The Security Guy and CIA Spy PodBroadcast

And welcome to the Security Guy and CIA Spy Pod broadcast. I am the Security Guy, Robert Siciliano. And this is—

I am the CIA spy, Peter, former CIA spy. I caveat that so people don't get necessarily so worried if I come into their life at some moment. Peter Wormka.

Peter Wormka. Peter, yeah, like, you're like legit, like, like Langley, West Virginia, retired former CIA spy.

I am legit, 100%. I don't need to lie anymore.

Yeah, and, and right, like, that was— you were, you were an operative.

Yes, I was, uh, over two decades an operative. I mean, I did have some management responsibilities the latter part of my career, but most of the time I was out there in the field, and my job was to spot, assess, develop, recruit, and then handle sources predominantly to acquire to steal foreign intelligence.

And so you essentially, like, literal boots on the ground, socially engineered people.

Oh yeah, it's a little bit more visual, right?

Yeah, yeah.

And it works. I mean, it's amazing. It's really at the heart of so many, you know, different I mean, when it comes to security breaches across the board, we talk about many times, it's at the— I mean, it's the leading cause, or at least the initial ploy is a social engineering ploy that usually ends up with the actual breach. And it also equates very well with, you know, the main tool that scammers and fraudsters are using today, not only to scam companies, but particularly to scam individuals. It's human hacking, social engineering. I don't care if you add different types of, you know, technology pieces to it, but at the heart of it, it's basic manipulating people, you know, focusing on that basic human psychology.

And that basic human psychology— and I've been speaking about this quite a bit— is because, you know, security awareness training, most experts get up there and talk about, you know, do these things, don't do these things, and so forth, that you should be fine. Manage your passwords, two-factor authentication, update your operating system, update your virus definitions, all that stuff, which is all basic stuff. But people don't necessarily care about any of that stuff or want to do any of that stuff. And so what I've been speaking about a lot is explaining to them how we as human beings trust by default. And it's that human psychology that you referred to that is what's interesting to people. And that's what gets their attention. And when they understand that in a security awareness program, then they're more apt to engage in the best practices of do this and don't do that and so forth. But trust really is what you exploited.

Absolutely. It's at the heart of it. I mean, there's other techniques that are used, incorporated, you know, uh, to, to play upon people's emotions. It might be fear, it might be, uh, scarcity of time, might be greed. But these are all different things. But you, as you said it, the heart of this is that human trust. And, you know, a lot of the training or things that come out today are like, you know, talking about we need to have more public awareness, which is 100% true. But I think a lot of the training, the awareness is more like looking at what is the tech, what is the ploy, what is the scam of the day? Instead of looking at trying to address this issue as, you know, using our critical thinking that regardless of the new scam, the new ploy, the new technological piece that might play in here, it comes down to the same thing. A situation arises, we need to stop and analyze. That situation before taking an action. And we need to do that across the board. So I think more of that needs to be, how do we reform, I mean, how do our thinking, our analysis of these different situations? Because I'm looking at every single day, I put a Google alert basically looking for elder scams, fraud, and I'm looking at all these, there's so many every day. But they're all the same when it comes down to the first, you know, the basic psychological, you know, ploys that are used on these individuals. It's, it's all the same really at the end of the day. So we don't need to learn about all these different types of scams per se. We have to learn about changing our mindset about how we approach, how we approach these things that come our way, right? It's not when we reach out to somebody that we're going to get scammed per se. It's when someone who we don't know reaches out to us. Yeah, that's when we need to stop and really use our critical thinking skills.

