Call Security

Hey folks, I wanted to mention that I'm continuing to take Archive episodes out of the public feed and put them behind the paywall at Substack. So if you want to find these older episodes, the best way is to subscribe and then go to the risk of ruin page in the Substack app and search for the word archive. My goal is to get the public feed down to about 20 episodes and then have everything else as premium content for subscribers. Anyway, I hope you enjoy this episode. [Music] We found an online manufacturer's spending play where you could get a, uh, the spend that you were getting on your card, you could get a percent back, but the lower the spend, the higher raw amount you would get back. So if the charge was for between, I don't know, it's like, $0.20 in a dollar, you could get more than 20% back, you know, like maybe a 15% cent charge, you're getting 20 cents back. I think it just has something to do with a lot of the way a lot of interchange fees work. Hard process, it'll be like, uh, X percent plus 10 cents. So the lower the charge, you could get up to more than 100, more than your full stake back, right? And so we found a, uh, an online, it was a wedding registry that accepted cash gifts through card, and they did card processes. So I got pretty excited about the possibility and I will admit, I got so excited I didn't think about the thing, oh, this isn't a card issue or this isn't a casino. I mean, I'm not really somebody that is super into the culture of every small business as a good bit. And as I bet you, the worst guy in your town, and it's probably some kind of fucking jet ski dealership guy, right? Yeah, it's just generally I didn't stop to think about that kind of thing because I was so excited about it. And I ended up dodging the moral issue on that because I got Jordan excited about it too. And we thought, oh shit, you know, we're the 100% sack. You have some kind of program that just sits there and charges 10 cents at a time and you're just getting paid out 11 cents or more back and you just let it run and you collect the money from the wedding gift registry and you pocket it and, uh, Jordan, quick, outbuild this app, built this bot. And I got him excited and then he built it and then we deployed the bot and we got shut down after about 20 transactions because there were too many too quickly. So we sat down for our debrief and we said, you know, we probably should have just done a bunch of this manually to see what the limits were before I wrote all this fucking code. I said, I'm sorry, Jordan. You're listening to risk of ruin. I'm John Reader. This is episode 48. Call security. I'm going to start by telling the story of the time I was drafted by a team of advantage players to fly to the middle of the country where our mission was to bet a very specific correlated parlay. And, well, I guess just bet sports in general. I'm looking at my spreadsheet from this trip and I see NBA college football college basketball NHL and something called Bruce Carrington, which I had to look up and apparently he is a boxer. Over about a week, we made bets in six different sports books across three states and the majority of that action went into self serve. He asks one of the days I was on this trip. My job was to drive 45 minutes from the city where we were staying to one of these small towns that could have been like any place in the heartland, but for the massive casino. Then I sat in a not at all glamourous sports book. I mean, it was a single betting window, some very mediocre TVs, a few high top tables, and probably fewer than 10 total customers all day. So I would just sit and watch my phone waiting for bets to come in. Then when I got a text message, I would hurry to a kiosk and try to get as much Dartmouth over 137 as I could before the line moved. Now these kiosks only accept cash and tickets, so if you want to bet 5,000 on the Dartmouth over, that's a lot of bills to feed before you make your bet, which means that some of the monotony of waiting for bets to come in can be broken up with the monotony of creating tickets for later use. I think I spent six hours at this place and in addition to the Dartmouth over, we also had Drexel over 137 Niagara over 147 and a half, Kinesis or is it Kinesis? I have no idea. Over 137 and a half, Minnesota under, Northwestern under, Missouri state under, Central Florida over, Duquesne over, Ryder under, Santa Clara under, etc. I got about $47,000 into this machine and then on those bets, we won 32,000, which is, you know, let's just say, well above, expected value. Anyway, the next day when I went to cash out, I was informed by the incredibly nice sports book manager that I was no longer welcome there. I guess they had had enough of the stranger with the out of state driver's license and the Fanny Pack full of cash who sat there for hours and didn't bother to look at the sports on TV even a single time on that trip. I also got backed off from another casino in the area, although the details are different. This other place took three bets, totaling $11,000 all over the counter and then gave me a letter saying that in the future, I wouldn't be allowed to bet more than $250. This happened before any games had even been played and even more disgusting is that we ended up net losers on those bets. Okay, and then when our group wasn't lurking around the sports book, we spent the rest of our time doing some white manufacturer spending. I think we bought $150,000 of a holiday promotional gift card and we got backed off from a store for doing that. Actually, I will describe the scene so it makes at least some sense. Make sure a group of about five guys standing in the self-check out lane of a store, each with a pile of gift cards. And the sequence goes, scan two gift cards, pay with a credit card, then scan two more gift cards and pay with a different credit card. Then repeat that process for about 15 minutes at each store. If all of that doesn't seem sketchy enough, we did not look great either. I don't think anyone shaved. The entire trip. You know, no one's hygiene has ever improved from a week in casinos. You probably smell like a mix of second hand smoke and chicken wing sauce. To be fair, I think we bought these gift cards in 10 to 15 stores and only one of them took issue with the low life vibe we were giving off. But a fair question to ask is, so what? What's the point of this story? Here are some common elements as I see them, a company making an offer like, here are the odds you should make a bet. Same company knowing they're vulnerable to being adversely selected on that offer. They're at risk of being overweight to customers they don't even want in the first place. Then some throttles or countermeasures or speed bumps are established, like kiosks that will print max tickets of $900 or a point of sale that limits to two purchases. But the countermeasures are still somewhat porous and bad things keep