#12: How to Become and Stay "Cyber Secure" feat. Kayee Tong

Welcome to the Passive Income MD podcast where we talk about creating your ideal life through multiple streams of income. I'm your host, Peter Kim. If you enjoy hearing about this stuff, make sure to hit subscribe so I can bring it to you every week. Now let's get on with the show.

Hey everyone.

I'm super excited about today's episode because this is a topic that's extremely relevant considering all the news that we've been hearing. And this is something that I've really been concerned about for so long. And in particular that topic is the topic of cybersecurity. How to make sure all your transactions are safe online since we do a majority of our banking and everything online. How to make sure your accounts are safe and secured as well. And I found an expert in this field who's actually part of the medical community. If you are on the White Coat Investors Facebook group or on my website at least Passive Income md, he's been a guest on there as well. His name is Kai Tong and he's actually a third year medical student at utmb. But he has an extensive history in some of this stuff and I'm going to let him explain it himself. So, Kai, how you doing? Welcome to the show.

Hey Peter, how's it going?

Going great. I'm really glad you're here. I know that we struck up a conversation online about this and I know that you've been really proactive about getting this out to the physician community, in particular about how to be careful and be safe. And considering all a bunch of the news that I've heard recently about some scams, some wire fraud, these kind of things, I thought this might be a perfect topic for people. And so can you tell us a little bit about your background besides being a third year medical student? Tell us about how you got involved in this field.

When I was young I was very interested in computers. I had a computer science major in college and I also have been doing cyber security consultant for a while. Some security audits and bug bounties as well. But yeah, and just monitoring the dark web and you can see quite a few things here and there.

Okay, let's talk about some of the things that you mentioned because I'm not familiar with all those terms. What's a bug bounty? What does that mean?

Bug bounty is when you look for bugs in software and some companies will pay you for that. So if you, for example, let's say if you found a bug in Apple software, they might pay you $10,000 or $20,000 if it's a serious bug.

Right. Are there companies that in terms of cybersecurity, like you try to go and crack in and that sort of thing, and they pay you as well if you find flaws?

Yeah. Also like, for example, if you noticed Robinhood had some issues issues before, it's like the free brokerage, right. Someone borrowed a lot of money on margin and they couldn't pay it back because of just one bug. So.

Yeah, gotcha. And you mentioned something called the dark web. What is the dark web?

That's a long story, but I'll keep it short. So for the dark web, mostly there's a lot of black market things being sold. Credit cards, medical records, drugs, obviously, and there's a bunch of other stuff. But I think the main ones that personally we like as physicians, we should be more worried about is on a personal level, definitely credit card. Any identity theft for hospitals, they might be more concerned about medical records, health records, people like HIV or just sensitive information just from like the hipaa. HIPAA and all. People want their privacy. So that's very important.

Gotcha. I mean, I've always been really super paranoid about identity theft. I know I've actually heard of some people it's happened to something as simple as getting their Facebook account hacked and that sort of thing to all the way kind of getting their bank accounts hacked and that sort of thing. And so I've been super paranoid about that. I even bought something called identity theft insurance. You think that's helpful at all?

First of all, I mean, it's not something that would guarantee that you won't get identity theft. Usually it's more of a monitoring issue and they might give you some tools to monitor it, but you still personally have to look at your records, preferably at least every month. The insurance, they pay out certain things, but they don't really pay out everything. And it's also, I think as physicians, time is pretty important. And just trying to get through all that stuff, if you do get into identity theft is a pretty big issue.

Right. I think the part of the insurance is that they'll take care of it and kind of handle all these issues to kind of get things cleaned up with your credit cards, your bank accounts and that sort of thing. So I think that can be ultimately, like you said, a time saver. You know, and I'm scared about people logging into my accounts and breaking in and that sort of thing. I mean, in terms of your opinion, what are the best things that I can do or anyone listening to this can do to try to Safeguard their accounts?

