Ransomware has changed dramatically over the years. What started as criminals locking up individual computers and demanding relatively small payments has grown into a much larger operation involving stolen data, entire networks, third-party vendors, and increasingly sophisticated ways of pressuring victims to pay. Now AI is adding another wrinkle, giving criminals new tools while also creating some unexpected problems for them.

Joining me to talk about how ransomware has evolved is Allan Liska, a ransomware researcher and Field CISO at Recorded Future. Allan has more than 30 years of experience in information security and has spent the last 12 years researching ransomware. He has advised major corporations and government agencies, served on national ransomware task forces, and written extensively about ransomware and threat intelligence.

We talk about how ransomware became the business it is today, why small businesses can be just as vulnerable as larger organizations, and how attackers are increasingly going after trusted vendors instead of their intended targets directly. We also discuss what happens inside an organization after an attack, why disrupting ransomware groups really can make a difference, how AI is being used by criminals, and some of the mistakes ransomware operators make that ultimately work against them.

• [01:06] Allan Liska introduces himself and shares how his work at FireEye led him to begin researching ransomware more than a decade ago.
• [03:10] Growing ransomware problems pushed Allan and other researchers to begin developing better detections for attacks that many security teams were overlooking.
• [05:22] Ransomware evolved from attacks on individual computers to taking down entire networks and later stealing data to pressure victims into paying.
• [06:30] Publicly naming victims gave ransomware groups their own form of publicity and made it much harder for organizations to quietly deny an attack.
• [08:05] Encryption creates technical challenges for criminals, and stealing valuable data can sometimes be just as effective as encrypting an organization's systems.
• [09:28] Attackers increasingly target vendors and partners, while some groups are now using AI to create fake stolen data and falsely claim organizations as victims.
• [13:05] Chris and Allan discuss how transparency and regular communication can help organizations manage public trust after a security incident.
• [14:35] Ransomware response can quickly lead to employee burnout, making outside coordination and basic needs like sleep, food, and scheduling an important part of incident management.
• [16:14] A major breach may temporarily open security budgets, so organizations should already know which improvements they would prioritize after an incident.
• [23:29] International law enforcement agencies have become increasingly creative about tracking ransomware operators and waiting for them to make mistakes.
• [25:48] Being skilled at hacking does not necessarily mean criminals are equally skilled at protecting their identities or activities from intelligence agencies.
• [28:21] Ransomware groups frequently make technical and strategic mistakes, including faulty AI-generated tools, reused encryption keys, and stealing data nobody considers valuable.
• [29:36] Fewer ransomware victims are paying, but average payments are increasing, and ransomware remains profitable enough to attract new threat actors.
• [33:09] Allan explains why simply banning ransom payments may not work and discusses approaches that could give governments better intelligence about where payments go.
• [39:33] Collaboration remains an important part of ransomware research, and Allan encourages people entering the field to learn from other researchers and security communities.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Allan Liska - SANS
• Books by Allan Liska
• Recorded Future
• Ransomware Live
• Europol Alerts
• CISA Alerts

A counterfeit handbag may leave someone disappointed. A counterfeit medication, airbag, or child's car seat can do far more damage. Fake products now reach into nearly every part of daily life, and many of them arrive through online stores that look completely legitimate.

Kari Kammel saw the danger firsthand when a pharmacist overseas offered her several versions of the same medication. Some were authentic, while others were openly described as counterfeit. That experience stayed with her. She now directs the Center for Anti-Counterfeiting and Product Protection at Michigan State University, where she works with consumers, brands, researchers, and law enforcement.

Kari talks about how counterfeit goods enter the marketplace and why they have become so difficult to recognize. She explains what shoppers should examine before placing an order and what to check when the package arrives. The conversation also looks at the health risks behind fake products, the criminal activity they may fund, and the real reason an unbelievable deal can be so cheap.

