Easy Prey

Our body can give clues to what we are thinking or feeling and review of what we're saying is the truth or deception. How can we use that fact to detect when others are being deceptive?

Today's guest is Traci Brown. Time magazine has named Traci as one of the nation's top deception detection experts. She's trained alongside the country's top law enforcement, and she is a frequent television guest and the author of How to Detect Lies, Fraud, and Identity Theft Field Guide. Her fraud-spotting learning platform has helped companies stop millions in fraud loss.

• [0:51] - Traci shares her background as a cyclist and how observing and learning other cyclists behavior and body language led her to eventually become a body language expert.
• [2:29] - Many had thought that Traci was able to read people's minds, but really she was just noticing body language.
• [3:34] - Traci shares how an experience of her brother's led her to training with law enforcement and started her path in fraud and deception detection.
• [5:19] - While a lot of attacks happen online, Traci encourages listeners to know about in-person fraud and protect themselves.
• [6:17] - 40% of people lie in a job interview but only 2% of people hiring them can tell.
• [6:54] - Traci works with a lot of sales people because "buyers are liars."
• [7:43] - Traci has even worked with world renowned poker players. She describes how poker tournaments work and how body language impacts how you feel as well.
• [9:54] - The number one thing that law enforcement looks at is baseline behavior. Everyone runs in patterns.
• [10:40] - You want to believe the body first and when there's a mismatch between the body and the words, that's the hotspot.
• [11:47] - Traci lists and describes body language signs that something is not true.
• [12:55] - As you are talking to someone and notice these signs, Traci suggests saying, "It seems like you have something more to say about that," and then stop talking.
• [13:58] - If you ask people questions they have no reason to lie about, then you can see the shift when you ask them something more pressing.
• [15:19] - Some people can't help but lie. Some people lie to cope with something trauma or were conditioned to lie in simple conversations.
• [17:12] - Lying is not just indicated through body language. It is a combination of body language, tone, pacing, volume, and word choice.
• [18:21] - Everyone is unique in that baseline behavior so you need to know that first.
• [19:15] - Some people have a nervous baseline that doesn't necessarily mean they're lying but that they are just nervous people in general.
• [20:12] - Traci shares a story about an experience with her husband in the grocery store and how her knowledge of body language can benefit relationships.
• [22:03] - Security takes full enrollment from your senses at all times.
• [23:15] - Traci hosts a podcast called Fraud Busting and interviews criminals.
• [25:01] - Traci refers to presidential debates and how candidates practice their answers ahead of time, but that body language is telling. The answers to questions that are on the spot is where you can tell a lot.
• [26:30] - Watching a debate with the sound off and not knowing what the candidates are saying is a great way to start noticing body language.
• [28:03] - Even Chris can tell when a podcast guest is launching into a response that is rehearsed. He asks Traci if that could be an indicator that someone is being deceptive in certain situations.
• [29:37] - We have the least control over our feet. So watching peoples' feet can give you a lot of information.
• [30:54] - Traci describes the "pain" people and businesses pay with when they aren't paying attention.
• [31:52] - Know more than is immediately obvious and use it when the time is right. The idea is to make people comfortable around you enough to talk.
• [33:04] - Traci also can look at social media profiles and can tell a lot about a person before actually meeting them.
• [35:29] - Traci shares that she watched a video of Paris Hilton describing the abuse at a school she went to as a child and determined that she is telling the truth.
• [36:21] - Body language is not admissible in court, so using the body language to dig is important.
• [38:06] - Chris and Traci briefly discuss psychopathic and sociopathic behaviors.
• [40:07] - The reason Traci started her podcast is because looking back, everyone knows something is not right but didn't do anything about it. Listen to yourself.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Body Language Trainer - Traci Brown Web Page
• Fraud Busting Podcast
• Fraud Busting Body Language Expert Facebook
• Traci Brown on Twitter
• Traci Brown on LinkedIn
• How to Detect Lies, Fraud, and Identity Theft Field Guide by Traci Brown

Most of us have received that call from someone claiming to be from Microsoft Tech Support saying that there is an issue with our computer that they want to help us resolve. This scam has evolved into something so sophisticated and so refined that it has become big business in and of itself.

Today's guest is Jim Browning. Jim can't stand scammers, so he's doing something about it. Jim has been baiting, investigating, and exposing scammers on his YouTube channel for over 5 years. His channel now has over 2.3 million subscribers and many of his videos showing how these scams work have been watched millions of times.

