SipCyber - Presented by IT Audit Labs

Your bedrooms, your windows, your door locks, and maybe even where your security cameras are mounted could still be online for anyone to see. In this episode of SipCyber, Jen Lotze spends the afternoon at Jenny in the City and SK Coffee in St. Paul, MN, and talks about a privacy gap most homeowners never think to check: interior photos left behind on old real estate listings. 

When those photos are paired with an address that shows up in a family photo, a package picture, or public property records, a stranger can learn a surprising amount about the layout of your home. Jen walks through how to claim your home on Zillow and hide or remove those photos, plus where else to look once you're done. 

Key Topics Covered: 

• Why old listing photos stay online long after you buy a home  
• How your address gets connected to those photos  
• Step-by-step: claiming your home on Zillow and removing or hiding photos  
• What to do when Zillow won't let you edit your listing  
• Checking Redfin, Realtor.com, and asking your original listing agent for help 

You don't have to disappear from the internet to protect your privacy. Sometimes it just takes someone pointing out one thing you missed and giving you a simple way to fix it. 

☕ Featured Spots: Jenny in the City and SK Coffee, St. Paul, MN 

Take ten minutes this week to look up your own address. Subscribe for weekly cybersecurity tips from local spots across the country, and share this with a friend who just bought a house. 

#Privacy #HomePrivacy #Zillow #RealEstate #OnlinePrivacy #DataPrivacy #CyberSecurity #HomeSecurity #DigitalSafety #CyberAwareness #SipCyber #StPaul 

Plenty of hotel guests pack up everything except their Netflix login. In this episode of SipCyber, Jen Lotze checks in at Roam Hotel at Century Plaza in downtown Minneapolis the night before the Outdoor Retailer show and discovers a clever room feature that lets guests set their streaming logins to expire. That small detail sparked a simple travel habit worth adding to every trip. 

Streaming accounts left signed in on hotel TVs can reveal more than most people expect, including viewing history, family profile names, and sometimes the email address tied to the account. Jen explains why that matters and walks through how to remove access from home if you forget to sign out before you leave. 

Key Topics Covered:  

• Why hotel TVs so often stay logged into past guests' streaming accounts  
• What your viewing history and profiles can reveal about you and your family  
• How an exposed email address adds to your digital footprint  
• Using Netflix's Manage Access and Devices to sign out remotely  
• When to sign out of all devices and when to change your password 

Good security doesn't have to be complicated. A few seconds before checkout, or a couple of minutes once you're home, keeps one more piece of your digital life in your hands. 

☕ Featured Spot: Roam Hotel at Century Plaza, Minneapolis, MN 

When you check out of the room, check out of your streaming accounts too. Subscribe for weekly cybersecurity tips from the best local spots across the country, and share this with someone who travels for work. 

#CyberSecurity #TravelSecurity #HotelSafety #Netflix #StreamingSecurity #AccountSecurity #DigitalPrivacy #CyberHygiene #BusinessTravel #OnlineSafety #InfoSec #Minneapolis #SipCyber 

Familiarity is one of the strongest signals we use to decide who to trust, and it's exactly what attackers count on when they take over a social media account. In this episode of SipCyber, Jen Lotze returns to Goebbert's Pumpkin Farm in South Barrington, IL, a place she and her sister Holly have known since childhood, to explore the difference between familiar and verified. 

Once a criminal gets your password through a phishing message or a reused password exposed in a breach, they don't need to build a fake profile. They have your real one, along with your photos, your history, and the relationships you've spent years building. Jen explains how account takeovers turn that trust into a weapon and why multifactor authentication is your best defense, as long as you choose the right kind. 

Key Topics Covered:  

• How social media account takeovers exploit the trust of your friends and family  
• Why text message MFA codes are vulnerable to SIM swapping  
• Stronger options like authenticator apps, passkeys, and physical security keys
• Why you should never share a security code, even with someone you recognize  
• How to verify an unusual request through a separate, trusted channel 

Good security can evolve the same way a favorite tradition does, keeping what works while making room for something better. A few minutes in your account settings today can protect the trust other people place in you. 

