The Security Guy and CIA Spy PodBroadcast

And welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano and this is As always, Peter Wormka from Orlando, Florida.

How are you, my northern brother?

I'm, uh, warming up, man. It's like 70 degrees here. Oh my God, the grass is green and, uh, everything's sprouting, so it's, it's good.

Yeah, it's hotter. It's like 15 degrees hotter here. The grass is getting brown. Even though we water because we're in a bit of a drought.

Yeah, yeah, yeah. That— we actually have about 2 weeks of no rain, which does worry me actually. Uh, but, uh, I do have a lawn, so I know it's like kind of an ecological nightmare, but I probably will still water it, you know, because it's artificial turf. There's always that.

Yeah, I always wondered how that would stand up though in, you know, in the sun of Florida. If it was just like tear it apart after, you know, sunrise.

Well, ask your football teams because that's what they have.

Yeah, but they make so much money, they probably change that out every so often. I don't know.

Yeah, yeah. So hey man, we got a lot to talk about today.

Yeah, what's going on?

Well, uh, FBI is actually picking up the phone and emailing people. That's scary. Crazy. Yeah, yeah, I'm gonna talk about that. Uh, the PayPal scams are the worst that I've ever seen. I'm getting emails to my inbox on a regular basis from what looks like PayPal. We're going to talk about the commonalities of all those various scams. And if we have time, passkeys versus passwords.

Yeah, there's a big difference, but passkey looks like it could be a winner.

Yeah, yeah, eventually, yes. So right here, the FBI is calling. They want you to warn you about the scam you don't know you're in. Local woman reported losing $3 million in a crypto investment scam. You and I have talked about that a little bit. Um, so traditionally when I'm speaking in front of an audience and we're talking about phishing emails and all that stuff, and every time the phone rings, an email comes in, you get a text message, that, you know, government agencies aren't going to call you, they're not going to email you. If anything, they're going to send you snail mail and occasionally knock on your door, right?. But I have told people traditionally, the CIA, the Secret Service, the FBI are not going to call you and they're not going to email you. The IRS is never going to call you. They're never going to email you. You know, Medicare is never going to call you. They're probably never going to email you and so forth. They do all of their correspondence via snail mail.

Right, traditionally, yes.

Well, the FBI is in fact calling people and emailing people, and this has just happened in the past 16 months. And I think it's great, actually. It's scary, but it's great. So here, uh, Baltimore, a mysterious call from someone claiming to be an FBI agent seems like a scam. But there's a real chance it's not. Okay, but, but buyer beware because there's still a good chance that it's a scam. But hear me out. The FBI is now proactively reaching out to potential fraud victims as part of a new initiative to stop scams in progress before money is lost. Okay, this article just came out in April of 2025. It's brand new. Okay. Let me go down to the nitty-gritty on this. This particular victim of this scam who lost like $50,000 in a cryptocurrency investment scheme got an email from the FBI saying, the FBI saying, we're seeing a lot of activity with your account. We think you're being scammed.. And the woman said, when I first saw the email, I thought it was a scam because I would too, but it wasn't. This contact was part of what's called Operation Level Up. So the FBI's Operation Level Up launched in January of 2024. The FBI strategy to save victims from sending more of their hard-earned cash, uh, to scammers for cryptocurrency-type scams. So FBI said, what we're doing is we're using sophisticated cyber techniques to identify victims who are being victimized, who live, who are currently in the scam, and trying to contact them to have them stop sending more money to the scammers, said Special Agent David Panawozik with the FBI Baltimore field office. He said, I've gone as far as calling people's place of business, not in a bad way, but just, I really need to talk to you, said Special Agent Jason Murrays with the FBI Baltimore, who has contacted about 60 victims through Operation Level Up. These interventions have successfully prevented devastating financial loss from January '24 to February 2025. It said we've contacted over 5,000 different victims of these scams. Peter, this is insane.