• [0:51] - Most people recognize tech support scams as a cold call where the scammer claims they are working for a company that needs you to get on your computer to gain access.
• [2:34] - Jim says the way to put these people off is to deny having the device they are asking for you to connect.
• [3:13] - These types of scammers might also claim they are your bank or credit card company. Either way, this scam is all about logging into your account and giving them access.
• [4:32] - Jim describes what would happen if a scammer gains access to your computer after you follow the steps they give you over the phone.
• [6:01] - Jim never intended to be a YouTuber. In fact, he has a "proper" job in IT and is an engineer at heart. But as someone who received these calls, he became curious and one day recorded what a scammer did.
• [7:23] - More often than not, the people running these scams are out of a different country and it is near impossible to do anything about it through law enforcement.
• [8:21] - Jim shares that India's equivalent to the FBI has recently conducted raids and some of these operations may actually be dealt with.
• [9:27] - Through running scams, Jim describes how one operation brought in over a million dollars per month and employed several hundred people.
• [10:19] - When hiring, these operations may hire people who don't know they're scammers. Some, though, actually advertise that they are scammers.
• [11:27] - With enough computer knowledge and the curiosity, Jim let scammers access his computer but was able to reverse it and gain access to their computer instead.
• [12:31] - Jim tells a story about how he accessed a scammer's CCTV recording and was able to see and hear how they are running their operation.
• [14:12] - These scammers take the business very seriously and professionally. Like legitimate organizations, they record calls and use them to train their employees.
• [16:39] - Sometimes scammers will retain the access to the computer, but most of the time, they will get their one-off payment and it will likely be the last time you hear from them or you won't hear from them for a while.
• [17:56] - If you are scammed once, your information will be sold to other scammers. Once you've been victimized, you are far more likely to fall victim again.
• [19:10] - The cold calls are the most common, but a more subtle scam is to Google for genuine support. Some sites are not genuine and many people do not check the legitimacy of the site.
• [21:27] - There are various software you can install on your computer that help identify a site that is not legitimate.
• [22:14] - If you think you are a victim of a scam, you need to start by contacting your bank or credit card company as quickly as possible. If it has been several months, it is very hard to get your money back.
• [23:40] - The most safe thing to do if you fall victim of a scam is to completely wipe your computer and start over. But Jim does state that most of the time, scammers are only in it for a one-off payment so you might not need to do that.
• [25:01] - Jim has also seen scammers take identities to open up bank accounts in order to launder money.
• [25:46] - There are scams that ask for gift cards, which is as good as cash in most cases. If you use a gift card or read out a gift card number, you will not get your money back.
• [26:40] - No legitimate online business is going to ask for gift cards and is a big red flag. The big one right now are Amazon gift cards.
• [27:52] - A lot of employees who sell gift cards are trained to ask the customer who is buying large denominations on a gift card to ask if they have been put up to it. But Jim gives examples about how scammers get around this.
• [29:55] - Scamming organizations have also recruited people in the US and the UK to be a part of these scams to make it more believable because of their lack of foreign accent.
• [31:42] - Scammers have been known to cunningly coach people into willingly transferring money to them.
• [32:40] - No legitimate company will ever have a problem with you asking questions. Be a skeptic.
• [33:44] - Another red flag for a scam is urgency to take action. Always stop and ask questions and call them on the number you know is accurate.
• [34:28] - Anyone can forge a number. You cannot trust the caller ID. But there is something possibly happening in the United States that will help identify real numbers.
• [36:49] - Jim's YouTube channel shows how scams work and can help you recognize when a call could be a scam. His YouTube channel's mission is to bring awareness.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Jim Browning on YouTube
• Jim Browning on Twitter

Is there such a thing as an ethical hacker? Do all hackers use their skills to attack infrastructures? If you're interested in ethical hacking and penetration testing, this is the episode for you.

Today's guest is Ed Skoudis. Ed has taught upwards of 20,000 security professionals globally and his contributions to information security have had an immense impact on the community. His courses distill the essence of real world frontline case studies he accumulates, because he is consistently one of the first authorities brought in to provide post-attack analysis on major breeches. He's not just an expert in the field, he's created many of the founding methodologies empowered by governments and organizations around the world to test and secure their infrastructures.

Ed is the founder of the SANS Penetration Testing Curriculum and Counter Hack; leads the team that builds NetWars, Holiday Hack, and CyberCity; and serves on the Board of Directors for the SANS Technology Institute. A consummate presenter, Ed is a keynote speaker appearing internationally at conferences, and is an Advisory Board member for RSA.