• [01:04] Kari Kammel explains how the Center for Anti-Counterfeiting and Product Protection works to keep fake products away from consumers.
• [02:28] An encounter with counterfeit medication leads Kari into the field of brand protection.
• [03:34] Why even counterfeit experts sometimes purchase fake products by mistake.
• [06:11] The worldwide scale of counterfeiting and how online sales accelerated its growth.
• [08:30] Small direct-to-consumer packages make counterfeit shipments harder for customs officials to detect.
• [10:46] Why the word "dupe" can refer to either a legitimate alternative or an illegal counterfeit.
• [13:22] Counterfeit goods extend far beyond luxury items into car parts, electronics, toys, and medical products.
• [16:08] The health risks of fake clothing, cancer medications, and injectable weight-loss drugs.
• [18:12] Why people become less cautious and more impulsive while shopping online.
• [19:38] Only the brand can confirm authenticity, but consumers can still look for warning signs.
• [20:29] Checking the seller, business address, website, and contact information before placing an order.
• [23:30] Suspicious photographs, fake reviews, unusual prices, and shortages that attract counterfeit sellers.
• [25:41] What packaging, shipping origin, and product differences can reveal after an order arrives.
• [27:25] How unauthorized "third shift" manufacturing produces goods outside a brand's quality controls.
• [28:36] Following the money from counterfeit sales to organized crime and other illegal activity.
• [31:58] How counterfeiters divide shipments and change tactics to avoid customs inspections.
• [35:00] The countries involved in manufacturing, transporting, and purchasing counterfeit goods.
• [38:15] How brands search for fake products and try to remove them from online marketplaces.
• [39:15] The whack-a-mole problem created by counterfeit listings and AI-generated advertisements.
• [41:00] Child labor, human trafficking, unsafe factories, and the hidden costs behind cheaper products.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Kari Kammel - A-CAPP Team - Michigan State University
• Kari Kammel - LinkedIn

A convincing lie no longer needs to look suspicious. It can appear in a familiar social media feed, come from someone who seems real, or arrive as a video that looks almost impossible to fake. By the time doubt sets in, the post may already have been shared thousands of times.

Few people understand that online environment better than today's guest. Nina Jankowicz has spent more than a decade studying what she calls the bad things that happen on the internet. She is an internationally recognized expert on disinformation and online harassment. She was also named one of Time magazine's 100 most influential people in AI.

Nina explains how disinformation spreads and why emotional content travels so quickly. She talks about online harassment, doxxing, romance scams, and AI-generated impersonation. The conversation also covers ways to check questionable information and protect your personal data. Just as important, Nina shares how to step away from trolls before they take over your time and attention.

• [01:00] Nina Jankowicz describes her work studying disinformation, online harassment, and AI-generated harm.
• [03:50] The important difference between misinformation and deliberate disinformation.
• [05:09] Why an emotional reaction may be a sign that someone is trying to manipulate you.
• [07:09] How social media platforms monetize attention and reward harmful engagement.
• [10:05] Using lateral reading and multiple sources to evaluate questionable online content.
• [12:27] Why slowing down matters when an image or video may have been generated by AI.
• [14:04] How algorithmic feeds have made information consumption increasingly passive.
• [17:01] When an aggressive disagreement crosses the line into harassment.
• [19:34] Threats, doxxing, and the limits of platforms and law enforcement.
• [22:18] Nina's one-reply rule and how blocking trolls removes the attention they want.
• [24:07] Why laws and law enforcement training have not kept pace with cyberstalking.
• [26:06] Preserving screenshots, documenting abuse, and asking employers for support.
• [29:23] Password managers, two-factor authentication, and the personal details hidden in photos.
• [32:34] Removing information from data brokers and making online safety more manageable.
• [34:40] A romance scam involving stolen images and real-time AI impersonation.
• [37:35] Why older adults need digital literacy training as much as children do.
• [39:44] Addressing disinformation without suppressing speech or telling people what to believe.
• [42:12] How social media incentives favor profitable engagement over trustworthy information.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Nina Jankowicz
• Nina Jankowicz - LinkedIn
• How to Lose the Information War: Russia, Fake News, and the Future of Conflict
• How to Be a Woman Online: Surviving Abuse and Harassment, and How to Fight Back

It is easy to say you would never fall for a scam when you are looking at the situation from the outside. In the moment, though, things can feel much less obvious. A request may sound reasonable, the person may seem trustworthy, and saying no can feel awkward enough that you go along with something you would normally question.

Today's guest studies exactly why that happens. Vanessa Bohns is the Bronstein Family Professor and Chair of Organizational Behavior at Cornell University's ILR School. Her work focuses on social influence, compliance, and the pressure people feel to cooperate, even when they are uncomfortable with what they are being asked to do.

Vanessa shares several experiments that show just how strong that pressure can be. People agreed to write in library books and even handed over their unlocked phones. She explains why it can be tougher to refuse someone in person or over the phone. The conversation also covers a few simple ways to slow things down before making a decision.

