SLAM, scam, thank you ma’am.

You're listening to the Cyber Wire Network, powered by N2K. Hello, everyone, and welcome to the Hacking Humans podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner, and joining me is Joe Kerrigan. Hey, Joe. Hi, Dave. Maria is on vacation this week. So joining us is our friend of the show, Michelle Kellerman. Michelle, welcome. Gentlemen. That's a little... Wow. Okay. I don't think I'm... Giving us a little more credit than we deserve, perhaps. Joe's got a tie on. It felt right. That's true. Joe does have a tie on today. I don't know if he's got up here in court or something. Yeah, I got a court date later. We've got some good stories to share this week. But first, let's get into some follow-up. And I guess before we get into the real relevant stuff, Joe, how are the chickapoos doing? Chickens, the chickens are doing very well. We moved the coop and the run last weekend. Okay. Which was no small feat because this thing is heavy. But my brother gave me a couple of dollies so we could just put the two by fours on the dollies and roll it across the lawn. Okay. That worked really well. But now the chickens are out in the sun. So I've got to find a way to make the roof opaque. I've already put the roof on, mind you. And the first thing I did was I said— What is the roof made of that it's not opaque? It's clear plastic. Okay. I feel like you should have seen that one coming. I should have. You're probably right. But so my first solution is, well, I'll just get some black spray paint that sticks to plastic and start spray painting it. Sure. Start spray painting it. There I am. I can talk. I'm a podcaster. And my wife called on the way over here to the podcast, and she's like, this is not acceptable. The sun is going right through the piece you've painted. we're going to have to get new roofing material. And I'm like, that is no small cost nor task. So I'll keep you updated on how this pans out. I wonder if you could get some of, like what are those adhesive like shelf liners you put in on something opaque but sticky? Maybe you could put on it there. Maybe that would work. Not terribly expensive. That's a good idea, Dave. I'm certain there is some Redneck Engineering. There's actually a subreddit called rredneckengineering. You may find your solution there. I'm going to check that out right now. I'm so serious. Michelle, you have something you wanted to highlight this week. Yes. Mentioned it a couple weeks ago when I was guest hosting, and we are still doing a Blood Cancer United fundraiser. So I am about one-third of the way through a 10-week campaign supporting Blood Cancer United, previously the Leukemia and Lymphoma Society. and my best friend, her daughter had infant leukemia and she is in remission and doing great, but they are all very involved in the cancer community and this is just a way I want to support her for the Visionary of the Year for Boston, for Blood Cancer United. All right, very nice. We will have a link to that in the show notes, so please do check that out. I actually have a little bit of relevant follow-up this week. How dare I? But I was at a play earlier this week with some friends, and before the play was getting started, we were sitting in our seats, and I was bringing my friend up to date on work things, and he was asking about this show. And I was telling him about some of the different scams we cover, and I mentioned romance scams. and at intermission, I was out in the lobby and a gentleman came up to me and he said, I heard, I'm sorry, I couldn't help hear you speaking to your friend about scams and he said, my mother got scammed. He said, in fact, she's in the middle of one right now. This is the second one. She's already lost about $20,000. Yikes. And he said, there doesn't seem to be anything we can do to convince her that it's not real. He said he even had a friend of the family who is in law enforcement come and speak to her. And she just refuses to believe that it's a scam. It's tragic. It is. Yeah. So I guess the lesson here is try to spread the word and get ahead of these things. So we talk about inoculation. Right. So if you can warn people about these things before they happen, it's a lot easier to convince someone not to be scammed than to get them out of the scam while they're in the middle of it and while they're believing it. Yeah, and the inoculation part is no small feature of this. If you can make them aware of what happens and what the pattern is, you know, the love bombing, then the sudden, but you've never met this person, then there's some sudden crisis and they need money. that should at least map to something you've already heard of. Right. Right. And if you've done that groundwork beforehand, you're in a lot better of a position, I think. I don't know if there's been any research on whether or not that's helpful. I think the big part of it is going to be doing it before they're in that position, because if you're doing it while they're in it, then it feels like you're telling the person that they are, why would they be romantically inclined in any way? Right. And then you're defending that, not the, it's not about the behavior. It's about, you know, making them feel like it's not you. It has nothing to do with you being undesirable or wherever we're going to find our insecurities. This is just the fact pattern prior. Doing it in the moment is infinitely harder. Yeah. And you don't have any sunk cost fallacy going on as well. Every attacker counts on one thing, environments that trust too much. ThreatLocker closes that gap with default deny at execution. Unknown software? Blocked. Trusted apps? Contained with ring fencing. Configurations? Verified with ThreatLocker