• [1:14] - Ed introduces himself as a penetration tester and hacker. He does expert witness work on large scale breeches and incident response.
• [1:37] - He started this path as hacking for phone companies. He explains how he started and why he was hired.
• [3:55] - Ed describes what penetration testing (or pen testing) is. It is when he models the techniques used by real world attackers and then apply them in structured fashion to help protect companies from future attacks.
• [4:53] - Pen tests can be used by an organization for a specific reason or can be done as a "check-up" to make sure everything is okay.
• [5:40] - Zero Day is researching vulnerabilities that aren't known yet. It is called Zero Day because it has been known for zero days.
• [6:18] - Ed never believed the cybersecurity industry would be as huge as it is today and explains some of the more recent issues we've been seeing through Covid.
• [7:52] - Security is now a part of the process and is becoming less of an afterthought. Ed shares this idea long-term, but sees the same vulnerabilities repeatedly.
• [8:49] - There is no such thing as 100% safe and secure. The goal is to raise the bar to make things more difficult for an attacker.
• [9:31] - With ransomware, attackers have figured out a really reliable way to get paid for their malware.
• [10:08] - Ransomware is a real problem and have even attacked hospitals and local governments.
• [12:37] - There is so much that we do that leaves us vulnerable.
• [13:29] - One major piece of advice that Ed gives in regards to general consumer security is to keep all of your devices patched and updated.
• [14:18] - Another area to be aware of is always spear phishing. Don't click unless you are confident in the link.
• [15:19] - Ed has a separate computer that is separate and independent that he only uses for financial transactions.
• [17:17] - Chris and Ed discuss routers that consumers buy from their ISP.
• [19:01] - Ed shares how "Live Off the Land" attacks work by using what is already installed on a computer. These are harder to detect.
• [20:18] - With ransomware, organizations have to think about what is best for the business. Is it better to give the attacker the money or spend the time and money to fix the problem?
• [22:27] - The dominant trend in technology today is cloud storage.
• [24:18] - Ed describes how this works and some of the various problems associated with it.
• [25:39] - The US Army, Tesla, and Uber are a few organizations that have lost data to this common vulnerability.
• [26:10] - Ed describes the Holiday Hack Challenge and the fun way he has modeled this problem to educate users.
• [28:03] - Although there are some security risks if not managed properly, Ed shares that cloud data storage is a very cost effective option for small to medium sized businesses.
• [29:24] - Most organizations use multiple cloud services. Cloud migration is good if a different service is necessary, but the previous cloud service is left alone and vulnerable.
• [31:01] - The Holiday Hack Challenge is a free educational event that Ed and his team have created to solve cybersecurity challenges. This is a worldwide event.
• [34:02] - The Holiday Hack Challenge is something that some people participate in with their kids due to the video game aspect. There is also a social aspect to it with the chat feature.
• [35:29] - Not only is the Holiday Hack Challenge free, but all of the past challenges are free and accessible to play. This can build your skills.
• [36:30] - Chris asks if Holiday Hack Challenge has ever been compromised. Ed admits that there are three people who have hacked their way in as players, but there were no purposeful attacks.
• [39:43] - Ed admits that he sees the world through the eyes of an ethical hacker because he likes to explore and see what's beyond the edges.
• [40:48] - Chris and Ed discuss Bug Bounty Programs and can be useful.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• SANS Web Page
• Counter Hack Web Page
• Ed Skoudis on Twitter
• 2020 Holiday Hack Challenge

With Giving Tuesday right around the corner, it is important to make sure that the money we give gets to the causes we are passionate about. In the midst of the season of giving, scammers are working to get as much of your charity as they can.

Today's guests are Michael Thatcher and Zachary Weinsteiger. Michael leads Charity Navigator and its efforts to make impactful philanthropy easier for all by increasing the breadth and depth of ratings coverage of a large number of charities. He has held various board positions within the non-profit and tech sector, holds several patents in enterprise systems management, and has a degree from Columbia University in New York. Zachary is on Charity Navigator's analyst team and is responsible for data collection, research analysis, and the evaluation of the performance of America's largest charities. He also works towards improving the evaluation system and process.

