Criminals try to steal your identity - daily! #37

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly— my name is Robert Siciliano, I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being.

So let's get at it. And welcome to The Security Guy and CIA Spy.

I am Robert Siciliano, and this is Peter Wormka, live from Orlando in the hot thick of summer, but I guess Orlando is not any hotter than any place else in this country right now. In fact, I think we're a few degrees cooler than, uh, half of the country.

Yeah, um, Boston, we're in the high 70s, uh, middle 80s, uh, not too bad. I am a mariner, which means I'm on a boat as often as possible. So bad in the water. I will say we've been getting a lot of rain up here. My lawn is as green as it's ever been, which is amazing, you know, with all that heat. But all that rain certainly helped. And my flowers are really pretty. I, I have a lot of flowers.

Oh, that's not— that's just as long as you don't burn them up with the, you know, over, over too much sun, you know.

Tell me a little bit about what you have had going on lately, speaking gigs. Like, just give me a, a heads up as to what that might look like.

Oh, I don't even know if I want to talk about— I mean, I've just came back from Las Vegas. I mean, I don't mind Las Vegas, but it was a heck of a time just getting there with So many flight disruptions. Someone told me actually that because of the heat, that also has an impact on aviation as far as— and that has been part of the reason why we have had problems with flights being canceled, being delayed. Maybe it's true, maybe not, but I certainly had a share of them. A lot of things coming up, fortunately, and giving speaking events at both conferences as well as private events for clients. And also, I think more— I'm, I'm kind of glad in hindsight, with COVID we had the opportunity to do a lot more webinars, people getting used to doing webinars. And I think that's also been an area where I've been able to reach more people, probably, probably you as well, right, through doing online events that we normally wouldn't have done.

Yeah.

And it's also, uh, it's, it's good for the, for, for the wallet, for the bank account, for business, for for remote education is great for, um, the environment. So I'm all about it, you know. I'm all set up, you're all set up, and the more of it the better.

Yeah, absolutely. You know, speaking about, uh, the weather, we always talk about scams, you know, and a lot of times scams will—

will—

a lot of scams are created when there's a crisis, you know. During COVID there were all kinds of scams. Now with the hot weather, I'm just telling, you know, we just ask myself this question. I haven't read anything specifically But I would think this would be an ideal time for scammers also to take advantage of this frustration that people are going through and concerned about, you know, is their electricity— is their electrical grid going to go out? Are their air conditioners going to go out? You know, what can they do? What would they do if that happens? You know what I mean?

Yeah, I'm glad you brought that up. So it's important that everyone is always aware anytime there's an inbound communication, whether it's via email, you know, text, phone, Anybody posing as anybody offering you something, asking you questions and so forth, anytime it revolves around making a contribution, money, anything at all, anytime that there, there's immediacy involved, they're raising your blood pressure, they're putting pressure on you, just simply hang up, delete, you know, just click mark as spam, report as junk, whatever it takes, right? So that leads us into our topics of the day. Worried about identity theft? There is a reason for that. This is via a company called Enzoic. So did you know that an identity theft occurs every 22 seconds? And identity theft can be a number of different things. It could be credit card fraud, it could be new account fraud, account takeover, could be, you know. So an identity theft is, to put it plainly, a multi-billion dollar industry. And the state of affairs has gotten substantially worse just in the last few years. Uh, they're saying it's around $52 billion, uh, you know, which is compared with a jarring $635 billion predicted in 2023 alone. So there's a bunch of different types of identity theft. There's financial identity theft and fraud. One of the most common motivations, of course, is money. And that generally is— financial identity theft and fraud is like new account fraud. They get your social, they open up new lines of credit under your name. Or account takeover fraud, which is they get your passcodes and they compromise the existing accounts that you have. Or like I said, credit card fraud, right, where they get access to your credit card, they, you know, make a variety of charges without your authorization. And then there's medical identity theft to get a hold of your medical ID, you know, whatever that might be, or insurance cards, whether it's in your wallet, whether they hack it online. Then there's synthetic identity theft where they essentially will get your Social, but they might use a variation of your name, not or maybe not even your name at all. And then they use your physical address, usually the combination thereof. And there's no way to really protect yourself from medical identity theft or synthetic identity theft. And then there's child identity theft. And child identity theft happens when they get your kid's Social Security number. And often they'll use your child's actual name and maybe your address or not. And that child, 17 years and under, is now a victim of fraud, and they can use that child's identity, that identity, for a long time. So, Peter, let's talk about the different ways to protect yourself regarding the different types of identity theft.

