The Security Guy and CIA Spy PodBroarcast

And welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano and this is Peter Wormka, aka Human Hacker. Hey man, how are you doing? Pretty good, thank you.

I just— I'm, I'm, I'm really, uh, I want to say on cloud nine, but I very— I came back from last night from an event down in Davie, Florida. It was organized by, uh, university down, down there, and they invited me to speak before a group of seniors, and I thought it was going to be like 30, 40 people It was 130. They— it was, it was full. They had to bring in more chairs. It was just like packed. And people were so into— I was just amazed. They were, I mean, very educated— I mean, educated on, on cybersecurity or security in general, but then asking more and more questions. So you can see there was a hunger. It was so eager to learn more. And it was so satisfying, you know, as a speaker on these topics, you you know, even though you don't make money, you know, money on these type of events, but just seeing how, you know, you're helping the community. And, and then they— the sponsor ordered 150 books, and I was there signing my books. I never signed so many books in one day. It was fantastic.

I, I am guessing that you don't often speak to seniors.

No, but I do want to do it more often.

Yeah, I really do. So they're the best audience. They are the best audience. I've spoke to seniors lots and lots and lots of times, and they know a lot, um, and they ask a ton of questions. They are the most engaged, interested audience ever. Seniors are the best.

I'm glad to hear that confirmation because that's what I walked away with.

Yeah, that's so fun.

They are.

They make it— it goes by so quick because they're constantly raising their hands, interacting like they want to know.

I wish the rest of the population was like that. I mean, other people that are, you know, younger, it's just like, whatever, you know. Hey, but seniors, they're— they definitely want to learn about these topics for sure.

Well, the difference— a big part of the difference is, you know, they're at a point in their life where they also have like a lot more to lose Right. They've got investment accounts, they get retirement accounts, they're kind of on a budget and they don't want to see that money disappear. Plus, they're at a point in their life where, like, you know, younger audiences, I find, are a little bit resistant to raise their hand to ask questions because they don't want to ask a question that's like a dumb question. They don't want to appear or ask a question that, like, they feel that they're going to be judged upon. You know, that's a little part of it, you know. But whereas seniors, they're at a point in their life where they are— they don't care what anybody thinks, plain and simple. Like, they're just gonna say whatever they want, they're gonna ask whatever they want. They don't care what other people think of them at that point in their life.

No, but it's fantastic. I'm looking forward to more of these.

Yeah, good for you, man. That's awesome. Um, I just came back from, uh, El Paso, Texas. Uh, the, uh, the client, uh, was a— was that— was a dental study club and, uh, I spoke to like 50 dentists and their staff, so bookkeepers, administrators, hygienists, and so forth. And, you know, dentists, they have a lot to lose, like, uh, physicians in general, you know, doctors in general. They have practices that have a lot of sensitive information, uh, healthcare information, Social Security numbers, account numbers, uh, in many cases forms of payment. And they want to know how to protect themselves, uh, their, their, their businesses, their practices, and also, you know, their, their own bank accounts, their identities, their family's information. And, uh, we also speak to like social media, online reputation management, and personal protection. You know, these are moneyed individuals that have something to lose and they want to know. So yeah, great.

Good stuff. So what's going on today? What we got?

Oh man, there's so much to go over. So, uh, first and foremost, employment identity theft happens more often than you think. Here's how to spot it. This is via CNET. So employment ID theft isn't the same as a fake job scam, which I think the stats on that are as many as 1 out of 5 job postings are just fake. Uh, but it can have real negative impact in your life. So you may be familiar with employment scams and fake job posts created on LinkedIn intended to fool applicants. These scams look to extract your personal identifiable information and can lead to identity theft. Okay, so that might mean they're trying to get your Social Security number, right? Uh, employment identity theft basically is they get your social. Um, it happens for multiple reasons. The thief may be struggling to find employment due to a criminal history. Or lack of job skills. And how does it, how does it harm me? Well, basically, it can lead to financial identity theft-related consequences like tax-related fraud. They might, they might issue W-2s, 1099s under your name, right? That could lead to various problems regarding your own taxes. Let me see, your reputation could be at risk. I mean, what else? Um, I wanted to get to the meat and potatoes. So how do, how do you— so ID thief, ID thief may open lines of credit under your name. So basically, if they can get a job under your name, then the next step for them is to become you at a higher level. And that means getting credit cards under your name, getting loans under your name, getting a car under your name, and so forth, right?

Now, using your Social Security number, right?