• [01:00] Vanessa Bohns explains how she began studying influence and why people are more likely to say yes than expected.
• [04:01] Small favors reveal how much people underestimate the power of a simple request.
• [06:53] The library book experiment shows how awkwardness can outweigh clear ethical concerns.
• [09:58] Why people are wired to cooperate and avoid the social discomfort of saying no.
• [15:37] How scammers use a few believable details to make an unlikely story feel true.
• [18:32] Why a small cue of authority can be more convincing than an elaborate explanation.
• [22:29] Creating distance from a request gives you time to think and verify what is happening.
• [25:31] Advance warning helps people make a more thoughtful decision instead of reacting automatically.
• [29:46] Participants hand over their unlocked phones even when private search histories are at stake.
• [33:16] Incentives and the fear of losing access can push people to break their own rules.
• [34:24] Social pressure can be powerful even when there is no financial reward.
• [37:49] A phishing email uses authority, urgency, and reciprocity to fool an influence expert.
• [41:02] Firm personal rules can make it easier to resist pressure from salespeople and scammers.
• [44:20] Asking for a request in writing reduces pressure and gives you time to process it.
• [46:20] Why knowledge does not make anyone immune and scam victims deserve more grace.
• [48:20] Helping a family member avoid another scam without blaming them for what already happened.
• [49:20] Vanessa's final takeaway on slowing things down and preparing for the possibility that anyone can be fooled.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Vanessa Bohns - ILR School - Cornell University
• Vanessa Bohns
• Vanessa Bohns - LinkedIn
• Vanessa Bohns - Instagram
• Books by Vanessa Bohns

A drink can be out of your sight for only a moment, but that may be all it takes for someone to tamper with it. Spiking can happen in bars, restaurants, festivals, and even among people who already know and trust each other. It also goes far beyond alcohol. Drinks, food, vapes, cigarettes, and other substances can be altered without someone's knowledge, leaving them vulnerable before they fully understand what is happening.

Dawn Dines has spent more than 20 years working to change how people understand and respond to spiking. She is the founder and CEO of Stamp Out Spiking, a UK charity focused on education, prevention, training, and better safeguarding practices. Her work has helped bring spiking into the public conversation and pushed for stronger laws, better training, and more support for people who have experienced it.

Dawn talks about the experiences that led her into this work and what she has learned from victims over the years. She explains some of the signs that a person may have been spiked, why it can be so difficult to know exactly what happened, and what friends or staff can do when someone suddenly seems far more intoxicated than they should be. She also shares practical ways people can look out for each other while still going out and enjoying themselves.

• [00:44] Dawn Dines shares how her 20-year campaign against spiking helped push for changes to UK law.
• [02:18] Spiking can involve drinks, food, vapes, cigarettes, and even needles, not just alcoholic beverages.
• [04:27] Dawn recalls two frightening experiences while traveling that showed her how easily someone could be drugged without their knowledge.
• [07:32] She explains why she continued campaigning despite years of resistance and how public pressure helped bring greater attention to the issue.
• [10:41] Spiking affects both men and women, and Dawn describes how widespread the problem has become around the world.
• [13:37] Victims may struggle to understand what happened, especially when friends or family assume they simply drank too much.
• [16:35] Dawn explains how quickly symptoms can develop and why getting to a trusted person immediately can make a difference.
• [19:54] Education can help hospitality workers, security teams, and the public recognize when someone's behavior changes suddenly.
• [23:06] Victim blaming, embarrassment, and memory loss are among the reasons many incidents are never reported.
• [26:58] Bars and restaurants can reduce risk through staff training, drink covers, safety information, and clear procedures for helping customers.
• [28:41] Dawn discusses the growing awareness of spiking and why cooperation across countries, venues, and law enforcement matters.
• [31:48] Witnesses, security footage, recovered substances, and quick reporting can all help investigators build a case.
• [34:18] Dawn encourages people to stay vigilant and look out for one another without allowing the threat of spiking to stop them from enjoying their lives.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Dawn Dines - LinkedIn
• Stamp Out Spiking

What sounds like the plot of a crime thriller was Sharon Armstrong's real life. An online romance drew her into an elaborate web of lies involving overseas contracts, invented emergencies, and several people playing carefully planned roles. By the time she arrived at an airport in Argentina with five kilograms of cocaine hidden inside her suitcase, she still believed she was carrying business documents for the man she loved.

