Social Media scams cost Americans $2.7B - are you one of them? #39

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give to you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being. So let's get at it, and welcome to The Security Guy and CIA Spy. I am Robert Siciliano. I'm the Security Guy, and this is Peter Wormka, live from Orlando, Florida.

Robert, how are you?

And Peter is the CIA spy. I'm doing—

I'm undercover. Hey, I'm undercover and you're, you're, you're leaking that out. No, but now everybody knows who I am, I hope.

Um, Peter is like the, the legit Langley. Like, you, you spent some— you, you actually like have been in and out of Langley. Like, that's—

yes, but you know, like anybody that works for a corporate headquarters, whether it's, you know, government or private sector You really want to stay out of headquarters as much as you can because there you got all the bureaucracy, all the nonsense everywhere. We all have that, right? And so I spent most of my career out in the field. I spent over 20 years out in the, you know, overseas. And I love that part. Going back to work at headquarters, I mean, we have to do it, right? But I, you know, yeah, I went into Langley more than I probably wanted to.

So you were, you were, you were telecommuting to work like you were doing like the, the boots on the ground spying on government officials, like kind of like Zoom but 20 years ago.

Yeah, that's right. I mean, the psychology is the same, a lot of, a lot of it's the same. It's just that technology has changed things a bit. But that's right, I mean, I was like the guy, I was the, the, the hunter with the spear on the ground in a particular country procuring that intelligence that then would go back to Langley where there would be a lot of different analysts, right, that would look at that information and package it for a variety of consumers.

It's pretty awesome, man. Yeah, you're my hero. We got a lot of stuff to talk about today, and we are broadcasting from YouTube and Twitter, which is X, and LinkedIn and Facebook. And welcome everyone. Uh, and, uh, this will be going out via our, uh, newsletter, uh, shortly afterwards. So, uh, stay tuned there. So today we're going to discuss a number of, um, crazy things going on out there in the world of fraud and cybersecurity and personal protection. And here, uh, Security Boulevard talks about FTC, that is the Federal Trade Commission. Americans lost $2.7 billion since 2021 So that's what, 2 years, uh, to social media scams. Okay, so America's lost a whopping $2.7 billion in scams that reach them via social media, and the actual figure could be much higher. It is definitely much higher, Peter, according to the FTC. Of those who reported losing money to fraud over the past 2 years, 25% said the problem started on social media. The agency wrote a report this month, but that likely barely touches the true scope of the problem because only about 4. 8% of the people who were the victims of mass market consumer fraud complained to the Better Business Bureau or a government entity.

For— yeah, what, 4 point what percent?

Like, not even 5% actually reported it.

And the one— and reported is $2.7 billion. So you met— I mean, this is just a tip of the iceberg that's been reported, and the amount of losses, tip of the iceberg.

It goes on to talk about, like, how it happens, like, what facilitates it. So between the ease and low cost of running such scams, right? So social media platforms are like the base of where it begins, and it's free for them. And the growing number of people hopping onto multiple, multiple social media networks, it's likely the numbers will climb in the coming years. So it's going to get worse, definitely not going to get any better. Uh, Emma Fletcher, who's the senior data analyst at the FTC, says social media gives scammers an edge in several ways. They can easily manufacture a fake persona or hack into your profile, pretend to be you, and con your friends. We've seen that plenty of times. They can learn to tailor their approach from what you share on social media. Scammers who place ads— they place ads, so they're paying Google, Facebook, and others— can also use the same tools advertisers use to target victims based on such personal details as their age, interest, purchasing history, whether or not they buy crypto, whether or not they're single, they're looking for romance, whatever the case is. 'all of this costs them next to nothing to reach billions of people from anywhere in the world,' Fletcher wrote.

No, this is a huge problem, and I think a big reason why it's not, you know, only the tip of the iceberg is reported is because the vast majority of people that suffer from these scams— and there's a variety of them— are really embarrassed. They're embarrassed to report it. And, uh, and I think if more and more people started to report being victimized, they would get the word out. People would understand. They would hear what's happened to others. And I really encourage people to provide testimonials or share their stories. I've been out on the speaking circuit like you have, Robert Siciliano, and one of the things I do at the end is always encourage people to come forward with their stories. And people are beginning to come forward and provide me with their personal stories about what's happened to them. And I'm beginning to bring those out. And I think that's That's crucial. You know, companies are— a lot of companies won't report that when they've been hacked, but they do have that legal requirement to report at certain times, right? If it impacts the consumers, the personal identifier information, PII. So there's legal requirements for some companies to report. But if there's no legal requirement, most companies won't report. In the case of the consumer, hardly any of them are required by law to report these scams. And so that's why the vast majority of them, unfortunately, don't report it.