That's it, you know. So now this particular article kind of dives into like how do you protect yourself, and I don't agree on most of it. Uh, well, actually yes and no. Let me explain. So how do you stop it? It says like don't give out your personal information, especially your Social Security number, freely. Okay, I mean, there's some truth to that. However, like, you've got to give out your social more often than you want to. Uh, you just have to be you know, uh, I guess cautious about giving it out. So I mean, that tip is like legit. And then the tips— use antivirus, shred personal documents, use a password manager, two-factor— those are all like standard protect your data, protect your identity. I get all that. Like, that's all yes, but that's not going to generally prevent job-related identity theft is my point, right? But do those things.

Right, and this article addresses how maybe the individual can try to protect themselves, but it doesn't really go into the duties, I would say, of organizations that employ individuals such as these potential scammers, that they're not doing sufficient due diligence and verification of these applicants. That all— and then in the end, it also hurts— it can hurt incredibly the organization, because maybe it's an individual that's going to go in there and also become a malicious insider?

That is a huge problem. So there are a number of companies out there that do employment-related background checks and employment histories. And those same companies, they look for anomalies in employment applications. So I think it's important if you are a small, medium, large business that whenever you are hiring, that you're using a service that is looking for more than just whether or not they have a criminal background, but they are looking at all data points to determine whether or not that person is who they say they are. Does the name match up with the address? Does it— does the driver's license match up with the address and so forth? And then doing driver's license scanning, uh, companies that, um, do like mortgages and loans and such, banks, they scan driver's licenses and they look for whether or not that driver's license is real or fake. And you can do virtual via an app driver's license scannings to look at a number of data points to determine, A, is that driver's license real? B, is everything about that person and that address and that driver's license and their background legit too? Do other data points match up? Would you—

hey, Robert, would you recommend locking down— and that was not really that familiar with this— locking down your Social Security number by, uh, creating the e-Verify account? I mean, have you had an experience with that? Yeah, yeah.

And so that's actually what you should be doing to ultimately prevent job or employment-related identity theft. So if you've already been a victim of employment related identity theft or not— or not. I don't know why it says if you're already, uh, yeah, exactly. Consider locking— right, consider locking your Social Security number by creating an e-Verify account to prevent it from happening again. So if you click on this particular link right here, it brings you to e-Verify. Now this is important. I recommend that everybody do this. Number one, Freeze your credit. Get that done. 3 major credit bureaus: Experian, TransUnion, Equifax. Freeze your credit across all 3 bureaus. Beyond that, go to eVerify. Now, I already have an eVerify account, uh, a couple of reasons. If you set up Global Traveler— so Global Traveler is through the federal government, it's beyond the, the TSA PreCheck. So I have Global Traveler and I have TSA PreCheck. Setting up Global Traveler begins here by setting up an e-Verify account. It is the federal government's way of identifying and authenticating consumers, citizens who do business with the federal government or set up, you know, passports, Global Traveler, and so forth. That's done through e-Verify. Everybody should have an e-Verify account. If you don't, eventually you should, or you want to. And to lock down your Social Security number in regards to employment-related identity theft, start with e-Verify and the self-lock.

Good.

This is a great thing. So if you want to get an electronic— if you want to get a passport without having to renew your passport, Uh, you could do it online, and you do it online by, by beginning to set up an e-Verify account. That's how this all works. Once you're set up there, there are so many additional conveniences afforded to you because you have that account.

So, okay, so let's, let's— scenario here. Let's say you don't have your credit frozen amongst those 3 credit bureaus, but you have your Social Security number locked. If somebody wants to take credit in your name, Does that mean that they wouldn't be able to use your Social Security number to do that, or those are two separate things entirely?

Yeah, they're two separate things entirely. Um, keeping in mind that when your credit is frozen, that it does lock lenders out from checking your credit, of course, but in some cases when background checks are being done or other various checks especially like if you're opening up a bank account and so on. Um, the credit freeze in place will in some cases stop different forms of background checks. Can't get into the specific, specific details right now, but that said, it's a layer of protection that you want right now regardless. And on top of the credit freeze is the eVerify self-lock.. And generally, you should be good. I was quoted in an article this week, and the journalist just sent it to me today to, you know, say, hey, it's published. And one of the things that I said, which I thought was pretty smart of me, was, you know, like, it's amazing to me that identity theft is even happening today, because there are so many options for consumers to lock down their social, their credit, their employment identity, and so on. That your identity really shouldn't be stolen, that you can do so many different things to make your social useless to the thief. But why don't— why doesn't everybody do it? Because I just think that they don't know. Either they don't know it's a problem, or they don't think it's going to happen to them, or they just haven't been around to it.