Sharon was arrested and spent more than two years in an Argentinian prison before returning home without a conviction. During that time, she had to confront the truth of what had happened and find a way to forgive herself. She later wrote about the experience in her book, *Organized Deception*. Today, she is an author and international scam awareness advocate who works to educate the public, support survivors, and challenge the shame that often keeps victims silent.

In this episode, we talk about how the criminals built trust so quickly, why warnings from loved ones can be difficult to hear, and how organized scam networks use kindness and personal values against the people they target. Sharon also explains why she no longer says she "fell for" a romance scam. She was deliberately targeted by sophisticated criminals, and she believes the attention belongs on those who planned the deception rather than on the person they harmed.

• [01:12] Sharon begins the story of moving to Australia and unexpectedly being signed up for an online dating site.
• [03:36] A convincing introduction quickly develops into an intense romance with someone claiming to be an engineer.
• [04:52] The first request for money tests the trust that had already been built through a carefully fabricated story.
• [06:18] The scammers introduce new characters and create a plan for Sharon to travel to London through Argentina.
• [09:07] Family concerns grow as the relationship begins to take priority over the people who had always mattered most to her.
• [11:34] A suitcase supposedly carrying business documents arrives after Sharon has spent a confusing week alone in Argentina.
• [13:21] Airport officials discover five kilograms of cocaine hidden beneath the lining of the suitcase.
• [15:46] Sharon describes surviving the first days minute by minute before spending two and a half years in prison.
• [18:09] Criminals study a target's values, kindness, history, and online presence to create a story that feels deeply personal.
• [20:58] A dramatization of Sharon's story shows how organized manipulation can gradually change someone's behavior and relationships.
• [23:16] Her experience as a probation officer did not protect her from grooming that closely resembled techniques she already understood.
• [25:07] More than 7,000 messages over five months reveal the intensity of the communication and how difficult it was to recognize from inside the relationship.
• [28:13] Healing begins when Sharon decides to forgive herself rather than continue carrying shame for what the criminals did.
• [30:04] Denial can become a safe place when accepting the truth feels more painful than continuing to believe the story.
• [32:08] Public humiliation adds another layer of trauma after details of Sharon's arrest are released to the media.
• [34:27] Each day in prison begins with a choice to move toward happiness rather than allow the experience to make her bitter.
• [37:52] Writing, speaking publicly, and sharing her story become important parts of rebuilding her life.
• [40:09] Sharon rejects the phrase "fell for a scam" and explains why victims should be described as people deliberately targeted by organized criminals.
• [42:18] The title Organised Deception shifts attention toward the people who intentionally planned and carried out the crime.
• [43:17] Victim blaming can make people feel safer because it allows them to believe the same thing could never happen to them.
• [46:02] Sharon believes being arrested may have saved her life and kept her from being trafficked through an even more dangerous country.
• [48:34] Families increasingly reach out for help as they recognize the seriousness of romance scams and look for ways to support someone they love.
• [50:01] Sharon shares how listeners can connect with her through Stand Up 2 Scams and learn more about Organised Deception.
• [51:37] A reminder that scam victims are not alone and that the shame belongs with the ruthless criminals who targeted them.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Sharon Armstrong
• Organised Deception
• Stand Up 2 Scams - Facebook

Everybody is searching for ways to increase income. Unfortunately, MLMs often look like an easy way to start a business without taking on the cost of a traditional company. The pitch sounds simple. Buy the product, follow the plan, and put in the work. The numbers behind those promises often tell a different story.

Today's guest, Stacie Bosley, has spent years studying what really happens inside MLMs. She is a professor at Hamline University in Minnesota and holds a Ph.D. in applied economics. Her research covers multi-level marketing, consumer protection, income claims, and pyramid scheme fraud. She has also served as an expert witness in cases involving the Federal Trade Commission and the Securities and Exchange Commission.

We talk about what separates an MLM from a pyramid scheme or a Ponzi scheme. Stacie explains why these opportunities attract smart and motivated people. We'll learn about the role of recruitment including those hidden expenses and fake or misleading success stories. We also learn questions people should ask before investing their money and time in any business opportunity.