And they're embarrassed.

Yep.

And they don't know who to turn to in many cases. They might call local law enforcement, but then local law enforcement might say, "Okay, you can fill out a police report, and we might suggest that you contact the Federal Trade Commission." But if they fill out a police report, once they're told there's nothing we can do about it, they may or may not report to the Federal Trade Commission, probably because they're just so exhausted and upset by the whole thing, and they see no point in it.

Well, I think one of the article mentions a little bit later that one of the biggest areas of the scam is in online shopping, right? And I know I've seen this because I've been tempted. I get online, especially, you know, if it's the holiday season or if I want something specific, a high dollar volume, you know, I will look and I'll come price compare. And all of a sudden you see, you know, you see a bunch of retail establishments that have a very similar price, and then all of a sudden you'll see one or two that are like, wow, this is like half the price, and you're tempted to buy it. And the pro— this is my personal opinion, Robert, and, uh, I appreciate your, your comments, but I think one of the problem is there's no real penalty for individuals that will buy that cheaper item that never arrives, right? And then they can charge it off with their credit card because the credit card most times will cover such fraud. And so it relieves the individual of this sort of, uh, they want to be, you know, they can be negligent and it's going to be covered by the credit card. I think if the credit cards had more, I don't know, more conditions there that if this, if it's a case of negligence, that it's the consumer that pays, that consumer versus all of us as consumers that pay for that negligence.

Yeah, I— now as far as merchant status goes, you know, the bank does, the credit card companies will take that money out of the merchant's account. Therefore, the losses sustained would be minimal to both the credit card company and the, uh, clients, you know, like the, the consumer. And so it, it, it's, it's whether or not that merchant that's essentially operating fraudulently can move that money out of the bank faster than the credit card company might charge them back. That's the thing.

No, that's a good point. But think about it, when, you know, how long does it take to set up and how long does it take to close these down? And usually people, when they, they buy something, they, you know, they think, well, I'm gonna get this in 3, 4 days. It doesn't arrive, then they start checking. By the time it gets back to the bank that there's been a case of fraud, you're probably looking at a good 10 days.

Yeah, real simple. Like, if you look at Facebook, you know, and any advertisements that you see on Facebook, those advertisements, paid advertisements, the consumer sees that and they're like, oh, it's a paid advertisement on Facebook. Facebook is approving of an advertisement for whatever it might be, an online dating service, cryptocurrency, whatever the case is. And so the consumer clicks on that and they think, okay, well, if Facebook says it's okay, it must be okay.

You're right.

I mean, and they end up going down this rabbit hole.

Yeah.

And they end up getting scammed. And that, that is a huge problem, one that Facebook and Google and others lend credibility to all the various scams because they facilitate the scam by taking in money for advertising.

No, you're absolutely right. Maybe there should be a way of verifying for these platforms to verify the advertiser, right? Somehow, you know, get additional information like a tax ID number, whatever the case may be, but to make that step. Don't just take in the money and say, okay, you can put the ad out, but verify that it's a legitimate entity. I don't know.

So one of the things that I do in my demonstrations is I'll take my audiences online and I'll take them through various websites that are fraudulent and scammy. And I'll do basic keyword searches on certain things to demonstrate, you know, what you can find on the web. And, you know, drugs and prostitution and guns and, you know, fake IDs and all that stuff. And I'll search for fake IDs, fake IDs, right? And on the first page of search, I'll find like 10 different websites that sell fake IDs. And at the top of search, often Google is facilitating fake ID websites by allowing sponsored advertising. And it's like, these are US passports, US IDs, Canadian IDs, UK IDs, and these fake ID companies are paying Google for ad space to show up at the top of search.