happening, which means that the last line of defense is some employee having to decide that the biggest customer by volume has to go. I'm actually not the type of person that anyone needs to be worried about. I was just a button pushing drone on this trip, but my friends are. They're exactly the kind of people you do not want poking around your patchwork defenses, which means they get kicked out of online sportsbooks, brick and mortar casinos, retailers, and even online wedding registries. This episode isn't about the whole group, but it is about two of the guys in it. The voice you heard at the top of the show is Ohio Mike. Then the other voice you're going to hear belongs to Jordan. If there's a bot that needs to be programmed or a capcha that needs to be defeated, Jordan is going to be the one to do it. He's the coder of the group. Here's Jordan. I love solving these kinds of problems, like technical problems that can be beaten either with mathematics or computer science or just using some form of technology to gain an edge. That's so much fun to me. Just edge getting with the skills that I do have and with maybe new skills that I can acquire. Jordan talks about programming with the excitement of someone who just discovered it, but he didn't. He's been this stoked his entire life. I remember being three years old and going to my neighbor's house and my dad and I were over there. He was like, "Oh yeah, I got this new computer. Check it out." He booted up good old windows, something from the '90s. He was like, "Yeah, and I've got the internet too through the phone line. My computer can talk to other computers." What? What is this? This is kind of like three years old. This is really cool. This is going to be important. Whatever this is, this is important. I remember talking to my dad about it later and he was like, "No, it's just a weird technology and it's not going to be anything. It's not going to mean anything." I remember being 12 years old and I started building websites when I was 12. For myself and for my friends, I even built websites like streaming some of our favorite TV shows who knows who was hosting those video files. But I just had the embed links so we could embed it from somebody else's hosting site and then watch all of our favorite shows and have like a little chat box for me and my friends to be like, "Oh man, this show is crazy." Yeah. I fell in love with like, straightened code at the time and kept doing that through high school. Doing other stuff and I got a job, pull an internship. I was in high school with a local web development company. They did like development and maintenance for e-commerce websites. It's been pretty, pretty big e-commerce names. And they gave me a shot and I'm so grateful that they did because it wasn't long before that just became like an actual job. And even after high school, I was like, "Man, this is what I'm going to do. I don't have to go to college for this. I'm just doing it right now." Eventually, I got tired of just a little board with like, building new features and stuff for e-commerce websites. And so I realized like, we're finding these bugs. These are like unique bugs that introduce vulnerabilities into the sites and stuff. These weird things that people are hitting our sites with. That's really interesting. That seems like a lot of fun. I'll just maybe start getting into that. And it was kind of like I was 12 again building my first website. This is amazing. What do you mean you can like, it just feels like magic. Being able to make a system do something that it wasn't initially designed to do or something that people don't expect that it could do, it just feels like magic. There are lots of programmers of various pedigree in the Advantage Playworld. Some learn to code in college or maybe even work for software companies. A decent number of them are also self-taught. It's not hard to understand why. If you want to make a script to analyze some casino game, it helps to have the math background, but it also helps if your code runs quickly. Actually, that reminds me of one of the great episodes from an Advantage Play message board. There were two guys in a pissing contest over whose Baccarra simulations could run faster, and they put money on it. Also, a third party escrow was set up to hold the funds in Bitcoin, and a three-judge panel of other Advantage players was assembled to adjudicate the matter. Anyway, I think that part of the reason you find a decent number of programmers is practical, and the other part is just cultural. Advantage players might be a subset of hackers. I guess in my early adult life, I kind of had a hard time with authority. We're working regular jobs, where people told me, "How do tell me where to be and what to wear and what to say and what to do when to go home and when I can take a leak?" That wasn't really my vibe. I would rather do something that I enjoyed that felt not nonsense and not get paid a ton for it. In the beginning, I started building web scrapers that would build bots that would go to websites and collect a bunch of data. A lot of that was dancing around their web application firewalls. I think a cloud slider, for example, it's a web application firewall that does a lot of things, but included in those things is bot mitigation and preventing people from just hitting a page, all days, scraping data from the same IP address, and a bot user agent. So, figure out how to get around that and collect all this data that maybe somebody else needed in a very clean and parsable format. That was the first thing for me. "Where did the application firewalls? How can I evade their bot detection and create a system that still uses the website as I needed to and doesn't get IP addresses banned or user agents banned?" Things like that. That was the start there and then seeing like, "Oh, what else do web applications firewalls do? They could prevent things like SQL injection or whatever." I was like, "That's weird. What is that?" I got into the bug bounty hunting scene from there. This is a way that I can learn how to exploit websites and not really have to. I was never super interested in. I don't know. Steeleing somebody's banking credentials and then liquidating their bank accounts. That just sounds. I don't know. It doesn't sound like fun to me. It also doesn't sound like a good use of my time. But in the bug bounty scene, you can find a remote code execution vulnerability on some banking server somewhere and then say, "Hey, I found this. Please pay me." And not getting trouble. They'll pay you to do that and say, "Oh, hey, thanks very much for finding this. Here's some money." Which is. I just want to know, really different from how it used to be. In the early days, if you found something like that and you said, "Hey, you've got a major problem here. You should fix that. Here's the details of it. I haven't done anything wrong. I'm just telling you that you have a