• [01:03] Stacey explains how her background in applied economics led to research on multi-level marketing, pyramid schemes, and income misrepresentation.
• [03:22] Early experiences in rural Wisconsin and changes in retail and internet commerce sparked an interest in how people pursue business opportunities.
• [05:07] Pyramid schemes rely on a pay-and-recruit structure that mathematically leaves most participants with losses.
• [08:57] Adding a legitimate product does not change the underlying structure when profits still depend primarily on recruitment.
• [10:33] Ponzi schemes generally use investment language, while pyramid schemes tie a participant's compensation directly to recruiting others.
• [12:38] Products, demographics, religious communities, and other affinity groups can shape how MLM opportunities are marketed.
• [16:17] Reward-responsive people may be attracted to the recognition, status, and sense of competence these opportunities promise.
• [19:47] Anyone considering an MLM should define what they hope to gain and examine their realistic chances of reaching that goal.
• [22:53] The appeal of a turnkey "business in a box" can cause people to skip the research they would normally do before starting a business.
• [25:32] Earnings often look far worse after product purchases, training costs, conference fees, and other expenses are deducted.
• [28:13] Companies making income claims have a responsibility to explain what participants typically earn and spend.
• [31:02] Disclaimers such as "results not typical" do little to correct exaggerated success stories or earnings claims.
• [34:08] MLM losses can affect finances, relationships, social connections, and a participant's sense of personal worth.
• [37:12] Limited time, money, and energy can be diverted into opportunities that fail to improve a family's financial situation.
• [40:03] A company may be operating as an MLM regardless of its chosen label if participants earn from the activity of recruited sellers.
• [42:22] Important questions include the typical startup cost, ongoing expenses, earnings, profitability, and participant retention.
• [44:23] Claims that unsuccessful participants simply quit or failed to work hard can be used to dismiss troubling outcome data.
• [46:12] Encouraging sellers to recruit their own competitors conflicts with basic principles of supply and demand.
• [48:03] A large number of local sellers may be presented as community support even though it can indicate market saturation.
• [49:47] Resources such as Stacey's TED Talk, Truth in Advertising, and her published research can help people investigate these opportunities.
• [50:59] A reminder to look beyond the sales pitch and ask what people actually earn after expenses.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Stacie Bosley - Hamline University
• Stacie Bosley - LinkedIn

A familiar voice on the phone or a recognizable face on a video call used to offer some reassurance that you knew who you were dealing with. AI has changed that. Voice cloning, face swaps, and real-time video impersonation now allow scammers to convincingly pose as executives, job candidates, romantic interests, or even family members. Understanding how these attacks work and where they may be headed is a central part of Tom Cross's work as Head of Threat Research at GetReal Security.

Tom has spent more than 30 years studying cybersecurity threats, software vulnerabilities, and the methods attackers use to exploit technology. Before joining GetReal Security, he held leadership roles at IBM X-Force, Lancope, and Drawbridge Networks, and he has shared his research at major security conferences including Black Hat and DEF CON. His current work focuses on deepfake-enabled social engineering and the development of tools that can detect digital impersonation, including signs that are often too subtle for a person to recognize.

In this episode, we learn how little audio is needed to clone someone's voice, why live video is no longer reliable proof of identity, and how deepfakes are being used in romance scams, investment fraud, identity theft, and remote hiring schemes. We also talk about AI agents that can carry on persuasive conversations, adjust their behavior based on a victim's reactions, and repeat those tactics on a massive scale. The discussion offers a revealing look at why familiar advice for spotting fakes is quickly becoming outdated and what individuals and organizations will need to do differently as the technology improves.

