The Security Guy and CIA Spy PodBroadcast

And welcome to The Security Guy and CIA Spy. I am Robert Siciliano.

And this is Peter Wormka, live from Orlando. How's it up north, Robert? How is it up there?

It's finally cold. Yeah, it's, it's been unseasonably warm, which has been concerning, as it should be. And, um, yeah, uh, here we are, uh, a little bit more about 5 weeks after the election. And, um, yeah, I kind of— I honestly, Peter, I didn't— I don't want to get too deep into the weeds here, but I kind of don't know what's going on in the world. I kind of had to turn it off for a little bit, um, to the point where, like, I knew that there was a CEO in New York City that got shot, assassinated. But beyond that, I've just kind of, like, you know, kept a low profile, uh, even though, like, my job, our job is to stay on top of what is new in regards to safety, security, you know, all that stuff. Um, I've just kind of kept a low profile. I'm going to kind of do that for a little bit because it's a bit overwhelming, you Robert Siciliano?

Yeah, I think it's important for all. I think I feel the same way. I have to kind of like tone down the amount of information I'm looking at every day because, you know, most of the information that we are consuming is information that usually is just stories about tragedies, about big problems, and it's not— they're not really many good stories. You know, the occasional good story is rescuing a dog or a cat, and that's about it, right? Otherwise, it's, it's things that usually are not— it's bad news. And so that weighs on us, that gets us stressed out. And there's only— there's, you know, I had a conversation with the other day and someone said, why are you even worrying about this stuff if you can't change it? If you can't change anything that's happening in, in the news, don't let it stress you out. Just try to live in peace, because at the end of the day, you're the one that's suffering, you know.

Agreed. Yeah, so, um, today's pod broadcast, uh, is about, you know, holiday shopping and, and giving to charities and just reducing risk. You know, um, forewarned is forearmed, so that if you know what the current events are in regards to what the bad guys are doing out there to fleece you, to get your money, to steal from you, then you stand a better chance of, uh, you know, reducing that risk. Like, you know, knowing what your options are. Okay, so this, this entire pod broadcast is dedicated to that. Um, world events, all that crazy stuff, you guys are on your own out there because I have no idea, and I'm fine with that right now. Yeah, if I can't control it, I don't want to know about it right now. I'll check in 4 years in that regard. Okay.

Yeah, yeah, let's let the holidays— that's enough stress just dealing with the holidays right now, okay? So we gotta focus on that.

All right, so check this out, Peter. Um, let me see, uh, hold on, let me share something with you, the whole screen. Thank you. All right, hold on. Sorry about that. Oh, Peter, I made a mistake here.

I see it. I mean, you pulled it up.

You can see it, but I can't see you. What did I do wrong?

That's okay, no one needs to see me. Let's get into this.

Important. All right, there we are. Okay. Oh, new options in StreamYard. If you guys don't know StreamYard, StreamYard is a pretty cool tool. That's what we're broadcasting from today. All right, so right here, Better Business Bureau, BBB, uh, the naughty list, uh, the 12 scams of the holiday season. So we're going to kind of blaze through these, uh, both 2023, 2024 misleading social media ads. As you scroll through your social media feeds, you often see products advertised. Often, you know, they get your attention with little videos and such, and then you click on it and then you have a chance to buy it. There's a few things going on there that I've noticed over the years. BBB says always research before you buy. That's definitely the case. I would say more than anything, the scam itself, I find more than like it being like fraud, but that does happen, of course, scammy links and all that stuff, is that when you click on something, um, and this is like more of a consumer advisory than a scam, is that like that product or service that's being offered always appears a lot better than it actually is.

That's what I find, because the quality, the quality of the product is inferior to what your expectations are.

Yeah. So what I usually do is I'll check out that product by searching it out, and on— often I find it on Amazon or somewhere else where people have crowdsourced their rating for what that product or service is all about. And I'm telling you, 9 out of 10 times, it, it's like everybody's like, nope, don't, doesn't look good, bought it, poor quality, the whole thing. And often, you know, you could, if you still want it, you could find it a lot cheaper than you could get it when you clicked on links on Facebook. So research it, find out more about it before you just impulsively buy it on Facebook or wherever, uh, because chances are you're gonna find it a lot cheaper elsewhere and probably rated poorly. I like a lot of that Facebook advertising that I see is like, it's just junky stuff.