Perhaps we need more regulation because companies like Google— I mean, we see it all across the board, these other various social media platforms. They're limiting the amount of scrutiny that they place on establishing, you know, profiles, personas, you know, advertising for companies, because they can just rake in the money and they really are limited in their responsibility. So maybe there needs to be some sort of oversight in regard to this area to protect consumers.

So, you know, I consider myself pretty savvy when it comes to fleshing out you know, what's a scam, what's not. So anytime the phone rings, an email comes in, I get a text message, you know, anytime I get an instant message of sorts, you know, through all the various platforms, I'm pretty good about, you know, using my Spidey sense, right? And kind of fleshing out what's real and what's fake. And every so often, like, something comes across that gets my attention and I'm not exactly sure if it's a scam or not. But usually, like, I stop doing what I'm doing and give it some attention before I just go and click a link and respond and provide whatever information they might want. For example, so recently, like, I was selling something on Facebook Marketplace. Like, you know, I'm constantly, like, moving something out of my garage that I no longer need, and instead of, like, you know, throwing it away, I'd rather, you know, recycle it in so many ways by selling it for, like, you know, pennies on the dollar, right? Just to kind of like get rid of it and at the same time, you know, have coffee money, right? So recently I put an ad for something and somebody immediately responded to it and like, I want it, this is great, I definitely want to— can you do me a favor? I'll pay you Venmo and, uh, just that way you could just like take the listing down. And I've done that actually a number of times where I've paid people Venmo to take the ad down or they've paid me Venmo to take the ad down. And I'm, I'm like totally cool with that. Like, I, I have no problem giving you all my Venmo information. You want to give me money, I'll give you my Venmo. No, no big deal. I don't see any problem there. And so I started engaging that person, and they were like, great, what's your Venmo? I gave them the Venmo. 5 minutes later, they get back to me, Venmo. They said they sent me a screenshot of a Venmo window, like on their phone or something. And it showed Venmo and it showed my user ID and it said Venmo is asking for your email address to confirm the transaction. Now I've done thousands and thousands of dollars of Venmo transactions and no one's ever— Venmo has never asked me, no one's ever asked me to confirm my email address in a Venmo transaction. I've been asked for the last 4 digits of my phone number, which I'm happy to give out, but never my email address. And so I did a quick— so because of that, because it was like a little odd to me because I've never been asked that before, and even though I was like, I almost actually knee-jerk responded with my email address because I was kind of excited about like moving this product, let's say. But instead of like doing that, I was like, well, wait a minute now. And I did a quick search on Venmo email Facebook scam. Venmo email Facebook scam, full words, you know, because it was Venmo, it was email address, it was Facebook, and I'm thinking scam. And immediately at the top of search, somebody wrote an article about a Facebook scam that involves Venmo where they ask for your email address. Bang. So because I was just a little hesitant and paid that much more attention and, you know, wasn't necessarily greedy but more cautious, um, I avoided what could have potentially turned into a fix— a fishing expedition where they now had my Venmo email address that could have turned into who knows what, a potential password reset. I don't know.

Um, I mean, those are such simple— I mean, I would highly recommend that to everybody where there's any So just do that search. It's a simple search to include scam and a few keywords. And unless that scam was just created that morning or just like yesterday, there's gonna be something. Almost always there's gonna be something available on Google or other search engines that will point that out, that it's this current scam going on. So that's really, really critical.

Peter, there isn't a day that goes by that— and I have this conversation with my father, who's 75 years old, all the time. There isn't a day that goes by that there isn't someone, somebody, some corporation, some government agency, some scammer, some email, some phone call, some text message. There isn't a day that goes by that somebody isn't trying to fleece me and my dad. Yeah. Oh yeah, every single day, multiple times a day.

And you notice, Robert, that over the last, I would say, year or 18 months, it's been— I mean, those type of things you've you've seen? Exponential growth. Exponential.

I would say it's 3 to 5 times a day at this point between the phone calls and the emails and the text messages. I'm getting at least 1 or 2 that's ending up, you know, in my inbox, uh, in my text messages, in my, um, coming across as a phone call that's not listed as spam, you know, like it's— so it's getting through, you know, AT&T's filters or whatever. It's like, it's like every freaking day, multiple times a day. And I would say I'm probably spending, I don't know, maybe a good 15-20 minutes a week just kind of like dealing with all that stuff.