Well, the one that's at the very top of the list, which is huge, and we've spoken about this, and I know a number of people are doing this, but to me it's amazing that not more and more people are doing this because this is almost a, a foolproof way of preventing this from establishing new accounts in your name by using credit freezes. That is such a simple, uh, solution to prevent this from happening to most people.

And really, a credit freeze is such a no-brainer. Like, all you got to do is go online and just search the term credit freeze and then the name of any one of the credit bureaus. So for example, I'll do it really quick for y'all. So I search C-R-E-D-I-T credit. And I don't even— it's even a typo. Freeze TransUnion, right? All typoed. Look at it and watch. There you go. Credit Freeze TransUnion pops right up. Okay, and here you are. You go right to Credit Freeze TransUnion and click Add a Freeze. A credit freeze is also known as a security freeze. It's the best way to help prevent new accounts from being open in your name. It's absolutely free to freeze and unfreeze your credit. Won't affect your credit score. I mean, what else do you need to know? And then right there you click Add Freeze and it brings you to the page where you basically begin to establish an account, in this case at TransUnion.

I would say that this is important for everybody, but especially, I mean, some of the— maybe your, your parents or your grandparents might not know about this. And the fact is that probably your grandparents don't really need to be taking out additional lines of credit. They're at a stage where They're probably paying for a lot of things in cash. They're not taking out additional credit. They're not checking, you know, if anybody, you know, their credit scores, because it's not important to them. But if they were to do a credit freeze, that would really save them from a lot of different types of problems with identity theft.

Not just them, but you too, because if you're handling your parents, grandparents' financial affairs at any level, you're also going to be the one that's going to have to clean up the mess. So my wife and I, we froze my mother-in-law's credit about 10, 12 years ago. She's like 92, and we've been handling all of her finances since she was like in her early 80s. And we had gone over a house on a Sunday afternoon, and we saw like dozens of credit card applications on her kitchen table filled out, ready to go. And we're like, what are you doing? And she's like, oh yeah, they keep sending me these offers. I'm like, yeah, but why are you filling them all out? She goes, because I need credit cards to take the, take the ladies at the senior center out to lunch. We're like, what? So she didn't quite understand, you know, like that she had to pay the bill, you know. Like, it's just, they get to a certain age and they may not understand the repercussions of what they got going on.

Absolutely.

So we froze her credit and that ended that, you know. So freeze everybody's credit in your life that is vulnerable, including children. Yes, 17 and under, because they are just as vulnerable. And that may or may not protect you from synthetic identity theft, but it will protect you from most forms of identity theft. It won't protect you from medical identity theft, but it'll help. Uh, and as long as you engage in a password manager and antivirus and protecting your devices. That should protect you from most forms of account takeover, right? Uh, medical identity theft— don't carry your medical card in your wallet unless you're going to the doctor's office. Even then, as long as you're going in-network, you don't necessarily need it. Like, I haven't carried my medical card for years. You don't really need it. It's really a generational thing. Like, if you have a picture of it in your phone, that pretty much is enough.

Exactly.

You know, and then what else is there?

Child identity, you know, also with the— it's a little bit different with the account takeover, that gets a little bit more complicated, especially, you know, I like to focus a lot on artificial intelligence and deepfakes and the fact now that, uh, deepfakes can also circumvent some of the things that we've been doing using biometrics to log into your accounts. Like if they use facial— let's say that you use facial recognition to log into your bank, let's say that, that is at risk right now, that the fakes can circumvent facial recognition systems, and they're only going to get better. So that's something we need to keep a— keep an eye on as well.

