Unspoken Security Ep 56: The Billion-Dollar Scam Nobody Talks About

I think that there are the certain sexy topics that everybody wants to latch onto, like ransomware. But really what's happening on the daily is business email compromise, and it's just another form of trickery. It is making you think that you need to send a payment to someone to a different account, and you don't think twice about that because you're not living your life from a perspective of who's trying to trick me today. Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly at NSA, and been building and maturing intelligence programs in the private sector for, I don't know, about 10 years now, I suppose. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! So I continue to be deeply committed to servant leadership. Now, this podcast brings all these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not going to be a typical polished podcast. My dogs make the occasional appearance, although I don't think we'll see them today. People argue and debate here. We even swear. I definitely do. That's all okay. I want you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. Now, today I'm super excited because I'm joined by a genuine celebrity. I know she won't say that, by the way, but it's true. So Erin West is our guest today. She's a globally recognized speaker and educator leading the fight against transnational organized crime. Now, her expertise comes from 26 years as a deputy district attorney in Santa Clara County, California. That includes 8 years leading investigations into cryptocurrency-enabled crimes, SIM swapping, and digital financial fraud. In fact, Erin founded the Crypto Coalition, which is an international network of nearly 2,000 law enforcement professionals focused on cryptocurrency investigations. As if that isn't enough, now she's the founder of Operation Shamrock, and with that, she's built this powerful coalition uniting law enforcement, private industry, and global stakeholders to combat scams linked to transnational organized crime. And if you look carefully, you might even see her on Netflix because she was on a very cool show about busting some scammers that maybe we'll talk about. Anyway, anything else you want to add to that bio, Erin, before we jump into the show?

No, and you surprised me with the reference to Love Con Revenge, so I'm glad you caught that.

Yes, it was, it was surprising to me. It's a very cool show, by the way. For anybody who doesn't know, I got tuned on to it by a friend and I didn't know you were going to be in it. I knew of you. I followed you for a while, but then you popped up and I'm like, I know her. Well, I mean, I don't know her, but I know who she is. And it was very, very cool. And a very interesting story for those who haven't seen it. If you've ever heard of The Tinder Swindler, uh, this was sort of a follow-up to that. The main character, the main person for that, the victim, she's no longer a victim and now she helps others. So, and Erin was a big part of it. So very cool. But today. The topic for today's discussion is the multi-billion-dollar crime nobody talks about. Now, there aren't a lot of multi-billion-dollar crimes that don't get a lot of conversation. So what are we talking about, Erin?

We're talking about the scamdemic. We're talking about transnational organized criminals who have set their sights on the rest of the world and are currently, right now as we're speaking, stealing a generation's worth of wealth.

Scamdemic. Now that's, that's a phrase I haven't heard before. I don't know if you've patented that one, if you've copywritten that one. If you haven't, I recommend it. I think it's a really cool phrase.

I should. I use it a lot.

Yeah, I think it's a really good one. So the ScamDemic, and, and it, it hits right on. Like, the scams are everywhere all the time now, right? I mean, I, I, I get more emails that are junk than aren't. I get text messages are the same, and a lot of them are scams. But how would you describe the scam threat landscape over, say, the last 5 to 10 years?

On a massive upward trajectory. What we've seen is we, we sort of got a handle on the Nigerian prince that we, that, that everyone kind of gets that now.

You mean that guy's not real? I shouldn't have sent him my money.

I know, I know. Well, he's not related to you. He might be related to me or your cousin, but, but, but I think that what we've seen is that more and more transnational organized crime has seen that this is a much cheaper, easier way to come up with a lot of cash that doesn't involve guns or drugs or or violence. Well, some violence, but not extreme violence against— in some of the ways. Well, it's violent. It's, it's actually quite violent. It's quite violent.

It's just behind the scenes, right? It doesn't show up as gunshots.

It's not on your street. It's not on your street. Yeah. And so, and so the more and more they've realized how effective doing scams can be, how inexpensive to them and the huge upside of what they can make, the more they are doing scams and they are doing them at an industrialized scale.

Well, yeah, I mean, criminals, you know, it's not, it's not a big shock here, and I'm certainly not going to mansplain it to a, a prosecuting attorney. The criminals are coin-operated, right? They go where the money is. I think everybody knows that. The path of least resistance, you know, most profit, least friction. I mean, they're good business people, generally speaking, um, in that regard. And, and like you said, this has turned out to be a very profitable way to, to make money with what appears to be a very low likelihood of being caught, prosecuted, you know, punished for these things, right? The statistics I know on scams are incredibly low on punishment, partially because of, you know, transnational nature of things. You know, first you gotta find somebody, and then if you find them, you gotta find them in a jurisdiction that you can get to, or one that actually cares, and they can't be tied to the government of that jurisdiction. Like, there's a whole lot there, as you know. I, I'm saying this for the audience, clearly not for you. But when, when you talk about how this is playing out over these, over these past few years, so What, what are the common, most common scams? I think a lot of people may know these, but like the baseline, like, you know, phishing obviously is still huge, right? So I think that's still the most common attack vector, but what are some of the most common and most profitable scams you're seeing?

Yeah, so I would say that I can think of 6 scams in my immediate vicinity that people in my immediate circle have become victims of. And my dad got an email from Norton Antivirus that he owed them money, and that really ticked him off because no, he doesn't, and he doesn't doesn't like Norton and he's going to call them up and give them what's on his mind. And he's telling me this, I'm at an airport at a layover and he's telling me this story. And then he says, well, he calls me and he says, well, I got to tell you about some bad news. And I go, oh, tell me about the bad news. And he's like, well, you know, the scan, the scan went badly. And I was like, what scan? He goes like, well, they scan my computer. And then I'm like, oh no. Oh no. Oh, let's turn off the computer right now and start from there. So I think the problem is, and it's not just my dad. My good friend Lisa came to find her dad had just moved to Boise and Googled Boise Geek Squad because he had a problem with the way they installed his televisions. Sure. And the first example at the top of the Google search is not the Geek Squad. It's a scammer. And so he called them. And they made it sound very authentic that they were the Geek Squad. And the next thing Lisa knows, they're in her dad's computer telling him that he has come into contact with child pornography.