But I, I mean, this, this is— there's a number of points here, and I think this is very interesting. First of all, I think, I think this is, this is great because it's also for the for the FBI good PR in the fact that they're, they're having more contact with the people, right? Trying to help people not get scammed and, and protect those individuals because they're not really able— we all know they're not really able to bring scammers to justice. It's at the most when people are reporting these scams, they're just, they're just incorporating those in their statistics, right? But they're not really effective in bringing people you know, bringing people to justice, because a lot of these people are from overseas and everything. So the fact that they can show measurable results by contacting people, I think that's fantastic. I'll be a devil's advocate. I, I— this is not how I feel, but I know there's gonna— there was gonna be some people that when they hear, oh, the government is looking at all my transactions and what's going on in my emails and what I'm doing with my banking, where's my privacy? There's going to be people that are going to be upset with that. Not me. That doesn't bother me. If the government can help me, protect me from scammers, I'm all for it.

Yeah. So I think what is happening here, and, and this line is what has my attention the most, is right here where it says, so where you— what we're doing is we're using— this is the FBI talking— we're using sophisticated cyber techniques to identify victims who are being victimized live, who— or who are currently in the scam, trying to contact them to have them stop sending more money to the scammers. You alluded to this, the privacy aspect of things. I think what's happening here, I bet my life on it, and hopefully I don't get any trouble for talking about this, I think that the FBI has full unfettered backdoor access to WhatsApp. Ah, I think that sophisticated cyber techniques is WhatsApp. You could— I think they can see exactly what's going on because one of two things. Number one, WhatsApp is owned by Facebook, Meta, Zuckerberg, his company, and, and Easily, FBI can say to Zuckerberg, hey man, we need backdoor access to Meta. We need backdoor access to WhatsApp, and here's why. And I don't know that Zuckerberg would say no. I mean, he bent the knee for Trump. He pretty much wants to play the game. So I don't see why he would say no, you know. He's just a frat boy that made it big. And, you know, if there's billions of dollars being lost and he can help those people, why wouldn't he? What's he got to lose?

And it's interesting because a lot of these— a lot of good percentage of these scams start or initiated through contact on WhatsApp.

So they're started through WhatsApp. And I agree with you, but I also think that many of them, from my own experience, are actually started on robo-text messages. Hear me out. Robo-text messages, robo-AI-driven instant messages on Facebook, LinkedIn, Twitter, and so on. And then very early in the dialogue, like within 24 hours, they request to move it to WhatsApp.

Okay.

Yeah, so I've been scam baiting for, for months now, and, uh, that's what I've been finding. So when we all— when we get all these scammy text messages, emails, instant messages on Twitter, Facebook, LinkedIn, most of us block, delete, Mark as spam. I've been responding to all of them, engaging in the dialogue, often, you know, with men and women. In my case, it's mostly women who look like, you know, Russian models or Southeast Asian women, uh, attractive by all standards. And, um, after 24 hours of engaging in chat they request to move to WhatsApp because they think they know it's just a matter of time until they're blocked on Facebook, Twitter, LinkedIn, that their profile is identified as a scam. So moving to WhatsApp allows free— the free flow of communication. And I'm pretty sure the FBI has backdoor access to WhatsApp to see what's going on.

That could be. Yeah, that makes It makes sense to me. I mean, we were just talking about this earlier, that there's been a— there appears to be a significant increase of all varieties of scams over the last year. I mean, it's just, it's just incredible. But a lot of that, you know, as you alluded to, seems like to be AI-driven.

Yeah.

And I think it's going to be continuously get worse. Yeah.

And that leads us to McAfee posted a blog, Stolen with a Click: The Booming Business of PayPal Scams. I am getting inbox PayPal scams at least daily or every other day.

Oh yeah, I am too. I don't use PayPal. I told you I haven't used PayPal forever, and but I, I'm also getting these, uh, these emails that are coming in. Yeah.

To my inbox, not to my spam folder, right?

Yeah, they're not getting— they're not getting filtered out.