DAC so you stay secure and compliant. ThreatLocker delivers the visibility and control CISOs need without adding operational pain, making zero trust real for teams of any size. Stop ransomware at its earliest point. Book a demo at threatlocker.com slash n2k. All right. Well, that is our follow-up for this week. Let's get to our stories here. I'm going to start things off. And this is actually from a group called Pycus Security, who's new to me, but they shared some information here, some advice. They call it the SLAM method. SLAM. This is the SLAM method for phishing awareness. Oh, SLAM method for phishing awareness. And this is not a scam. No, no, this is a SLAM. It's a SLAM to prevent scam. I see that it's a... Dr. Seuss is knocking on the door. That's right. That's right. Do I like this SLAM that scams? No, I do not like this SLAM that scams. Especially not when from semi... So the SLAM method stands for... It's an acronym. It is indeed. It stands for Sender Links Attachments and Message. So Sender Verification. They talk about how you can verify it and why it's crucial. They say, look at the full email address, not just the display name. So in your email account, very often... Like if I get an email from you, Joe, it says Joe Kerrigan. And it doesn't say supercoolguyatgmail.com. Yes. Supercoolguy1atgmail.com. Right, right. Because supercoolguy was already taken. Right. They say look for lookalike and homoglyph domains. So that means using characters that look like English characters, but are actually characters from other languages, like Cyrillic or Greek or Latin characters, those sorts of things. Yeah. they say, look at domain age and reputation. Obviously, this is probably not something you're going to do routinely, checking your email. But I'll tell you, there are corporate things that will, I'll say that my employer has something that will not let you go to a recently registered webpage. And I know that following up on our things, Joe hates me purchasing the domain back because I wanted to go to it and see what it looked like. And it was like, oh, no, this has been registered in the last two weeks. And I was like, oh, okay. Yeah, I couldn't follow any Artemis stuff while I was on my work computer because a lot of the stuff popped up for the Artemis mission. So it was that newly registered domain despite being either government or something. So that was, I had to look at it on my phone, which I hate on principle. Yeah. It's not a little computer activity. It's a big computer activity. You know, we're going off the rails here, but we do that every show. We do best. Yeah, I hate looking at websites on my phone. It is the worst. Yeah. I agree. It's a big computer activity. Yeah. Yeah, yeah. But, you know, more and more, that's going to be less and less, right? Yep. Because as the kids grow more comfortable with their mobile devices and wonder why anybody would ever use a desktop computer. I got mocked in one of my classes because I had a desktop computer. Really? And a laptop. Yeah. So they still make those? I'm like, what are you talking about? This is the best thing you can do. Oh, my. All right. So the L in SLAM is the links, links within the email. And they outline here how to reveal the real URL behind a click. So as we've talked about here many times, if you have a link in an email and it says it's going to take you to things Joe hates, there might, you can click on that, but you don't know that behind that link, you don't know what the actual URL is. So you can examine that link. You can right-click the link, examine what the URL actually is. Or in a lot of browsers, I guess you can hover over it and it'll tell you in, there'll be a display somewhere in your interface there that'll show you what the actual destination is. Right. Again, phone problem. This is harder to do on a phone. Yeah, absolutely. I'm told you can do it, but I can never remember how. Yeah, I don't know how. because there's really no hover over on the phone right yeah i think it's like press and hold but probably but who's gonna risk that yeah uh we're old uh the a in slam is attachments how to identify dangerous files before you open them uh the legitimacy of the attachment is important is this something that you'd normally receive uh they point out that threat actors frequently disguise material as routine business documents like invoices or resumes or something from HR, meeting notes, those kinds of things. And also they point out the urgency. You must open this now. Again, something comes from HR or your boss. I need you to take care of this right now or payment overdue. Your action is required. Yeah. I mean, that's a telltale sign of any of these scams is the artificial time horizon, the time constraint. So yeah, look out for that. I will take Maria's place as your annual reminder. If you get one of those for your taxes, now that tax season is done and you say you actually missed some, you owe more, the IRS will mail you something about it. They will not text you about it. They will not email you about it. They will send you an official document and you'll know for real as best as you can that it is a IRS document. Right. Well, on the opposite kind of, of the urgency is, uh, the incentive where they say, here's a reward or benefit. If you do this, we're going to give you a gift card or, uh, you've won a contest or something like that. Or from maybe HR it say congratulations on your raise You know here here your here click here to find out what your new salary is or something like that And then the M in SLAM is for messages and they talk about how to spot suspicious or inconsistent content. This is just basically looking at the body of the message