Yeah, well, you know, the scammers are going to locations where they can find us, right? Where they're going to get our attention. And I think in this article it even mentioned that the average user is spending over 1 hour and 45 minutes per day on a social media platform. And the average user— this is phenomenal— has over 8 different social media platforms that they visit. That, I mean, that's maybe— we're— I don't know, sometimes that seems like maybe we're spending too much time there. And, and, and the scammers know it, you know, and that's where they're going to look for us.

So it says that, um, online shopping scams accounted for most of the social media-based losses for the first half of the year, about 50%. Uh, most of the scams often started with Facebook ads and on Instagram. Uh, however, most scams that accounted for the most money loss were fake investment opportunities, accounting for 53% of the total loss. So the, the pig butchering and the other forms of cryptocurrency scams that involve romance scams as well is when somebody will meet someone on Facebook, like they're on a dating site, let's say, and they'll begin to communicate, they'll begin to correspond via instant message, via either the dating site or on Facebook itself. And like, it is a, it is a one-on-one, you know, instant message. Sometimes it involves video, sometimes it involves just text, but often like they're— the, the scammers are creating an actual bond with their victims. Like, when I say bond, like, like a, like a, like a, like an emotional relationship with them, uh, that, uh, involves spending time with that person. And, you know, again, that could be actual video. Like, they could actually be corresponding with that person face to face via video, FaceTime, uh, whatever the case is. And that can go on for days and weeks And over time, like, that person, the scammer, says, you know, listen, I just let you know, like, one of the things I got going on in my life, like, I'm making some good money in cryptocurrency. Um, and they'll, they'll actually, like, spend time with that person and walk them through cryptocurrency websites where they trade cryptocurrency, and they'll show them and walk them through the process of busting out their credit card, hooking up their bank account, whatever the case might be, to make an investment in that cryptocurrency platform. Think of like a Coinbase but like another brand entirely. And over time, right, they're investing $1,000 here, $1,000 there, $5,000 here, $10,000 there, and they're actually getting dividends. It's like a Ponzi scheme. And eventually, like, as they're making dividends and getting paid, they're seeing the legitimacy in the particular site, the legitimacy. Before you know it, they'll dump $20,000, $30,000 thinking that they can, you know, uh, quadruple their money over a certain period of time because they've already made money by dropping $500 or $1,000. And eventually, once they drop a significant amount of money then the scammer is gone. And so what the scammers are doing is they're actually setting up legit, fully functional crypto-type websites that facilitate an actual transaction, and, uh, all revolving around romance scams.

Well, it's, it's interesting because these romance scams— I mean, I guess the way to attract somebody is also these individuals, these fake personas are created, and many of them are very attractive. And I, I don't know if you saw last November, there was an article regarding the problem with many of these fake personas leveraging the name of a big company as being their employer. And in this particular article, it was SpaceX that was, uh, being, being leveraged, and there were over 1,500 fake profiles that were created, most of them from of Asian descent, very attractive females. And they all had kind of like the same, uh, the, you know, they, they got it first, your undergraduate in, in China, they got their first business experience, uh, in China, then they relocated to the States and got their degree or master's degree in the United States from one of 5 different prominent universities. And then they, they all became— majority of them became senior engineers, senior programmer, uh, program managers for SpaceX. And then they, you know, reached out, uh, to individuals, and they, they were offering eventually these, these cryptocurrency scams. Eventually, I don't know, you know, the back door, you know, how this worked, but eventually they were taken down by LinkedIn, uh, and now if you were to go by there, you would find still hundreds of new ones being set up. And it's not only SpaceX, there's a lot of other really reputable companies that are having these fake profiles, you know, uh, attached to them just because it kind of gives them that credibility, right? Oh, this person must be really smart if they're a senior program manager for SpaceX. I mean, it's, it's, it's huge, and it's working apparently because this keeps on going, going on and on and on.

So the article—

hold on—

the article states right here Included in the steps the FTC recommends consumers and organizations take to protect themselves from scams on social media are limiting, limiting who can see your posts and information on the platforms. And if a friend messages you about an opportunity or urgent need for money, call them to make sure their account hadn't been hacked. That's a big one. That's particularly important if the person asks for payment in cryptocurrency, gift cards, or wire transfers transfers, which is how scammers ask you to pay. Don't rush into a friendship or romance with someone who suddenly appears on your social media pages. And before buying anything, check out the company selling the product, including search for the online name along with the word scam or complaint. Hey, that's my recommendation.