So, so right here, the, the current PayPal scam landscape: while PayPal works diligently to protect its users, scammers are constantly evolving their tactics. The recent surge has been traced to a single highly effective campaign where attackers send official-looking emails with action required warnings demanding users to update their account status within 40 hours. Or 48 hours or face account suspension. Also, there has been— so along with account suspension notices, there's been fake PayPal gift cards, fraudulent invoices for purchases, deceptive surveys, fake customer support scams, phony payment confirmation requests. Uh, I, uh, have a couple of them right here in front of me. So right here You know, you sent a $257 US dollar payment, uh, to, to, to James Cecil. It shows up in my inbox. All right, your note to James: do not recognize the seller, please contact 1-888-381. The, the next one is, uh, your PayPal online purchase went well. Uh, it talks about how I— in the past 24 hours, the PayPal account has been auto-debited. For $528. There's a phone number to call. And the next one is, uh, heads up, uh, April 2025 report for Nathaniel Ruiz. Uh, thank you for choosing PayPal. Pleased to inform you that your payment of $741 for the purchase of an Apple iPhone, so on and so forth. If there's a problem, call this particular phone number. Here's the deal. What, what do all the— what, I guess, two things strike you right off the bat that these scams have in common? Two things right off the bat.

Well, I mean, does PayPal always send you a follow-up email every time you make a purchase of something? I don't think so, do they?

Uh, I think that there's always some type of a PayPal correspondence when you engage in something, whether you pay someone or you get paid, they let you know. Yeah. So that's— but that is common, right? But there's a couple of— there's a couple of things here. Number one, the fact that they're all PayPal communications. So that is actually a common thing. And the next thing is, if this activity was not initiated by you, please contact us immediately at a phone number to report the incident.

Yeah, then they got you. That's the hook.

That's the hook. So here's the deal, and I don't know that most people fully understand this. I know that most people don't fully understand this, is that number one, if you don't— if the consumer does not immediately, immediately, immediately recognize that this is a scam, just hit delete, just block it, right? If they don't immediately recognize that it's a scam and that— and they pick up the phone, it's game over. Yeah, because when you pick up the phone, they know right off the bat, we got one. Because the person who doesn't immediately recognize it's a scam, that picks up the phone, is not all that technically savvy to begin with.

You're right.

And once they pick up the phone Basically, they're going down the rabbit hole. They're, they're, they're, they're, they're, they're the chicken heading into the fox's, you know, den.

Yep. And they have, they have scripts that they use, and they have a variety of scripts depending on how the conversation goes. I mean, they even have a, you know, they work in teams, so if they need to transfer you to someone else that, you know, as part of the team, they can do that too, depending on how they want to escalate the issue, right?

It is no different than sitting down at a timeshare presentation. You sit down at the timeshare presentation, that initial salesperson has his spiel, he has his script, she has her responses to your questions and queries. And when things don't go the way that initial salesperson wants they bring in the next salesperson, and the next salesperson has a whole other set of products and services to sell you, or reasons to get you to sign on the dotted line, whatever. And the scam uses the same principle. They got— they have a hierarchy of people initially answer the phone, they're trying to like get access to your account, they're trying to get access to your device, they're trying to get your sensitive information. If that doesn't work they move you on to the next salesperson or the next scammer that brings you to a whole other level of nefarious activity. Most people aren't prepared to deal with this. The reality is, if you get a communication like this with the phone number to call, whatever, just hit delete. I mean, that should be the red flag. The, the red flag really is I didn't engage PayPal or this person or this payment, therefore it is a scam. If you didn't do it, it is a— if, if what this— what the email is telling you is something you didn't actually do, it's a scam. That's it, done. If you want to log into your PayPal account and check activity, do that by going to paypal.com. Don't click links in the body of the email ever. Log into your account and just, you know, see if there's anything waiting for you there. See if there's any, any notices. See if there's any activity you can view that has any similarities with the email that you received. And if there is, which there probably won't be— I know there won't be— just contact PayPal directly through your actual PayPal account, not through an email. And definitely don't make a phone call through an email, and so on.

Yeah, we've definitely seen an increase in these, so undoubtedly it's working very well for the criminals.

Well, that's it. We see the, the increase because it works. Yeah, it has no business working, but too many people are just not technically savvy enough to recognize risk.