• [01:05] Tom shares how his early work in vulnerability research led to a career studying sophisticated cybersecurity threats.
• [03:32] Running a bulletin board system as a teenager helped spark an enduring interest in hacking and computer security.
• [06:11] A look back at early online communities, text-based games, Fidonet, and the pre-internet era.
• [09:36] The conversation shifts to deepfake research and the technology being developed to detect manipulated media.
• [11:29] Deepfakes are divided into audio, visual, file-based, and real-time forms, each creating different risks.
• [15:20] Modern voice clones can fool both people and biometric authentication systems, making specialized detection increasingly important.
• [18:30] Virtual backgrounds and other subtle processing artifacts may reveal manipulation even when nothing looks obviously wrong.
• [20:31] Deepfake detection has become another cybersecurity arms race as attackers continually improve their methods.
• [22:30] Romance scams, investment fraud, remote job schemes, and identity theft are among the growing uses of deepfake technology.
• [25:26] Scammers succeed by exploiting desires, expectations, and the human tendency to rationalize warning signs.
• [27:56] Large-scale phishing and business email compromise attacks only need a small percentage of targets to respond.
• [29:22] Criminal compounds in Southeast Asia use trafficked workers and deepfake tools to conduct scams on a massive scale.
• [30:27] North Korean remote workers may use stolen identities and shared deepfake personas to secure jobs at American companies.
• [33:45] Purpose-built criminal software combines face swapping with appearance-enhancing features designed for romance scams.
• [35:05] Common visual tests for identifying deepfakes are becoming unreliable as the technology advances.
• [39:24] Emotional investment makes detection even harder because people often explain away signs that something is wrong.
• [40:47] Building authentication into the internet could help people determine whether digital content is genuine.
• [42:13] AI agents may soon conduct automated scams that respond naturally, apply pressure, and adjust to a victim's behavior.
• [45:14] Automation could allow criminals to target hundreds of thousands of people while making impersonation increasingly convincing.
• [46:22] Machine learning may create self-improving scams that test countless variations and concentrate on the tactics that work.
• [49:18] AI lowers the technical barrier to cybercrime by helping people create tools they could not build on their own.
• [51:06] Phones and messaging platforms may eventually require stronger controls as automated calls and texts become more common.
• [53:09] Digital signatures, watermarks, and verified content could help distinguish malicious deepfakes from authorized uses.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• GetReal Security
• Tom Cross - LinkedIn

Most people use technology all day without giving much thought to what is happening behind the screen. We trust routers that may not have been updated in years, depend on internet systems few of us understand, and now turn to artificial intelligence for everything from travel plans to home repairs. That convenience comes with tradeoffs. In this episode, we look at the weaknesses built into our connected world and what happens when our technical knowledge fails to keep pace with the technology surrounding us.

Sherrod DeGrippo leads threat intelligence for Unit 42 at Palo Alto Networks, where she oversees teams working to identify and respond to increasingly complex cyber threats. During more than two decades in information security, she has held senior leadership roles at Microsoft and Proofpoint, along with positions at Nexum, Symantec, Secureworks, and the National Nuclear Security Administration. Sherrod was named Cyber Security Woman of the Year in 2022 and regularly shares her expertise at industry conferences and through outlets including BBC News, The Wall Street Journal, CNN, and The New York Times. She is also the author of *Threat Driven Software Development: Defending Modern Online Services*.

We discuss how outdated home routers become tools for criminal and nation-state attacks, what could happen as technical knowledge disappears, and why foundational internet systems may be more vulnerable than people realize. Sherrod also explains why the greatest danger from AI may not be a dramatic technological disaster, but the gradual loss of human connection as people choose frictionless answers over real conversations. Along the way, she shares practical examples of where AI genuinely helps, where its limits become obvious, and why slowing down still matters when emotion or urgency begins driving a decision.

• [01:48] Sherrod introduces herself and traces her 23-year career from government network security to threat intelligence.
• [03:00] An early lesson in buffer overflows sparked a lasting interest in both hacking and protecting systems.
• [05:10] Growing up around AT&T gave Sherrod firsthand experience with telephone networks, copper lines, and beige boxing.
• [08:17] Technology has shifted from something people opened and explored into consumer devices few people truly understand.
• [11:24] As technical knowledge disappears, the people who understand how systems actually work are becoming increasingly rare.
• [13:41] Older internet users often understood where their data traveled, while today's devices constantly communicate in the background.
• [16:22] Network security remains critical because once malicious traffic reaches a device, the problem has already become much larger.
• [17:57] Outdated home routers provide an attractive attack surface for criminals and foreign governments.
• [20:12] The conversation turns to the fragility of DNS, internet protocols, and the systems supporting the global network.
• [22:13] Chris shares his experience with denial-of-service attacks and seeing legitimate online services exploited by malware.
• [25:48] Sherrod explains why AI's greatest danger may be the gradual loss of human relationships rather than a dramatic physical threat.
• [29:23] AI works well for tedious tasks, but human connection, creativity, and judgment should not be handed over so easily.
• [31:35] Living intentionally means deciding what experiences matter instead of allowing technology or other outside forces to decide for us.
• [34:10] Frictionless technology may leave people more vulnerable to scams by training them to expect immediate and effortless results.
• [35:33] Social engineering uses modern tools, but manipulation, espionage, and theft have existed for thousands of years.
• [38:14] AI may eliminate certain jobs while also giving people more time to focus on customers, relationships, and other human-centered work.
• [40:44] A furnace repair shows how AI can guide basic troubleshooting and reduce the need for some professional diagnostic visits.
• [43:08] AI can help someone become competent in many areas, but having access to it does not make anyone an expert.
• [45:44] Used intentionally, AI can remove unwanted planning and create more opportunities for people to spend time together.
• [47:18] Strong prompts, detailed skill files, and personalized instructions may become more valuable than traditional prompt engineering.
• [49:10] A gift card scam demonstrates how fear and urgency can push someone to ignore repeated warnings from others.
• [51:30] Sherrod advises pausing whenever a strong emotion begins driving an unusual financial or personal decision.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Sherrod DeGrippo
• Sherrod DeGrippo - LinkedIn
• Palo Alto Networks Unit 42
• Threat Driven Software Development: Defending Modern Online Services