itself, the tone or the phrasing, spelling or grammatical errors, which, of course, are becoming fewer and farther between, thanks to our AI overlords. I, for one, welcome our new AI. You know, I was interviewing a security researcher yesterday who very, very deep into AI stuff. And he mentioned that he's always very polite to the AI agents. He's like, just in case. He's like, you know, I realize it's probably being silly and it can't hurt. And when they do come to take over, maybe they'll kill me last. Right. Nah, take me out first. I'm not. I'm not navigating with that. Right. Right. Where will you be if a nuke goes off? At the center. Yeah. I'm not doing that. You want to be vaporized. I get irritated when I have to park too far from the door. I'm not built for these things. I know who I am. I am looking forward to post-nuclear Holocaust survival. See, how long will I last? It's kind of like a game. I'm going to gamify it. I like my water filtered and ice cold. I'm not doing that. Well, I can find a way to filter it. Never mind. Requests that feel out of context. Inconsistencies between the message and the role. Like they point out HR sending financial documents or IT sending payment reminders. Like if the ask doesn't match the person who's asking it. And then a manipulative tone, which touches on the urgency thing. If they're using any kind of pressure or fear, unexpected benefits, anything that feels off, pause. Because nothing that's critical is going to be sent in an email that could risk getting filtered out. They are not going to send you stuff that you could potentially miss if it's time critical. They will pick up the phone and call you. Right, right. Even better. They'll come and knock on your door. Yeah, they will come and knock on your door. Yeah. So I kind of like this. We'll have a link to it in the show notes. But I think SLAM is pretty easy to remember. And again, it's sender links, attachments, messages. So I don't know that everybody's going to memorize that. But I think this is a decent one to send around to your colleagues, to your friends, that sort of thing, to help guide them through and remind them what some of the things are to look for. So thanks to the friends at Pykus Security for publishing this, and I kind of like it. All right, Michelle, you're up. What do you got for us this week? So I'm actually going to do something a little bit different this week. I'm not doing one particular story. Mine is an amalgamation of stories that I think is the early warning signs to a turn of the tide when it comes to scamming. So to start this off, I'm going to set the stage to the, I believe, early 2010s. Do you guys remember when it was pretty standard for if you were using a standard credit card, your MagStripe would get stolen. There were skimmers everywhere and such. Yes, sure. Yeah. And then those EMV chips came out, the stuff that's on your card that you now insert instead of swiping. Right. And when those came out and then all of a sudden they exploded and they were everywhere and there was massive adoption. That adoption of those EMV chips were not because they were more secure and everybody just wanted to be more secure. Right. Nobody does that out of the goodness of their heart. Yeah, we talked about this a lot. Yeah, it was, and it wasn't even dictated by the banks either. The credit card companies, MasterCard, Visa, Discover, American Express, they changed their liability structure. If you do not adopt this technology, whoever is least compliant with the EMV chip will be responsible for paying out frauds from MagStripe steals. So instead of the credit cards, American Express or FDIC insured, you know, they have insurance for credit card purchases that are fraudulent so that the end user doesn't end up having to pay it. They decided they're not going to foot the bill if a business in their store doesn't have these EMV chips. If you're not going to be compliant with this more secure technology, you have to foot the bill. We're not going to do that anymore. That's how those chips ended up becoming so widespread adoption. Right. That's interesting. They also carved out an exception for gas stations because they gave them more time because there was so much infrastructure that did not have the EMV chip readers in it. And changing stuff out from pumps is so much more intensive than just like a store or something. Right. And a lot of times the individual store doesn't actually own the pumps. It's owned by the fuel company, like Shell or Sunoco or something. So that was the mechanism for enforcement back for EMV chips back in the day. So now I want to bring this back to scamming with this reading these different stories that I'm going to go through. Kind of got my spidey senses tingling. So as we all know, the whole part of the reason that this podcast exists is because Facebook makes money off of fraudulent advertising. That's where a ton of these frauds happen. And an investigation from Reuters at the end of 2025 talked about in China specifically, China does not allow their citizens to use Facebook just to use, but they do allow Chinese companies to advertise. on Facebook. And out of an $18 billion annual sales for advertisement for Meta from China alone, more than a tenth of that accounted for their global revenue. And about 20% of that money, about $3 billion, was coming from ads for scams, illegal gambling, and other banned content. And it was known to Meta at the time. So we know that Facebook is aware that their ads are fraudulent and they just let them go anyway because they make a ton of money off of them. Yeah, right. Which is a huge part of the problem. We're sorry, but there's a profit to be had. Exactly. So fast