062 John Sileo - You Don't Have to be a Victim of Cybercrime!

In just a few seconds, we've got another amazing leader for you on Walking the Walk. But first, are you a member of the Sensei Leader Movement yet? And if not, why not? Your success as a leader is measured by one thing: the success of your people. And you're at your best when, and only when, you help your people perform at their best. Our mission is to help our members inspire, empower, and guide the people you lead to their very best. Our first level membership is free, always will be. Now I don't want to keep you any longer from today's guest, so just visit SLMJoinFree.com for all the benefits and join the Sensei Leader Movement today. You know, sadly, every time we face a crisis or a disaster, there are scumbags that are just ready to take advantage and rip us all off. And today it's even worse because we're so vulnerable online. Well, how can you protect your identity and keep your personal and professional information safe? That's what we're talking about today with John Cillio.

People who inspire, empower, and guide us to our very best. Leaders who are walking the walk. Your host, leadership activist, author, and founder of the Sensei Leader Movement, Jim Bouchard.

John Cillio is one of the world's leading experts and speakers on identity protection and cybersecurity, and he gained his expertise the hard way. He was ripped off, and I mean badly. John, let's start there. Can you give us a little bit of a brief on what led you to this career? I mean, that's a rough story, brother.

Yeah, you want case number one or case number two?

Whatever you'd like to share.

I'll go quickly through both. First time was just kind of garden variety identity theft, personal identity theft, where a crime ring that are called the Cashmen, they drive around in a garbage truck and pluck the documents off your curb when you don't shred them, sold it on the dark web. And a woman, in my case, Rosemary Serrano, bought my identity off of the dark web and used it to buy herself a home cross-country in Boca Raton, Florida. And then she went— she defaulted on the loan. She declared bankruptcy using my Social. And it was just, you know, chaos for a year trying to prove that I hadn't done this.

And then they hit your business.

And, and yeah, in the, in the meantime, because I was so focused on that, my best friend, who also happened to be my business partner in a very successful software company we had started, took advantage of that to fund some habits of his, used my identity to embezzle from our clients. And I spent the next 2 years in criminal court fighting to stay out of jail and prove that all of these bank transactions he had committed using my logins, right? He was using my identity to commit his crimes. It took about 2 years to prove it wasn't me. So, I lost everything, everything but my family in that process. And, that's how I came to writing my first book and making my first speech. And, I've been doing that for the last, gosh, 14 or 15 years now.

Believe me, I've been to jail. It's no fun, you know. But let's start with this because a lot of people have some misconceptions about what you're really trying to preach here. And there is the garden variety stuff, like you said. Yeah, I had some— well, it was the bank's trash that was actually stolen and somebody was kiting checks on my business account. They didn't even get it out of our trash. They got it out of the bank's trash. And, you know, one not too long ago, I think it was, I'd gotten a notice that my Facebook ad account, the payment information was wrong, but it didn't feel right. It looked like the logos, everything, but when I clicked on there, it took me to a form, and I knew, it said Facebook doesn't ask you for a form. They ask you to log into your account, but so many people fall for that, and they think, right, that's one of the ways we can get into trouble.

It's not even only one of the ways. It's probably both on the corporate and the personal side, those phishing emails, as we're all we're all familiar with them now, are probably the most invasive of all, because what you're doing is either in your case, you are uploading probably your account information so that they can—

Oh no, I didn't.

As you, right? Good, good.

Nope, this doesn't look right. Yeah, yeah.

The rest of us, however, populate those things and hit the send button. The other thing that you do is you download malware, right? You're clicking on a link and saying, go ahead, you can install this on my machine. You're literally giving consent. And on the corporate side, you know, while we think this is all kind of just the personal stuff that we get in our email, this is what brings so many corporations down. I mean, the Anthem data breach, 80 million of our medical records, was because somebody clicked on a link in one of those emails.

Really?

And that, that malware onto a system. Not only did somebody click, but it was their security person. It was their system administrator. So it shows you how difficult it is sometimes to detect those. We, you know, we think we're so good at detecting which ones are fraudulent, but they've gotten really good.