Oh yeah.

And that he needs to move money. So there's— the fact is, the scam themselves are, are the same things we've always seen. We're going to trick you into thinking that you need to move money for some reason, whether it's because you touched child pornography or because there's a warrant for your arrest or because you didn't pay a toll. It's— they're really going after the adrenaline rush of, oh my God, something's wrong, and not giving you time to reflect on it and, and demanding and showing authority. And, and that's, that's a great recipe for stealing someone's money. And it continues to be just as effective as it always was.

Well, yeah, I mean, you point out, you know, some of the, some of the specifics, right? So the border one, for instance, I, I'm surprised at just how many packages at the border apparently are addressed to me that are, are narcotics. 'Cause I get that call often, a few times a year at least.

Yeah.

It's fun now 'cause when you know it's a scam, of course, you know, the, the more you, you don't care, the more angry they get, you know, trying to scare you, right? You know, that one or the, or the fake IRS calls, you know, that using law enforcement or government authority to scare people is, is pretty effective for a lot of people, right? And then you mentioned, you know, in your, in, in the two instances you mentioned, your father and a friend of yours' father, the targets, right? Older people or less tech-savvy people.

Yes.

Still tend to be great targets. And it seems like now, you know, in the age where everybody can find everything about everybody else pretty easily, it seems like it's a lot easier to, to find those people, to, to target those people because even people who aren't tech-savvy, or even people who are, you know, a generation further along and don't care much about it. Almost everybody's connected now in some fashion. Everybody's got a phone, you know, most people have some kind of a computer, right? So it seems like it's very difficult to protect or immunize those communities who are most susceptible, least knowledgeable. You know, what have you seen in that area? Is that— I mean, is that accurate? Is it— I know everybody's possible, but are these areas that are specifically being targeted, people specifically targeted?

Yeah, I would say definitely they are. And that every— there's information out about all of us everywhere. Everyone's been subject to a data breach. And so it's not difficult to find out who the senior citizens are in a certain zip code. It's not that difficult to find out who has a Chinese last name. And what we're seeing is a whole nother targeting of— on Fridays, my organization does survivor calls. So we talk to people who have recently been targeted and they help us understand what's happening out there. And we're looking for where are the gaps, where, where have you been let down by law enforcement or banking, where, how can we help them do better? And the one that we've gotten 5 times out of the last 6 calls are, I am an immigrant to the United States and I've been called by my own embassy telling me that there's something back at home that I need to address and I need to come to the embassy to do this work. Or if not, I can, I can start moving my finances and they will assist in doing that. And, and unfortunately, the thing about the scammers is they know exactly which buttons to push. And if you are an immigrant in the United States right now, whether you're nervous, you are nervous, you are, you are uncomfortable. And so when somebody is asserting authority and you don't have time to think about whether that makes sense, it causes your blood pressure to spike and for you to respond in a way that doesn't allow you time to carefully consider whether it is a true threat.

Yeah, well, it's a good point. I mean, it's playing on emotion, right? A lot of these scammers, I mean, they're experts on psychology. They understand what they're accomplishing. So it's either threats, you know, government, as you said, you find vulnerable parties. Immigrants in America right now, I'm sure, are not as comfortable as they've been in many generations. So whether that's the U.S. government saying you've got to go someplace or whether that's, you know, a government from a country they came from, They're, they're much more susceptible than they might have been previously. You know, romance scams I know is another big piece, right? So not as much of the pressure necessarily, although they get to that. A friend of mine not long ago, I won't name him obviously, but he was, he was a victim and he felt really bad about it. And I explained to him, listen, that can happen to anybody. He's a really good guy. And I pointed out to him, you know, the people who are victims of romance scams, the reason you're a victim is cuz you're a good person. If it makes you feel any better, they targeted you because you were a good person, cuz cold-hearted You know, jaded people are terrible victims. They're terrible targets. They won't be victims. You're a good person. You cared about this person, you know, and, and that's how it happened. So, you know, please don't be embarrassed or feel bad about it. But yeah, it's, you know, in his case, you know, he's, he's, he was in a long marriage. Unfortunately, his spouse had passed away, so it was again a more vulnerable person, you know, looking for, for love again, you know, in a tough, a tough situation, right? And somebody said all the right things and kind of reeled them in, and then, you know, starts to unravel a little bit, but it's hard to see those red flags when you're, when you're already romantically involved. So whether it's a threat or whether it's— I'm curious actually, your thoughts, which is more effective, the threat, the stick, or the carrot, right? The threat or the, or the romance scam, which is a more effective scam?

Oh gosh, I think they're both so effective because you will do anything when you're scared. And, and you— I've seen victims do all kinds of, of things that they would never normally do. I've seen victims going from branch to branch of Bank of America in the Bay area taking $9,000 out at a time and handing it all over to a courier who came to their front porch. I, and then in the name of love, I've seen people do all kinds of crazy stuff. And I think that the words that you told your friend are so poignant and so accurate because this happens to people who are after what everyone is after, and that's a solid companion, someone who sees you and understands you. And that is what these bad actors are experts at. And they've been operating in a space where they have been rewarded for creating warm, tender relationships. And, and if you talk to people who've come out of this, they will say, that was the best relationship of my life. I've never felt so seen, heard, understood. They remembered everything about me. They listened to me like it was their job. Right.

Yeah. They were very motivated.

Yes. Yes. And so, and scammers know this and they know that once you're reeled in in that way and once that trust is created, that bond is created between the scammer and the victim, it can be really hard for anyone to try and disrupt it.

Mm-hmm. Yeah. Thankfully for my friend, his heart was broken, but his bank account wasn't. Oh yeah.

Yeah.