forward to now this week, I saw two different articles that got me curious. One was titled, Banks Cannot Save the UK Financial System from Fraud Alone. Talking about the controls that the banking system in the UK has put in place from a technical control only does so much. And so banks in the U.K. are starting to seek for accountability to extend upstream to telecom and social media companies too. That has gotten so rampant that the U.K. banks are saying, we are not going to foot the bill for you guys either doing nothing or actually encouraging it because you are making money off of it. It is not going to be squarely our responsibility anymore. Fair enough. It's not solely their fault. So they should not be responsible for footing the entire bill of this. And then fast forward to this week with all the Mythos stuff coming out, all of the disclosures, seeing all of the potential issues that could come or the goodness of identifying these vulnerabilities and being able to patch them. Well, let's pause there, Michelle, just for folks who might not be up on that. Can you describe to us what exactly Mythos is and why it matters? Yeah. So Mythos is a new AI model made by Anthropic. Anthropic is one of the leaders in AI development, and they started testing this particular model to identify vulnerabilities in code, in software. That's a good use for AI in general. Humans can't possibly, with the volume of code that is out there, humans cannot possibly identify all the vulnerabilities. This particular model, Mythos, is excellent at it to the point where actually the Wolf SSL vulnerability that got a 10 out of 10 for the CVE, that came from an anthropic researcher working on this Mythos AI model. So we were already seeing how well it can identify all of these vulnerabilities. And I thought that it was interesting that when that came out, the first official administration action was Secretary Besant, the Treasury Secretary, calling a meeting with all the bank CEOs to talk about what are they going to do about this? How are they going to secure banks? How are they going to secure banking infrastructure? because at the end of the day, the banks are the ones who put the bill for a lot of this. People have to, unfortunately, stomach some losses, but also banks do as well. So I thought that it was interesting that they didn't call DHS, they didn't call cybersecurity firms, they called banks. And it got me thinking of, yeah, when banks want something done, it gets done. that has to by the nature of how the world works. So my solution is to the banks, you're going to start using this mythosanthropic model or anthropic mythos model. Start looking at your software. Use this model. Go find the vulnerabilities and fix them. That's the first thing that should be on every single CEO's and CISO's mind. But it probably isn't. Well, I think the problem here is that that Mythos is able to find things so quickly and find so many things that they're already talking about there being a huge backlog of things that it's found. We're going to, for the next year, probably, we're going to be seeing all of the technical debt from, we'll just put it out in beta and we'll fix it later, that we have gotten way too comfortable dealing with. Yeah. And so I think that we're going to see so much. But the thing that I was realizing with all these seemingly disparate things that are all happening at the same time, I think we might be entering a time where banks are going to start pushing liability onto all of the infrastructure that is either enabling or allowing scams to go unchecked. Because it is now really hurting, bottom line. It's hurting when we were talking a couple weeks ago. bank mortgage fraud accounts for 40% of losses on mortgages. It's becoming, you can't ignore it anymore. And I think that banks are going to start forcing the issue as opposed to just, oh, it sucks for the little guy. Banks now have a problem. And when they want something fixed, it gets fixed because they're footing a lot of the bill. When you say pushing it to other organizations, who would they push it to? Telecoms, social media, the same way that the credit card companies put liability, they change their liability structure to whoever is least compliant with the EMV chips. That's who pays when there is fraud. Right. So I guess what we're talking about here is faulty software. If you're a third party provider to a bank, and I suppose this is maybe the shape of things to come is that every contract, on the one hand, the people who are buying software are going to try to have it in the contract where the person providing the software will be liable for any errors in the software, but the people selling the software are going to try to have it in the contract that they're not liable for anything. Or Facebook is going to get some legal heat for liability from fraud stemming from fraudulent advertisers on Facebook. They just got hit a couple weeks ago with their first product liability suit, they were found guilty for putting a faulty product on the market, which is just their social media. Yeah. So they are already facing some introductory product liability suits. And I know that there are more coming. And I think that Facebook could catch some of the heat for just allowing these fraudulent advertisements to go unchecked that lead to the fraud down the road. Yeah. It's interesting. what this makes me think of is this whole notion of enough is enough. At what point do the banks, or I guess it takes someone with the influence of the banks to be able to say, okay, we've had it. There are going to be changes here. Listen up, Mark. Well, yeah, but also listen up, Congress. Right. We're tired of footing the bill