• [1:16] - Michael has been with Charity Navigator for about 5 years, but previously worked for Microsoft. He was attracted to Charity Navigator to make a more positive impact.
• [2:04] - Zachary initially intended on being an educator on the college level, but during the course of study he felt that he wanted to do more. He wound up with Charity Navigator after hearing someone speak at his graduation.
• [2:53] - Charity Navigator was started in the early 2000's by someone who was wealthy and wanted to donate money. He noticed that there was no way to evaluate the organizations he would invest in, so he started it himself.
• [4:42] - Michael shares how large the non-profit and charity sector is in the United States.
• [6:10] - On one hand, there are several successfully run charities, but then there are some that fall apart.
• [6:42] - Michael started working in the non-profit sector when he opened a dance company with his wife. Unfortunately, it failed, but now he has found himself in a similar position running Charity Navigator.
• [8:03] - The hardest part about charity scams is that they're scams and until they get caught, we don't know they're scams.
• [9:32] - Zachary says that sometimes the donors might not actually know they were scammed and move forward without knowing.
• [10:43] - If you feel like you have been scammed, you need to report it, regardless of the feeling of embarrassment that many people feel.
• [11:04] - Look for transparency. Legitimate charities will have a website and will be able to direct you over the phone to a way to find out more about them.
• [13:10] - Be intentional with your giving. Donate to causes that you care about and find out if the charity in question is on Charity Navigator.
• [14:29] - During times of crisis, people change their giving philosophy. This year, the United States has seen different crises and people may be donating to charities they don't normally notice.
• [16:21] - Charity Navigator has a relationship with GoFundMe and Michael says it is a legitimate, strong, and successfully run crowd-funding site. But if you don't know the person and have a real relationship with that person, you need to be wary.
• [18:04] - What Zachary notices with GoFundMe is when individuals donate to others they don't know, there's no form of accountability.
• [20:09] - There are organizations that are a good filter to avoid fabricated stories on GoFundMe. Michael shares them as Give Directly and Donors Choose.
• [21:39] - When you donate to charities through Give Directly and Donors Choose instead of GoFundMe, you can use them as a tax write off. When you donate to an individual on GoFundMe, you cannot.
• [22:08] - One of the key things that Charity Navigator looks for is strong financial performance. Michael describes what this looks like and why it is important.
• [22:41] - Another important facet that Charity Navigator looks for to establish their ratings is the charity's level of transparency and governance.
• [23:33] - Overhead costs are not a bad thing. The salaries of the people that work with the charity organizations are important too. Charity Navigator looks at this as well.
• [25:02] - Michael dives into the way their rating system works and what a rating could mean.
• [28:19] - There really isn't a one-size-fits-all that works in this space. Michael compares a charity that supports an orchestra versus an organization for a homeless shelter. Charity Navigator does not cross compare.
• [29:36] - Charity Navigator is the largest independent evaluator of charities in the US and has been around for 20 years.
• [31:14] - Charity Navigator has a team of only 26 people to maintain a small business feel and keep their costs low as well. Each analyst is assigned a specific type of charity that they themselves care about. Zachary explains how this works.
• [33:25] - Another thing Charity Navigator sees frequently is when costs disappear. Zachary explains how this works and how it goes into an evaluation.
• [35:53] - Charity Navigator uses the form charities fill out to establish and maintain the organization. This creates uniformity, consistency, and gives them a way to determine if a charity is being truthful.
• [39:42] - Michael explains how and why the end of the year sees an increase in donations and traffic to their site.
• [41:18] - Scams pop up during this time of year as well because scammers know that people are in a rush and are in an emotionally driven time to give.
• [43:13] - Charity Navigator has a feature called The Giving Basket which allows you to donate to an organization through their website. This is a very safe way to make a donation to make sure it goes directly to the right place.
• [44:55] - Before you give, do your research. Slow down and look at everything you can find about the organization.
• [45:39] - Think of your giving as an investment and follow the money. Stay connected to the non-profits you give to because you are investing in the changes they bring to the world.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Charity Navigator Web Page
• Charity Navigator on Facebook
• Charity Navigator on Instagram
• Charity Navigator on Twitter
• Charity Navigator on YouTube
• Charity Navigator on LinkedIn
• Michael Thatcher on LinkedIn
• Zachary Weinsteiger on LinkedIn

As cybercrime grows more sophisticated day by day, so do technical defenses. But great technology is no match for an employee clicking on a simple phishing email. Psychological security is designed to protect the human mind from manipulation that leads to compromises.

Today's guest is Adam Anderson. Adam is chairman of the board for Hook Security and a serial cybersecurity entrepreneur. He is one of the founders of the Psychological Security Movement. Psychological Security or "Psy-Sec," was born to create new technologies and processes to help build resilient human minds that can resist manipulations through technology.

Show Notes:

• [1:10] - Adam introduces himself as a serial cybersecurity entrepreneur who has launched 21 companies over 20 years. He is passionate about this topic.
• [2:24] - The human part of cybersecurity is always the weakest link.
• [4:01] - Chris and Adam discuss how when you work in IT, you look at things through an IT lens, but there is a human side.
• [5:21] - Security is typically an afterthought that comes after an incident.
• [5:51] - Adam breaks down the meaning of security and what types you will see within a company or corporation as being physical security and info security.
• [6:42] - Adam says that both types of security are vulnerable to social engineering.
• [7:31] - Hook Security was created after Adam worked in frustration for 20 years. He is chairman of the board and hired a successful educator as CEO who is an expert in how people learn.
• [9:23] - Adam is a firm believer that "Psy-Sec" needs to be a separate department of professionals who can work to build resilience in human brains to resist manipulation.
• [11:15] - It is unreasonable to expect the IT department to be proficient in the human interface as it is not in their skillset.
• [12:42] - Adam states that systems are 95% safe from compromise which is a great improvement, but when you have a large company, 5% is still too much.
• [13:12] - Right now, Adam is working with the cognitive brain function and explains the details on how this works in regards to psychological security.
• [15:10] - There are two ways to lay down memories and "fight or flight." One is through fear and one is through humor.
• [16:27] - People are better at remembering something that made them laugh and Adam trains people with this in mind.
• [18:26] - Hook Security provides Security Awareness Training that people actually enjoy.
• [19:06] - Hook Security is being very careful with how they present their findings and taking their time with the science elements involved so that it is used for good and not as a tool for attackers.
• [21:54] - Social engineering is no different from simple marketing. Marketing is there to show you something that you may find valuable and hope that you click on it. Social engineering is the same, but "with a different punch line."
• [22:56] - There's a database. You're in it. You are a product. If you are getting something for free or are paying something low, you are the product. Adam uses a Netflix example to demonstrate this.
• [24:52] - With the way YouTube and Netflix work, you are trusting big corporations to have your best interests at heart.
• [25:52] - We are all wired to help others. These hard-wired responses allow marketers and attackers to take advantage.
• [27:16] - Chris and Adam discuss that the way marketing works is not a bad thing because they want to see the recommendations based on their interests. But they can be used negatively.
• [28:39] - Fake news and "echo chambers" that we find ourselves in are designed to polarize people to different extremes.
• [30:02] - Just like marketers who know who they are targeting to sell to, cybercriminals know what your triggers are to manipulate you into a compromising situation.
• [31:46] - There are different types of triggers that cause us to fall for scams.
• [32:08] - These triggers are wonderful when they happen organically and to help others but are terrifying when they are used against us.
• [33:53] - Learning how to pause and evaluating whether something is true or not is crucial. If you can't do that, Adam says to "reprogram your auto-pilot."
• [36:14] - Your perception of the phone is that it is something that you get a lot of value from but it is also a place where people will call you and text you with fraudulent stuff. Some people can pause and question it and some cannot.
• [38:12] - We all have blind spots and we don't know what they are, so always have a support system to get others' opinions on the matter before making certain choices.
• [39:50] - It is imperative that we treat this seriously. We are throwing a burden on our "nerds" by having them try to understand the nuances of the human brain.
• [41:39] - None of this science is new. We just need to apply it.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Hook Security
• Adam Anderson on LinkedIn
• Adam Anderson on YouTube