He, I think he just, just in time, right? It, it was hard emotionally, but just in time was like, hey, I know this is what you do. Can you talk to me about this? And I mean, sadly, as an outsider, objectively, I looked in 30 seconds, I was like, yeah, this person doesn't exist. This isn't real. But interestingly, like it was something I hadn't seen in, in, in, I haven't done this as, uh, researcher in a while now. This person, I mean, you had AI-generated video. This person had, had sent many, many videos, you know, and snapshots and all the things, right? So it wasn't just text messages, it wasn't just emails. This person had gone above and beyond. Their story didn't work out very well cuz it involved military stuff that they obviously didn't know, which helped me as a veteran be able to, to dig it out. But also digging into the video and be like, that's AI. It's really, really good AI, but that's AI. So I was able to see the whole scam unfold. I was like, well, they, they've gotten much better. You know, and it's, it's, it's hard. I could see how, how somebody could look at these videos and be like, that's a real person, and, and that really seems to validate things, right? And allows you to, to buy in. And like you said, once, once you're in, you know, people do anything for fear, and they'll do anything out of love, even things they know are irrational. And, you know, they'll let emotion lead them. We all do it. So, you know, it's, it's a great place for the victims to be found, you know, for these criminals. Now, on another note, okay, still fear-based, I think, probably not romance-based. Everybody talks about ransomware as a huge crime, right? We're not going to talk about ransomware today, but I think it's interesting that business email compromise is like 10 times more damaging financially than ransomware and almost never gets talked about. How does that relate?

Right, it's so funny that you say that. I think that there are the certain sexy topics that everybody wants to latch on to, like ransomware, and— but really what's happening on the daily is business email compromise. And for your listeners, that's just— it's, it's just another form of trickery. It is making you think that you need to send a payment to someone, to a different account. And you don't think twice about that because you're not living your life from a perspective of who's trying to trick me today. You're living your life from a, oh, somebody told me this. Well, it must be true. I trust people. I come from a place where I trust people. So the thing about business email compromise is there are There are huge numbers of dollars being stolen through business email compromise, and it's not talked about in the way that we talk about ransomware. It's interesting what gets discussed and what doesn't. And I think for a long time, it's issues like that where it feels like, well, that's human error. You should have caught that. You weren't smart enough to catch that. That we're not talking about those. We're able to dismiss them. Yes.

I mean, it's a good point. I think people love to focus on the flashy stuff, you know, the ransomware or the, you know, the hoodie, you know, hoodie-wearing hacker, you know, that whole concept, right? And the reality is, I mean, first of all, if you get popped for business email compromise, again, much like the romance scam, you're not stupid. Like almost certainly not. You know, I have seen a lot of these scams. First of all, they're again much better. Technology makes them better. For those who don't know, by the way, for anybody who doesn't know what business email compromise is, This is, you know, somebody sends, you work in accounts payable and somebody sends a bill for, I don't know, FedEx or DHL or some shipping that never happened, or they send you a bill from a supplier, but it's not actually from them. Or they've actually hijacked a real bill and then just changed the bank account number. So it looks very authentic. It's a spoofed email. It's the right looking format, et cetera. And who checks bank account numbers, right? So these are really common. Or the other one is that I find most common. I'm curious if you've seen this too, Aaron. Is somebody impersonating leadership and saying, I need this right now, right? You know, I, I need you to send the entire company's tax forms to, to me immediately. It's a, it's a great scam. And so, they use a lot of pressure and a lot of threats and, and, and that's the other way, you know, if you're not just trying to be subtle about it, the other way I've seen business email compromise be very successful is just through, again, scaring people, right? Fear. Are there others I'm missing in here?

No, but I, I, I was gonna say that what you're pointing out is so interesting too, because A lot of our technology and the data drops and all of that opens up doors for bad guys to use them. So what they're doing now is people who have new jobs, they're figuring that out on LinkedIn and they're reaching out to those people with new jobs and saying, hey, I'm your boss. I need you to do this. I need you to buy this and send it. And people are new to the game and they don't know that their boss might, would never reach out to them in that way, right? Yeah.

Welcome to the company, here's this, here's this gift, I need you to, you know, click on the link and download this gift card. Or, or, welcome to the company, I need you to go buy me gift cards.

Exactly.

Which is exactly the most bizarre one I could think of. A CEO on your first day in the company reaches out to ask you to buy gift cards, it's a good chance it's a scam.

It is. But like, if you are my 22-year-old son, is that obvious to you? I don't know. And that's the problem. So I, I'm just back from Las Vegas and I spent some time there with one of my colleagues. He works for Las Vegas Metro PD, and he was telling me about— he's Mark Evans— and he was telling me about some of the trickery that is responsible for millions of dollars of theft in Las Vegas, where they are convincing people who work inside the cage that payments need to be made on behalf of the casino. And I'm going to tell you, that there are hundreds of thousands of dollars walking out of the cage and being delivered to lawyers' offices, right? And it's just, that's how good they are these days. And, and he talked about, you know, he start— the calls start off by saying that they're from the fire department. They make her go around and take pictures of the fire extinguishers. Like, the whole thing of how you trick people is you make it seem really real and you throw in a lot of crap that I don't know if that's true or not. I guess I'll go take pictures of the hydrants if you need that.

And a lot of the tedious stuff throws them off, right?

It is. It's the tedious stuff that throws them off. And it's the same things that happen to our parents when they are saying that they're with the GIFS, the Geek Squad, and they're from the hacking department and they're, write down my code number. My code number is CX25. I want to transfer you to my colleague. He'll have, you know, like it's just all of the additional nonsense that makes you miss the big picture that, oh my God, the fire department's not going to call the casino cage and ask for payments to be made, right?

Yeah, that's a good point. It's the camouflage, right? You get so messed up in the minutia of it, you're like, oh God, this seems like a terrible job for them, and it's so administrative, and you don't realize, no, it's all, it's all fake. Yeah, I'm gonna transfer to my boss. Yes, not a boss, just another, just another scammer, right?

Yes.