for this, and our insurance companies are tired of footing the bill for this, And so we need some changes here. And maybe that's what it takes to tighten some of these things down. And we've seen that before. Going to bring up the caveat punchline of the Video Privacy Act for when members of Congress were getting their video rental history back in the 80s. Right. Advertised. And then all of a sudden there was a privacy act around what video like your video rental history is private Yeah They did the same thing with selling and buying browser histories But I don think that had much of an impact Yeah I think it was also the books you borrowed from the library was fair game for a while, and I don't believe it is anymore. Yeah, I know that in Howard County, Dave, where you live, the library does not keep your history of book checkouts. Really? They just don't have a record of it. Why do you know that? Because I asked. Okay. Why do you think I know? Well, how do they know if you've returned a book or not? Well, obviously they have a system to know that you have a book out. Yeah. So, I mean, so while you have a book out, they can, you know, they know that you have the book. But once you return that book and they check it in, they delete it. It's gone. Good. Good. Good on them. Yeah. It's so refreshing that for once, something I do is not being sold to a data broker. That's right. How cute. I love that. That's right. That's right. What is the saying about libraries? Is there like the one place left in our daily lives where there's no expectation of commerce, right? You can just go and do what you need to do and not spend any money. Yeah. How quaint. I should check and see if Carroll County has the same thing because now I'm a Carroll County library patron. But I still have my Howard County card from when I lived here. Yeah. So, yeah, I think we're getting to that. Enough is enough. And I think it's just reached a volume of how many millions and billions of dollars are just stolen all over the world where now it's we can't keep stomaching it. We're starting to see that with cyber insurance policies. They can't keep taking the losses if these companies are not going to do a certain amount of cybersecurity to prevent these things. We're seeing just a critical mass of just how much volume is it's not supported. anymore. Yeah. No, I saw recently that the feds are exploring the idea. They're open for comments about the possibility of a federal backstop for cybersecurity, much the same way that they provide flood insurance. So I think we're starting to reach critical mass where it's not just, oh, that sucks. Be careful. Right. As the official guidance anymore. Yeah. Yeah. Which makes me, I hate that it took this long, but it's nice to starting to see at least whispers of it. Yeah. I guess my hope is that it doesn't ultimately land on the consumer, you know? Yeah. Because so often that's what happens. Yeah. That's what I think is going to happen ultimately. And maybe that results in some some kind of consumer level class action action or class action against some of these big media or big social media providers that make billions of dollars off of fraudulent advertising. Billions, billions of dollars. Billions from one country. Right. Yeah. And that's just one country's fraudulent advertising. And that's only what they could identify as fraud. I remember when like all the information about the Facebook advertising space after Brexit was shown that was heavily handed by Facebook advertising, it's impossible to fully get all the way into the details of how many ads are fraudulent, who is paying for these ads. It is incredibly difficult to do. So this is just best guesses. It becomes a money laundering problem. Can I just, you got a minute for me to rant about Facebook? Go for it. Dude, we do that so much. I'm a certified hater. So just yesterday, I was doing what I do, minding my own business. Minding your business, right. Scrolling through Facebook. That is objectively minding other people's business. Well, that's true. That is textbook minding others' business. She's got you there. You're correct. All right. I stand corrected. Thanks, Michelle. Got you there. Yeah. Okay. Next week, Michelle won't be with us. Someone else will be. I don't know who yet, but it won't be her. Just be knocking on the window just sad. That's right. Knock on me. She'll be inside practicing her violin. so I'm scrolling along and I see an ad come by and it's like it's from the Peterson Automotive Museum which is a well-known museum in California and they have one of the greatest collection of cars in the world and I've watched some of their programming on YouTube I wouldn't say I'm not a car guy in that I have desires to collect cars or anything like just an admirer I like yeah I like cars and I'm interested in cars and I like keeping up with technology and so on and so forth. Anyway, I made the mistake of pausing while this ad was going by to look at the picture of the 1970, whatever, like Porsche Carrera turbo that they're giving away. They're auctioning off. They're raffling off, I guess is the way to say it. Yes. I paused to just admire this lovely car and whatever. And then I go scrolling. every single ad from that point on was a car raffle. That's amazing. From all over the place. Like every kind of vehicle you could imagine. Like I don't need an industrial work truck, but I could win one in a raffle. I mean, it's so aggressive and so fast. There's just no subtlety. There's no nuance. And I just hate it. I just hate it. I had the same thought of like, I put my phone down for a hot second just to like go do something. And then I picked it back up and it was on a dumb ad. And I