Yeah, it's funny, I don't know if I'm— maybe I'm just kind of like the oddball out, but I, I really don't get on the Facebook and look at ads on Facebook. I mean, I may look at some things that people have taken me in as far as pictures, what they're doing, but I don't— I don't be honest with you, I don't think I've ever bought anything that I've seen on Facebook.

Yeah, um, I bought one or two things, my wife has bought one or two things, and it ended up being bad, and that's how I learned, you know, not to do that. You know, I'm a consumer just like everybody else. Social media gift exchanges, these are also known as, um, Cash gifting. Uh, the older version was called Secret Sister. Newer versions of this scam revolve around exchanging bottles of wine or bourbon. Another suggests purchasing $10 gifts online. Any type of exchange of cash or gifts online, just don't, you know, just don't. Why don't we—

and we have enough family and friends to give gifts to, I think, during the holiday season. Why are we giving gifts to people we don't even know?

Yeah, because you think you're gonna get something back, and it's like, just, just don't, you know.

Yeah.

Holiday apps. Apple's App Store and Google Play lists dozens of holiday themes apps where children can chat live with Santa and such. Just be careful whatever you download, you know, look at the ratings before you do so. You have less to worry about on an Apple device than you do on an Android device. On an Android, you should have antivirus, you know, and Androids are susceptible to viruses. Like PCs are susceptible to viruses. Macs aren't as susceptible. Um, Apples aren't pretty much at all. I mean, I know that like that could be debated, but in general, iPhones, iPads just don't get viruses, you know.

Are you seeing that some of these— some of these apps allow the children to converse with Santa Claus? So they're getting on the app and they're talking to an old man with a beard, and I mean, this is This is concerning to me.

Well, any app that your children are communicating with anybody outside of, you know, their immediate family, adults for that matter, or people posing as adults, or children posing as adults, whatever the case is, vice versa, is concerning. I know that my kids, when they were kid kids, we used to have an app and probably still have it. That, uh, you could track Santa, which is kind of fun, you know. And they loved it. Yeah, yeah. Uh, fake toll collection texts. So these are going on all year long, not necessarily just the holidays. I've gotten a bunch of these. Really? In the Northeast, E-ZPass is our toll, and I've gotten numerous E-ZPass type EasyPass type toll text saying that I owed money, click on this link, and so on. It's always fraud. Just delete it or block it from that point on.

I mean, they're just, they're just sending this out to randomly to a lot of people, whoever they can get telephone numbers for, they send it out, which really is just robocalls. Yeah.

And they don't necessarily know the person, uh, or the fact that it's a legit phone number. They're just, you you know, robocalling, like my phone number starts with the 617, and then whatever the exchange is, whatever the last 4 numbers are, and they'll do that 111, 112, 1113, 1114, and so forth, just go down the line. And eventually they're gonna get somebody on the line, like, and I'm a 617 in the Northeast, or Massachusetts specifically, is 617-508-978. And so forth. These are the exchanges. Uh, what is the first 3 number called? The exchange?

I think so.

I think so. Uh, and they know that— they know enough about that that they know that E-ZPass in Massachusetts and New England is a thing. And so they'll specifically upload that particular graphic for that particular toll in that particular region and so on. So there is some, um, social engineering that goes on there where they have a general idea of who will respond to what, you know.

Yeah, and a lot of people will probably— a lot of people probably will fall for it because they say, well, let me just take care— I mean, I'm sure the tolls are not that much, right? But it's enough that, oh, if I don't pay this now, there's going to be fines and other things later on. Let me just pay this, uh, and forget about it, right?

Yep. Uh, temporary holiday jobs employment scams were identified as the number one riskiest scam. Um, listen, temporary jobs over the holidays are a thing. You see an ad for that anywhere, even Monster.com for that matter, like anywhere, um, Facebook. You get text messages, you get emails for any temp jobs paying good money. Just never give out Social Security numbers, never give out personal information. Always reach out to the company itself to find out if in fact they are offering any employment. Just be cognizant that this is happening and do your research before you react or respond to any inbound request.