☕ Featured Spot: Goebbert's Pumpkin Farm, South Barrington, IL, with an Olivia iced coffee from the Holy Grounds coffee truck 

Don't let a familiar name lower your guard. Subscribe for weekly cybersecurity tips delivered from the best local spots across the country, and share this with the friends and family who would trust a message from you. 

#Cybersecurity #MFA #AccountTakeover #SIMSwapping #Passkeys #SocialMediaSecurity #MultifactorAuthentication #SocialEngineering #InfoSec #CyberSafety #DigitalSafety #SipCyber 

You don't need a security clearance to be valuable to a foreign intelligence officer. What you know, who you know, and what you can access might matter more than you think. In this episode of SipCyber, Jen Lotze visits Saint Paul Brewing in St. Paul, MN, right after the annual InfraGard Minnesota meeting at Metro State University, where an FBI counterintelligence briefing left her with one question, she can't stop thinking about: what makes you interesting to someone else? 

Set inside the historic Hamm's brewery complex, St. Paul Brewing is a place that holds a special memory for Jen. From its whimsical garden and string lights to a canoe with a fire in it, it's the perfect backdrop for a conversation about the ordinary details of our lives that can have extraordinary value to the wrong people. 

Key Topics Covered:  

• Why counterintelligence applies to professionals, students, researchers, and contractors, not just people with clearances  
• How public LinkedIn keywords can make someone attractive to foreign intelligence officers  
• Warning signs in unsolicited outreach, from probing questions to requests to move off the platform  
• How to verify a stranger's identity before sharing details about your work  
• A five-minute exercise to review your online presence through someone else's eyes  
• What to do and who to tell when an interaction starts to feel off 

This is about awareness, not fear. Keep networking, keep sharing your wins, and be intentional about what you make public. 

☕ Featured Spot: Saint Paul Brewing, St. Paul, MN 

Take five minutes today and Google yourself. Subscribe for weekly cybersecurity tips delivered from the best local spots across the country, and share this with a colleague who's active on LinkedIn. 

#Cybersecurity #Counterintelligence #FBI #InfraGard #LinkedIn #SocialEngineering #OSINT #OnlinePrivacy #DigitalFootprint #SecurityAwareness #InfoSec #StPaulMN #SipCyber 

Trust between people builds over time, but AI assistants are asking for all of it on day one. In this episode of SipCyber, Jen Lotze settles in at Roots in St. Paul, MN, a youth-led coffee shop and economic development program just down the street from Metro State University, with a tiramisu cold brew before an InfraGard meeting. Fresh off a solo trip to see The Avett Brothers at Wolf Trap, where a group of strangers became friends over a weekend of music and conversation, Jen uses that experience to look at a very different kind of relationship: the one we're forming with AI agents. 

Instinct, a new AI assistant still in private beta, has drawn major media attention and a reported $2.5 billion valuation. It can book travel, manage appointments, make reservations, and carry out transactions for you. To make that happen, it can connect to your email, messages, calendar, location, audio, and screen, and its terms describe receiving screen captures, cursor movements, and keyboard inputs. 

Key Topics Covered:  

• Why trust with people grows over time, while AI tools ask for it up front  
• What the Instinct AI assistant can do and the access it needs to do it  
• Screen captures, keystrokes, and location data in AI terms of service  
• What it means when an AI agent can make commitments and transactions in your name  
• Weighing convenience against privacy before you connect your accounts 

Convenience is a great selling point, and it's worth knowing exactly what you're trading for it. A few minutes with the fine print can tell you more about an AI assistant than any product demo. 

☕ Featured Spot: Roots, St. Paul, MN 

Think before you connect. Subscribe for weekly cybersecurity tips delivered from the best local spots across the country, and share this with anyone who's been eyeing an AI assistant to run their day. 