And now with AI, uh, which you and I have been talking about quite a bit lately, and I think we're going to continue because it is, uh, taking hold, uh, it's, uh, becoming a part of, um— I know I'm using it on a regular basis. I, I wouldn't even do a Google search at this point. I'm doing like a Gemini search, a ChatGPT search if I want to get information, if I want to find an air conditioner, I'm using ChatGPT or Gemini to find deals on an air conditioner. If I'm looking for information on something or need to define something, I'm using AI. And then when it comes to content management, AI gives me everything that I need to research. And so with fraud, It's being used to manipulate like it never has. Like a tool that has not existed previously is now perfecting fraud and the social engineering aspects of fraud in ways in which it never has. But now with FraudGPT, It manipulates audio, spoken word, voice, and video. And here, Rubio impersonator signals growing security threat from deepfakes. Dark Reading talks about an imposter who posed as the Secretary of State in text and voice communications with diplomats and politicians demonstrates the increased sophistication of and national security threat posed by AI. This is just, you know, a couple of weeks ago, uh, in, in Dark Reading. The case of a threat actor using AI to pose as Rubio in communication with foreign and domestic diplomats as well as politicians demonstrates the growing sophistication and the increased threat AI poses to national security. Uh, WAPO reported that an imposter sent voice and text messages mimicking Rubio using AI, citing senior US officials in State Department cable obtained by the publication. The impersonator used standard mobile text messaging as well as the encrypted messaging form app Signal in the campaign, which began in mid-June, right? I mean, when, when, when you're seeing this, when you're seeing AI used at the highest levels of government, to manipulate those in the highest level— levels of government, uh, you know, the technology has come into its own, and criminals, fraudsters, understand its value and its benefit.

What these AI tools do, like these— you could call them deepfakes as well, because whether it's video, pictures, or images, or voice cloning, it enhances the credibility of the message. I mean, you get back to your earlier point, trust, right? We all typically have— we overtrust, but then you get, you know, these deepfakes, which increases the credibility of the message. It goes back to that, you know, increasing, increasing generally our trust in whatever's coming our way. I don't know that you— this is really interesting because it reminds me of a particular fraudster. This goes back a few decades, but did you see the Netflix Netflix series called The Masked Scammer, Robert?

I don't know if I have.

If you haven't, go back and watch it because it's fun. It's a story, it's a documentary, it's phenomenal because it talks about the, the scams that were conducted by— I think he was maybe Israeli initially, but he spent a lot of time in France. His name was, uh, Gilbert Siciliano, and he— his, his con was he impersonated He impersonated many times CEOs of companies, impersonate the presidents of banks, basically to get the underlings to make those wire transfers. We're hearing more and more about voice cloning and people being subject to that, being defrauded and going ahead and complying with the instructions they are hearing from their senior bosses. Well, this guy was doing it back a couple of decades ago. He didn't use voice cloning, but he would impersonate them in the way they spoke. And also he knew the psychology. He knew how, how, you know, he learned a lot about the operations within companies and kind of know how, how they communicated. But even more interesting, because there's this parallel here with this, this particular voice cloning impersonation targeting a senior official in, in the government, right? He also, Cicely, also impersonated at that time the minister, the French Minister of Defense. Because at that particular time there was, I think there were some French citizens who were kidnapped and held in Mali. And the stance of the French government at that time was that they're not going to negotiate with terrorists, right? So they were unable to officially send money over to try to negotiate a release of these guys. So what Cicely took advantage of this situation to impersonate the French minister of Defense by reaching out to high net worth individuals and saying, listen, this is a special government operation. You realize that we can't officially— this has to be off the books, but we need money to do this. Please contribute right now to this and we will give you a guarantee 100% of that money is going to be returned to you. But we need your help right now. And it evoked patriotism, right? And this guy just used a silicone mask and basically got on— I don't know if it was LinkedIn or some platform with a silicone mask and, and I was able to defake it. I mean, was able to fake impersonate, and it worked. You know, now today with this type of voice cloning, it makes— it lowers the bar, which makes not just people— not only people that are really crafty like him, but pretty much anybody with a minimal amount of, uh, you know, experience can undertake these type of scams.

Yeah, it's awesome and awful all at the same time.