What is it like to be a world-renowned cybercriminal and what motivates them? Today's guest referred to as the original internet Godfather shares his experience running a cybercriminal empire, going on the run, and ultimately turning his life around.

Brett Johnson was responsible for refining modern financial cybercrime as we know it today. After being placed on the United States' Most Wanted list, captured and convicted of 39 felonies, Brett promptly escaped prison. Captured again, Brett served his time, accepted responsibility, and found redemption through his loved ones and the help of the FBI.

Today he is considered a leading authority on internet crime, identity theft, and cybersecurity. Brett speaks and consults around the world to help protect people and organizations from the type of person he used to be.

• [1:11] - Brett starts telling his story by summing up why he got the title, "The Original Internet Godfather." What really got him the title was him building the first organized cybercrime community called ShadowCrew.
• [2:24] - Brett ran both ShadowCrew and CounterfeitLibrary. The other primary cybercrime site that he did not run was CarderPlanet.
• [3:14] - ShadowCrew and CounterfeitLibrary were run like forums and marketplaces to connect and network with other criminals.
• [4:37] - Brett was arrested in 2005 and was offered a job to work with the Secret Service, but chose to continue pursuing criminal activity and eventually made his way onto the United States Most Wanted List.
• [5:40] - Secret Service used a Trigger Fish, now called a Stingray, which locates targeted cell phones in a specific area. This device was used to find Brett at Disney World and to arrest him.
• [7:37] - Brett shares the experience of his car and house being searched and how his choices got him caught.
• [9:54] - Brett's tendency to break the law started when he was 10 years old and his mom was also a criminal. He shares a lot of his childhood background in shoplifting.
• [12:13] - Although he started shoplifting as a child, Brett says that as an adult, he made the choice to continue criminal activity.
• [13:32] - Brett's first cybercrime was on eBay by posting a Beanie Baby for sale, requiring the buyer to send a money order that couldn't be canceled, and sent her an item that did not match the post.
• [16:07] - Brett kept going and his eBay crimes led to pirated software, which led to modchips, which led to programming satellite DSS cards.
• [17:40] - After bringing in several thousand dollars per week under his real name, Brett got scared he would get caught, so he shares his story about getting a fake ID to open a bank account.
• [18:17] - Brett's fear of being abandoned became a reality when his wife left him.
• [19:36] - Brett remarried a stripper who was an addict. Through all of his crimes, his second marriage caused his sister to disown him.
• [21:06] - It took several years of not speaking to his sister and justifying his actions for Brett to realize that he was in prison because he chose to break the law.
• [22:08] - For three after being released from prison on probation in 2011, he couldn't get a job because he wasn't allowed to use a computer.
• [23:13] - Brett met his current wife during this time and moved in with her. He was able to find a job doing yard work.
• [24:00] - Although he was doing better, during the winter months when there was no yard work to do, he got online to find stolen credit card information and started making orders. He went back to prison for 10 months.
• [25:24] - After his 10 months, he got married, and started to turn his life around. He contacted an FBI agent for job advice and now he feels he is living a blessed life.
• [26:40] - Now Brett does a lot of consulting and hosts a few podcasts. He also works with AARP and other types of organizations.
• [28:19] - A big misconception people have about cybercriminals is that they are very educated and can hack into anything. But 98% of cybercriminals out there are really good social engineers and know-how to manipulate someone using technology and psychology.
• [29:56] - The number 1 group for identity theft is children.
• [30:51] - Most people use the same password across multiple accounts. Brett says to always use a password manager.
• [32:38] - The reason a scam works is because the scammer and the victim are on opposite sides of the field. The scammer works to get the victim to his side by establishing trust through technology and social engineering.
• [34:36] - How good is the scammer at establishing trust with a victim using the technology they have?
• [37:09] - The scammer's job is to make sure the victim is not thinking objectively.
• [37:50] - People like to trust. Generally, people like to see the best in people. Brett says to trust, but verify.
• [39:08] - In his experience as a consultant, Brett has found that most victims suspect something might be a scam but alienate themselves from telling anyone out of embarrassment as society tends to blame the victim.
• [42:16] - Chris asks Brett when a scammer stops caring about the victims and only cares about the money. Brett answers that it depends on whether or not the scammer is a sociopath. He says that most scammers are not and come to believe their own justifications.
• [44:18] - There's no beneficial thing about being a criminal.
• [44:50] - Be proactive, not reactive, when it comes to security.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• AnglerPhish Web Page
• Brett Johnson on Twitter
• Brett Johnson on LinkedIn

