They say they use direct product validation with accredited safety labs. Okay. I'm skeptical of that. I just don't believe this. Right. None of this from everything I've seen seems legitimate. They say they use, oh, wait for it, AI to scan billions of listing changes daily for intellectual property violations. So I guess that would be the counterfeit things. Yes. They say more than 99.9% of suspected infringing listings were blocked before brands reported them. Hmm. Interesting. Okay. And they've verified 2.7 billion product units as genuine. Okay. All right. None of us have any enthusiasm. Yeah, I mean, this doesn't impact me at all. No, it's more, I'm wondering where the number is. We've verified more than 2.7 billion product units. Are 2.6 of them Amazon? Like their version of it? I have no frame of reference for what these numbers mean. And do they list 10 trillion items on Amazon? Because we can't fathom the volume of what Amazon does. It's nobody has done it before to this scale. So like these numbers just mean nothing to me. Yeah. They say they use automation and AI for fraud detection. They analyze seller behavior, listing content, supply chain signals, and network relationships. And they look for coordinated abuse networks. They said they analyze tens of thousands of suspicious URLs every week. Their phishing site takedowns increased by more than 10% in 2025. A meaningless statistic. Well, I mean, that's, yeah, that is meaningless, but it's good that they're actively going after the phishing sites and taking the domains from the scammers. Yeah. Because that's impacting customers. They said they actively enforce scam calls impersonating Amazon. So that's good. How do they do that? I'd like to know. That's part of what I'm wondering. I would love to see some type of presentation about how they do this, So that way Facebook can't come and say, we have no way of monitoring for this. Right. You know, I'm curious to see the applicability of this. Amazon's doing it because it's costing them money. Exactly. Right. They say their counterfeit crimes unit has pursued more than 32,000 bad actors since 2020. Over 15 million counterfeit products were seized and disposed of in 2025. Legal actions shut down more than 100 scam and fake review websites in 2025. Okay. Oh, 100. Fake, well, I mean, fake reviews on Amazon? I'm shocked, shocked. Right. You hear there are fake reviews on Amazon. And then they say they working with Chinese authorities and that led to detention of 151 fake seller registration brokers so people who are getting you on Amazon in a fraudulent way Huh And they did 70 raids on counterfeit operations I wonder what's going to happen to those people in China. Yeah. Yeah, this just feels like them blowing smoke a little bit about it. Like, yeah, we are doing stuff, but there's not a lot that's like meaningful. Yeah. They talk about their partnerships with law enforcement, which makes sense. But at the same time, if you get scammed by something that happens on Amazon, you're going to call the FBI. Right. You know, what's going to happen? I guess, I mean, on the other hand, Amazon could make it right. You get something scammy. I imagine Amazon's going to send you the real thing. Yeah, that's more like where I was thinking is like because they already, they will absorb any problems. They have enough market share that—and you see it with the taking returns after 30 days, even if the product is not in the original packaging. Even if it's—you know, they can't resell it as they are willing to absorb a ton of the financial strain of returns or scams or whatever to keep you shopping on their platform. Yeah. And, of course, the sellers don't want bad reviews, so they'll do anything they can to try to settle it one-on-one. And I had a thing I think I shared. I'm pretty sure I shared it with you, Joe, that I tried to buy a battery for one of my ham radios. Yes. And so I was shopping around, and I saw this battery, and it said 4,000 milliamp hour battery. I said, oh, that's good. That's twice what the normal one has. Right. I will buy that. And there was a picture of the battery, and the label on the battery said 4,000 milliamp hours. I said, great. So I ordered it and arrived and it was 2,000. Just like the one that came with the radio. Just like the one that came with the radio. Right. So I wrote to the seller and said, hey, this is what your thing says and this is what I got. And they said, oh, sorry, we'll send you the real one. Keep the one we sent you. We'll send you the one you want. Right. I said, terrific. A couple days later, new one shows up. Same thing. 