was like, oh, I'm going to see that for the next two weeks. I was so irritated. I was pre-irritated. Like it hadn't even happened yet. But I knew by looking, I was like, I'm going to see that for the next two weeks. I have a great story about this. Go be the judge of that. Last week, I was doing some thinking about what I'm doing with my degree. I'm going to UMBC and I'm getting a master of science in data science. And I was deciding whether or not I wanted to continue on with this degree and finish it up. I only have four classes left after the semester. Or if I just wanted to take the certificate and move on to something else. College boy. Right. Yeah. I've been in college most of my life, Dave. Same. Yeah. I have a greater percentage probably just by age. We'll do the math. We'll follow up with that next week. Um, so, uh, I was on my regular, I have a Google account for my UMBC account. And then I have a Google account. That's just my personal one that I use. Yeah. And I had both of them open and I was doing some, uh, searching through the UMBC stuff for the program and looking at classes. And on my way home from a class last night at UMBC, I have YouTube up and I'm listening to something on YouTube and it stops in the middle and pitches me an ad for the very program in which I am currently enrolled and almost finished with. There you go. And I get a sense of satisfaction from that. Really? Yeah, because that is, and this happens all the time when I buy something on Amazon, I start getting ads for the thing I just bought. And I'm like, yeah, that's right. Waste your money. Burn that money in the fire of futility. So, yep. I see. That's the satisfaction. Yeah, I get that too. The last time I bought a car, after I bought the car, I was getting all these ads for the car I just bought. Right. I don't need two of them. Just be glad you didn't stop for a second to look at the bikini ad, Dave. Because then when your wife sees you looking at nothing but bikini ads for the next two weeks. I'm starting a fight. Right. If I've got nothing to do that day, you don't either. Right. You have something to do. It's a fight with Michelle. Yeah. Oh, boy. Yeah. All right. You know what? This is a good time for us to take a break. Yep. We're going to take a quick break here to hear from our sponsor. We'll be right back after this message. Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker allow listing, you stop unknown executables cold. With ring fencing, you control how trusted applications behave. And with ThreatLocker DAC, Defense Against Configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero-trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose ThreatLocker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo at ThreatLocker.com slash N2K today. And we are back. Joe, what do you got for us this week? My story comes from the LA Times, and the reporter is Sierra Morgan. And it's a story of these two cousins, Shrey Goel of Calabasas and his cousin, Janik Raheja of Denver. They both have admitted to federal crimes tied to a nationwide rental scheme that has been pretty big. So this scheme relied on deceptive listings, including double bookings and last-minute cancellations. And this is all according to federal prosecutors. The short-term rental strategy was first launched back in 2013. So they've been doing this for 10 years. And it involved an online business to list properties on digital platforms. So, which these platforms, of course, the big ones, Airbnb and Vrbo and other platforms as well. Right. But the two were allegedly using a mix of properties they owned and others they had rented or leased on the platform. And they were listing the same property multiple times with varying prices on multiple platforms. Okay. So I go out and I secure an actual house. And then I say. So you're the scammer. I'm the scammer. Right. I'm the scammer. I'm Joe the scammer and I'm going to go out and I'm going to try to list a house. So I put an ad on Vrbo and I put in or a listing on Vrbo and I put a listing on Airbnb. The Vrbo listing is $200 a night. The Airbnb listing is $150 a night. Michelle, she gets the, she says, I'll take the Vrbo listing for $200 a night. Dave, you take the Airbnb listing. And when the night comes for you to check in, I canceled Dave's reservation. Oh, see, I was thinking it was like a meet cute. Right? That's worse. That's worse. Thanks, Michelle. Right. Overbooking. So my initial thought listening to this is, how is this different than how many other conglomerates are doing business? How is this any different than airlines overbooking on purpose, than dynamic pricing because of the person or the platform? Yeah. I get it because it's illegal because these two just dudes are doing it or whatever. Right. That's a good question. It's not any. This all sounds like what's being done at a massive scale by all these mega corporations. I know that airlines have obligations to pay you when they bump you or overbook you. They did. I think that that was overturned with this administration. Was it? One of those FAA. Oh, one of those FAA regulations. Yeah. Okay. Because that's just a regulation. It's not a law. Mm-hmm. The, so in terms of, in terms of that, I don't know. That's a good question. Yeah, this all sounds like how business is done now. We'll continue with the scam. So, oh, okay, so that was one of the things they'd do. They either cancel it and say, sorry, Dave, there's plumbing problems at the house. You can't rent it. Or we got some kind of mechanical issues. Or I would say, hey, Dave, here's your new address. This is where you're going. And it would just be some alternate rental house. Maybe like a trailer parked