vulnerability. Some people got sued and went to prison for that stuff to say, just letting a company know, like, "Hey, you've got a problem. You should probably fix that before somebody comes along and really hurts you." Jordan didn't just decide to get into security and then have everything immediately work out. In the beginning, it was never a hobby. For me, it was like, "Oh, I need to make a living doing this." I was determined to do it. There were times where I wasn't making any money, but I was devoting all of my time to figuring out how to make money doing it. It was a kind of a liver-died situation. You know what I mean? Like, in the beginning, I was like, "Man, I don't know if I'm ever going to make it." Kind of the despair that comes with that thought, like, "Oh, I might not make it." Things might suck like this forever. I used to live in a house that had no heat. There's a three-bed, one-bath duplex that I shared with five roommates or five other people. One of them was my girlfriend at the time and then four other people. There was no heat in the house. My method of transportation was my bicycle. I'd go to the dumpster dive at the grocery stores that used dumpsters and come back with a bunch of fruit and vegetables and cereal and bread and stuff. And. Jordan said that when he was younger, he had a problem with authority, which I kind of think of that instinct as being coincident with believing that a system designed to work, like a casino or a website, believing that some mistake could have been made. It's a motivational shove in the direction of looking for the thing, the rest of the world got wrong. Like, I'll show them. Which can work. But the cost is you have unmoored yourself from convention and from the conventional world. It's like, "Oh, man, the fridge is kind of empty. Actually, it's really empty." And nobody believes in me except for me. That's really all that matters. And I did do it. Like awesome. No, I can buy some bread and tell everybody else to go fuck themselves. Jordan was vague when he was talking about the kinds of things he was doing in cybersecurity. He says that he's not interested in doing anything illegal. But also, he doesn't want to say something and have listeners end up with any kind of mistaken impression. But he has a story which is very relevant for this episode because it highlights the way that advantage players see things like limit one in a promotional offer and just flat out reject the legitimacy of that request. So there was one situation where there was a food brand that was offering a $1 coupon to anyone who signed up on their website. It was like for a newsletter or something. And you had to verify your email address in order to get this $1 off coupon. And you would just print it off and take it to the store. And they were unique coupons. So it wasn't like you could just print off a hundred copies of the same one. Once you used one once, it was it was dad. You had to get another coupon or just not use coupons. And so like, okay, I know that I can programmatically sign up for the newsletter, verify my email address, save the coupon or print it out. And that's a dollar. Okay. Is there a way to build a system that does that over and over and over and over and over and over and over again? The answer was yes. You certainly could. And I did. And it did exactly that. Went to the website, verified the email address. Did this did this from tons of different email addresses. A variety of IP addresses never using the same IP address more than once. Never using the same email address more than once. And do that about a thousand times per day. And yes, there was a web application firewall that tried did a decent job of blocking bots and it did not block mine. So that was a fun one. Just generate $1,000 worth of coupons every day. I think I averaged four hours at every place before getting backed off. I don't know what most people face, but like, you know, I was spreading pretty hard to start with and playing probably the games that get hit the hardest throughout the country. You know, you're your stand 17s, your surrenders, or you know, on six deck and then like, oh, these isn't good juicy double deck games. Things like that. Earlier, I said that advantage play programmers have the ability to analyze games on their own, but I think that kind of understates things. I think they actually can't stop themselves from doing it. Oh man, it was it was a few months into full time card counting. And I was like, man, I need to find something else because I'm going to run out of casinos real soon. And so I started learning about like side bets that can be beaten in Blackjack and some other games. To start with, I started using some work that other people had done and published about like, okay, theoretically, this could be beaten in this way. And this could be how much money. Like under these conditions, like some somebody or some group could make. And so like they're missing bits. Like, okay, I wanted to see what would happen if it's said of like max betting. We did like a spread and we reduced variance. We didn't bet until like we had like we weren't betting at a half a percent edge with extreme variance. And what if we did this? What if we did that? And I said, okay, let's just build a simulator. If you think of casinos trying to pick off APs as sort of having to put a puzzle together, then one thing that AP should do is obscure the pieces of the puzzle. Maybe the most basic bit of information is, who is this player? What is their name? Oh, there was one place in Vegas. I was trying to cash out just like less than $100 in chips. And like I had never really shown a huge spread there. I just like came in to investigate and whatnot. And I was cashing out. I hadn't even played that day. And I go to the cage to cash out at least less than $100 with a chips and like a slot ticket. And they're like, all right, let me see your ID. Excuse me. Like this is, this is less than a hundred bucks here. What you're going to ask for my ID? Like, yeah, any dry deal. That's ridiculous. You're not getting my idea that we had this like standoff for half an hour. I was like, okay, I'm calling gaming. You're like, all right, we're calling the boss. I'm like, okay, that's fine. I'll sit here and wait for gaming. And like this is 20 or 30 minutes on being unhold and finally talking to a gaming guy. They realized that I wasn't bluffing and they were like, okay, okay, okay. Here. Here's your money. That's fine. Get out of here. So now you've met Jordan and you have some sense of where he's coming from. Let's move on to the other guests for this episode. This is Ohio Mike. Yeah. No, my day job. I was a microbiologist at a pharmaceutical manufacturing facility. Wasn't really, you know, something fulfilling in any sense, even really financially. I got into advantage play towards the end of the pandemic. We made it through the whole thing. We were producing as normal and