I remember for years it used to be the computer one And, and I'll, I'll confess, I, I spend more time than I probably should messing around with scammers now when they call me, because I find it to be fun. And if I'm wasting their time, then they're not hurting somebody else. And the computer one, I'm like, oh, okay, oh, my computer, let me go get one. You play along and you can't find whatever button they're looking for. Well, is it a Windows or a Mac? Oh no, it's, it's an, it's a Mac. Oh, I'll transfer you to my Mac per my Apple person. And then you wait and they get on and then fumble around. No, no, it's not a Mac, it's a, it's a Windows, you know, send them back over. And eventually you're like, no, it's, it's a typewriter. Like, what? You know, get mad about it. I've, I've had many a scammer break their, their character and curse at me.

And just had it with you.

Yeah.

Yeah.

I had a Russian guy who wanted, wanted something. I was like, he's like, okay, you know, it's a scam. I know it's a scam. Now give me money. I was like, I don't think that's how it works.

I'm pretty sure that's not how it works.

I don't think that's how it's gonna work.

Yeah.

But I appreciate the honesty.

Okay.

So it's, yeah, it's. The business email compromise, I wanna close the loop on that before we move, cuz I, I wanna get your thoughts on this. It's something I've told people many times, but it hasn't really sunk in apparently enough places. But I think business email compromise is actually probably the easiest crime to solve or to prevent, I would say, because, and this is why I wanna bounce it off you and get your thoughts. My opinion on this has been this is as much about corporate culture as it is anything. You know, if, if, if somebody in person, the CEO is hammering somebody in accounts payable. You know, pay it now, pay it now, pay now, it's not processed. At some point, that person has to think to themselves, what's worse for my career, sending money someplace it shouldn't go and being defrauded, or saying no to the CEO? And in a lot of companies, saying no to the CEO is a lot worse for your career.

Yeah.

And so people will just send that money off. And if the company's a victim, the company's a victim. You know, I, I have suggested that if you have a corporate culture in which people are given permission to challenge authority in the right, in the right ways, obviously, and just like a daily password, something very, very simple, most email compromise would go away. Not the good fake billing, that would still slip through. But I mean, have you worked with organizations like this? Have you seen this? Do you see corporate culture as a contributor to business email compromise successes?

I haven't really thought it through in that way, but that makes a ton of sense to me because we don't want people blindly accepting things because the boss says to do so. So, I love the idea of a corporate culture that encourages Hey, if you see something, say something. Even if I am your boss, point it out and we will work through it. And, and I love that idea. It's a good idea.

Well, thanks. I hope it catches on. I've said it to a few people, but I mean, I just think it's especially with people who handle money, like maybe not everybody, but the people who handle money have to be able to say no to anybody, including the CEO. Otherwise you're open.

Right.

Yeah. So, all right. So I want to shift. It's kind of, kind of a quick shift, but I want to talk about another really important topic in this area on scams and it's I know it's where you've put a lot of your time and energy, and it's pig butchering, which most people, again, aren't gonna know what pig butchering is, or a lot of people won't at least. So I want you to explain to everybody what is pig butchering and why is this growing so rapidly?

Sure. So, and thank you for giving me the opportunity to talk about this because this is a major, major crime that is happening every day that people just aren't talking about. Someone you know is being pig butchered and you will not know it because Scammers have figured out the type of crime that people don't want to talk about because it's embarrassing and humiliating. The way it usually starts is there will be some sort of reach out to you, and frequently it looks like a misdirected text message. One of the ones I got recently was, "Come over to my house tomorrow to eat ribs." And I was like, "I might." That doesn't—

Random, but okay.

Right? All right. And all they're trying to do is get you to respond to that. You know, they started off with things like, as this, I hope this is Dr. Ihsan's vet because I, my dog won't eat his food. They're just trying to get you to respond. And when you do respond, you're going to get a picture of a very attractive woman dropped into the thread and she's going to say, hi, I'm Jessica. I hope I'm not disturbing you. And I tell you that because that's what she says every time. And she's always Jessica or she's Anna or Emma. That's who she is.

I've met Anna and Emma. Yes.

Yes. And so, and Jessica doesn't want to disturb you, but she'd love to talk to you, but it's going to have to be on WhatsApp because she's on her work phone and she doesn't want to keep doing this on her work phone. And so what is happening is, you know, people listening to this podcast might think, I'm not going to respond to that, or if I do, I know it's fake. But I'll tell you what, we've got a loneliness crisis, a world loneliness crisis, and people are responding to that because Jessica's pretty cute. And I say Jessica, but it could just as easily be Ethan because women are also victimized by this crime. And what's going to happen is over the next 4 months, Jessica is going to become the relationship that you always wish you had. And you might even be married. This is happening to married people as well, um, which is another clever way the scammers are, are doing this. But, but what Jessica will do is she will pay attention to everything about you and she will greet you in the morning with a good morning, my sweet, and, and tuck you in with the same kind of thing. Over a 4-month period, Jessica is trying to build the kind of trust that will, that will lead you, when she suggests that you can make money in cryptocurrency, to make that investment. And pig butchering is so particularly dangerous because it does not stop until she has stolen every penny from you. So over these 4 months, Jessica's going to become the woman you always dreamed of, and you will imagine a life ahead with her. And you will disclose to her how much money you have in your 401 and whether or not you have accounts for your college kids. And Jessica, all this time, will be showing you cute pictures of herself. She's going to be driving a really nice car. She has nice clothes. She eats really nice food and she travels well. And you're going to believe she's wealthy.. And one day you'll say, how do, how are you affording all this, Jessica? And she'll say, thank you for asking. My uncle taught me how to invest in cryptocurrency and I didn't know how, but he will teach you as well. And, and that's what leads people to say, oh, Jessica, I don't know about crypto. And she'll say, I know, let's start with a small amount of money. And so Jessica will get you to take $5,000 out of your bank account.

Well, it's a small amount of money, 5 grand. Jessica's doing well.