2,000. Well, Dave, now you have 4,000 milliamp hours. I do. I do. But I'm faced with the inconvenience of having to swap out batteries like an animal. Right. You know, in the middle. Like some kind of caveman radio operator. Right, exactly. I don't want to have to do that. I want to be able to operate uninterrupted for much longer than otherwise. So anyway, Amazon did nothing about that. And I gave up. I was like, okay, I'm not going to get what I want. Right. This isn't worth fighting about. I got two batteries that are, I guess, that I didn't have before. Have the same power volume as the one you thought you were getting. Yeah. But you're right. The inconvenience is there. I'd be curious to see any information about how Amazon handles bigger purchases. Like, I will say, I do not buy anything big on Amazon. I do not buy major electronics. I don't buy furniture. I don't buy high-ticket anything on Amazon. I'm going to go in person to do those things. So I'm curious to see exactly how much the smooth, wrinkle-free process of doing returns and dealing with scams would be for a larger ticket item if you take a bigger gamble on their platform. Yeah. Yeah. I imagine there's all kinds of trouble with things like laptops. I mean, I've definitely ordered things from Amazon that have arrived, and I can tell they've been returned. Right? Really? Yeah. Like, this is not how this was originally packaged. Right. Just tell. And so then you have to decide, is this worth the trouble of sending it back, packing it up, or is it new enough that I'm just going to be okay with it? And most of the time, that's what people do and that's what they count on. And Joe, that's how they get you. That's how they get you. That's right. Amazon says, looking toward the future, they're emphasizing predictive detection, including monitoring social media signals to anticipate counterfeit activity before listings appear. Interesting. As if by magic. And they say that their trust protections are continuously evolving alongside retail threats. I just think it's interesting that all three of us are like, yeah, whatever. We're just resigned. Do my batteries show up in a day? I'm happy. Yeah. I think it's more because we know what metrics kind of matter. We know what would pack a punch. And again, these numbers just have no context. is information is just a list of stuff. Right. That I have no idea if it's impressive or difficult or if this is a large percentage of what you're looking at versus a small percentage. I have no idea. Yeah. And the vast majority of the interactions we all have with Amazon are fine. Yeah. They're not noteworthy at all. Yeah. So. Yeah, I'll agree with that. I mean, we talked last week about the Airbnb and Vrbo scam with those two guys who are going to wind up doing prison time. Uh, and Airbnb's, uh, corporate statement was like, it's rare on our platform and we're working to make it more rare. Right. They use the word rarer, which I don't like because it's kind of hard to say. Um, but. Like the rural juror. Right, rural juror. That is a great show, by the way. 30 Rock. It's a 30 Rock reference. If you go back and watch 30 Rock, it's funny. but you know these things these things generally Amazon has done a really good job with me I don't have any complaints except for that one way back in the early 2000s other than that it's been great yeah you know and when you hear stories it's like dumb stuff of like I got this like this ended up being AI generated and then you see the post and it's like yeah you should have noticed that right I think that's a user error did you return it Yeah, I returned it. And they give your money back? Yeah. Okay. Okay. Every now and then, like a lawnmower will show up that you didn't order. I wish. What is this? I wish that would happen. I wish a lawnmower would show up at my house that I didn't order. I'm going to have all the lawnmowers I need, but I'd like to have another one. You want a spare. You need a backup lawnmower. You never know. You pick the thing that would just make Joe's day. Yeah. Yeah. Every now and then, something like we do a lot of, I think we have, I don't know what Amazon calls it. We have a regular standing order where things come on a schedule. Yeah, a subscription. Yes, there you go. I have a couple of those as well. Yeah, and mostly they work out, but every now and then something shows up. Like, we didn't order this. Okay, whatever. They didn't charge us for it, so it all works out. Right. All right, well, again, we will have a link to that report in our show notes. Joe, Michelle, it is time to move on to our catch of the day. Our catch of the day comes from the r slash scambait subreddit, Dave. And it's just titled Paul McCartney Part 1. So would that be Beatles or something? Yeah, I'm looking at his picture. That is Paul McCartney. Right. Yeah. I mean, well, I mean, it's not Paul McCartney Part 2. It should be Wings, right? Oh, I see what you're getting at. That was a bad joke. I apologize, everybody. I was trying to go. Uh-huh. All right. Didn't work. So, wouldn't it be the Silver Beetles would be Paul McCartney Part 1? Ha ha! I out-Beatled you, Joe. I don't know what that is. Is that what they were called before they were just called the Beatles? It is, yes. The Silver Beetles. Silver Beetles. I did not know that. Yeah. That's new information for me. Dun-dun-dun-dun. Not