then right at the tail end of it, they laid us all off. I had a lot of free time. I picked up a card counting book that I had from when I was a teenager and I saw the movie 21. It was just sitting around. I practiced. I want to say like maybe a couple hundred hours based off that before I started going out there. I think in this podcast series, we can be very cavalier about getting back to off, but it kind of sucks because there are three things. One is just the uncomfortable feeling of having someone say that they do not approve of what you're doing, which goes against all of our social conditioning that we get from a young age. Getting the boot from a pit boss feels like getting detention from a greasy middle school principal. Then there's the anticipation of the back off or the very understandable flinch reflex. You know it's coming just not when. And last is the fear of losing your play for as long as you've been thinking about the opportunity you've wondered how long are they going to put up with this. Once I was confident I had a probably all perfect at home game. That's when I started going to the casinos to the S different doing all that in that pressure. I got a couple hours, you know, tens of hours in locally before I actually decided to make a trip to Vegas just because I needed to. I wanted to get over the fear of being backed off and I knew I could get exposure therapy there pretty quickly. You just going there playing hit and run, you know, 30 minutes sessions get out of here, 20 minutes sessions get out of here. It really helped me get over the initial nervousness of being backed off in general. And when I came back from that trip, I felt like I was that's when I started going full time. Mike's mom is a CPA which might make her more likely to be able to understand the basic math involved in advantage play, but his experience talking to her about it also illustrates why this stuff is so difficult to communicate. I think most people even if advantage play is fully explained to them would still sort of reflexively reject it. Not in the way where they would argue about the math. It's more that they would still quickly flip back to their prior that no one can beat the house. My mom was supportive in the sense that as long as I was being safe because a lot of, you know, maybe Gen X's mentality of advantage play or casinos in general is based off the movie casino or the culture around it. So once I was able to convince her, no, mega corporations run things now. It's not like 50 years ago. My physical safety isn't so much an issue. And she's also an accountant. So she got in theory inputs equals outputs, you know, I'm playing with an edge. If I do X, Y and Z, especially with card counting just, you know, something in the culture. But then general Addages about casinos are also part of you like someone's cultural understanding of it. I could I would call her up and tell her, hey, I'm doing I'm out here in this area. I just I had a good trip. I'm doing this. And I'm up and I'm up. And she said, okay, that's good. I'm glad it's going well. And this night you're having a trouble. Maybe you should leave while you're up. Like, no, that's not that you've been over this. Mike was only a full time card counter for a short time. Eventually you found a group of advantage players who are moving for large sports betting groups. I was up and down the West Coast. Most of most of that college basketball season. Yes, just looking for this sports book that would just looking for sports book that would really just let me blast them. Yeah, it it it it. It became almost like card counting again. You go somewhere, you stay for a day or two or five and you get kicked out and then you move on. Except they don't tend to fly or you for sports betting. So that was pretty cool. There was probably a golden age of over the counter opportunities that followed the state by state legalization of sports betting. Various casinos and internet books tried opening retail locations and then some of them decided to take big bets. Even though they were getting their brains beaten in. I mean, what were they going to do? Just immediately waved the white flag, kick out every shirt better and then watch their volume fall to hundreds of dollars per day. As in not enough to justify the salaries of the employees and definitely not enough volume to justify the construction costs for the book. Of course not. Almost no one would have that cold blooded ability to cut bait on a bad idea. So I think they cooked up convoluted theories about how the retail book was a loss later in. It was bringing people in and establishing a presence. But eventually the reality is unavoidable because that brand building ends up being very expensive. We found a place that was like, okay, we're not really sure about this. You know, we know some people that have been kicked out of there for trying to do some other casino advantage stuff. But my parents, you go try it out and see what the ledgy bed sports book. And I was just ended up there for two months completely comped. Food stays drinks the whole time and letting me bet $10,000 a game. And that really that was that was that was pretty great. But it did give me a it wasn't a great impression of me to have on some of my first months into the non blackjack related casino advantage play. Because boy, that's about as good as it gets and it doesn't get that good too off. So yeah, while I was there, I was ended up having to be fairly close with the on a professional level with the sports with manager. Nice guy, but I kept having to beg off of deeper conversations about sports because I don't really know anything about sports. I was invited to go to a local college game with him once, but I couldn't because I had to stay there and bet all time. At one point, I just kind of got him to go away because I just started ranting about my allergies, you know, just doing anything I could stay on, but not have him like think too much of me. And then one day I came in. One day I woke up and I had a message from the Sportsman manager that said, "Hey, before you start betting today, I need to talk to you." I thought, "Okay, this is it. I called up my friends and they were saying, "Oh, yeah, it's now it's likely to be a big deal. You're probably done there, but you know, just collect all your tickets, you know, don't talk about any group activity, just, you know, be firm, just when you're done, you know, you'll grab the money and go." I realized, I, that's safe for me, and I talked to him about a year later, and he said, "Oh, you know, I was totally talking about my ass. I was really worried that they were going to take all your money. I was just trying to keep you calm." But I went down, and I met with the Sportsman manager. He sat down at my booth with me, and he said, "So, what's your take?" I said, "What?" He said, "What's your take for like whatever group you're betting for?" And I'll, you