Yeah, Peter, next time we— next, next show, we need to definitely talk more about that, and I want you to demonstrate.

Okay.

All right. Okay, so just so you know, like, when I search Credit Freeze TransUnion, what automatically propagates in search is Credit Freeze Equifax and Credit Freeze Experian. So right there, it brings you to the page on each of the credit bureaus' websites where you go and freeze your credit.

There's also one page that's put up by the government that has all three of them, but I don't, I don't remember which one it is. But you got to make sure that there's not a, a site that looks just like— you got to make sure you're going to the official sites to do this.

Yeah. And when you search the actual name of the credit bureaus on the first page, you're going to see like the, the actual page for Credit Freeze TransUnion, for Experian credit freeze and for Equifax credit freeze right there. Like, Google ranks it very high in search on the first page within 1 to 2 clicks.

Good point.

All right, and then annualcreditreport.com is a place that you would go with all 3 bureaus where you would check your credit, uh, for free. You won't get your scores, but you could actually check the credit.

You should do that, really important. Definitely.

All right, let's check this out, right? Attention shoppers, credit card skimmers found at Walmart checkout lines in the Northeast. So New York, New England, check this out. We're going to watch a video really quick. You ready?

All set.

Police warning you to pay close attention next time you're in the checkout line. Have a look at this video from a Walmart in Central New York. Right there you can see 3 suspects. What they're doing right here is they're attaching a credit card skimming device to play, uh, to the device where you place your credit or debit card in. The whole thing takes less than 30 seconds. The cashier was standing right there the whole time. She didn't notice. Cases of this crime have happened at 16 different Walmarts across New York and Maine. So skimming is when thieves attach a device to a payment terminal. Often you won't notice it. That device then collects your data and your PIN number. The FBI says skimming costs consumers more than $1 billion each year. So how can you stay safe?

Technology makes things sometimes safer and better. They also make it easier for criminals, and they're always working on the next front. We stop them one way and they find another way to do it.

Well, experts say the best tip to stay safe is make sure you cover your PIN as you enter it. The suspect caught on that surveillance video is still on the run. Walmart released a statement saying, quote, providing customers with a safe shopping experience is a top priority, adding that it's reviewing protocols and adding enhanced security measures to better protect in-store transactions.

So here's the deal, right? Uh, basically, if you saw the video, you saw how it happens, right? You saw the swapping out of the actual facade of the actual point of sale, right, at Walmart. Okay, so this isn't necessarily ATM skimming, it's, it's, it's point of sale skimming. And they, they gave advice in regards to like, you know, cover up the keypad with your other hand as you're punching in your PIN code at an ATM in case there's a camera around. That camera would record your PIN code as you swipe your card. In this case, when they're swapping out the facade, the face of the actual point-of-sale device, they're logging both your PIN code and your, um, credit card information with the swipe of the card and when you actually punch in the PIN code. Okay, so there's no real way to protect yourself from this particular scam. What you could and should and only really can do is to make sure that you are, um, checking your statements frequently, looking for any unauthorized transactions, and refuting those charges in real time. So I don't actually check my statements at all. What I do is I get push notifications or push alerts. So every single time there's a charge on my card, I get a text message and/or an email in real time as it's happening. That way I can respond to the lender, the credit card company, the bank in real time and say, hey, that wasn't me, uh, you know, do something about it, refute those. I'm refuting those charges, and they squash those charges as they occur. That really is the best way to mitigate yourself from ATM skimming and/or credit card fraud and/or debit card fraud.

You're absolutely right. One other thing that I do is, uh, when I go to like a gas station or some other place where, uh, the point of— they have multiple point of sales, I'm going to try to pick the location of the point of sale that's closest to where there's going to be somebody who's viewing the area, you know, whether by, by CCTV camera or closer to the front of the door, because I feel that If these skimmers are going to be different, they're probably not going to be skimming every single POC in the, in, in the retail location. They're going to probably want to pick some that are a little bit further out where they feel comfortable in putting them in without them being viewed. So that's why I will pick kind of like where I want to go. Another thing though, I got a question for you, Robert, if you know. Is the store itself liable in the sense of, are there— did they— are they have, you know, like credit cards, they might pick up most of the, uh you know, the liability, uh, fraudulent, uh, fraudulent, um, what do you call, charges. But you know, here's the deal, here's how it works, okay?