Mm-hmm. Exactly. And then Jessica's gonna get you to move that into a cryptocurrency exchange. And if you're not literate in crypto, if you're literate in Delta SkyMiles or a stack of poker chips, you will understand what I'm talking about for this. And you're gonna put it into a, an account at someplace like Coinbase, and you're gonna change your US dollars just like you would change it into poker chips. Or, or skins in a video game, and you are going to now, instead of having $5,000 in US dollars, you have $5,000 in Tether. It's a stablecoin. It's 1-to-1. And Jessica will say, my uncle says this is the platform we are going to use. And she will teach you screenshot by screenshot how to move your 5,000 Tether into this investment platform. And it'll look just like Merrill Lynch. It'll look just like Smith Barney. It'll look like any normal investment platform. But it's completely fictitious. And so when you put your money in there, you are literally handing your money over to a scammer and it's gone. But you don't know that because you see a beautiful display that shows that your $5,000 is $6,800, is $7,800, and now it's $10,000 by the end of the week.

And I'm getting rich.

You're getting— you have a beautiful woman who loves you, AJ, and you're getting rich.

How do I invest more?

And that is what Jessica will say is, let's go, let's each put some money in and Jessica knows how much you have. So Jessica will say, let's liquidate. Let's, let's take $100,000 out of the 401 and let's put it in there. And that's what you would do. You can't miss. And before you know it, you think you're a millionaire. And so you go to take money out and now customer service says, I'm sorry, AJ Nash, to do that, you have to pay some taxes.

And they're 25%.

But the problem is you don't have any money left, and Jessica knows you don't have any money left because she has got you to put it all in there. But now let's say you have a fake million-dollar portfolio. You need to come up with real $240,000 in cash to get that money out. And that's when our victims are going to banks and getting lines of credit. They are begging and borrowing from friends, relatives, parents. And so by the time they got to me as a prosecutor, they had been completely decimated. They had figured out that this was all a scam and that the person behind it was Jessica, and they loved Jessica and they trusted Jessica. So they are wrecked. Wrecked.

Yeah. Well, and that's why it's called pig butchering, right? Because for those who don't know how pigs are butchered, but every drop of blood, everything, right? So it's not, it's not just like most scams we talk about, it's like, oh, they hit you once, they get a little bit you change your password, or you move on. These folks are long conning it for all of it.

They're in for everything. They're in for every dime. Yeah.

Which by the way, this is where my friend was headed. It was definitely going to be a piggyback scam. So I give him credit. Yeah. I know he felt bad about it, but actually he reached out at the right time. He didn't get sucked in further. Yeah. And he definitely was headed down that path. But it's interesting you mentioned men and women are both victims of this. 'Cause I assume, I guess I shouldn't assume, I should just ask. While that might be true, or that is true, are men more likely to be the victim of this? Is this the target? It targets men more than women because, you know, the sucker for a pretty woman is, is, is a cliché for guys.

I would think so. I would think so. But what I will say is we don't know because, because people don't report, and because when they report, it's embarrassing and humiliating. And I've talked to so many people who will say This happened to my dad. This happened to my cousin, but no way are they going to report this happened. So the fact is we don't know what the statistics look like is they look about equal, but are women more willing to report this? I don't know.

Oh, well, that's, that, that is interesting. I don't, obviously I don't know either as a guy. I can see how guys would hide it, but I don't know if we would do it more likely or less likely than women.

Feels like you would be more likely, but I don't know. Yeah.

As a, as a, as a species, we seem like we're, we're more likely to, to eat it than to tell somebody we've, we've made a mistake, but it, it's definitely hard to say. And it's interesting because, you know, you talked about the loneliness epidemic and obviously, you know, the crypto piece. Again, a lot of people don't understand crypto, but they see the news every day. People are making a lot of money on crypto. So, you know, and, and economic times are another factor. You know, we talked about how right now immigrants are probably more vulnerable because they're less comfortable, you know, than they have been in past generations. Economics also plays a factor. People who are desperate, you know, people who either don't have, don't have work or they're behind on, you know, where they think they need to get to for retirement, which is most of America, frankly. And then you hear about, you know, somebody who's just getting rich instantly on crypto and it's this magic dollar, you know, magic money machine. So it's easy to get pulled into that just like every other get-rich scam, you know, has been around forever. This is, you know, this is the one that seems to be working. And so behind these scams, what does it look like? You know, it's, it's not just like one-person or two-person, you know, operations, right? What, what am— when somebody, when, when Jessica, and by the way, My girlfriend's name is Jessica, so this is gonna be very—

Oh, interesting. Interesting. Well, you tell her. I hope she's not disturbing you.

She's physically here, so she's not disturbing me. But when, when that person reaches out, like, what's really going on behind the scenes? What, what are we not seeing? As, as the facade is what we're getting. What are we not seeing?

Right. This is sort of the mic drop moment because I think we all think that the person on the other side of the phone is an evil, terrible person. And in fact, what is happening is that Chinese organized criminals in Southeast Asia have made this their massive business. And what they've done is they've built compounds. It started off with hotels that had been repurposed. They were going to be used as casinos, but nobody was traveling during COVID And they said, well, let's fill them with humans and have them scam people. And so they did. This started in Cambodia. And, and to do that, they trafficked people in. They led people to believe that they were leaving from China, where there's a massive unemployment rate, and leading them to believe they could make a nice amount of money in this live-work environment for a limited amount of time. And so people came, and when they arrived in Bangkok, their passports were taken and their mobile phones were taken, and they were bussed into a massive compound with gated entry with men with AK-47s at the gate. And we're told, well, you're a scammer now and you are expected to scam 16 hours a day. And, and that is who is on the other side of your phone. And we talked a little bit about carrot and stick. But what I'll tell you is that to get human beings to do this work, It's one of the two of those. And for the most part, it is stick. This is a violent enterprise. I tripped over myself in the beginning of this call saying it wasn't violent, but in fact, it is as violent as it comes inside these scam facilities. And I'm not talking about small places. I'm talking about people, places that will house tens of thousands of people. I'm talking about scam cities in Myanmar and Cambodia, Philippines, Laos. And so what it's done is industrialize this, this methodology of stealing our money.