get really confirmed or deny anything like that. So, we spent a while just talking past each other, not really answering each other's questions, and he just ended up by saying, "Okay, well, look, obviously you can't bet here anymore. We'll go ahead and cash out and, yeah, you can even stay in your room the rest of the weekend, but you know, no more betting here." Which was very professional of him, but I believe I had about a quarter million more uncashed tickets than they had really been expecting. So, it took a couple hours, but I ended up caching everything out in a bulging backpack. It was about half a million dollars that I had to take and then drive through the desert to meet up at the next place we had to bet at because it was more betting to be done the next morning. If you're making these bets, you are like a very inefficient API endpoint. You know, some originator located God knows where. Enter's Texas minus seven minus one ten into their computer, and then expects that they will quickly get a response of success with a risk amount. And the only thing holding up that success message is that a ticket writer and a runner are having a conversation about, "Are you sure it's not Texas Tech or Texas Southern or Texas State or Texas A&M?" Because I'm not seeing Texas minus seven. But wait, yeah, there it is. Texas minus seven and a half, minus one twenty. And you want that for ten thousand? The very nicest thing is we can just rattle off rotation numbers for games, and they just read it back to them. You go. If I was ever going to run a sportsbook betting movers boot camp, we would definitely spend a few hours going over the pronunciation of every single college. One friction to running this kind of betting operation is the logistical cost. It requires an actual person, and there's no telling when the bet might come in. A day could easily span the time that the book opens, maybe around 8 a.m. until NBA second halfs are underway. And then you have to cash tickets the next day. You need a place to stay, and food is also helpful. This is why the target has to be willing to take big bets, and it helps to have a very healthy ROI. But you also have to grind on the cost side as well. So it was going to be my second year, uh, uh, exclusively focusing on, you know, uh, college college sports and just betting big for people and being a mover. And a lot of our outs from previous year were either gone or not quite as good, and we needed new outs. And there's never any guarantee I'd be they'd be able to put me up at some place for a month that it happened to be once or twice before. So I thought, okay, I'll just get a converted sprinter van and I'll drive it around the country during college basketball season. And I'll, I'll save on expenses, and I'll save on hotels. And every now and then I'll find a place that'll put me up for free, and I'll be able to get a break. And uh, like anybody that's got a van could tell you, the reality is a bit tougher than that, but I did. I spent a college basketball season on the road in a converted sprinter van. Uh, no heat. I kind of cheaped out on that part. Did have a very, uh, warm sleeping bag at one point. You can try to put yourself in the place of the people that work for these sports books and guests. That's what they think an ideal customer looks like. But I mean, it's really just low level astrology. Maybe the best you can do is take whatever you have to work with and spin it in the most degenerate way possible. During that during the van era, I think the van was actually pretty helpful because there was a lot of this idea of the, uh, like a van life had filtered down from you know, the, the, the, the, the noble hip-be to being kind of a, uh, an adventure playground for a more wealthy people. So like I could play it off as a, and I often did that, uh, I was doing some kind of unspecified remote work that I really wanted to try van life. And I was out there going across the country because I can work wherever. And then maybe I sort of imply that somewhere along the way, I became a gambling generate. And so from their perspective, it looks like he's interrupted his, uh, foray into van life with all his expendable money because what we got him, we trapped them here, that keep them here. Part of the job of being a mover is running a service which has frequent disruptions and then making it seem as if you have flawless uptime. At one point, Mike was in a place that was taking a lot of action, but he needed to go home. So instead of just saying, oh yeah, we're not going to be able to get these bets for a few days. Jordan flew in to relieve him. This all required a van key handoff, which had to be done even though Mike was leaving before Jordan got there. On the first leg of this required swap, things went okay. Yeah, while I was on the road with the van, I needed to come home for a little bit. And I believe Joe Jordan was going to be in the area. So I told him, hey man, I've got this van. You can save on lodging. So okay, we're driving it around. It's no big deal. You don't have to get a rental. He said, that's great. He landed an hour later and said, okay, I've got the keys. Thanks. And then a couple days later, he said, this shit sucks. This van has no heat on part. I'm going to leave your van in the park. I'm getting a rental car. And here's Jordan. It was comfy, but it didn't have heat. And man, it was the middle of winter, you know, cold area, a very cold area. And so the idea was like, oh yeah, I'll take the van for you. No worries, man. And like, I won't have to get a rental car. And I will have to pay for hotels and stuff like that. It'd be a nice little expense cutter. And I'm just freezing in that thing, man. I got this like really expensive sleeping bag that you're supposed to be able to take out the negative, negative temperatures. And that can be warm at night. But when I wanted to get up and get some work done in the van or something or eat some lunch or do anything other than lay in with the sleeping bag, it's like, oh no, I am freezing. It's also worth mentioning that Jordan was sick at this time and a sniffle like bleeding out of his face, unidentifiable flu, possibly some escaped from a lab animal emergent COVID strain kind of sick. So if you ever have illusions about the glamorous life of being a professional gambler, just think about spending the night in a van with no heat. And then during the day, when most people would lay in bed and let the misery wash over them, you have to get up and wash your phone for Arkansas Pine Bluff plus 4.5. Then run up to a window and try to bed it for 10,000. Also, the ticket writer knows you're sick and also knows that under no circumstance, should they say, hey man, you don't look so good. Maybe you should be home in bed. On the way out of town, Jordan was supposed to pass Mike the van keys. On the way out, we were rotating back again. It was the other way around. So I had to