Here it is. Yeah, this is, this is amazing. Highly recommend it to everyone, not just because it's a fascinating story, but I think you can also learn a lot about human hacking, social engineering, because this guy was a master. Still is. He's still alive. I think he's in prison right now, but I'm sure he's, he's still out there conducting.

To help facilitate the scam, the imposter created a Signal account with the display name Marco.Rubio@state.gov, which is not an email address associated with the Secretary of State, and used it to contact foreign ministers, a US governor, members of Congress with the goal of gaining access to information and accounts. Other unspecified state department officials were also impersonated in the campaign, according to the report. Yeah, man, like, this is the direction that pretty much all fraud will be heading or is heading as we speak, because it works.

Well, you know, the scary thing is that this is all the tip of the iceberg because very little of the, you know, very little of that gets reported, whether it's the, you know, something that happened in the private sector or even here in the government sector. I mean, what's the threshold for reporting if someone, you know, is aware that the scam took place or attempted scam took place? You know, if it's for legal reasons, pretty much only companies have to report it, right? If it, if they're looking at maybe the loss of PI information, right? I'm sorry, PII information of individuals. Otherwise, a lot of times this can go on, companies being defrauded, but they're not necessarily going to report this. So we occasionally hear of it. But I think the cases of this actually happening are so many, many more than we're aware of.

It's unclear where the attack originated from, although there is some speculation that Russia adversaries are behind it. Which makes total sense. Yeah, you know, we're— look, consumer beware, you know, small businesses, you know, CIOs, CISOs. If you are not training your people on the extent of the problem here and what to look out for and getting back to the basics, the fundamentals of trust and understanding how we as consumers, as, you know, when I say consumers, not just of products and services, but you and I, you know, we've been consuming the written word since, you know, elementary school. We've been consuming the spoken word via, say, radio. We've been consuming visual via television since we were kids. And now it's streaming, it's online. And we're consuming it. We're consuming some form of media in all its forms, 8 to 10 to 12 hours a day. And we have grown up trusting that written, spoken, visual media all our lives. And so by default, we pretty much trust the majority. We give the benefit of the doubt pretty much all the time. Uh, sure, there is some skepticism there, uh, and, and we may not— you know, some of us say, well, I don't trust anybody or anything, and, and, but you do, you know, you need to. And, uh, and so as a result, um, we're being bombarded with, you know, regular legit media all the time, and the bad guys are slipping in general communications, emails, phone calls, text messages, instant messages, and so forth. And the bad guys are slipping in the fraud in between all of this. And we may not recognize the risk that we're encountering when it's most necessary.

So you have to kind of push back from this whole concept of seeing is believing, hearing is believing, because we have to start questioning uh, some of these things. And, uh, it's, it's not going to get any better, right? Not going to get any better for a long time.

And so I've been seeing more and more of this. People are losing billions to celebrity romance scams, right? I'm surprised actually it's taken this long for this to happen, uh, but with AI, again, it makes, the probability of, of the likelihood of a, um, celebrity, uh, approaching you, uh, and, uh, using AI to model and mimic, you know, their audio and video, uh, in likeness that much more probable. So here Vice talks about, you know, by the time Margaret checked into a hotel room to finally meet Kevin Costner Right. And like you say, like, you know, how dumb could she be? But no, read on. The Yellowstone star she thought she'd fallen in love with, you know, online, she'd already wired him over $100,000 in Bitcoin. Right. The scam here is perfect. The bad guys know what they're doing. They are basically doing what you did as a CIA spy for decades. But they're doing it with the help of AI now. She packed bags weeks earlier, left her husband of 10 years, and believed she was about to start a new life as part of Costner's mysterious new production company. Instead, she got a photo of a totaled car and a message saying that Costner wasn't coming, he'd been in a crash, right? As, uh, detailed in an excellent and quite depressing Hollywood Reporter feature, uh, there was of course no crash and there was no Costner. Margaret, a 73-year-old retired office manager, a TED Talk speaker, and recent divorcee, uh, was just the latest target in a boom industry of celebrity impersonation scams. It's part of a digital grift that preys upon the lonely, which we've talked about. 1 in 4, 20 to 30% of all of us, experience loneliness on a regular basis, including in our own marriages, right? Uh, the grifter preys on lonely using a variety of modern-day tools that make deception as easy as it could be, using a variety of social media platforms that don't seem to care to protect their users from scam artists. Romance scams cost Americans $672 million in 2024 alone. Older women like Margaret were among the hardest hit. These scams prey upon parasocial affection. That exploit the one-sided relationships we build with public figures. And, and trust is the fundamental— trust and loneliness are the two fundamental aspects of this. That's why scammers overwhelmingly impersonate older, trustworthy male celebrities like Keanu Reeves, Kevin Costner, uh, Jonathan Rourney, who I don't know who that is, an actor who you may not know by name, but he is a big hit in the Christian film industry, uh, playing Jesus in The Chosen. Okay, uh, you know, like, this is, this is awful.