somewhere. Okay. Congratulations. Thank you very much. Is it still a meet cute, Dave? No, not so much. You lost me So one rental platform eventually did ban them due to customer complaints But that didn bother these guys They just used fake accounts to maintain their operations And according to their plea agreement, they also took measurements to minimize negative feedback, such as reposting property listings under new identities and putting in fake reviews. So they were doing that as well. from October of 2017 to November of 2019, they use these fake names and identities. And then they started up a couple of LLCs, which I don't know why they did that other than maybe they just wanted to spin these up and throw them away. But, you know, one of them was called Abbott Pacific LLC and the other one was called Jet Set Work LLC. Cool names, by the way. properties included listings from Southern California and also cities like Chicago, Dallas, and Denver, and Nashville. So if you're going to go check out Graceland, baby, maybe you're going to get a scam by these cousins. So what was ultimately the scam here? Did anybody get a place to stay? Some people did. Okay. Some people did, but other people did not. Okay. Right? So what they were doing was they were maximizing the amount of money they could get, And there's a little twist here that's coming up that is going to be disgusting. But I love Airbnb's quote here because actually the LA Times reached out to Airbnb and Airbnb said, Airbnb is built on trust and bad actors have no place in our community. We supported the U.S. Attorney's Office and the FBI throughout their investigation to help ensure those responsible are held accountable. And we are thankful for their work. we have taken multiple steps to strengthen our defenses and help make rare issues like this even rarer. Okay. You know, which is very corporate ease, right? Like, hey, this is a rare thing. Don't worry about it. We're working to make it better. Okay, maybe you are. Just once, I'd like to hear a corporate spokesperson said, it's too bad the U.S. Constitution prohibits cruel and unusual punishment. You know? These people are reprehensible and should be punished to the fullest extent of the law. And then some. Yeah, and then some. Okay. Okay. Verbo did not immediately respond for comments. So maybe that's what we'll say the Verbo people said. No, we can't say that. The prosecutors alleged the scheme was large scale, that they did this more than 10,000 times, and their revenue was $8.5 million over these 10 years, which is a lot of money. Now, that means that some people were inconvenienced and all kinds of other stuff. But the indictment also alleges that the defendants engaged in discriminatory practices based on racial biases. They were targeting, they would cancel the reservations of people they perceived to be black and disproportionately targeted them with cancellations. Neither defendant would agree in their plea deal, said that it was a large-scale operation or that they practiced this discrimination. But the prosecutors did allege that. Okay. And that's the really icky part. According to the plea agreement, Goel pleaded guilty to wire fraud, and he faces up to 20 years in the federal pen. And Raheja pleaded guilty to obstruction of justice because while he was being investigated back in 2023, he made false statements to federal agents, including denying that the overbooking practices were intentional. He faces a mere 10 years in the federal pen. That's what I was thinking. Those plea deals are wildly different. Well, they're different crimes. So lying to an investigator will only get you 10 years, but wire fraud will get you 20, I guess. But they have not been sentenced yet. That happens in August and September. Plus probably restitution for the wire fraud, potentially. Yeah, I don't know. That's a good question. I had to look at the indictment. I just read the story. Or look at the plea agreement, rather. Yeah. Do you guys make much use of these sorts of things? These Airbnbs and Verbos? I used to be a big fan of them back when they were actually worth it. When they cost less than a hotel room and you could have a bunch of people in one location. That was great. But now they cost more than a hotel room. You get no service. And you have to clean up after yourself on top of paying them a cleaning fee. And they want you to strip the bed and take out the garbage and all this stuff. And it's like, I can do that at home. Right. For free. I don't need to travel. Yeah, at least at a hotel now, you get service, and then you don't have to worry about all the ickiness that happens in Airbnbs and creepy hosts and stuff. I still check for the ickiness. Yeah, you always got to. So, no, I have said goodbye to Airbnbs a long time ago, which is disappointing because it was a good idea. Yeah, if they offered a reasonable value proposition, I might be willing to do all the service work, you know, like that gets done at a hotel. But if it's more expensive than a hotel, I'm going to have to do some math on that. Like how many people are staying there? How many hotel rooms do we need to get? You know, if seven of us are going down to Texas, maybe I'll get one. Maybe I'll get an Airbnb. But, you know, if I go down to Texas, I got a place to stay. Yeah, and the economics are just not sustainable anymore because a bunch of people started buying up Airbnbs and renting out and stuff. And now I have seen stuff on social media and in the news of Airbnb rentals and such are just staying vacant because there are just too many Airbnbs or they are too expensive. There's no need for it. Yeah, it's like multi-level marketing. If you didn't get in early, you're not making the