stash the key for him and I forgot to do that. I got to the gate at the airport. It was like 30 minutes before my flight and I was like, oh shoot, I still have the key. I can't stash it in that same spot on the van. So I just looked around the terminal, found a gate that wasn't like heavily occupied, found a cabinet that was sitting behind the gate. It was like nobody's going to look behind this cabinet, except for this camera that's pointing to Rayleigh into the cabinet. Oh man, this is my best bet, unless I want to stick it to the bottom of a table somewhere. So I said, okay, I'm just going to stash Mike's van keys behind this cabinet at the gate and the airport terminal and have to tell him how to get to it. And it all worked out. I was a little worried there though for a minute. I was like, this is going to look so weird if somebody's watching me on camera. Mike says that he still has the van, but he's not really looking for opportunities to use it. The longer I've been in like the casino space, I've built up such that I've got more and more free hotel stays than I ever have, like, starting out. And thank God, because I've gotten sick, staying in that van. Mike found a few casinos that took a lot of action for decent amounts of time, but no spot last forever. So he has been all over the country and jammed bets in a lot of different ways. So at this time, they were washed in DC, sports betting kiosks all over the city, and they were run by the DC lottery. The lines were not bad and also you could bet the lines above it and below it for the number you wanted. You could bet it multiple times. And so I spent a month or so in Washington DC going around to where they have all these kiosks. There's just a bar here, liquor store, general store. Like some places they were clustered so closely that you could just walk around and do a lap and getting getting down decently on all of it and just collecting dozens, hundreds of tickets and duplicates and kind of a pain in the ass. When you take your winning tickets or even just your vouchers to the DC lottery commission, the first time I went they said, okay, do you have your social security card? Not your number. They wanted you to have your physical card with you. And I didn't. I would have had to go home to get it. But you could also cash out your tickets at these at the store with the store owners who were hosting these kiosks and they got a small commission off that as well. So like, you know, they dried up their inventory of cash, but they did make a little bit something just for cash and tickets, but they don't necessarily have everything on hand. So in addition to going around to getting all the limits that I want on each of these kiosks, I'm also going around trying to desperately keep the cash flow up and not build up too much of a backlog in just tickets and no money. It was usually during the daytime, occasionally you go into somewhere that's not so great. Like, you know, maybe you skip past some of the ones that are that are like a lot of people are hanging around or it's in a rough neighborhood. You just like, you look outside and you're like, these people aren't going to be able to pay you out $6,000 and couldn't it be a basketball tickets to me? In fact, I did go to a, I went to get paid out at a bar once and I was there for 40 minutes. I just had a drink and lunch while I was waiting on this fucking guy to pay me out and he came back and paid me out and five's, ten's and ones and I, she acted like it was totally normal and we got the talking and it turned out he was under the belief that he could only pay out winning tickets with the exact same funds that were put into the machine. So he just went and got all the small bills that were in the machine and used them to pay me out. There are some interesting folks in the AP world when it comes to the issue of security and identity. For instance, I have heard AP say they don't even give their real name at Starbucks and it's common to me to guy from a message board and you know him by his screen name like Long Teaser 420 or whatever. Then he introduces himself as Ken and you later find out Ken's also not his real name. Anyway, I have no idea whether Jordan's name is actually Jordan because it just doesn't seem like giving up something that important to a stranger is something he would do. Also, one time my wife met Jordan and she was trying to make polite conversation so she said, " where do you live?" and he kind of mumbled something like he was trying to avoid answering but my wife is a relentlessly direct person. She was not at all discouraged by this half-assed attempt to evade the question so she asked him again, "Jordan, where do you live?" Okay, Jordan had a look in his eyes like in that moment he would have been just as happy to have the world end as he would have been to honestly answer that question. Actually Mike and Jordan told me a story that illustrates the effort that Jordan will expend to keep things locked down. We were hanging out there getting a handle on how to work the key asks for the upcoming effort college basketball in January. We were going to spend two years there. Jordan was going to drive up to meet us and I believe he was a day or two late because he just ended up driving the wrong way on the interstate because he doesn't like to use GPS software. I am always charmed by the eccentricities of our guests and a guy who refuses to use GPS is one of the more eccentric things we've heard on this podcast which I mean that is really saying something. I think I don't use maps. I'll look up, I'll look on a map online before I go somewhere like right down the directions and maybe like look up an online map not like a GPS please take me to my destination but like an online map I can look at it. I know the road that I'm on. I know where I am on that map. I know where I'm trying to go and I can see kind of how it is that I need to get there. And so we were all meeting up for new years in this one place and we were we had some plays in that area too and it was you know a decently long drive is many many hours and so I get started on the road and I get tired in the middle of it so I pull over take a nap. I think I was halfway there. Pull over, take a nap, wake up, say all right cool I should get back on the road. I go to get back on the road and I'm driving and I'm getting to where I feel like I should be pretty close. I'm like an hour away from my destination where I'm trying to go and then I realize wait a second that's the exit that I would take to go home if I was coming back. Where am I? Oh no I would south when I got back on the highway not north and it took me hours to realize and so yeah it just had to show up to the party a day late on that one. I sent Jordan a list of questions before our interview and one of them was roughly what other weird shit are you into and he said that prompted him to sit down and write out his security manifesto. He