It is. And to me, I mean, it's, uh, once these scammers, especially with romance scams, get their hooks into somebody, it's like, no, you know, even if people try to, like, even like family members try to speak to the victim targeted victim, you can't, it is very difficult to be able to convince them to the contrary, that it is not a, that is not real. I think, you know, it begs to the importance of having more and more communication between, you know, the elder parents or grandparents and their children and grandchildren, because if children, grandchildren, you know, can have discussions and what's going on in that person's life, it's more than likely that that person will reveal, "Hey, you know, I got a new friend," or, you know, and they reveal that. And early on, the family members should be able to detect that or find that out and try to mitigate this and try to save the individual from being scammed. But I think there's really a lack of communication. I think, and many times it's a delicate sword too because Sometimes elder abuse is even caused by a family member when it comes to finances. But it would be, you know, in some cases really good for a family member to become more and more involved, to include maybe having power of attorney on an account or being advised of these alerts that when their parents are taking kind of money out of an account, that they're aware that this is happening, where they might be able to intervene or at least find out what's going on. Because after, you know, the hooks are too far into the individual, it's, it's really hard to stop it. It's really hard to stop it.

Yeah, and like you said, the, the, the victims in these cases, they often, even with intervention, don't want to believe and sometimes just won't even believe that they are in the process of being scammed. Like, they are in complete denial. Their world has just been turned upside down by this new celebrity in their life who has now, you know, made their day blissful. You know, they wake up anticipating the communications from their new celebrity romance, and throughout the day they're engaging in this scammer who they think is, you know, Brad Pitt or Costner and so forth. And when someone intervenes and says, no, that's fraud, that's a scam, they're like, no, you're fraud, you're a scam, you're You don't know what you're talking about. Brad Pitt loves me. And they will continue to go down that rabbit hole no matter how much this friend, family member, neighbor, banker tells them they're engaged in a scam. They don't want to believe it because they feel so good. And nobody ever wants to think they're a victim of anything, especially, you know, a romance scam. You know, because when they initially were duped, 9 out of 10 times that the victim was feeling a sense of loneliness on a regular basis. And loneliness, the pain and ache of loneliness is something that is within us that's been part of our evolutionary process since the, since the beginning of time. It's, it's very much similar to the pain and ache of hunger pains, you know. Oh yeah, oh yeah, hunger pains. We, we have hunger pains, yeah, because we're hungry, but we have hunger pains as a natural part of our species so that you will eat, so that you will, you know, nourish the body with food and water. We have thirst because we need to hydrate our bodies. You have hunger pains because we need to feed our, feed our body with food. And without hunger pains, without thirst, you wouldn't eat and you would wither away and die, or you would dehydrate and die. Without the pain and ache of loneliness, you would not engage with others socially. And if you don't experience loneliness in any capacity at all, you have absolutely no motivation to be with others. Therefore, we would not procreate, and you— the species would wither away. We would slowly drop off. It's, it's the same thing. And when you put it in that perspective, people begin to go, oh, that makes sense now. That's why people feel lonely. But in, in, in our modern age, loneliness is, is, is causing disease. And when the celebrity or this romantic partner comes into your life digitally and you're feeling loneliness on a regular basis, and all of a sudden your new romantic partner, whether it's Kevin Costner or Brad Pitt or anybody begins to make you feel whole and that loneliness dissipates, you're like, this is great, I, I feel, I feel 20 years younger, I feel happy again. And you're not about to believe that it's a fraud.