Yeah, exactly. Exactly.

Oh, man. Okay, all right, uh, next but not last. Too rich to ransomware. MGM brushes off $100 million in losses. MGM wins big bet that choosing days of operations outages is a better business decision than paying the ransom following last month's data breach. So I don't know if they won the bet. I mean, they lost $100 million. I think that Caesars paid like $15 million. Yeah, so MGM's incident response strategy was sharp left turn from Caesars Entertainment, which after it was breached by the same threat actor, decided to pay and negotiated $15 million and move on. In the days following the casino cyber attacks, Caesars was back to day-to-day operations while MGM struggled to claw back operations for more than a week. So what, uh, in its revised SEC disclosure, uh MGM reports a loss of $100 million as a result of the breach, which seems like a hefty price tag at first blush. However, the company noted that the losses only slightly impact the company's third quarter financials. Look, I, I have no sympathy for MGM whatsoever at all. I mean, they're basically— yeah, they're gaming, they're entertainment and all that stuff, and you know, they're fun and all that, but I mean, they're capitalizing on lots of people that essentially a lot of people, not everybody, that have issues, that are gambling issues. Oh yeah, I don't have a lot of sympathy there. That being said, uh, what is it, Caesars spent $15 million and moved on, uh, and, uh, MGM spent $100 million. And I don't think that anybody should ever pay the ransom, but I'm not sure that MGM did better than Caesars in this particular situation.

Oh, I really completely agree with you. And, uh, I guess you have to ask this question Is there honor? I mean, uh, how, how high is the integrity of criminals? Because yeah, you know, they may say, okay, you pay this ransom and we'll decrypt, you know, um, we— and all, all your, you know, everything that we've done here so you can have access back to your information. But nowhere in this article did it mention that the criminals did not retain a copy of all this information, which can be used later on or even bought and sold I mean, think about all the consumers, all this information that these casinos are collecting on individuals, you know, via their reward programs, right? It's marketing detail, and it's a tremendous amount of information that they collect. That information was in the hands of the criminals, and you think that they just gave it back and didn't keep a copy? Please get real. I mean, if I was a criminal, um, uh, I think I would leverage everything I have going forward. So What it sounds like, yeah, they got— they got— both of them made their own decision, but at the end of the day, it's still the consumer, still the clients of these two casinos that could have their information being manipulated, being utilized by criminal groups. Still possible, 100%.

So Peter, um, tell everybody what you got going on, what you're up to, your website.

Well, it's been so busy, Robert, as you're aware of. I mean, I've been gone for like 6 weeks. I was, uh, international travel to Buenos Aires. Rio de Janeiro to give presentations for a big client I have down there. And I've been on a conference circuit here in the States. I've been in Chicago, San Diego, Los Angeles. I finally got home last night. I gotta go next week again, but it's fortunately two events here in Florida. I have my— recall the book Confessions of a CIA Spy: The Art of Human Hacking. I'm happy to also next week, Monday and Tuesday, this book in both paperback and Kindle, will be released in Spanish and Portuguese languages, as I do have a lot of clients that come from Latin America. So I'm very excited about that. Messing with Me is also the book recently released and getting a lot of attention, and I'm very pleased. I'm very pleased. A lot of work though, Robert, as you're aware. Nothing comes easy, but very happy. What about you?

I am— September, October are my two busiest months, and thing. It's, it's, it's slowing down just a little bit, but I've got the whole last week of October. I'm on the road every single day. Um, it's been good. A lot of real estate engagement. Uh, we're certified for continuing education in, I think, now 27 states in the country, uh, for CE for real estate agents, um, who handle a lot of sensitive and personal information. Uh, y'all can see me at protectnowllc.com. Again, that's protect nowllc.com. Peter is at counterintelligence-institute.com. Peter, last words.

Well, be careful out there, look out for each other, and especially when you're out there trolling these social media platforms that you love to do, just be careful because not everybody out there is out— is out there just to share information with you. Many of them are using your information to come back and fraud you, defraud you.

And as my dad says, be good, behave, and be careful out there. Be nice to each other. Thank you so much.

Take care. Bye-bye.