When most people think about online scams, they picture criminals sitting behind a screen and stealing from victims around the world. But in Southeast Asia, many of the people sending those messages are victims too. Some were promised legitimate jobs, flown across borders, trapped inside guarded compounds, and forced to scam others while trying to survive.

In this episode, I talk with Ivan Franceschini, a lecturer in Chinese Studies at the Center for Contemporary Chinese Studies Asia Institute. After years of studying labor rights, civil society, and Chinese investment in Cambodia, Ivan's work led him to the online scam industry and the cybercrime compounds that have spread across Southeast Asia. He is the co-author of Scam: Inside Southeast Asia's Cybercrime Compounds, and through the EOS Collective, he and his colleagues also help support people who have been trafficked into these operations.

I talk with Ivan about how small scam operations grew into large compounds, why COVID helped the industry expand, and how fake job offers are used to recruit people from around the world. We also talk about the blurred line between victim and criminal, the local economies that grow around these compounds, and what happens when people escape or are left stranded without money, documents, or a safe way home.

• [01:27] Ivan Franceschini explains how his academic background in China studies and labor rights eventually led him to research scam compounds in Southeast Asia.
• [04:39] Early scam operations in Cambodia started as smaller setups in villas, apartments, and hotels before expanding into large, organized compounds.
• [07:53] COVID becomes a major turning point as isolation, financial desperation, and new technology help the online scam industry grow rapidly.
• [10:42] The industry expands beyond Chinese-speaking networks and begins recruiting people from many countries, including large numbers from Africa.
• [13:29] Criminal groups, businesspeople, local elites, and trafficking networks all play different roles in keeping the scam compound industry running.
• [15:50] Fake job offers are used to recruit people from abroad, with many victims believing they are traveling for legitimate work in customer service, teaching, sales, or other fields.
• [18:19] Recruiters use believable salaries and convincing explanations to lure people who may be desperate for work or unfamiliar with the region.
• [21:43] Many trafficked workers are not highly trained scammers, but poor or vulnerable people who are taught scripts, given tools, and assigned small parts of the scam process.
• [24:05] Language barriers are no longer a major obstacle because scammers can use translation tools, AI tools, and backstories that make mistakes seem believable.
• [26:40] Scam compounds become embedded in local economies through guards, cleaners, restaurants, construction workers, delivery services, and other support jobs.
• [31:22] Getting out of a compound can involve paying a ransom, escaping physically, or risking a message to an embassy, family member, NGO, or government official.
• [33:40] Some trapped workers are able to ask for help online, but contacting authorities can also be dangerous if local police alert the compound operators.
• [35:17] Crackdowns in Cambodia have left many people stranded without money, valid visas, housing, or a safe way to return home.
• [37:27] Survivors released from compounds may end up sleeping on the street, begging for food, and trying to find help while facing fines and deportation barriers.
• [40:14] Survivor support often means meeting immediate needs such as food, basic medical care, and flights home for people who have nowhere else to turn.
• [41:29] Ivan explains that sanctions and enforcement need to consider the human beings inside the industry, not just the money and criminal networks behind it.
• [42:49] Survivors often have valuable information about trafficking networks, scam techniques, and specific operations, but that intelligence is lost when they are abandoned.
• [45:15] Verifying survivor stories requires interviews, embassy coordination, compound maps, cross-checking details, and recognizing that victim and criminal roles can overlap.
• [48:53] Ivan shares where people can find his book, Scam: Inside Southeast Asia's Cybercrime Compounds, and learn more about the EOS Collective's work.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Ivan Franceschini - LinkedIn
• Scam: Inside Southeast Asia's Cybercrime Compounds
• EOS Collective