No, you're right about that. And that's the thing too. And I certainly don't want to rank on the guy because any of us could do it. And in one of the interviews that you did, I don't remember if it was the 60 Minutes interview you did for the Australia thing or was it one of them that I watched? And you said that most of us, when we're not in a moment of panic, right, we might be able to be a little more discerning. But when we're under pressure, when somebody is saying, you got to do this now, then almost any of us are susceptible to that?

Well, take a look at what's going on right now. I mean, scammers and, and frauds and cyber criminals follow the headlines too, right? They, they take— they piggyback on anything they can. And coronavirus and what's going on, you know, around the country now and will be going on for the next year is probably the most ripe opportunity they have because, you know, they, they can pretend to be selling masks. They can pretend to be your, your workplace saying, here's our remote work at home policy. There's all kinds of things that, that get us to click, and man, when we click, that's, that's when the trouble starts.

You know, you got so many ways to help people, and I want to make sure that folks understand a lot of this is over our heads for the average person, the average business person, especially small, small business people like myself. You know, we need help with this stuff, and you've got a lot of services that, that can help. And we're going to tell— well, in fact, Cilio.com— and we're going to say this a couple of times— and thinklike— was it thinklikeaspie.com?

Yeah, that one's— that's kind of the older identity theft site. We don't utilize that much more because, you know, the cybersecurity side on the corporate side and social engineering, all the stuff that's going on with the corporations, the criminals have kind of moved from the individual cases of theft and into, I want to steal entire million-populated databases.

Let's focus on that then. What are some of the key steps that you start people with, you know, and tell us how you do it? I mean, I think that's really important. You know, there's a lot of people in this space, but you know, you've got some pretty interesting, some pretty unique ways, obviously based on your experience, right, your personal experience. But how do you walk people through, especially a business, how do you walk them through protecting themselves?

Yeah, so the business side, you know, we all kind of treat our jobs like they're secondary to our personal lives. So it's really important to get people involved at a personal level first. So, you know, when I'm in a— when I'm giving a speech, back when we gave speeches in person, I would— I will and will again.

Well, some people will be listening while we're back in business.

So it's good. You know, hack an iPhone in the audience. To show them how much is on that phone, how easy it is, and how much the human beings are at the center of this. We tend to push all of this off onto the technology, right? It's really easy to blame the technology. And yet every breach that we have seen, that we've, we've been inside of and watched, is because a human being makes a decision with the technology.

Okay.

And so, you know, the first thing is it's about the employee in your business that's clicking on the link because they don't know Oh my gosh, there's these scams that are going on. It's about the person who installs the software, but then doesn't look at the alerts on their firewall that says, hey, you're being attacked, and they don't do something about it. So oftentimes that human part is first. And really in a small business, that means letting people know, here's the type of scams that happen. Here are the calls that you're going to get. It's, you know, Microsoft on the phone, pretending to be Microsoft.

Right.

And they need to update your machine because it's running slow. They've got a little information about you. It's probably from your social media profile or your website. Suddenly you're giving them the keys to the kingdom and they're into your data.

The con is always the con, isn't it? I mean, that's interesting. Again, watching some of your pre— and one of the things you do I think is so special, you know, in your live events, is you actually get somebody to give you their purse Right? And you sometimes you go through the content, right? And you're showing them how vulnerable they are, right? The different pieces of information that we carry with us. But still, and I think this was on your 60 Minutes piece too, didn't you go in and buy a bottle of wine with someone else's credit card to show how?

Yeah, so with the reporters, with the woman, it was a woman reporter and I used her female credit card and walked in and bought a bottle of wine. And I can do that in a Best Buy. I can do that in almost any store because people just are not sensitized enough to, hey, I have to verify that this person is who they say they are. And, you know, the purse— you allude to the purse thing. It's not just that I take it, it's that I take it. It's that I then train them on some techniques of how to stop and think about it. Right.

I hope we didn't give people the impression you're a purse snatcher. Yeah, I know that's not what it's about, right?

No.