So when you are a merchant, which means you accept Visa, MasterCard, American Express, the merchant, in this case Walmart, right, they are generally liable for the charges.

Uh-huh.

Means that when you engage in a relationship with Visa, MasterCard, American Express, and Discover as a merchant, those who accept credit cards for their storefront, whatever, for their online portal, whatever. It is known in that agreement that you are responsible for the majority of the fraud should fraud occur. That's usually how it works.

Okay.

And so in the event that, let's just say, you as Walmart sell a generator and you accept a credit card for it, and that generator goes out the door, and the actual holder of the card isn't who swiped the card at Walmart, it's me or you, and we're paying attention to our statements and we call up Visa, MasterCard, American Express and say, hey, I see a charge on my card at Walmart for a generator. I didn't do that. Heck, I don't even live in Idaho. How'd that happen? What happens next is Visa, MasterCard, American Express will put in a claim to Walmart in your behalf saying, hey, your— our client says that they didn't make this charge. Therefore, we are charging back. We're taking that money back and putting it in the client's account. We're disputing this charge. Walmart has to go through some hoops and fill out some information to prove that you in fact were at the Walmart in Idaho. Uh, if they are unable to do that, then the money stays in your account, my account, and Walmart loses. They lose the money for the generator and that credit card charge.

Seems to me then, if a, a really good manager of a retail establishment should at a very minimum have somebody just check each point of sale once a day at a minimum to ensure that one, you know, a skimmer has not been in place. Because it's not only, you know, losing that money, it's also what— how likely are you going to go back to, uh, this retailer if you had to deal with, uh, something that was a and it showed up on your account as being fraudulent. I mean, you might lose— they might lose clients because of something like this, you would think, you know.

And there, there are some— there, there are brands that, that have had some damage or lost revenue as a result of this type of fraud. Uh, so Target, you know, got a little bit of a hit. Walmart has been hit in the past. Like, their brands do suffer a hit. It's not nearly what you think, although, you know, they should do what's necessary, of course, to mitigate fraud up front, right?

Yeah.

So all that being said, set up push notifications or push alerts. How do you do that? Make sure you log into your bank or credit card company's website, go to security settings, go to notification settings, go to alerts. If you don't know or you can't find out where it is on their websites, you can set it all up. And I've done it on all my credit cards and, and everything. Call the number on the back of the card and they'll walk you through it.

You didn't, Robert, you didn't mention another really cool, uh, point of knowledge that you get from doing something like that. It's not only to protect yourself from scammers, you can also learn what other family members who have access to your credit card are doing on a regular basis, right?

That is, if you share cards with a spouse or a child, absolutely. So the answer is yes, I do that with my spouse actually. Yeah, and, uh, I get notifications of her charges all the time, and she complains about it because she can't surprise me if she's gonna buy something for me. That's a good excuse, you know. But look at— as far as I'm concerned, my wife can buy whatever she wants. Like, that's, that's not a thing for me. For me, I just want to know what's happening in real time. And I've actually picked up fraud as a result of this, because in the past, I recall, like, early in the morning I got a couple of charges on our American Express, and they were from my wife's card, and she was in bed, you know, so it wasn't her. And immediately I called up, you know, American Express. I'm like, hey, and they took the charges right off and sent us a new card.

So what is it? What surprised me, uh, I previously, every time I traveled, especially international, you know, I was encouraged to call the bank so that the bank would know, hey, I'm on the road, this is where I'm going to be from what time, what time. But lately, like the last few months, when I do that, they say no, we don't need that anymore. So I mean, maybe they have a lot better algorithms or whatever the case may be, but they're not asking for that information. At least my bank isn't.

Yeah, it might have something to do with like the fact that your card was probably used for flight. Okay. And they know That could be, that could be a possibility. Say, no, you're flying that day, which in and of itself is a little freaky. But at the same time, you know, it could have been a different card that was used. Either way, um, you know, their algorithms pick up certain fraud, but it's up to you and I to pick up all the fraud.