money. Yeah. Yeah, and we have a serious shortage of housing stock in our nation. So that helps, makes that worse. Yeah, well, maybe this will make it better when people stop making money with Airbnb and they just have to liquidate the house. That's what I'm hoping. They'll sell it to somebody. All right. We will have a link to that story in the show notes. Joe, Michelle, it is time for our Catch of the Day. Dave, our Catch of the Day comes from the r slash scambate subreddit. the title on this one is Who Wants to Help Me with This One? And it's very short. It looks like a text message coming. Oh, today it's 1934, which is 734. Wow. Yeah. Good thing you're here, Joe. Quick math. Yep. It goes like this. It says, Hi, Bob. It's me. Is he sick? I'm just trying again as I'm not sure my messages have been getting through. My phone screen's cracked, so I'm using a spare at the moment. I tried my SIM in it, but there's no signal because it's locked. Can you save this number and let me know when you see this? So many questions. How are you sending this message if the phone screen is locked? That's my first question. Well, it says he's using a spare. A spare, okay. Yeah, because his regular phone is cracked. So that explains why it's coming from an unknown number. Ah. Right? My phone's broken, so I'm using a spare. Tried using his SIM, but can't do that because the SIM is somehow locked. The thing, the nuance here that I think is interesting is they say, can you save this number? Because if you save the number. They can call you. It's not unknown anymore. Right. Right. So they're trying to get them, like, I'm guessing, I mean, he says, hi, mom. So, hi, mom, it's me. It doesn't say who it is. Right. But you're only one, only a handful of people. Most are calling you mom. I think it's the I have so many questions I think is exactly the point. Nobody in general, most people do not know SIM architecture and how phones work and how phone numbers are assigned. not enough people know that to be able to identify a specific like that's not how that works right right so like there even like i've done some learning about it and even still i couldn't be like uh that's actually not how that works with certainty of it's like huh that's weird but you know i don't know how that stuff works okay right it's plausible yeah it's just it's just vague enough and so what's your first response to this text well let me let me go in a different direction and just say, I will answer your question, Joe. Okay. My first response is, I'm trying to imagine my mother answering this question. If this came to her. Right. Her first question probably would have been, is this Dave? Right. So now she's given away the name. Yep. And so the scammer's going to say, yes, it's me, Dave, and I'm in trouble, and I need help, and off we go. Right. How would I answer this? Yeah. Well, I wouldn't. Oh, you wouldn't? No. I would say, is this Tommy? And when he comes back, yeah, this is Tommy. Tommy, you got the wrong number, man. That's good. Because I don't have any kids named Tommy. That's good. Yeah, I like that. That's a good one. Mm-hmm. Yeah, and I guess this is, I was talking to somebody just a couple weeks ago about, this was a person who has grandchildren, and they were telling me that their entire family has a code word. Right. And this is a great example of why that would be a good thing to have. We have that too. What's the code word? And if they don't know it, tough. Right. And if it's a family member and they can't remember it, it'd been nice knowing you. Right. We'll start making arrangements. Yeah, it's just interesting being like, it's not as overt. It's like subtly just a bit confusing, but not confusing enough to like set off alarm bells. Right. Right. I don't like this one because of that. Intentionally vague. Yeah. It's effective, and I don't like that. Oh, yeah. I'm rereading this again, and it's, yeah, the SIM is locked. I'm sorry. Yeah, it's effective. Yeah. I don't like that. I like when they're bad at what they do. So, when I got my new phone, which is a Google Pixel 10, which is still just a big box of tears and disappointment. Okay. For some reason, Google cannot make a Bluetooth interface to save their lives. Okay. And this one exhibits the exact same problems that every other Google Pixel I've ever had. I'm just complaining. But anyway, I did not have to set up a, use a SIM. I had an old SIM from my previous Pixel. Yeah, they have virtual SIMs now. Yeah, they said, we don't need that. We're going to create a virtual SIM from your old one using your mobile provider. Give us the number on it or something. And I had to do that and it created a virtual SIM. Yeah. Yeah, this is what I mean. none of us know like enough detail about it. That's not technically how that works. You've got to be a real specific person. I have never been really into the mobile technology. Just never, it never interested me. So I never learned about it. All right. Well, that is our catch of the day. And of course, we would love to hear from you. If there's something you'd like us to consider for the show, you can email us. It's hackinghumans at n2k.com. Most environments trust too much and attackers know it. ThreatLocker enforces default deny at execution, blocks unknown apps, and limits what trusted apps can do. Stop ransomware at the source. Get your demo at threatlocker.com slash n2k. And that is our show brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans at n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Iben. We're mixed by Elliot Peltzman and Trey Hester. Peter Kilpie is our publisher. I'm Dave Bittner. I'm Joe Kerrigan. And I'm Michelle Kellerman. Thanks for listening. ... ... ...