But then I take it again. Yeah, right. I take it a second time. It's the point here is, is kind of being humble about how difficult this stuff can be. And then when I take the phone out of the purse and I hack into a 4 or 6-digit passcode and I do a down swipe and I type in the word bank and it gives me their bank.

Yeah.

And I then surf to the bank and get in because I send the two-factor code to the phone that is in my hand. I mean, there in 30 seconds, I have control of their bank account when we'd think, oh, because I have a password, I'm Totally safe.

No, and you know, the reason I was bringing that up too is because, you know, I've seen almost every conference that I work at these days, there's somebody doing cybersecurity to some point, right? And I got to tell you, and I'm not disparaging anybody, they're giving good information, but dry as toast, you know what I mean? And the way you're interacting with the audience and the way you're, you know, you're getting them to share their purse with you for a little bit, and they're having a ball. I mean, they're still getting the, you know, great information. You're very serious about the consequences and whatnot, and you're very good at, I think, shifting back and forth. But people are having a good time, and I think that's one of the things that makes your presentations pretty special.

Yeah, thank you. That is really, to me, if it's not memorable, nobody's going to remember it. And if they're not engaged, they're not going to care.

No, that's for sure. What did you— do you mind me asking you this? With the business one, how did you fall to that? I mean, personally, you know, what was it? Was it trust that you extended? Is it just a failure to check up like you've been talking about? What was the moment, you know, that you look back on and say, geez, if I had just done that differently, wouldn't have been in this situation?

You know, excuse me, there were indicators early on. So this was somebody that I had known for a couple of years, had done business with And, you know, it ended up being this insider in my business, which for small business is incredibly common. And there are people that maybe have been there and we have known, but their circumstances change. They have a divorce or a bankruptcy or a medical issue and they need money.

Okay.

In my case, it was my friend, my rock climbing partner, business partner Doug. He was trying to cover a life an alternate life that he was leading and didn't want— in spite of being independently wealthy, didn't want his wife seeing the expenses that he was having. So he had to fund those from a different source. Now, I have to tell you that generally when we go back and we forensically look at these type of frauds in small businesses, somebody in the business has had a sense that there's a problem.

Right. Right.

Say something. They don't, they don't listen to their gut. They don't speak up. They don't tell leadership. They don't do more investigation. And almost in every case, they had some sense that was going wrong. In my business, it was my wife. She told me early on, you know what, this is too good to be true. He treats us too well. You're making too much money. There is something that's wrong here. And she was absolutely right. If I had listened to that and just done more due diligence, you know, when you take on a business partner, it's like taking on a spouse, right? When you hire somebody, it's like bringing somebody into your home, especially in a small business, and doing that vetting and knowing that they're trustworthy and having some oversight makes all the difference in the world.

It does. You hit on such a key point as well. And you know, you have a martial arts background too, which is really cool.

Yeah.

And we're taught all the time, right, to, to trust your gut. I think people have a kind of a misconception of what that's all about too. It's not just that you're kind of going with the vibes in the universe and all that You know what it is? Your gut, your gut feeling is based on something very tangible. It's based on your experience. It's based on your training. It's based on your preparation. When we say go with your gut, it just means the way that our brain— our brain is designed to take shortcuts, right? And so that's what it is. That feeling you have is based on your experience, and you need to trust it. You need to trust it at least enough to do some diligence, right?

Yeah, exactly. And if you can trust that, and that's literally when I'm doing the purse snatching and the iPhone hacking in the audience, that's all what we're doing is we are reorienting people's relationship to their gut and to hang on, why, why am I doing this? Let me pause for a second and think about this. And that one response, you know, we call it the hogwash response, the BS response. That reflex is the key to every other form of cybersecurity and fraud protection down the road.

Let's pick that up on the other side of the break, 'cause that's a key point. We're gonna talk about, you know, how to, how to recognize that smooth talker, how to recognize you're being played. Okay. Does that sound good?

You bet.

This is John Cillio, one of the best cyber identity— what do you call it? Cybersecurity identity theft protection guys on the planet. Can we say that?

I'll take that. You bet.

All right.

We'll be right back.