Good advice.

Yep. Uh, imposter scams— there's a zillion of them— can take many forms, especially during the holidays, uh, when you may be purchasing or returning gifts. When shopping online, be on the lookout for fake lookalike websites created by scammers to trick people into downloading malware, making dead-end purchases, and sharing private information. Fake charities— we'll talk about that, uh, actually, let me see. Fake charities Um, let's go right to, uh, here. How to avoid fake charities. So what that boils down to is, you know, all of us I think are pretty generous in our nature, or most— many of us, or most of us, you know. And I know for me that I, um, give every year. Um, we, uh, I run the Boston Marathon for Dana-Farber Cancer Research and we do football squares and send out all kinds of emails requesting donations. And so I know who I'm donating to, and I know the links that I'm going to donate to, you know. And occasionally I have other runners and other friends and family that, that, you know, looking for donations. And if they're sending me something, then I'm, you know, 9 out of 10, I'm gonna donate to it, right? Um, and I am familiar with the links and the charities that, that, you know, are requesting my money. I'm familiar with it, like I've done it before, I know it, you know. Um, and that what it boils down to is don't donate to a charity that you're unfamiliar with or based on a solicitation by somebody who you don't know. Very important.

Well, also too, I think you find, um, when, when you're giving, a lot of times you end up on these lists, right? And, and your name and your information is shared with others. I mean, it's just like a compound, like, you know, you give You give to 3 today and all of a sudden you get 15 different charities sending you things out. So I got to a point where I, like you, I just like to have my favorite ones and kind of like forget it. It sounds kind of cold, but forget about the rest because they probably all need money, right? But it's just for peace of mind, I'll go with the ones that I feel comfortable with and give to those and don't respond to everything that's coming in every day. A lot of unsolicited request.

That's it, you know, just turn that stuff off, deny it. Uh, platforms such as Charity Navigator and GuideStar can help confirm that a charity is registered. Uh, they often include financial reports as well. So, you know, AmericanRedCross.org, donate there, you know.

Uh, but you're right about those reports. It's not only verifying that they're registered, that they're legit, also their financial reporting. You can see how much of your donation is going to go do they actually help the people at the end of the line versus going for, you know, PR, advertising, marketing, and administrative costs. So if you're really conscientious about how much of that dollar, each dollar goes to the cause, it's good to see that type of information as well on that site.

Yep. Another, I guess, scam, fraud to be aware of regarding charity is, for example, um, in my own town, uh, my girls, uh, they dance and they go to a dance studio. And one of the families, uh, their, uh, I believe daughter, uh, goes to this particular dance studio and their little boy is sick. And so this boy, I believe, has a form of cancer. And, you know, we have been asked by the teachers at the studio to make donations. So we've bought, you know, stuff online via Amazon and sent directly to the family for the holidays. We've donated food, we've donated money. So like, you know, we're supporting this family through this, you know, difficult time. And they have a a, a web page set up through one of the charity sites, uh, where they get donations. I forget the name of it off the top of my head. And what has happened is, uh, some scumbag, uh, modeled that family's issue, basically taking photographs and information. And from that, from that Facebook page that was created, and they duplicated it. And that exact same page, all the graphics, all the everything, you can see online on Facebook. And they actually, um, friended a lot of the people that had donated. And so now there's two, or there was two Facebook pages set up for this exact same family, one being the legit one, one being fraudulent. And people actually made donations to the fake one via, you know, a fake link and such. So be careful. You know, they called me and said, hey, what do we do? I go, well, first thing you do is you tell Facebook this is a scam. You know, and Facebook will take that down eventually, which they did, but not before some people got scammed. So always pay with credit cards, which are reimbursable. Be careful. And anytime you pay via Zelle or PayPal or Venmo or Cash App, Zelle will tell you on their terms of service that, um, treat Zelle like cash, because once you sell somebody, that money's gone.

That's right.

Clawing that money back is very difficult. They generally don't do that.

Yeah, that's very true.

Be aware. Okay, uh, let me see. Uh, Consumer Reports shares tips to avoid holiday scams and gift card fraud this season.