Embezzlement is on the rise, but only a few incidents ever get reported to law enforcement. Why do people steal and how are they doing it? What can business owners do to help prevent these crimes and what should they do if they suspect them?

Our guest today is Kelly Paxton. She has more than 25 years of investigation experience and is a certified fraud examiner and private investigator. She started her career in law enforcement as a special agent for the US Customs Office of Investigation in 1993. She has worked white-collar crime, fraud, money laundering, embezzlement, and conflict of interest cases. Kelly is also the proud owner of Pink Collar Crime, a passion of hers about embezzlers in the workplace.

• [1:02] - Kelly has always been interested in money. She started her career in finance but had a client arrested for fraud. She then became interested in investigating why people steal money.
• [1:57] - Kelly's goal is never to put someone in jail. Her goal is to find out why the person stole the money and to hopefully see the money returned to the victim.
• [2:32] - Why do people steal money? Generally speaking, Kelly says most people will steal because they think that money will help them fix their problems.
• [3:51] - Most people are good people, but life happens, and most people think money fixes it.
• [4:11] - Embezzlement is stealing money from business. Kelly defines Pink Collar Crime as petty amounts stolen by low to mid-level employees, primarily women, from the workplace.
• [5:40] - In the 80s, this was a shift in thinking. Up until then, most people hadn't thought about embezzlement as a common crime.
• [6:17] - Kelly explains that in embezzlement cases, there is a lot of victim shaming. Due to this, only 15% of embezzlement cases are reported to law enforcement.
• [8:01] - Most victims like the employee and that is how the employee is able to steal. Trust is not an internal control.
• [8:46] - 60%, or 3 out 5, of all dentists have been ripped off.
• [9:13] - Kelly calls embezzlement "the crime of main street."
• [10:01] - Financial audits are not always when losses are noticed. Tips and hotlines are actually more effective in finding out about these problems.
• [11:06] - 90% of bookkeepers in the United States are women. Women push back against the title "Pink Collar Crime," but should be pushing back that women are in lower-level positions as a whole.
• [12:30] - Kelly shares an example of a woman who stole millions of dollars over 20 years. When she was arrested, she was exhausted because she could never take a vacation as she was afraid of being caught.
• [13:48] - Another warning sign is a control freak, especially when it comes to changing computer programs.
• [14:53] - The number one way people embezzle from the workplace is forged or unauthorized checks.
• [16:28] - It is never good to be ripped off, but there are good things that come from it, including connections with other people and lessons learned on how to manage the business moving forward.
• [18:36] - The principle doesn't pay the principal, meaning the principle of being ripped off doesn't pay the loss.
• [19:16] - At the end of the day, you have to get back to work. The money is replaceable. The trust is difficult to get over.
• [21:00] - Intuitively, you trust a coworker more than you trust a stranger. So you won't always see this coming.
• [21:41] - Trust but verify. Kelly uses an example of trusting your dentist when you have a cavity.
• [23:47] - If you are a small business owner, Kelly recommends that you mail your bank statements mailed to your home or to a P.O. Box that only you can control.
• [24:27] - Always look at the images of the checks on your online bank statements.
• [25:49] - Mix up when you check things. Check different size checks, audit your own finances at different times of the year. Keep everyone guessing so they don't see a pattern that they can take advantage of.
• [28:10] - Kelly also suggests that you have a binder or system of some sort that outlines everything in the event that you need to show details in a case.
• [30:23] - Business owners don't generally look at all the checks going in and out of the business. Some business owners even have pre-signed blank checks to make tasks easier, but puts them at risk of fraud.
• [32:01] - Kelly would rather train business owners to help prevent these events than to sit across from someone she is investigating as a criminal.
• [32:48] - Kelly shares an example of one of the craziest cases she worked.
• [34:18] - If someone starts at a business and if they steal within the first 6 months of working there, they've done it before. They may not have a criminal history or have not been caught yet.
• [35:45] - If you walk into your house and you see a dead body, you call the police and you don't touch anything. Unfortunately, with embezzlement, when a business owner notices something wrong, they go in and try to figure things out themselves and oftentimes mess up the crime scene.
• [37:46] - Kelly is writing a book, but admits that it will be an ebook because most people won't go into a bookstore to buy a book about embezzlement. This can be seen as embarrassing.
• [39:07] - If you have proof of embezzlement, most of the time the employee will confess when confronted. But you need to be prepared and never confront them alone. Kelly recommends having a lawyer with you as a reliable witness.
• [42:16] - The more people who have access to the information, the less likely the crime will happen.
• [43:13] - There is no CSI Embezzlement. These cases take an extremely long time.
• [44:40] - Law enforcement has limited resources and will need to put their focus on different types of cases due to the length of time and investigation needed to work on these cases. As a business owner, you will need to spend a lot of money to have things investigated.
• [46:10] - There is also a level of embarrassment when things like this happen.
• [48:42] - There's not a national database of arrests and convictions.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Kelly Paxton Web Page
• Kelly Paxton on LinkedIn
• Kelly Paxton on Twitter
• Pink Collar Crime Web Page