calls it an essay but I think we are going to stick with manifesto. You know what I what I was answering like writing out an outline for my answer to your question. I had to hold back to not write a 30 page essay. I'm looking at my notes right now and I'm like I'm talking about Palantir talking about Discord doing facial recognition. Target sending maternity ads to women that weren't even aware that they were pregnant. It's it's just kind of looks a little crazy. Jordan told me a story about a time where he and a group of teammates were fresh off a play and they were driving through the desert with a lot of cash. It was the middle of the night. They looked in the rearview mirror and saw police lights like lots of them maybe 12 or 13 cop cars. His first thought was this is it this is the end. He figured for sure their money was getting stolen and they could easily end up dead which you know think about all of the effort he expense to leave no footprint but he can't also get his teammates to turn off the GPS on their phones. He is only going to be a safe as the least safe person he's working with. Oh and the end to the cop car story is it was just a bunch of border patrol agents and they were chasing another car. At least most most people that are kind of deep in the advantage play world have at least some concept of operational security and you know understand like oh there uh we do have adversaries including the casino including but not limited to the casinos and like we need to keep security in mind kind of at all times and that's kind of a space that I was already like a way of thinking that I had already taken to before becoming an AP and so discovering advantage play and like you said the social aspects of advantage play like you know some people still think I'm extreme just as a winner you have to keep operational security like as a higher priority than if you're just a casual player because you're winning this is your livelihood this is where your money is going to be and they're going to like they're going to realize oh wait these aren't our loyal customers that we'd love to have in shop betting with us these are actually our adversaries and we want to do everything we can to uh scrum over and uh fight oh they did this wrong so we can take their money or oh man we're just going to come up with this frivolous lawsuit so that we can lock their funds for an extended period of time and make them pay legal fees and just like make them suffer if you're listening to this and thinking what's the sky who is so protective of his identity and he wakes up in the morning thinking about facial recognition software and goes to bed thinking about Palantir what's he doing on a podcast actually asked Jordan that question I've asked myself that that exact question in the past few days like why am I doing this? this is uh this is um kind of out of character for me to to have something on the record usually like I uh kind of more of a personality of a ghost right like uh you you've heard of me you may have interacted with me but there is no evidence that any of that happened because Jordan is a programmer and an advantage player this episode is going to be wildly disappointing if we don't pay that off was a play involving an online casino okay I kind of got wind of one of these plays when I got some messages that were like hey do you have this very specific offshore internet casino account okay if somebody sends you that message they're not making small talk they had a game they were hammering and eventually it dried up but they started looking around for similar stuff and they found a roulette game that was off yeah I mean we we found some uh some other stuff that was that was similar um and that that that certainly wasn't like the That wasn't the first one, but that really was a good one. And I remember looking and saying, just like, "Ah, for kicks, I'll just gather data on this wheel." And just, I don't know, maybe it's off balance somewhere. And the more data I gathered, the more I was like, "Wait a second, this does look off balance." Yes, I built something that could collect thousands of data points from this wheel. And analyze it statistically and say, "Okay, well, are there other numbers that are hitting more often than they should?" And members that are hitting less often than they should. And the answer was, "Yes, most definitely." And the next question is, "Okay, is that bias strong enough to overcome the house edge?" And the answer was, "Yes." And then some. It was going very, very well, very, very quickly. And we didn't know that they, like, we had a setup where the money was going to fly out of the accounts. No problem. But it turns out they had a, like an alert setup where if they lose a certain amount of money on the casino within 24 hours, like, everything is frozen. No withdrawals are processed. Like, there's an investigation that gets triggered and trying to figure out what's going on here. And so, yeah, we might have accidentally tripped that, unfortunately. And they cut on and they're like, "Oh, we're losing on this game specifically a lot." Very, very quickly, just some very fast players. Didn't even consider that there was a trigger where they would just lock everything down and say, "Okay, we need to look at every single bet going on here." And we weren't doing anything like crazy. It was just, we knew what numbers were going to hit more than others. And to be fair, there were other vulnerabilities in that game that, you know, we chose not to use, were really worse than anything, or just, like, didn't fit our model of what we wanted to use and not use. And so it was just like, yeah, we're just betting the numbers that are winners. These are the winning numbers. I think people probably have a sense by now that if a casino or sportsbook has an excuse to not pay, they'll probably use it. You know, there are just more and more stories that have made their way into the news about gaming companies figuring out ways to wriggle off the hook, sometimes with the help of state regulators. But the universe of vulnerable games is also going to include stuff that can only be found on completely unregulated gray market sites. And then it's like the Wild West without even a thin veneer of fairness. That's the system that Jordan knew would have to be defeated to actually make any withdrawal. I mean, we had accounts that were, you know, aged and seasoned, and we're going to not really have a problem taking money out. Like, we're going to garner additional review, maybe minimal review when getting money out. Absolutely. And I mean, it had been verified before that this does work. This works well. And we'll be able to get the money out really without a big issue. And we kind of put too much faith in that because it turned out that like there were trigger points where if a certain loss threshold was crossed across or from our side, the wind threshold was crossed that