Oh yeah, this continues, right? I mean, it's, uh, it's amazing that this is still going on. Uh, a lot of the merchants though, I think, are trying to make some improvements in having it difficult for scammers to have access to those gift cards that are on the you know, on display.

So that's the problem. It's, it's the ones on display, Peter. I, I've been asked to, uh, speak to this a bunch of times, and what I have, uh, learned over the years is that the bad guys, what they do is, is they'll go into a, say, a supermarket, and you have like one of those towers. Yeah, they have gift cards all around it. That you can pick and choose whatever gift card you want, take it up to the register and, you know, buy it. And the cashier will scan the back of the card. And in that process, they'll— whatever you— whatever the gift card costs, they will add that money to the gift card through a process that they engage in behind the counter.

Yeah, and the fraudster will use that as soon as they can. They'll try it probably every day, try to see if that number has been activated and there's been money there, right? And typically they got a few days before whoever is the recipient of that card actually tries to use it, so they probably got plenty of time.

So what they actually do, Peter, is they actually will go into that store, they'll steal a bunch of gift cards off that rack Amazon gift cards, Apple gift cards, whatever, whatever the most popular ones are. They'll steal a bunch of gift cards, they'll take them back to their hotel, office, home, whatever. They'll peel the codes off the back, they get everything that they need in order to use that gift card, and then they bring it back to the store, they put it back on the rack feeder. So that when you buy it and you put money on it, they already know what the code is, they already know the gift card. So what they're doing back at their operation, they're constantly checking the balance on the gift cards. They're just hitting refresh all the time, and once there's money on it, bang, they cash it in.

But for example, some of the gift cards would be difficult to cash them in, right? Because isn't the only way you can cash them in is if you're using them when that's specific vendor? Let's say for a restaurant, let's say, uh, don't you have to—

can you—

or is there a way to cash them in without using them at the particular vendor?

So like, like, like a Visa gift card, you know, a Visa gift card is cash. Um, Amazon, you know, Amazon is, is, is, is, is, is cash on Amazon. And if, if that scammer has a rogue Amazon account You know, they can just boom, they've got money on Amazon, bang, they're buying stuff. It gets shipped out pretty quickly. You know, they do that on December 15th and that gift card isn't delivered to its recipient until December 25th. That person who gets that gift card as a gift may not use it till December 30th. You know, so that scammer has 20 days to cash it in. Makes sense.

What are some things that someone can look for when they're looking to buy a card gift card, is there a way for them to detect that something has been tampered with?

So look on the back, look to see if there's anything going on in regards to that little thing you scratch off, and/or if there's something you peel off, if it's been tampered with at all, take it right back to the store. What they say in this particular article here is, uh, Hold on. Run your finger over the card. Does it look like a sticker has been put over the barcode? Does it look like the package was opened or maybe been glued back together? That's good advice. Instead, buy gift cards from behind the counter or opt out for virtual gift cards, or opt, or opt for virtual gift cards, the ones you get via email. If you receive a gift card, use it as soon as possible to lower the risk. All of that makes perfect sense. So you as a consumer buying gift cards, buy them from behind the counter or buy virtual gift cards.

Right.

Two good options. And if you— if you receive them, like it says, run your finger over the card. Does it look like a sticker has been put over the barcode? Does it look like the package was opened or maybe glued back together? Use it as soon as possible. If there's a problem, talk to the gift giver, bring it right back to the store.

But what if you— okay, what if you've, you purchased the card, it's, it's fraud, you know, it's fraudulent, you already— and you give it to somebody and now that person tries to use it and they find out that there's nothing on the card. What kind of recourse really is there? Can they go back to the store? Yeah, I mean, that's got to be a problem for the store too, you know. Is there a, is there a proof of that transaction that they bought the card there? I mean, I don't know.

I, I think that, that it's going to be a problem. But I think that if there is fraud, um, you're probably going to be, um, I would imagine you're going to be taken care of, but it's not going to be easy.

Well, I suppose another good reason, if you're going to be buying these cards, to buy these cards with your credit card, right? Because you have recourse through your credit card company if something is fraudulent.

That is always the best thing. Uh, always use your credit card. That way you can contact your Amex, your Visa, your MasterCard and say, hey, I bought a gift card, it turned out to be fraud, they usually have some type of a protection guarantee, I would imagine. Yeah, credit cards definitely provide you a level of, um, uh, I guess reimbursement should something happen.