Yeah, I mean, unfortunately, it takes them becoming victims or somebody really close to them being victimized to maybe, you know, have them think about it, you know, and actually take action.

Yeah, it's just, you know, kind of ridiculous. All right, so next on the chopping block is, uh, CNET again. So this, uh, identity theft expert talks about, um, uh, how your Social Security number can be used to create new identities to rack up debt. Uh, let me see. So what— it's, it's synthetic identity theft, which we haven't talked a lot about on this, um, pod broadcast. Synthetic identity theft is not a new phenomenon. It's been around for a while.

This is a big one for, for banks.

Yes, but the term might be unfamiliar to most people. It's often referred to as Frankenstein fraud. Synthetic identity theft is the practice of creating entirely new identities by piecing together various parts of stolen, stolen from other identities. Some elements may be real or taken from more than one individual. While other parts may be fictitious. Yet these almost completely false identities are fooling the financial system at an alarming rate. As many as 15 million consumers in the US are victims of synthetic identity theft, which is a problem. Uh, synthetic identity theft caused $20 billion in losses in 2020 according to FII Verifies. So how does it work? Synthetic identity theft is an exercise in patience. So generally the bad guys get children's Social Security numbers, sometimes the deceased Social Security number, homeless people's, even like everyday legit people's socials. And what they do is, is they basically attach it to maybe your name or my name, uh, different name than, than the social, a different address. And what they'll usually do is they'll apply for credit, and often that credit might be rejected. But what happens is when they apply for credit and the credit is rejected You've now established an identity with that name and that social and that address, although it's fictitious. And although that very first application for credit might be rejected, now you've established an actual name associated with the social, associated with an address via the credit bureaus. Now this person actually exists. Now the next thing the bad guy does is they put that name and that social on a user's— a legit person's credit card account, meaning they get— they piggyback that fake identity on an existing real credit card account. So for example, if I bring my daughter in and have my daughter get a credit card under her name Now her credit is being built under my credit. I'm ultimately responsible, but her credit is part of my credit now. And she has her own established credit because I got a credit card under her name. And as that builds over time, uh, she becomes more and more established. Well, with synthetic identity theft, it's kind of the same thing. You create this synthetic identity, piggyback it on a legit, uh, well-worn credit profile. And over time, as that fake identity, synthetic identity, uh, establishes credit, eventually the credit bureaus, you know, create a score for that synthetic identity. And that synthetic identity eventually, 6 months, 9 months, a year is able to actually get a credit card under their name.

Well, once again, one of the things you can do is locking down— I mean, those credit freezes, because assuming that the Social Security number is the vital piece of information that they're going to be using. So locking down the Social as well as freezing your credit can really help from being, you know, for you becoming a victim of this.

Yeah, so freezing your credit reports is the first thing to do. Um, second thing, check your credit reports regularly because even freezing your credit report, uh, may not 100% prevent synthetic identity theft because it may— that, that, that credit file may not directly be frozen due to the fact that it might be associated with a different name.

Yeah, gotcha.

So by checking your credit report on a regular basis, you might see lines of credit opened up that might appear under your name and/or your social by checking your credit, uh, that may or may not have been prevented by the credit freeze. But by manually checking that credit report, it's going to give you some insight as to where or whether there might be any additional lines of credit opened up on your name that weren't covered by the credit freeze.

And each of the bureaus will provide you a free credit report once per year. And you might do this every, you know, do it once every 6 months and just rotate through the credit bureaus. And that way you're, you know, you can check.

And the best way to go about that is to do it at annualcreditreport.com. Annualcreditreport.com. All right. So, uh, let me see. Last but not least, scammers are stealing homes from under their owners' noses. AI AI is making it scarily easy. So this article is from msn.com. It talks about how it's like a $1.2 billion a year fraud. I mean, there's a lot that goes on here. Even, uh, Lisa Marie Presley, uh, was responsible for, uh, combating a deed fraud that occurred on her, uh, Graceland property, or her family's Graceland property. Um, and, uh, you know, she was able to make that happen or prevent it. Deed fraud frustrated regular property owners. In 2023, this guy named William Gordon, he bought some vacant land in Arizona and it was sold to somebody else without his knowledge. Uh, and they can sometimes even build properties on that. Um, they could build houses on that vacant property. Vacant land fraud is a, is a real problem, uh, and it's getting bigger and bigger. So this article talks all about that, how it happens, lots of stories. But here's the deal, I'm asked probably every, every presentation that I do, what about home title theft? Which basically is what this is. Do I spend that $25 a month on that service that basically, you know, watches my deed? Well, I say maybe. Um, Peter, here's the deal, right? Different states are more or less susceptible to deed-related or title-related fraud. Okay. What I suggest that people do is Google basically states offering title/deed monitoring free.