a big Beatles fan. My dad was a huge one, so I'm surprised I don't know that. Yeah. All right. I will play the part in blue. Michelle, you want to be the other person here? Okay. All right. It goes like this. Hello. How are you doing today? Hope you're doing pretty good and hope your family's good too I'm Paul McCartney, a very big and famous musician I respect your privacy, but due to my management They keep making it difficult for me to reach out to my tops fans all over the world for my safety But I'm here to make new friends that doesn't want me for my fame or money It'll be grateful if I know you more because I've been locked out of my verified account for so long Thank you and God bless you No worries, I guess Oh, that's nice of you. Where are you from? Kansas City. That's a nice place. I've been there many times. Cool. You really seem so nice to talk to as a friend. Would love to talk more, so my management will not find out about this. Okay, do you mind if we talk on my private Zangy page? That's weird, but whatever, I guess. That's how it is when you're big and famous. I like how you talk. Yeah, that's that brick wall aesthetic. Right. Here's my private Zangie number. Send me a message right away and let me know how to talk to you. Dave, is that really how it is when you're big and famous? Pretty much, yeah. Okay. You realize you're not really famous anymore, right? Maybe like 60 years ago, but not really now. Oh, I am? It's just that I'm getting old, but I'm still strong and cool to talk to. My app keeps freezing when I try to add you. Send me your number. Let me try adding you then. Number. All right. So here's a second interaction here. Hello, it's me, Paul. Got it. Okay, good. Nice talking to you here. We can talk now. My management won't lock me out from this, okay? Thanks for your understanding, too. You realize that your management works for you, right? Not the other way around. You can fire them at any moment. Since you're so old, you might be confused. Oh, yes, I can do that. I feel like I'm slipping into Canadian. A little bit. Right. You also sound more like George Harrison. Yeah, I know. Oh, yes, I can do that. But they've been working with me for decades. Don't worry, we're fine, okay? You sound scared of them. You know, I'm very big and famous. Don't get too worried about that. I will always get in touch with you here, okay? Again, you're not famous at all. You're like 90 years old by now. Your time was 60 years ago. By the time I was born, nobody really knew who you were. Oh, I am not. Just don't want questions from them because they keep doing that all the time. Oh, well, as long as my name is on the internet, I am. Ah, are they concerned that your mental health has been declining? You should probably do what they say in that case. If they tell you to do something, you should listen to them since your mind isn't all there anymore. Oh, yes, they are. But right now I'm doing my thing my own way. That's pretty nice. You're young. I like your age. We can stop there. Yeah. Yeah. Pretty good. Michelle, you do a good read, especially of the potential scam victim that really doesn't want to put up with this crap. Yes, you have a lovely deadpan. Right. Yeah, I love being mean to people. Oh, good to know. I love being mean to people who are bothering me. I see. Joe, what's that like? It's pretty awesome. It happened when we were in the same office. It didn't happen. Every now and then. Michelle's always been very nice. You just get cut down to your knees. Never saw it coming. Well, Michelle is very frank, which I appreciate, actually. So. And I'm actually very nice at work. Like, you don't even know. Right. Okay. I'm incredibly well-behaved at work. Yeah. I try to do that too. Mm-hmm. You know, different work joke. Every now and then the real you comes out. Right. Yeah. I took my kids to take your kids to work day when they were little. And my daughter came back and said, Dad's like a completely different person at work. I was like, yes. Yes, I am. Because if I act the way I act at home, they'll fire me. And then you'll have to live in a refrigerator box. And you don't want to live in a refrigerator box, do you? That's why I have to be someone completely different at work. Yeah. Well, I was cracking a joke with our boss. And I was like, yeah, I got to be well-behaved because we're doing this thing with one of our sponsors. And he's like, have I ever seen you like fully well-behaved? And I was like, no, actually. You get most of it, but never fully. It's about 90%. Yeah. Yeah. All right. So I'm getting the A. Well, that is our catch of the day. Of course, we'd love to hear from you. If there's something you'd like us to consider for the show, you can email us. It's hackinghumans at n2k.com. Thank you. Liz Stokes, our executive producer, is Jennifer Ivan. We're mixed by Elliot Peltzman and Trey Hester. Peter Kilpie is our publisher. I'm Dave Bittner. I'm Joe Kerrigan. And I'm Michelle Kellerman. Thanks for listening.