With the cost of surveillance and mass information gathering becoming cheaper and easier, laws are struggling to keep pace. Who is fighting for transparency and working to protect your digital rights?

Our guest today is Danny O'Brien. Danny has been an activist for online free speech and privacy for over 20 years. He co-founded the Open Rights Group and has defended reporters from online attacks at the committee to protect journalists. He is now the Director of Strategy at Electronic Frontier Foundation.

• [0:59] - Danny began working with Electronic Frontier Foundation (EFF) in 2005 but had been interested in them and digital rights overall since 1990 as a journalist.
• [2:18] - In the early days of EFF, the topics they were writing about seemed very theoretical to the everyday person. It became confusing, but a lot of these hypothetical situations were becoming reality in the early 2000s.
• [4:06] - The assistance Danny gave to journalists to keep them safer from online attacks began on a case by case basis.
• [6:23] - Danny explains that now they are seeing a rise in targeted attacks on journalists with government connections.
• [7:50] - The tools to conduct a spyware style monitoring of a particular person are now so ridiculously cheap. It can be anyone. In the early days, it always seemed like an attack was government based or done by professionals.
• [8:42] - Journalists in particular are highly targeted for attacks because they have likely upset someone they've reported about.
• [10:49] - When Gmail was hacked in 2009, it became apparent that the people that were targeted in that attack were Tibetan activists.
• [11:42] - There has been a shift into a professionalization of attacks. It is someone's job to clock on, hack and make someone's life unpleasant, and clock off.
• [13:10] - One of the key cases in the last several years in regards to digital privacy rights is the Apple San Bernardino case in which the FBI wanted a back door into the iPhone of a suspect in a shooting.
• [14:36] - There is a gray area where governments are saying that as long as they have the ability to do these things, they should.
• [17:16] - The globalization of technology has caused confusion and blurred lines on what is legal and illegal in each country.
• [20:25] - Danny gives an example of a loophole in United States law regarding getting geolocation data from phones.
• [23:13] - The process of getting information is very murky especially in the United States.
• [24:41] - We need transparency before we will ever see reform.
• [26:40] - Google would do something called The Creepy Test where they would demonstrate something they could do internally and determine whether it was something that could be used in a "creepy" way.
• [28:29] - Something may seem like a great idea but wind up causing more bad than good. Danny uses apps for tracking the pandemic as an example.
• [30:20] - As technologists, we are capable of acting very quickly and reaching for a toolkit that we can use.
• [31:19] - Sometimes we have to be careful that the solutions that are the simplest from a technological point of view aren't just shifting the complexity elsewhere.
• [34:02] - The consequences of simply uploading photos online in regards to privacy were very unexpected at the start of the internet and social media.
• [35:49] - In the 90s there was a strong fight against encryption. Now that encryption is what holds entire economies together.
• [36:08] - While encryption is useful, it is also being used by cybercriminals to hide illegal activity, particularly child pornography.
• [39:00] - We used to argue about digital rights but now all rights are digital. Now, all laws are about the internet.
• [41:53] - Danny and Chris discuss the passage of a bill about the digital rights of sex workers that had several unintended consequences.
• [43:12] - There is a big push right now to undermine encryption particularly for fighting against sex trafficking.
• [44:04] - There are a lot of problems that have been created that were unintentionally created by technology that needs to be solved.
• [45:06] - Large companies, like Apple, Google, and Amazon, have a lot of control of our personal devices.
• [46:46] - We will start to see a lot of technological compromises between large companies and the government.
• [48:44] - Pick the privacy tools and try out different tools to find what works for you. It exercises your right to remove trackers and ads from your web experience.
• [50:27] - In order to exercise your rights, you need to know them.
• [52:38] - People wind up being the consumers of technology and they don't become active citizens in this digital community. Education is important.
• [54:54] - Danny shares links to useful material to educate yourself on surveillance (listed in the Links and Resources).
• [57:21] - Sometimes, lawmakers don't know all about these technological problems, so write to your lawmakers when you have concerns.
• [59:30] - EFF is membership driven and a huge proportion of their funding is from individual members. If you are interested in becoming a member or donating to EFF, visit their website for more information.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Open Rights Group Web Page
• Electronic Frontier Foundation Web Page
• Danny O'Brien on Twitter
• Surveillance Self-Defense (SSD at EFF)
• Security Education Companion (SEC at EFF)

The pandemic has taken an economic toll on millions of lives. People are struggling, people want to help, and others are looking to take advantage of both. Before panicking about your bills or giving to the latest charitable cause, you need to listen to this episode to make sure your money is going where you think it is.