Okay. Good point.

States offering the word title/deed monitoring free. Okay. And when you do that, you'll see all kinds of options that pop up regarding Property Fraud Alert, which I believe is a subscription-related service. Um, like for, for me right here, I see, uh, there's all kinds of articles, um, from different title companies that talk about it. And then right here pops up consumer notification for Massachusetts. So obviously that's my home state. So I click on that and right here at the Registry of Deeds at masslandrecords.com for Massachusetts residents. And this same similar service exists for deeds and municipalities and counties across the country. Right? So right here, it says consumer notification service, get notified when some— when documents are recorded. This service alerts you by email whenever a new document is recorded for your property. Perfect. If you made this change, you don't need to do anything. If you did not, you should contact your local registry of deeds. So right here, it's saying for me to create a new account and I can go in and I can create an account and I can get alerted based on my property address. Whenever any changes are made to my deed.

Now what hap— this is great. What happens though, is part of it, it's already happened. The notification, you receive notifications. So someone has stolen your deed and perhaps it allows you a chance to stop them before they try to sell that property to someone else. Right? Right.

Well, that's it. Uh, the idea behind you, there being any changes made, you are notified pretty quickly.. And in that timeframe, you are able to stop any frauds that basically are going to result in your, your house or your land being sold from underneath you. So the quicker you know about it, the quicker you can intervene and stop any transactions from occurring, letting the Registry of Deeds know, hey, this is a problem, that wasn't me. And then once you do, they will stop any and all transactions related to your, uh, deed or title, uh, in real time. So that's the first thing. Knowing that something's going on in the background is the most important part. Uh, being, being alerted in real time is the best possible solution that you have. And any service that you might pay for, they're going to do one of two things. They're going to let you know that this is happening in real time, and then work with you to stop it. And/or they can— they're going to provide you some type of a legal representation to deal with it. But one way or the other, it's reactive to whatever changes are made in your title or deed. And that's the best course of action that we all have available to us today.

Mm-hmm. That's excellent. Excellent advice.

So Peter, uh, where you're at, what you got going on, how can people find you?

Well, where I'm at right now, I'm in Orlando, but I'm ready to travel at any moment. And actually, a lot of things are picking up here, so this year looks to be a very, very good year for us in regarding a lot of queries and contract— contracting for presentations as well as training, even training workshops for 1 or 2 days. So anybody, if your organization is interested, please reach out to me. Sooner the better because later on there might not be availability.

Robert, what's your website?

counterintelligence-institute.com.

And your books?

Confessions of a CIA Spy, The Art of Human Hacking. Everybody that attended the session yesterday wanted that book too. We didn't have it. Uh, the other book, Why Are You Messing With Me? A Senior Survival Guide on Privacy— I'm sorry, on Fraud, Privacy, and Security. Available on Amazon.

And, uh, you all know you can get me at, um, llc.com. Uh, January was a fantastic month. Uh, February is already turning out to be a great month, already matching, uh, January. Uh, 2025 is probably going to turn out to be a banner year because I'm sure you are finding the same thing, Peter. Uh, CIOs, CISOs, IT managers, directors of security awareness are all saying phishing simulation, while necessary and good, gets our people up to speed regarding phishing. It doesn't really help though when it comes to getting our employees to care about security.

And so more and more—

exactly, more and more Peter and I are hearing that, you know, companies, they want their people just to care. And so what Peter and I do is we provide a personal touch where we're providing more than just security awareness. We're providing what we call security appreciation. We show the user, the employee, how to appreciate the value that security has in both their personal— or first, their personal life and their professional life. And once they understand how security affects them, then they're more apt to be more responsible to protect the data that they are entrusted with in the workplace.

Place. Yeah, we're just finally seeing some, some companies beginning to understand that and moving on well beyond the phishing and, and starting to, to talk about these things and bring in, uh, individuals to provide this kind of training. So that's very favorable. I'm glad to see this happening.

Yeah, man. All right, last words.

Take care, be safe, and have a great time in doing it.

Talk to y'all later.

Bye-bye.