Yeah, I mean, that's a very good question. So the first thing anyone should do is they should set up two factor authentication for all their online accounts, especially the more important ones. So email is the first one. Any of your, like, bank accounts, they may not use authenticator apps like Authy or Google Authenticator, so usually that would be your sms, but yeah, that's. So I would go with insurance, tax, financial accounts, even Uber or Lyft, Airbnb, you know, those. Those accounts sometimes can get hacked. There's a lot of things that can happen. Amazon, Email, and even I've seen. This is way back. But like your Delivery apps like DoorDash or stuff like that, those have gotten breaches before and people have reported that some use their credit card on those sites. So. And I've seen those accounts being sold online on the dark web, so that definitely is something you can tell before they report a breach. That you can, you can tell, okay, these companies, they probably have some accounts that are being breached and you probably want to step up some security, maybe remove some of your credit card information if you, if you're, if you can do it before. I mean, it's pretty hard to keep up with all of them because, I mean, everyone has all kinds of services that they may or may or may use, but they might forget, oh, like I put my payment information there and it might not be secure, you know.

Yeah, I mean, I've gotten a bunch of emails over the last year or two that states that your information might have been kind of compromised. So is that one of those things where I should. I usually kind of just say, nah, you know, I kind of let it go and I kind of monitor that credit card, I guess, just in case. And if there's an issue, of course, report it to them. But is this something that I should be going in immediately and wiping the personal info from, or what do you suggest?

Yeah, I mean, like I said, the first thing, definitely set up two factor authentication and change your passwords fairly frequently. I know it's hard to keep up with that. So maybe a password manager would be a good way to kind of manage all those different passwords. But yeah, I mean, and just very basic stuff like set auto updates for your browsers and operating systems. So if you use a Mac or Windows, especially Windows, you definitely want to update it right away. Because these people that want to breach anything, they'll find ways. And the first thing they look at is the easiest one, which would be, okay, what vulnerabilities have been disclosed and they start from there. So if you didn't update it, then those vulnerabilities are still there on your computer.

Gotcha. Okay, so you should set up for automatic updates for your browser and all your stuff. Set up two factor authentication. And primarily the most of the way I've seen that two factor authentication happens is not through like an authenticator app like you mentioned, but most of it is through SMS or text. Now is that pretty secure as well, or is there something I should be worrying about there?

Yeah, you actually touched a really good point. So phones are actually not very secure. It's actually really easy for any hackers. If they felt like it was rewarding enough, they have ways to kind of trick the phone companies to port your phone over to them. That means they can actually get those SMS and intercept them. If they have your password and they have your sms, then they can still get into your account. So that's another issue that with sms it's not as secure because everyone has like a phone number attached to their full name on a database somewhere, at least most people do. And if they know anything like email, they might be able to figure out your phone number just from that. So it's not like it's not very secure in that sense because it's pretty easy to figure out like what passwords do you use, what phone numbers do you have and figure out from there. Okay, how can I hack into this account? You know?

Right. I mean, Allstate is kind of freaking me out, but how often is this stuff happening that you're seeing out there? Is this something that I should be, I guess, constantly worried about happening? Or is this kind of only for the big fish? Do they go after?

Yeah, when physicians buy homes, they tend to buy the zip code in zip codes that these hackers would target for like anything from credit card fraud to identity theft. So it's not a uncommon thing. It's maybe about anywhere between like 5% or so, give or take, but it's a possibility. And nobody is really immune from this. They'll go after really big companies, smaller investment firms, smaller businesses, which include practices as well, and also high income professionals, obviously.

So, okay, I mean, I know we can set up two factor authentication, but is that enough? What other measures can we take in terms of changing your password, often doing the two factor? What else can people do to minimize their chance of kind of getting hit in this scenario? And is there something that they should be doing otherwise to protect themselves?