Exactly, exactly.

All right, so potentially last in our list, Russian commander killed while jogging may have been tracked on Strava app. Okay, so Peter, I use Strava, I use the Nike app, I run 12 marathons in. So here, a Russian submarine commander shot to death while jogging may have been targeted by an assailant tracking him on the popular running app, according to Russian media. Russian media reported that Ryzhsky's killer may have used Strava, a widely available app used by runners and cyclists, to follow his movements. Risksy's jogging and cycling routes appear on an account in his name on the Strava app. One of his regular jogging circuits that he took while working in Crandonar include the park where he was killed early Monday.

No, I mean, it's good to— I mean, they said they suspect, they don't know. But in any case, bringing this up, it's important to understand how that app can really serve as surveillance on you, right? That can be, you know, picked up to know your movements along it. But this also could be the individual— if he had a very regular pattern of life, pretty much taking the same route, you know, whether it's driving or in this case running the same route every day, it'd be easy for, for anybody that really wanted to, to do this to him to be able to watch him a few times, you know. Yeah. But it is, it is scary. I mean, I think the U.S. military also has, has come out and, uh, and, and sort of caution individuals in the military about using this type of app just for that reason.

Because why you would broadcast— why anyone would broadcast where they are all the time, to me, is amazing, or just astonishing. It's, it's just unnecessary.

And people realize that. They don't think about that. And I mean they see the other application, the other uses, the other benefits of that app, and they don't think about the downside. Makes them vulnerable.

I use Strava and Nike app every time I go out, but I'm not broadcasting it. Nobody knows it, right? I've turned all that stuff off. Whether it's on or off by default, you should know the difference as a runner, somebody who uses these apps. Uh, and if you are the Commander of the Navy in Russia, you would think you would know the difference and/or his intelligence people would know the difference. It's just amazing to me how not well thought out the Russians are in this regard.

Mm-hmm.

Yeah, I agree. So for everybody, male, female, young or old, all the various social apps that you use, posting your location data just don't. Just pay attention. Let your family members know— sons, daughters, fathers, mothers, brothers, sisters— that like these apps showing your location data— and look at posting where you are and aren't on Facebook and other social media while you're traveling— I've never thought that as being a good idea. I never post my location data. I never post photos when I'm traveling. I just don't do it.

You can always do it later.

Do it later, you know. So I, I know that like social currency is a whole thing, and like it makes people think you're cool and all that, but really— all right, Peter, tell everybody about where you're at, what you got going on. I think you actually already did that. Tell them about your book.

Oh, the second book, Messing with Me. Oh, I'm sorry, Why Are You Messing With Me? And it's a senior survival guide on fraud, privacy, and security. It just came out, just released, and, uh, there's a lot of interest in it. So, and also, Senior— National Senior Citizens Day is coming up on the 21st of August, so you might want to consider, uh, procuring this book for, for, you know, your, your elderly loved ones in your life, whether it's your parents or grandparents. Uh, there's a lot of interest in this book because there's nothing quite out there that, that encompasses all these different threats and risks and dangers that our elderly population are facing on a day-to-day basis. So yeah, I'm, uh, I'm, I'm pushing this book. I'm out speaking about this book and my, and my other one, Confessions of a CIA Spy: The Art of Human Hacking. And so I have a number of events coming up and it's going well. And so if anybody's interested in also contacting me regarding training or speaking at events, the website counterintelligence-institute.com Very good.

And y'all can check me out online at protectnowllc.com. Uh, our cybersecurity employee training, uh, is designed to keep you and your organization FTC compliant should you be storing sensitive information that could get, uh, them and their finances in trouble to any level. We offer that both live in person, live online, as, and as e-learning as well. So Peter, last words.

Stay hydrated, keep cool. We'll get, we'll get eventually to the fall.

We will eventually, yes. And, um, last but not least, uh, everybody please, uh, be nice to each other out there and, uh, be safe. Talk to you soon.