You're not. And unfortunately, that will continue until all the money is gone. Not necessarily just the money that's in, you know, the 401 or in a in a time deposit, a CD, I'm sorry. But even they will take out in some cases loans, second mortgages. I mean, they'll lose everything. And then once there's no more money, the fraudster is just going to drop them. And that's usually the time when many of them realize it was a scam. They lost all their money. They've damaged relationships with their family members. They are emotionally devastated, financially, devastated. And can you imagine being at that point when you're supposed to live out your life, you know, be in retirement, you know, getting about to retire, you wanted to have this money maybe to help your kids or your grandkids, and, and all of a sudden you got nothing? You just, you know, it's got to be— I can't even imagine.

Yeah, I've met, um, victims, uh, that have engaged in various, you know, pig butchering scams, and they mortgage their houses and, you know, thinking that they're making a ton of money via cryptocurrency. And I've met victims of romance scams that have got second mortgages and they're going bankrupt. You know, a woman scammed into believing she was dating Brad Pitt, divorced her husband, transferred over $800,000. She was a French woman. You know, she thought she was, you know, communicating with Brad Pitt. You know, when you look at all the photos and the videos and everything else, It doesn't look like it was possible. She even said, you know, in her own words, that she thought it was ridiculous that Brad Pitt would be reaching out to her. But she said that the scammer she was talking to was really good at talking to women, and it just made her feel good, you know. Uh, and so look, it— like, it's important that, like, you know, comments— these scammers are everywhere on Facebook, Instagram, sending messages. They have plenty of good English. To be safe, just don't talk to men you don't know, as the lying is for your money and everything and anything goes. And then other comments, how can you believe that kind of a story? It's because loneliness. It's because trust. It's because we're just fallible, vulnerable human beings.

Yeah.

So Peter, where can everyone find you?

Where can they— I'm always on the run, you know. I guess digitally they can find me at counterintelligence-institute.com is the website, or, you know, even better, my LinkedIn. On LinkedIn I got a pretty good presence, as well as if you're interested in the books, I mean, in addition to my consulting services, and presentations that I give. I have two books, Confessions of a CIA Spy, The Art of Human Hacking, as well as more dedicated to seniors and elder fraud is a book, Why Are You Messing with Me? A Senior Survival Guide on Fraud, Privacy, and Security.

Yeah, well, you, Robert, I am— yeah, here's Peter on, uh, LinkedIn. You got 7,200 followers, man. That's pretty impressive. Yeah, yeah, you are a flipping rock star, man. That's great. Uh, I am at protectnowllc.com. As I've said in the past couple of months, 2025 has been a great year because companies realize that phishing simulation training is not really pulling its weight like it could or should, and it's only addressing one part of the security awareness problem. And until companies, you know, batten down the hatches and essentially get people like experts like you and I, you know, boots on the ground to explain human hacking that goes beyond phishing simulation training and that it violates trust in so many different ways and how AI is contributing to the fraud. It's going to continue to get worse. It's not going to get any better. So Peter and I right now are booking the fall with Cybersecurity Awareness Month. Uh, and, uh, which is October. But, uh, you know, my calendar is filling up for October. I'm sure yours is too, Peter. So yeah, last words, Peter?

Last words: exercise healthy skepticism. Always verify before trusting.

Awesome, man. You're the best. I'll talk to you soon.

Thank you, Robert.