Yeah, it's— and, and I, I remember at the opening, like you said, you know, we talked about violence, and I didn't want to give it away, which is why I said, well, it's in the background, because I knew where it was going to go, right?

Right.

This isn't an overtly violent act towards the victims, right, the targets, but the people doing the targeting are also victims. And, and in their case, it's overtly violent, like you said. It's— so it's— this is a layered approach of human trafficking. So first you have people who are already having a tough life and you convince them that their lives are going to be better and really you're just putting them into slavery, into these slave camps and thousands and thousands of them. So, so yeah, the person that's texting you or the person that's calling us, a lot of times, I don't know if it's every time, but a lot of times they're a victim too. Doesn't make me feel bad like I'm going to give them money like, oh, I hope they make their quota. I'm not going to do that. But it is a tragic situation and I've seen some of the reporting. I've even seen some of yours. I know you went and visited I want to say it was in Myanmar, right? Were you—

I happened to be in Myanmar. Yes, I've been inside a number of compounds. In fact, I just am back 2 weeks ago from Cambodia where I was inside abandoned compounds and found them to be exactly as the trafficked victims had described them. And quite honestly, scary as hell. Just really, you're inside a jail. You're inside a place where, you know, people have been badly beaten. They describe a dark room where they would be put if they didn't meet their quotas. And I saw it. I've, I've seen torture rooms. I've seen rooms with that are locked from the outside that have a bar attached to the wall where people would be handcuffed and attached to that bar and beaten. So it's a horrific, horrific environment. For people. And that is a piece that isn't widely known about what's happening because, you know, frankly, we hear a lot about how, you know, how to mess with scammers. And quite frankly, these are people who did not choose to be there.

Yeah, which makes it really difficult. Like I said, I make a hobby out of messing with scammers occasionally. And there's, there's a no-win proposition there, right? On the one hand, I'm keeping somebody else from being harmed because I'm keeping this person busy. Yep. On the other hand, I'm probably— well, not— hopefully not, but maybe contributing to them being harmed, which I cannot prevent whether I do this or not. It's— I'm obviously, like I said, I'm not going to start handing them money. That doesn't solve the problem either. So it's a very horrible situation all the way around where you've got slave labor, which obviously is cheap, you know, and they're just driven to do this, like you said, hours and hours a day, combined with cheap technology and improving technologies that make it more and more effective. All of this is, this is that multi-billion dollar— I don't know, do you know what the total number is for these kind of scams? Do we even have an estimate on how much this costs people?

That was just like what I was saying about how we don't really know a lot about the data. What we do know is this: we ask victims to report, even if they don't want to report in person, report online to the FBI at ic3.3.

Yep.

And And so we have data that comes out annually from IC3. We're waiting on the 2025 data. What we know about 2024 was $6.5 billion reported in investment fraud and $672 million reported in romance. So if you add those up, there are other categories that could be tossed in, and now certainly government impersonation would go in there as well. But if you add those up, that you're over $7 million.

Billions.

It's $7 billion. $7 billion.

Billion dollars.

B. And so if you add that up and you think, okay, AARP will tell you 1 in 10 people report, but let's be conservative and say 1 in 7. 7 times over $7 billion is $49 billion. It's $50 billion a year, United States alone, 2024 alone. And we know that it's on the rise. So we're talking about globally hundreds of billions of dollars into the hands of organized criminals. And when we think about where these criminals are located, what they're doing with that money, it's a very scary prospect. And so it is— it's, it's a national security issue to be losing a generation's worth of wealth into the hands of these threat actors.

Exactly. And, and so, you know, Myanmar, not a, not a, a member of the international community, essentially. Other country, you know, you mentioned, you know, China, at least that's where people are being taken from. What are the, who are the countries that are most likely behind this? Obviously, obviously Myanmar is one of them. Is North Korea, and North Korea certainly has, you know, a lot of interesting ways to try to create funding. China, what are the countries, you know, Cambodia you mentioned, what are the countries are behind this or are, are allowing this to happen? Are they turning a blind eye? Are they actually connected and involved with this?

Right. So when we think of the two big hubs at the moment of where this is happening, it's Cambodia and Myanmar. And we know how much money is involved in this. So to be able to set up a facility in a country like this, you know that you're paying up to the highest levels of government. And we know that. We know that there is embedded corruption happening in, in countries that allow this to remain on their on their land. And so what we do know about Cambodia, and especially the United States recently indicted a kingpin in this, is that he was, he was well connected to the existing government. With Myanmar, what we know is it's a, it's a war-torn society being ruled by armed militias. And it's a situation where so long as you are paying up for where you want to be, you can stay there. And so there's all kinds of money going into militias, into, into, into governments that we may not agree with.

Hmm. Yeah, it's terrifying. How do you— you said you were at a, you were just at a facility in Cambodia. And like I said, I know you've been to one in Myanmar at least once. How are you getting into these places? Who are you, who are you able to work with to safely, or I assume it's safe, I guess, to safely go to these places?

So the two places that I've been inside these compounds, one is the Philippines and one is Cambodia. And in the Philippines, the Philippines is, is taking an aggressive stance and is raiding some of these facilities and then leaving them open for journalists and law enforcement to come look and see, this is what it looks like here. We're going to leave all the scripts on the tables. Come see, come see how they do this work. And so that's what I was able to see in the Philippines. And that was really the location of the carrot and stick approach. They've got the torture room there, but then down the hall they have a brothel and they have a karaoke studio and they have gambling machines. So if you want to play, if you want to go with the program, we will allow you to enjoy women and liquor and singing. But if not, we'll see you at the other end of the hall where we will, we will torture you. So that was the Philippines. And in Cambodia, recently, over the past few months, there has been a— what the Philippine— what the Cambodian government is calling a crackdown. I'm calling it a reduction in force. What it, what it is essentially is that, that the obvious places where you look for compounds and that are well known, those are empty right now. Those are abandoned scam compounds. But if you tour Cambodia and you drive around and you go to the Vietnamese border and you go down dirt roads, you will see that there plenty of massive compounds that are still very much in business.