Cybersecurity is not a luxury. If you're online, even if you're not online, you need to protect your identity. It's that simple. And John Cillio can help. He shared his experience with hundreds of organizations, universities, and associations of all types as one of the leading speakers in this area. And no matter what the size of the company or the technical experience of the audience, John makes sure participants are motivated and educated to change their relationship to data security. You know, you've been hearing John's story, and he ultimately turned that experience into his greatest success as a renowned cybersecurity expert. From real-life experiences with cybercrime came the first of several books, a great love of sharing what he's learned, and a profound mission to help others defend data and tap into the resilience that defines who they are. Learn more about John and his work at sileo.com. That's sileo.com. The research is bombproof. People perform at their best when, and only when, they know their leaders care, when they know their work has meaning, and when they have the chance to learn, grow, and develop. To accomplish this, We need to connect with the people we serve, the people who trust in our leadership. Leaders today need emotional intelligence, strong interpersonal skills, and an accurate sense of self-awareness. I'm Jim Bouchard, leadership activist and founder of the Sensei Leader Movement. The sensei enjoys a very special relationship with students. It's one built on respect, trust, and loyalty, and these are also a leader's most valuable assets. I help you build these relationships. I work with you to help you inspire, empower, and guide your people to their very best. That's what the best leaders do, and that's what the sensei does. My job is to help you be the sensei so you can lead your people to their very best and yours. All right, we talked about how to reach John at sileo.com. Sileo.com. I, I had put the other site on that spot when I recorded, and I chopped that off real quick, so if you heard a little glitch. That's what that is. And also, and I'd be remiss to say, if you'd like to book John, I mean, you go to that site. And also, Alex would be upset if we didn't mention she's been out working hard to share your message too, armstrongspeakers.com. So either of those places and you can get in touch with John. And right now he's available. We're all available, right, to do online work and virtual training. There's no reason that we need to slow down. In fact, I think more than ever, you need to be paying attention to what John's talking about and access his services online right now, right, John? You're willing to work with organizations that way?

Yeah, in fact, to some degree, the need has ratcheted up because of remote workers. Yeah, yeah, we go to a virtual office and we open up all kinds of back doors into the corporation.

How do they get to us? I mean, you know, that's the thing too. What a strange twist in nature that sometimes the smoothest, most charismatic, attractive people are the ones that can lure us into the worst trouble. What are some of those tells? I know you were talking about some tells. What are some of those tells we can look for, you know, that we know we're getting scammed here?

Well, and you never know if you are. The point is to be a little skeptical with what you give away until you're certain that it's legitimate. It's kind of the, you know, we used to say trust but verify, and now it's verify and then trust. Trust. And really, it's, you know, if it's too, too good to be true, if it's too bad to be real, if it's too dramatic in some way to be worth your attention. And the tools that these criminals and fraudsters use are things like emotional appeals. You know, so right now, you know, with the virus going around, we're all wanting to know what can we do? What's the latest news? Those emotional appeals. Things like fear. They use fear a great deal that if you don't do this, you will cause harm in some way. Really, most of us already have built in a sense of something's not quite right here. It's not that we don't have the sense, it's that we have been kind of manipulated out of listening to it and pausing for a second. It's that, you know, it's kind of like washing your hands for a full 20 seconds. Like, yeah, it's a little inconvenient, but it works. And the same is true when you see that email or you get that phone call and they say, hey, you know, this is your IT support team where we need to upgrade your system or you're going to be responsible for a breach because your software is not up to date. Can we get your username and password? That momentary pause, 5 seconds, 10 seconds, where you think through, is this legitimate or should I do something else? Everything starts to be clear after the 5 or 10 seconds. But when they're rushing you and they're, they're flushing cortisol through your brain and, and making you fear that, you know, that something negative will happen, that's, that's exactly when you should stop and say, hang on, I got to investigate this and ask some questions.

Well, I imagine, too, even in a small, smaller operation, right, they usually have— if the person is not on site, they have some sort of dedicated tech person. In larger companies, you've got the tech people walking around all the time. Isn't it a matter to just pulling back and say, I've got to check with, you know, Sally from IT, right?