Yeah, and not aware. I mean, this is why we have this podcast, is why other people also in the industry are trying to make people more and more aware. And to me, it's still amazing that even though the information is out there, you know, but people either they hear it, they don't pay attention, or they kind of like just, you know, they don't think it's going to happen to them. So until it does—

I get the same scams that look like it's Geek Squad.

Oh yeah, forever. Yeah, a lot of those.

And it's the same thing, like this one goes to my actual email address, customers, and it provides a customer support phone number. Right, same thing here with another Geek Squad to my email address with another customer support emergency support phone number. And if you look at the actual number, it's 1-806. That is an actual 0-8-0-6 versus a zero. That's an O. And they do that to mess up the spam filters. Yeah, you know, so any of these emails that you get with the phone number in it to dispute it. I mean, it is absolutely a scam. Just tell your mom, tell your dad, tell your uncle, tell your wife, tell your husband, tell your kids, you know.

All right, delete.

So Peter, passkeys versus passwords, a detailed comparison.

Okay, this is interesting because, you know, we've heard so— passwords have been used forever, and we've heard a lot of the vulnerabilities that passwords have. I mean, and so this is a really interesting and, and positive development, uh, I believe.

Yeah. So let's kind of flesh this out a little bit. Our lives are increasingly intertwined with the online world. Robust online security is no longer a luxury but a necessity. With the rising tide of cyber threats, safeguarding our online accounts has become more critical than ever. For decades, passwords have been the steadfast guardians of our digital identities. But a new technology known as Passkeys is emerging as a more secure and user-friendly alternative. This is, what, April of 2025? It's— the technology has been around for a couple of years, but it's really only becoming a more streamlined process as, well, as Amazon, Best Buy, eBay, Shopify, Google, Microsoft, Apple, Sony, PayPal, MasterCard, Visa, Twitter, and others are making it much harder to deflect and avoid and are making it more and more a part of the way in which they want you to log in. I don't know specifically what the rate of adoption is. This article might discuss that. Oh, it says right here. So e-commerce giants like Amazon Best Buy, eBay, Shopify have embraced Passkeys, aiming to enhance security and streamline the shopping experience for millions of users. Amazon has over 175 million customers already using Passkeys. That's pretty impressive, right? That's actually really good. Uh, tech titans such as Google, Microsoft, Apple, and Sony have integrated Passkey into their ecosystems, paving the way for widespread adoption. Google alone has reported over 2.5 billion Passkey sign-ins across 800 million accounts. That's actually really good. Financial services, uh, security and trusts are paramount in the financial sector. Consequently, companies like PayPal, MasterCard, Visa, and numerous digital banks are adopting Passkeys to bolster security measures to combat fraud. Public sector government agencies are also joining the Passkey movement. Social media, popular social media platforms like X and Discord have incorporated passkey support, recognizing the need for enhanced security and user friendliness in online interactions. So here's the deal, right? I don't know that I will fully adopt passkeys quite yet because I don't know that it works in a streamlined process across operating systems and devices?

No, I don't think it does yet. So this is one of the— in the short term, it's going to be probably a little bit awkward if you have a variety of devices. Sometimes you're going to be able to use it, sometimes maybe it won't be available.

Yeah. And I don't know that Passkeys quite passed the grandmother test. Yet either, right?

They haven't really reported much on that.

Yeah, and so I'm all about adopting Passkeys, and I say that like for everybody, if you want to just dive in headfirst and just go Passkeys, fine. Um, I would do like one account at a time, meaning like spend— do Passkeys, say, for your Google account, on your Mac, on your PC, on your Android, on your iPhone, and see how that works. And if you're good and it's streamlined and it's working across all your devices without issue, fine. Then consider adopting Passkeys for, say, Amazon, or just do Amazon first on your desktop, laptop, and mobile phone. And that way it's just Amazon versus your entire Google environment. I don't know if I would recommend jumping in feet first or head first with Google. I'd say just do Amazon off the bat and see how that plays out.

I think that's a good idea, you know.