Horrifying. So when we talk about— I mean, this is obviously, this is terrible, right? This is a crime that most people don't know the back end of it, and it's, you know, there are thousands and thousands of people that are victimized right now. And not— we're not talking about the people that lose their money, we're talking about people that are, that are imprisoned right now, that are, that are slave labor. What are we going to see in the next 5 or 10 years, is there a way that we're going to— I mean, this is what you've dedicated your life to, it seems. I'm asking a question I hope I know the good answer to, is how are we going to get better at this? Like, what are we doing about this? Is there a way to improve about this? What's it going to look like in the next 5, 10 years? Is it going to keep exponentially growing, or are there some wins here and some ways for us to work internationally to stop this?

So I'll tell you, I saw my first victim in March of 2022, so that's exactly 4 years ago. And I've been pretty aggressively loud about this ever since. And I would say that every year we get a little closer. We— there's, there's a little bit of progress. I wouldn't say— I would say there's also a large trajectory of it getting worse. We're getting better about, about building collaborative groups that want to work together. We are getting better about law enforcement. It was a huge deal in October when the US indicted this kingpin. It was a huge deal when we sanctioned him as well. But, but it's not enough. It's, it's great. It's disruptive, but it's not enough. And I think what it will take is an international coalition to really make it difficult for these countries to continue to exist in the world's financial space unless they shut down this horrible scourge that is both a financial and humanitarian crisis.

Well, I mean, that's— let's hope that happens. I guess I'll ask on the flip side, unfortunately. So you mentioned right now Philippines, Cambodia, you know, Myanmar. These are places where this is happening. What do we think about the possibilities of this spreading? I mean, there are plenty of countries in Latin America, plenty of countries in Africa where it seems like this would be a potential business model, as horrible as that sounds? Are we seeing that happen? Should we worry about that happening, that it's being exported to other countries?

Well, you're absolutely right. That's exactly what's happening. So I was on a call this morning with Citibank, a webinar where a number of specialists spoke, and the Citibank representative talked about a scam coming out of Uganda. And I have to say, I'm not at all surprised about that. I went to Uganda to try and understand more about the human trafficking pipeline into these, into these. But if you could start running the scams in Uganda, you, you avoid having to move people to across the world to do it. These scams can flourish anywhere where the government can be, can be bought and can be influenced with large sums of money. And the fact is, This is more money than we've ever seen from anything. This dwarfs the drug trade. This is a massive and massive amount of money. So it's not surprising to hear that it's moving to, to Africa. We know that it's already moved to Palau, to Sri Lanka, and we're watching it in South America as well. It is— there is a massive global footprint that continues to grow. And so we need to, we need to be very cognizant of, of the, of the growing nature of this. We're way behind. We're way behind.

Well, yeah, clearly. I mean, I, I, years ago, for a brief period of time in my career, I, I did some work countering human trafficking. You know, I was, I was at the agency, I was at NSA, but I worked with FBI and some others. Specific cases, right? But it was nothing like this, right? It was human trafficking at that time, I mean, at least the part I knew about it, it was generally speaking, women being trafficked, unfortunately. And, and some of it was people, you know, coyotes taking people over the border in the US. But mostly what I worked against was, was human trafficking of, of young women. And it wasn't so they could make phone calls. So it's interesting now, because the numbers you're talking about makes me wonder if this isn't the number one human trafficking problem in the country, or in the world. And it may not be, by the way, for anybody who's out there who knows statistics. I'm, I'm hypothesizing, but it sounds like there's some significant numbers to this.

Yeah, it's hard to imagine what could be bigger when we know that the, the last UN estimate in 2023 was 120,000 in forced criminality in Cambodia and about the same in Myanmar. So we're talking about a quarter of a million people that are, that are in forced criminality.

Just two countries too.

And those, just those two countries. And what we know that's happening now is with this crackdown that is happening, that there are major consequences to moving people around the other side of the globe who do not have the means to get themselves home. And that puts them at— so they're closing down compounds. And but there's no, there's no strategy in place for how we're going to get these people back to Africa or back to Bangladesh. And so as a result, they're walking around the streets. Fearing getting arrested for overstaying visas. And so that makes them prime targets to just be thrown back into a compound because that's easier than living on the streets.

Well, yeah, I mean, it's— there's no repatriation plan. So if you took somebody who was poor, I mean, that's— I mean, a lot of people taken, I assume, don't have money to begin with. That's part of the lure, right? They're poor. They obviously don't have their documents now because they've been stolen from them. Yeah, they're going to need a way to get home. Just showing up on the compound isn't going to be good enough. It's not like they're gonna buy a ticket and go home. You know, they can't, they don't have ID, they don't have money. So yeah, that seems like half a solution. I mean, it's better than zero, I suppose, but it's half a solution.

It's half a solution.

Yeah.

It's half the solution.

That isn't enough. You know, if you build the most beautiful bridge in the world, but only goes halfway across the river, you're gonna end up wet. It's, it's not a good way to go. And this sounds like the same thing. So listen, this is horrifying. Obviously, I, I'm, I'm very appreciative of you taking the time to educate people and to talk about this and, and just your work in general. I've been a big fan. For a while, and I'm honored that we had a chance to talk about this. Like, obviously we could talk a lot longer about this, but what can people do to help? You know, Operation Shamrock, can people reach out to you? How can people get involved? How can anybody who's listening or watching this help?