Exactly. That's, that's the, that's the pause right there. That's the verification. And when they have a great excuse, well, if we don't do this now, you know, here's what will befall you, then you start to know, hang on, there is almost nothing in this world technologically that has to happen right this second. I could take 30 seconds, a minute, 5 minutes, and work this out, think through it, ask the right questions. And that's exactly the right response is get in touch with your IT person. Give somebody a call that you know deals with this type of stuff. If it's a small business, I call James, my IT provider, and say, you know, hey, is this legitimate or not? Or I'll email it on to him.

I'm not a big fan of one-offs, you know, because especially the things that are most important to us, it seems sometimes those are the easiest ones for us to forget about. Right? So, I'm a big believer in discipline. So, it sounds like this is something you don't just want to put up a poster or have, you know, well, I guess a seminar once a year would help. I mean, you know, bring you in or somebody like you to do at least that, but I think you still need ongoing, right, contact and updates on what the current threats are, no?

No question. I think there's kind of a couple of misconceptions that you can do this all, you know, purely by dry email. Or that you can get it all done in October, which is Cybersecurity Awareness Month. And for your company, you can have a one-time event. And it's a combination of a live event when you can have it is a great way to get people personally engaged and get that ownership. Then the knowledge, and you don't want to overwhelm them. A day-long thing, too much. An hour, a couple of hours, and then followed by, you know, some, some humorous but informative videos. That's incredibly helpful. And as you can see right here from, from the crisis we're in currently, it changes by the day and by the week. So doing it once and saying, OK, here's the scam today. Well, tomorrow it's not going to be that scam. It's not going to be based on the hurricane. It's going to be based on the virus or the next thing to come, the Olympics, whatever it might be.

Glad you said that, too, because one of our friends, another friend in IT, you know, he talked about that. He said as much as hard as they work, all they're ever doing is catching up, right? The crooks are always— they always have the first step.

No, no matter what, because of the structure under which they work, which is no bureaucracy and working conditions, you know, they're, they're the original remote work from home. They work whenever they want. They work when we're resting. So, you know, they can spend time pinging our servers and our people when the rest of us are sleeping, and they're very good at at understanding what the weaknesses in the system are. So yeah, you're exactly right.

And some, some of these guys just walk the fine line of legality too, right? I mean, a lot of the malware— I was hit twice with this stupid Akamied malware, and it's just a nuisance thing, but oh my God, what a nuisance. I mean, I spend a lot of my day on Google doing research, and for that browser to be hijacked to, you know, purchased search results which were garbage. It was just a pain.

And it—

oh, it is. And it's not illegal.

I mean, technically, right? Yeah. Yeah.

Adware and spyware and stuff. It's—

it's—

so you're right, it walks a thin line. And you bring up a good point for small businesses that I want to make sure we cover, which is, you know, when you do click on that link and you, you download a piece of malware, the most common type now for both corporations and small businesses is ransomware.

Right.

And it's where it freezes up your machine, it encrypts it, it uses the good side of technology encryption, and it freezes your machine, and then it works its way to the machine next to it and anything that's networked, and you have to pay a ransom to maybe get access back. That is probably the one of the most devastating things. If you were to have all of your data, all of your computers locked up, and if you don't want to pay the $50,000 or $60,000, you don't get it back. The key here for, especially for the small business, is to have a really robust offsite backup program or backup plan is even better, where you have the data in multiple places. It's not connected to the internet and it's not in your office. And the average small business has not taken those steps.

Are the commercial ones like iDrive and Carbonite, are those pretty good? Is that adequate?

You know, I'm a huge fan of iDrive. It's, it's kind of my backup backup. So I have an internal system, right? I'm an Apple user, so I use Time Machine, right? That's great for, for local stuff, but I want to have another version that's encrypted, that's safe, that's in the cloud. The nice thing about iDrive is it has a version that lets you put a copy on a hard drive. So once a month, come hell or high water, I have a copy of the most important data on on that physical device that is removed from my office. I have multiple, you know, multiple drives, only $100 apiece.

Right.