Our guest today is Dori Zinn. Dori has been a personal finance journalist for more than a decade with work featured in Forbes, Huffington Post, CNET, Yahoo Finance, and more. Her writing covers topics like banking, investing, credit, debt, student loans, personal loans, budgeting, and overall financial literacy. But today, she is talking about charities. Which ones are legitimate and which ones are raising those red flags?

Information security is not just technical. There is a human aspect involved and fixing that is more than just identification and awareness. Our guest today is Ira Winkler. Ira is the president of Secure Mentem and the author of the book You Can Stop Stupid. He is referred to as the modern-day James Bond, given his skills both physically and technically in infiltrating organizations.

Today, Ira shares with us many of his personal and professional experiences in the area of cybercrime. His valuable tips and information can change how you look at potential threats and scams. He is an expert in how to make people easy prey and how to prevent people from being easy prey.

• [0:51] - Ira graduated college as a psychology major and the only job he could get at that time was in the National Security Agency. This led him into the computer field within the military.
• [1:31] - He always wound up working on the human side of things.
• [3:03] - Ira shares his background and how he became a world-renowned penetration expert, which is a fancy name for a hacker.
• [5:21] - The way you break something is not the way you fix it. This is an important concept when looking at psychology.
• [7:01] - Psychology helps Ira exploit others but it is also important to understand when helping them.
• [7:55] - Telling someone the problem and then telling them not to fall for a scam doesn't work.
• [8:50] - Ira and Chris discuss the recent Twitter hacks. Ira says that in this situation, anyone could have done what the hacker did because it was easy. You just have to have the questionable ethics and morals to do it.
• [9:41] - A lot of times, hackers and criminals are hired in various agencies including government and law enforcement because of their skills. Ira says this is very backwards and gives examples why this is "horrendous."
• [11:58] - How do we get people to not fall for various types of scams? Ira says it is a very multi-layered process and gives a few examples of what can be done.
• [13:02] - Ira uses a comparison with terrorism attacks and how we can use that knowledge to help us protect ourselves, plan for a problem, and how to respond.
• [15:59] - A lot of sites other than banks and credit card companies are putting in security measures to keep people safe. But a lot of people get annoyed by security protection's inconvenience.
• [17:15] - In general, most people use the same password across multiple accounts. If one user ID and password is compromised then the others are as well.
• [18:32] - Ira uses the real moral of the story of The Wizard of Oz: You have what you are looking for, you just don't know it or how to use it. This is applicable to security. You have what you are looking for, but you aren't using it.
• [21:38] - People have to stop being offended when people put security mechanisms in place.
• [23:10] - Something that bothers Ira is when real credit card companies are calling and ask for points of verification like social security numbers. This is exactly what scammers do and when real companies do this, it is hard to tell the difference.
• [25:43] - If somebody is injured, it is the fault of the system where the user exists. Somewhere they enabled the user to put themselves in a situation to allow them to be harmed.
• [27:42] - Sometimes bad grammar and poorly written scams is actually a filtering feature for scammers to filter out the people who are too smart to fall for it. Even a small percentage of people falling for a scam is still money in the criminal's pocket.
• [28:44] - We need better infrastructure to protect organizations and individuals because these events cause so much money to be lost.
• [29:46] - Anyone who tells you there can be perfect security is either a fool or a liar.
• [30:19] - Anytime you have the option to add two-factor authorization, take it! Yes, it is annoying, but the consequences of not utilizing it are far more annoying in the end.
• [32:11] - Ira shares a story about when there was suspicious activity on his bank account. He saw the pattern and told the bank that he would work with them and law enforcement because he does this for a living. They "made a note of it," and didn't really do anything to stop the problem.
• [35:14] - Ira references a movie called Focus that is about scams, social engineering, and con-artists.
• [37:21] - You have to admire the minds of these criminals and the lengths they'll go to manipulate and take advantage.
• [38:10] - You need to respect your potential adversaries.
• [39:00] - Chris and Ira discuss why the United States is different from other countries in regards to using the combination of cards and signatures versus cards and a PIN.
• [40:24] - How much risk can you assume as a culture?
• [42:13] - Chip and PIN is risk mitigation, but how much risk is it actually mitigating?
• [43:10] - You Can Stop Stupid, Ira's book, is about how stupid is an effect, not a cause. It outlines what you can do now and how you respond to a problem.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Ira Winkler on LinkedIn
• Ira Winkler on Twitter
• Secure Mentem Web Page
• You Can Stop Stupid by Ira Winkler