#AI #AIAssistant #AIAgents #AgenticAI #DataPrivacy #Privacy #CyberSecurity #InfoSec #DigitalSafety #AIRisks #TermsOfService #OnlineSafety #SipCyber 

Our phones hold our photos, conversations, locations, cameras, and microphones, and every app we install gets a key to some part of that space. In this episode of SipCyber, Jen Lotze takes a detour from coffee to Eldon St. Tea Shop in Reston, VA, ahead of a concert at Wolf Trap. She uses Reston's history as one of America's first intentionally planned communities as a lens for how we should be designing our digital lives. 

Jen breaks down a recent story about Depthfirst, a cybersecurity company that built an AI-powered tool to hunt for software weaknesses. Researchers took a freely available AI model from the Chinese company Z.ai, modified it heavily, paired it with other tools, and sent it searching for bugs. The path it uncovered led all the way to a phone's camera and photos, a reminder that AI is changing how quickly vulnerabilities can be found by both defenders and attackers. 

Key Topics Covered: 

•  How Depthfirst used a modified open AI model to hunt for software vulnerabilities 
•  Why an AI-discovered flaw reaching phone cameras and photos matters to everyday users 
•  What AI-powered bug hunting means for the speed of future attacks 
•  Treating your phone like a planned community where you decide what each app can access 
•  Practical steps for reviewing app permissions for your camera, microphone, photos, and location 

AI is giving researchers and criminals new ways to find the cracks in our devices. The good news is that the access you control still makes a real difference. 

☕ Featured Spot: Eldon St. Tea Shop, Reston, VA 

Take five minutes today to check which apps can see your camera and photos. Subscribe for weekly cybersecurity insights delivered from the best local spots across the country, and share this with someone who never reads the permission pop-ups. 

#AI #AIHacking #CyberSecurity #PhoneSecurity #MobilePrivacy #AppPermissions #VulnerabilityResearch #InfoSec #DataPrivacy #DigitalSafety #SipCyber #Reston #ITAuditLabs 

It starts with a customer who seems completely normal and ends with a business refunding money it never actually received. In this episode of SipCyber, Jen Lotze reports from The Mug in Sutherland, NE, a road trip stop that turned into a reminder of how much one extra step can matter, all thanks to a breakfast burrito and salsa made from scratch just minutes before it hit the table. 

That same extra step is the theme of today's episode. Jen walks through the story of a small business in the UK that came close to losing thousands of pounds to a fake check overpayment scam. While the banking details in that case are specific to the UK, the scam itself works the same way here in the United States, and the Federal Trade Commission specifically warns American small businesses to watch for it. 

Key Topics Covered:  

• How a routine customer inquiry about products, shipping, and delivery sets the stage  
• The overpayment trick and why scammers ask you to send the difference back  
• Why a check that appears to clear can still bounce later  
• What the FTC tells U.S. small businesses about fake check scams  
• The simple verification step that protects your business and your money 

A deposited check is not the same as money you can safely spend or refund. Taking a moment to verify before sending anything back is one of the easiest ways to keep a good sale from turning into a costly loss. 

☕ Featured Spot: The Mug, Sutherland, NE 

If you run a small business or know someone who does, pass this one along. Subscribe for weekly cybersecurity tips delivered from coffee shops across the country. 

#FakeCheckScam #OverpaymentScam #SmallBusiness #CheckFraud #FraudPrevention #ScamAwareness #FTC #CyberSecurity #InfoSec #CyberSafety #SmallBusinessSecurity #SipCyber 

YouTube Tags: fake check scam, overpayment scam, small business scams, check fraud, FTC scam warning, how to spot a fake check, overpayment refund scam, small business fraud prevention, scam awareness, cybersecurity tips, cybersecurity podcast, fraud prevention, check scam explained, small business cybersecurity, SipCyber, Jen Lotze, IT Audit Labs, The Audit podcast, The Mug Sutherland Nebraska 

When someone you love gets scammed, the questions can wait. In this milestone 50th episode of SipCyber, Jen Lotze celebrates the occasion with a visit to the Minnesota State Fair, reflecting on family, tradition, and the small businesses that make the fair feel like home, before turning to one of the most important conversations of the show: how to actually help someone after they've been taken advantage of online. 