Thank you. I've got a lot of ideas. So I have a website, it's called operationshamrock.org. If you know someone or related to someone that is a victim of this, on my website I have tons of victim stories, and I've heard from victims that they are very— oh gosh, it, it, it makes them feel less alone to see that there are other people who have suffered in the same way that they did. If you are interested in doing more than that, we have something called Train the Trainer, where we every other month do a training where we will teach you how to teach about this. We'll give you a slide deck, and we'll encourage you to go tell your Rotary or your book club or some dinner guests about the scams that are out there. We just need to keep talking about this. You can donate to Operation Shamrock, or you can just as easily watch my podcast. And I'm on YouTube. You can subscribe on, on Spotify or Apple Podcasts. I've, I developed a podcast called Stolen because that's exactly what is happening here. People's lives are being stolen, their money's being stolen, their, their individuality is being stolen. And, and I talk at a level where my Aunt Terry can understand what's happening out there. Because I'm here to tell you, that's who needs to know about this. The bankers know about this. Law enforcement knows about this. But you know who doesn't know about this? The people that play pickleball with my Aunt Terry. So that's why I, I did that podcast.

Well, and that's fantastic. And, and you're right, you know, it's— we've got to be able to reach out to individuals. You know, I've, I've had presentations on, you know, cybersecurity for non-professional, non-technical professionals, things like that. You know, Practical Cybersecurity, I do that every year. For, you know, Cybersecurity Month, things like that. Because the average person has more technology in front of them than most people did generations ago, even very technical people. And therefore, they are within reach of bad people who want to do bad things. And we don't do a good enough job of training anybody on that. Whether it's your phone, whether it's your computer, God, whether it's AI technologies now, which have just been unleashed on the world with basically no training. So it's, it's, it's important to have organizations like yours and people like you And, and gonna be me, cuz I'm gonna volunteer to, to, to get out and try to help with these things because, you know, we've gotta stop both sides. Obviously, I can't go fix the big macro problem you talked about. I can't help governments punish, you know, punish each other and kick them outta the financial systems. I'd like to do that, but at least we can try to starve the other end of it as much as possible and, and see what that does to help put pressure, you know, on, on some of these groups. I mean, criminals, again, they're coin operated. If there's money, they'll be there. If there isn't money, They won't. If this isn't a profitable business, they wouldn't be doing it. So, you know, we can help dry that side up too. So again, I really appreciate you, everything you do. You, I rarely use the word, but I would, I would probably say heroic. Yeah, I think I really think so. I mean, it's, it's the kind of work that people don't, don't do. You know, people don't know about this and you're, you're helping people, you know, in ways that, that many people will never have that kind of impact on the world. So I appreciate it. Now that, that in mind, we're gonna transition to, we do have the closing question of the show, of course. And the name of the show is Unspoken Security. So, with that in mind, you get the same question everybody does. Tell me something you've never told anyone, something that until now has been unspoken.

So, I talk all the time. So, as I sat here, I was trying to think. I was like, what have I never told anyone? So, I thought it has to be something recent. And I'll tell you what it is. I got Girl Scout cookies at the grocery store yesterday. And had not enough time to have lunch today. So I had Girl Scout cookie lunch and it was delicious.

Absolutely. What's your Girl Scout cookie of choice?

Well, you know, I do love a Thin Mint. You cannot go wrong with Thin Mints. Yeah, absolutely. But you cannot beat a frozen Tagalong chocolate peanut butter. And I had more than I should have had for lunch. That's what's unspoken. I've got a little bit of a tummy ache from the Girl Scout cookie lunch.

Well, we all do that. I mean, it's for a good cause. That's what I tell everybody. It's not that I want the cookies, it's for a good cause. I feel obligated to help them. And yes, if I eat, you know, Thin Mints by the sleeve, I don't wanna hear about it.

It's fine.

That is a serving size is one sleeve of Thin Mints and, or one box of, of Samoas. Those are, that's a serving size.

Well, and honestly, those sleeves have gotten smaller.

They have.

Yeah.

Well, I've gotten bigger, so they, they seem to be doing their job.

So it works out. It works out.

Yeah. Seems, seems to work out just fine, but it's, that's, you know, I applaud you. That's a good lunch in my opinion. You know, not every day perhaps, but no, I'm, everybody who knows me knows I'm a sweet tooth and I'm a sucker for that. And I, I've, I've been known to eat cookies for breakfast or lunch or, or all 3 meals of the day. So, but it's interesting to hear, you know, and the kind of work you do, you know, a little sweet is, is also nice. You know, you need a treat. I'm sure it's hard to do the work you do and, and see and hear the stories and keep your, you know, keep your head up and keep trying to do good things. So again, I appreciate it. I'm gonna wrap it up. Is there any last things you wanna say? I, we already talked a little bit about plugging Operation Shamrock, of course, but is there anything, anything I missed? Anything you wanna add before we close out the show?

Yes. Go tell two friends. Tell two friends about this. Tell two friends how bad this is. And if you take Ubers, tell your Uber driver. I always tell my Uber driver.

Well, that's a good idea. Sort of a viral approach to, to spreading the word. I mean, I, I think it's a great idea. This is the kind of thing that everybody needs to know. We're all potentially impacted by it. So I love that. For what it's worth, anybody listening or watching, also tell 2 friends to subscribe to the podcast.

Sure.

I'd appreciate if everybody did that too. But let's start with Operation Shamrock. It's a hell of a lot more important than the podcast, frankly. My podcast, at least. Hers is important.

All right.

Well, listen, this has been a fantastic conversation. Very enlightening and interesting. Sad, but important. So I'm going to go ahead and wrap up the show at this point. Again, thank you very much, Aaron West, for being here. I appreciate you taking the time and I appreciate the work you do. For everybody listening or watching, thank you for taking the time as well. I know there's a lot of other things you could do with your day. If you like the show, please, you know, feel free to subscribe, leave comments. If you don't like the show, shut up. I don't want to hear about it. No, I'm just kidding. I say that every time, but please tell me. I, you know, the show is about guests and about the audience. It's not about me. So always trying to make things better. Um, and please do tell people if you like it. We do want to continue to grow this show so we can have amazing people like Aaron come on and tell us, you know, things that we don't know and the things that we need to know about the world so we can, uh, all be a little bit safer. So with that, I'm going to go ahead and close it out today. Thank you again, everybody. This has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.