So I think I'll go over like the last, most pertinent type of prevention measures. It's definitely when you look at your emails, some of the really obvious ones are like the Nigerian emo scams. Everyone knows those. But. And they're pretty obvious. But sometimes if, like, for example, if you're buying a home or if you decide you want to invest in some real estate for any syndications, they might ask you to wire money to them, right? And that's within the normal course of business. But if your email is compromised or their email is compromised or their systems are compromised, they can figure out who to send emails to and try to make it seem like it's real and give you wire instructions. Some of them are really tricky, so it really depends what it is. But the first thing I would look for is if they say it's really urgent, that's usually one like really telltale sign that something's wrong. Because usually they don't ask you like, oh, like send it right away. Or if something bad will really happen. That doesn't happen usually. And the second thing is they may look really legitimate, but if their systems are not compromised on, let's say, the escrows and, or whoever the investment firm is, if they're not compromised, they might just be using a email that might look similar to the official email they have. It might be like a letter off and that may tip you off. And yeah, the last thing is definitely, if it looks real enough, don't hesitate to always call someone to double check and confirm. Not from any information in the email, but like, let's say about you're buying a home and you want to put a down payment on the home, wire money to the escrow company, definitely call the escrow company, someone you know in person, call them, say, hey, like, I got these wire instructions as, is this the right one? Double check. It doesn't hurt. You know, people have lost significant amount of money on not just the down payments, but the full price of the home if they're paying in cash. So that's a pretty big one to look out for, right?

I think that's one of my biggest fears. I mean, credit card fraud is one thing because, you know, you notice an errant charge on there. You might call the credit card company, they'll refund you, they'll send you a new card. I mean, that's one thing. But when you actually go to wire funds for, like investing in a syndication or a fund, or when you're purchasing a property, whether for yourself or for rent, I mean, we're talking 25, 50, hundreds of thousands of dollars on a wire transaction. That's when I get paranoid. And I have heard stories even in this last year. I mean, there's one in the news right down, you know, a couple hundred thousand dollars, someone lost their down payment. There was also one where a physician was trying to invest in a syndication. They wired something to actually a non legit organization and then that money was gone. And so yes, I've talked at length to people about doing just that, which is that whenever I get a wire instruction, I will call the company again, not using the phone number, even on the instruction sheet. I'll make sure I find an independent phone number from either an email or somewhere else I got from them, or even look it up online and Google it. And then make sure I talk to somebody that I know or have talked to and have them verify who they are first and potentially ask some questions just to verify. And then I'll ask them for their wire instructions and I'll do at that point. But I mean, honestly, every time I send a wire instruction and I have to, I've done it quite a bit now, I still, there's always that little bit of that fear and unfortunately that's the case. But I tell everyone, yeah, you got to verify, double, triple check it, that sort of thing. Because honestly, once it's gone, it's gone, right?

Yeah, it's irreversible. And I think a lot of people don't realize though, for wiring, it's, it's literally one way, it's not reversible like credit cards like you said. So as long as you check your credit cards every month or two even, you'll be fine. But yeah, the wires are, it's really hard to recover it. Let's just say that if you send it out.

Right, gotcha. I mean, if this helps just one person avoid any sort of wire fraud in the future or helps secure someone's account just a little better so they don't give up some personal information, then I'll feel good about this interview. Are there any other tips that you can give people to stay safe out there in terms of securing their accounts or cybersecurity? Anything else you want to leave us with?

I guess the last thing would be it's really hard to get perfect security. There's so many aspects. I've only covered very basic aspects. If you can just do slightly better than everyone else, you probably come up ahead because they usually go for the easiest options that pay the most. So yeah, I mean just these very basic rules won't necessarily be perfect. But, I mean, I think you'll cover a very good range of potential things that can happen.

Gotcha.

Well.

Well, I want to thank you for just kind of making people aware. I mean, you've been very proactive. I've seen on a lot of the Facebook groups. But when you hear about something letting people know, and I don't think you're doing it out of trying to cause alarm or trying to cause any sort of pandemonium out there or any sort of paranoia, I think you're doing it because you're just really trying to help people and alert that this is a potential and possibility. And so I want to thank you for bringing that to people's attention. I hope this has helped a lot of people. And please come on back on the show if you learn anything more that can help us in this area. Cause I think this is something that we can't ignore. Please feel free to come back. But I want to thank you for your time and your expertise and thank you so much. Take care.

Yeah, thank you, Peter. Thanks for having me. You take care, too.

All right, see you guys. Enjoy. We'll see you next time. Enjoy the show. Let me know by dropping a review in the podcast app you're listening to us in. And if you haven't already, make sure to hit subscribe. Are you part of our community yet? Join 3000s of physicians who are also on this journey to creating their ideal lives through multiple streams of income. You can join us on our Facebook group, Passive Income Docs, and you can always learn more at our website, passiveincomemd.com thanks again for allowing me to be a part of your journey. See you next time.