Whether it's stolen money, a hijacked social media account, or an impersonation attack, the instinct to ask "why did you fall for that?" only adds shame to an already painful moment. Jen breaks down a clear, practical four-step framework for showing up for the people you care about when a scam has already happened. 

Key Topics Covered:  

• Why judgment and questions make scam recovery harder, not easier  
• The 4-step recovery framework: stop the money, secure the accounts, save the evidence, make the reports  
• Where to report fraud, including IC3.gov and IdentityTheft.gov  
• How to spot "recovery scams" that target people who've already lost money once  
• Why sitting beside someone through the process matters more than the advice itself 

This isn't just a technical checklist. It's a reminder that cybersecurity, at its core, is about protecting people. 

☕ Featured Spot: Minnesota State Fair (recorded from home, with a cold brew root beer float) 

50 episodes and counting. Subscribe for weekly cybersecurity tips delivered from coffee shops and community spots across the country, and share this with someone who might need to help a friend or family member through a scam.

 #Cybersecurity #ScamRecovery #IdentityTheft #OnlineFraud #InfoSec #CyberSafety #SipCyber #MinnesotaStateFair 

A friendly customer, a payment mistake, and a request to send some money back. It sounds harmless, and that's exactly the problem. In this episode of SipCyber, Jen Lotze stops at The Mug in Sutherland, NE, to unpack a fake check overpayment scam that nearly cost a small business thousands of pounds, and why the same trick works just as well on American bank accounts. 

The scam starts with an ordinary customer inquiry, moves into an "accidental" overpayment, and ends with a request to refund the difference. Jen breaks down why the money you see in your account isn't always the money that's actually yours yet, and how that gap between available funds and fully collected funds is exactly what scammers exploit. Whether you run a business or just sell something online, this episode covers the one pause that can save you from a very expensive mistake. 

Key Topics Covered:  

• How a fake check overpayment scam nearly cost a UK small business thousands  
• Why the FTC specifically warns American small businesses about this exact scam  
• The difference between available funds and fully collected funds, and why it matters  
• Why Venmo overpayment refund requests are almost always fraudulent  
• This week's cyber tip: never refund an unexpected overpayment outside your normal process 

☕ Featured Coffee Shop: The Mug, Sutherland, NE 

Don't let a good customer story talk you out of a smart pause. Subscribe for weekly cybersecurity tips delivered from coffee shops across the country, and share this with any small business owner or online seller you know. 

#Cybersecurity #OverpaymentScam #CheckFraud #SmallBusinessSecurity #VenmoScam #FTCWarning #InfoSec #CyberSafety #SipCyber #ScamAwareness 

The tools we trust most are often the easiest to fake. In this episode of SipCyber, Jen Lotze settles in at Quixotic Coffee to break down a phishing campaign that turned an everyday inbox notification into an attack vector. Attackers impersonated the automatic "you have a new voicemail" emails millions of workplaces send every day, hiding malicious code inside disguised SVG attachments that slipped past spam filters far more often than anyone would like. 

More than 26,000 of these messages hit over 5,500 organizations, each one personalized with the recipient's own email address to make it feel legitimate. Jen walks through why that familiarity is exactly what attackers are counting on, what to check before opening an unexpected voicemail email, and this week's cyber tip on locking down spam call protection on your phone. 

Key Topics Covered:  

• How attackers impersonated over 26,000 voicemail notification emails across 5,500+ organizations  
• Why the malicious SVG attachments slipped past Microsoft's spam filters 75% of the time The questions to ask before opening any unexpected voicemail email  
• Why familiarity is the exact thing scammers exploit  
• This week's cyber tip: turning on spam call protection on your iPhone 

☕ Featured Coffee Shop: Quixotic Coffee, MN 

Don't let a familiar inbox fool you. Subscribe for weekly cybersecurity tips delivered from coffee shops across the country, and share this with a coworker who checks their voicemail email without a second thought. 

#Cybersecurity #Phishing #VoicemailScam #SVGMalware #InfoSec #CyberSafety #EmailSecurity #SipCyber #ScamAwareness #DigitalSafety