And I always have a way to restore if they, if they lock me up with ransomware, I have a way to go back, restore from that backup. And quite frankly, the biggest problem is people never test the restore. They never try and see what happens. Yeah. And the fact is They're often faulty the first time because you haven't set it up right. So having an actual technician come in, try it, restore from the backup, make sure that things work properly, that's key.

Yeah, no, that was a big help to me because when I got hit with that one, I finally got to the point where I just reformatted my hard drive. And thank goodness I had Time Machine and I had Carbonite. So yeah, that was kind of comforting. Let's— guys, I could listen to you all day. For the next few minutes, we've got just about 4 or 5 minutes left, let's, if you don't mind, you know, usually I would ask somebody, imagine yourself in this position and tell us how you— but you've been there. So, you know, let's go to the worst-case scenario. You know, you got into that situation where you were facing, you know, legitimately facing the possibility of jail and, you know, losing your business. It's amazing how resilient you were to come out of that. I mean, you know, I wouldn't blame you if you'd put a gun in your head at that point. How did you get yourself out of that?

You know, the first key was not putting a gun to Doug's head, my business partner, and working through kind of the anger.

That would have sent you to jail too.

Yeah, yeah, exactly. And when you go through something like this and you lose everything, I mean, we're talking about, you know, money, houses, you know, it's devastating.

Stress on the family.

Mm-hmm. Stress on the family, on the marriage. Revenge is the first thing, and letting go of that bitterness was such a great thing. And, you know, this is where my taekwondo came in. I really had to do something physically to deal with my anger, to get— to help me get, get the energy out so that I could deal with it mentally, right? And at some point, my wife You know, it was probably 2 years into my criminal trial. We'd lost everything on the business side. She was working a second job to keep things going. And in the middle of the night, you know, we're up, you know, at 3:00 AM worrying about things. And she's like, you got to do something with this. Like, it's, it's time to do something. And it clicked in that case. And it clicked because my, my youngest daughter said to me, you know, where have you been, essentially, Dad? Because I was not involved in my kids' lives during that time. I was just trying to stay out of jail. And, that's when I wrote the book and that was kind of therapeutic and that led to the speaking. So, it was really— the biggest part was understanding that, listen, every one of us gets to choose what we do with all of the BS that comes into our lives, the good stuff and the bad stuff. And, my choice at that point was Listen, I owe this to more than just me. This is more than just about a business or myself. This is about my family. And that's really what I did it for. And I've spent the last 15 years trying to make it up to them for the times when I was not a good dad and I was not a good husband. And that's what drives me. I mean, that's why I still go out and speak. That's why I write. That's why I research. I love what I do. And it was really for the tribe around me.

Well, thank goodness you're doing it. I mean, really, that's inspirational. And again, just happens to be, if you're listening and we're still dealing with the coronavirus thing, we're hearing people, you know, call in every day that are feeling desperate and they're feeling like they've, they've lost everything and there's not much future. So, you know, thanks for sharing your story because that's the kind of story we need to inspire us, right? And help us keep going. You're an amazing man, John.

Thank you. Well, it's really nice to, to be on this and, you know, for people to understand that resilience really is a choice. It's not, you know, it's not something that you get to practice for. You have to implement it immediately. And that's what we're doing right now as we, we survive this and any other, any other crises that come up. We do it together.

Thank you so much. Thanks for being with us today. And again, it's Silio.com, right? Silio.com. Make sure you get, get on that website and see what services John has to offer. And like I said, again, if you go, if we're Who knows how long we're going to be going through the corona thing, so someone could be listening to this 6 months from now and we're still at home, right? But I doubt it. I think we're going to get back on our feet quickly, but make sure right now, get online with him, use his services. Tremendous. And you taught me a lot today. Thank you.

Well, thank you, and vice versa. It's wonderful to have each other through all this.

Amen. All right, John, thanks again.

We hope you enjoyed this episode of Walking the Walk. Please like and share. Our mission at The Sensei Leader Movement is to support and develop human-centric leaders. Leaders who put people first. Leaders who inspire, empower, and guide people to their very best. Be part of the movement. Join and access all our free resources by visiting thesenseileader.com. To book Jim or host your own event, call us at 207-751-4317.