That's why they can charge 23% annual interest, uh, because they got to recover all those, uh, expenses.

All right, so, uh, we are getting to the end here, Peter. Uh, BBB scam alert: don't be fooled by fake package delivery scams. I get the same thing. How the scam works: you receive a text message from what appears to be a delivery driver looking for, looking for your home. Uh, it says something like, hi, my name is Tony, I work for FedEx, I'm trying to find your house, please call me. Um, if this message seems strange, it is. Uh, a different delivery scam includes a text message, the USPS Packages arrived at the warehouse and cannot be delivered due to incomplete address information. I get that almost every day at this point.

Yeah, me too, every day.

Please confirm if you're at your address in the link, and then you click the link, and the idea is, um, you know, they're going to contact you, they're going to get credit card information, you're going to have to pay for additional shipping with the credit— with a credit card. Like, look at what it boils down to is just don't. It's really that simple. You know, like, don't, don't click the link, don't fall for it, don't engage in it. As long as you don't, you're going to be fine. Peter, like, what do you do when you get these things?

No, I just completely ignore them. I mean, I usually know if I have a package that's going to be, you know, delivered, and a lot of things I get it from Amazon, and I, and I just go back on Amazon and look at the track. You know, they provide you with the tracking. Almost every place is going to provide you with a, a link for the tracking. So just if you're in doubt, say, hey, let me just go and to the site and see where is this package that I, I know I'm expecting.

That's all I ever do. I go right back to Amazon, I go wherever I bought it from, I go to usps.com or org, I go to ups.com. Like, I just log in to carrier. Like, don't, don't engage in third-party rogue text messages that ultimately, you know, turn into you being fleeced. Like, it really isn't that difficult. But you're here for a reason, meaning like you guys are watching, listening, because you're on top of these things. But there are certain people in your life that aren't, so inform them, you know, echo what it is that we do here. All right, uh, Peter, so what's going on? Where are you at? What do you want to promote?

Well, I always like to promote my books. We talk about fraud and, you know, how we can try to protect, you know, through awareness, protect ourselves. So I always encourage either for you or for your loved one, there's a couple of books that, uh, Confessions of a CIA Spy, The Art of Human Hacking, and Why Are You Messing With Me, directed to the most vulnerable segment of our population, our elders. I just want to put a word out there, hey, we're almost to 2025, and myself, just like you, Robert, I know that people are already contacting us wanting to schedule events as speaking events or training events. So if you believe your organization could benefit from from what Robert and/or myself has to offer, please, you know, don't wait. Contact us early to see if we might be able to do something for you during this coming year.

Yeah, man, me too, right? Uh, Peter, what's, uh, what's your website?

counterintelligence-institute.com. And you can also find me on LinkedIn. Awesome.

And, uh, you can see me at, um, protectnowllc.com. 2024 was a pretty good year, much better than 2020, 2021, 2022, even 2023. So things definitely are picking up. Everyone's realizing and recognizing risk at a much higher level. Most companies that I'm working with today, they're like, you know what, we've been providing phishing simulation training now for quite a few years and it's good and our people are getting better at it. And then what they're saying to me is that the problem that we have is that people don't really care that much about security like we want them to. That, like, the phishing simulation is becoming a little stale. And it's not— it's doing its job for what it's protecting us from or them from. But they need to know more in regards to security for their person in order to protect our data, they're saying, you know, like, like they want to know how to protect their own identity. They want to know how to protect their families and their bank accounts. And once they understand that, they're better equipped to protect the data in which they are entrusted with at work. So I'm hearing— yeah, I'm hearing from CIOs, we just want our people to care more. And that's what Peter and I do. We provide that level of perspective.

Absolutely.

Okay, uh, that's it, Pete. So look at— like my dad says, be good, behave, be careful. Peter, last words?

Hey, happy holiday season, and, and watch out not only for yourself but for, for others as well. The scammers are out there, and they can— they need money to buy Christmas gifts as well. That's not— let's not fill their pockets with very much.

Yeah, thanks, Peter. Talk to you later, buddy.