So how do they work? To fully appreciate the advantages of passkeys, it's essential to understand the inner workings of traditional passwords and their inherent limitations. We pretty much know what they are. They, you know, are secret codes the user creates to verify their identity. When you create a password, the website typically employs a process called hashing to store it securely in a database. And then, but there are many things that can overcome that passcode, especially using the same passcode multiple times, something called a brute force attack, dictionary attacks, phishing attacks, credential stuffing. All of that compromises the passcode. Using two-factor authentication generally thwarts all of those attacks. So that is one way to, I guess, elongate or continue using passcodes, is by never using the same passcode twice and using two-factor authentication. Until passkeys become a ubiquitous technology that streamline— streamline the process across devices, hardware, and software, passwords that they can remain, I would say, at least for the next 5 to 7 years.

What's going to be nice about the Passkeys though is that the process— I mean, it's going to be so much easier and quicker to log in. You know, there's a lot— there's a high fail rate when it comes to, you know, people might make a mistake when they're putting in their password and they gotta look, ah, it's changed, what is that new password? And, and so the fail rate is kind of high with passwords versus the key is gonna be, you know, shouldn't have a fail rate. It should be really quick, instantaneous.

Yeah. This is an excellent, excellent article at securityboulevard.com. The title of the article is Passkeys vs Passwords: A Detailed Comparison by Deepak Gupta. I would search that article out at securityboulevard.com. One of the things he does really well is he does a comparison— passwords versus passkeys, pros and cons. Any of the features are security, usability, login success rate, compatibility, flexibility, cost, management, regulatory, and compliance. This is the best article that I've seen on this topic, and it makes it as user-friendly for the consumer as possible, even though this is a trade publication. So yeah, everyone check it out. Meanwhile, Peter, tell our pod broadcast audience what you're up to.

Oh boy, I mean, things are— it seems like a lot increase of activity. Some of it's productive, you know, most of it's leading to more work. Uh, never enough time. I feel like I'm— I feel like I need an AI or maybe a couple of AI assistants. Maybe I need to look into this now because supposedly the technology is there. I gotta look for some positive aspects of AI because as I mentioned to you in our show earlier, I'm a little, you know, before our show, a little concerned about— we can talk about that during the next episode, actually. So yeah, the travel, you know, providing workshops, speaking at a number of conferences coming up. You can— and I want to put a plug out for both myself and for Robert Siciliano as well that we got October is Cybersecurity Month, and if you're going to be looking for speakers, hey, you better start doing it now because everybody's schedule is getting kind of, uh, kind of getting packed. So yeah, me at counterintelligence-institute.com or my LinkedIn page. Yeah, and your books, Why Are You Messing with Me? A Senior Survival Guide on Fraud, Privacy, and Security for Seniors, as well as The Confessions of a CIA Spy, The Art of Human Hacking, both available on Amazon.

Awesome. And I am at protectnowllc.com. Uh, obviously, uh, virtual and, uh, on-site training. Uh, one thing that I also have on my site that I display at all of my presentations is what's called a Cyber Security Awareness Check. Has your personal or organizational security been breached? Get an instant answer. Check if your email has been breached and check if your password has been breached. You click on email checker, right? This is on the home page, right? You click on email checker and you plug in your email address. And in this tool, we have access to 14 billion stolen records essentially downloaded and left open on the dark web. This tool gives you the option to search out all of those 14 billion records instantly to determine which particular data breaches your email was a part of and whether or not the password for that particular data breach at that particular website was part of that compromise. And that this same tool also allows you to search out passwords that you possess to determine if they were also part of any specific— or just to determine whether or not they have been used by others. And you'd be amazed at how many millions of people are using 123456 as a password still to this very day.

Oh yeah, yeah, it looks like a great resource. Uh, hope people check it out. I'm actually— I actually gonna go there later today. I'm gonna check this out. Awesome.

And, uh, Peter, um, uh, last words.

Hey, stay safe out there and really look out for each other because the bad guys are really, you know, taking— they're victimizing so many people, and the awareness is the first First stage, if we don't have awareness, we'll never be able to defend ourselves.

And as my dad says, be good, behave, be careful. Talk to y'all later.