there absolutely would be severe scrutiny and additional review on the accounts that were there were winning like that. And so yeah, I mean, I think I think if somebody understood like, Oh, this thing is off, but I have no idea how to maximize this. Like that's that's kind of our strength is taking things like this. Like, Oh, that shouldn't be there. There's something here and figuring out how to how to scale it up and maximize it to get the most value out of it. And maybe that means hitting it hard all at once. Or maybe that means like milking it over time. We're just figuring out what the balance is and how to make how to get the most value out of it. Right. And so that's that's kind of the approach we took and you know, decrease our risk of having additional review had everything streamlined. And then whoops, we crossed this threshold accidentally didn't mean to edit through everything. I asked Ohio Mike if he could remember any plays where for it to work, you need 10 elements to exist, but only nine of the elements are there. He said, yeah, all the time, actually the clip from the top of the show is Mike talking about one of those plays. It would fit in the bucket of manufacturers spending or in the past, we have also called it credit card arbitrage. Lots of people can wrap their mind around, you know, a credit card that gives you three or four percent back. But Mike's plan was a lot more aggressive. He was going for something that would earn 20% back and it relied on quirks with the way that card interchange fees work. He needed a cashback debit card and tiny transactions and lots of those transactions. Most people would see those hurdles and just move on. But this is the kind of thing that Mike and Jordan enjoy working on. Because from my perspective, oh yeah, we did we did build the bot to do the thing. And it did it even better than how we expected it. It's just that like the volume of transactions is what upset them. It's what raised scrutiny on their end and eventually like led to it not exactly being a play anymore. Like they were, if they got more than a certain amount of transactions on a single card in one day, they would go and say, okay, that's kind of weird. Let's review that. And then if they didn't like it, it would just block the card or block the entire registry. So we would have to be a different recipient. And so from my perspective, like we did have a level of success where yes, we built the bot. The bot works. It's making purchases is doing the thing that it's supposed to do. It's just that we didn't have it running for as long as we would have wanted it to. And we probably could have saved ourselves the time of creating the bot and doing all the research by just saying, oh, how much, how many transactions of this magnitude are they going to tolerate throughout a given day or something before they get upset? That would have saved us in time, but it is what it is. Like a lot of the fun that I have with this is saying, oh, could we build something to beat that? And then after building something that does beat that, like, that's a lot of the fun right there. Not actually just flipping the thing on and beating it. That's fun too, but a lot of the fun is in, can I build a system to beat this other system and do it well? And I had fun accomplishing that, I guess. And here's Ohio Mike. Yeah, I know. It's pretty embarrassing because I wouldn't call myself a scientist now or even like when I was doing microbiology work. But that is, I mean, isn't that one of the first rules of science, you know, test, test for tested negatively, right? Don't just see what makes it works. You know, it makes it not work. And we just kind of just didn't do that. Mike was looking for this kind of manufacturer's pen play because he sees it as a natural compliment to the stuff he's doing with casinos. I would say they are. Criticards are very similar to other types of advantage play. I got involved with it after I was already doing the advantage play for a couple of years. I had been moving big bets for groups at sports betting and it was the down season in the summertime. I was picking up a little bit of free play and it was just a great match with the summer of sweeps casinos was just the perfect storm for me to also start getting into credit card points and miles hustling and manufacturers spending. Mike was one of the other guys on the trip that I mentioned at the top of the show. The one where we were betting sports and buying gift cards. Even though everything we did on that trip was plus EV, it was as degenerate as a trip can be while also being plus EV. We're a manufacturer spending on this holiday gift card. That was a great value. You go, you just go in there, you buy it, you pocket the points, you process the gift card, right? So it's just downstairs, James, college sports bets hit the key, up stairs, getting covered and gift card dust, just scratching gift cards. I'm going to be a little vague about this gift card because the value is decent and there's already a good amount of competition for them, but it comes on a special holiday display and not every store puts this display in the same place. We're checking every corner of the store because we missed anything, we're only stopping in once and we saw there was a palette that was still wrapped. That was a gift card display where he's like, "Ah, shit, they just haven't unwrapped it yet. This thing's going to be up here, display it in a week or so, but we won't be here." I'll take a picture of it right down with that company is, maybe we can do something about that later. Eventually, which came to trying to buy as many gift cards as possible, we just started thinking, "Well, okay, who manufacture these gift cards? What's their deal?" So I started trying to get into contact with the people there. It was so fun. The very first time I called them, I was trying to be professional. I was mentally wearing a tie when I called. It was 11.30am. It was a guy's professional LinkedIn page, his pro number on there. I was going to call up and just ask some questions about maybe I could display these in my store air quotes or have some kind of bulk sale ready to go. And the guy just picked up, it was 11.30 a.m. on a weekday. The guy picked up the phone like he was half asleep and just kind of, okay, yeah, yeah, okay, we'll get back to you. And I thought it was a dead end, but then a month or two later, he did get back to me, he said, "Hey, we're looking at a pilot program for other stores to carry these gift cards. What are your details?" I kind of heard about this effort as it was ongoing, you know, like excitement that Mike was really close to being able to bulk purchase a half a million dollars in gift cards. So far, it hasn't materialized. No, we did not. No, a lot of promises were made. Nothing in writing, but every time I talk to the rep, it's like, yeah, things are moving in the right direction just slowly, like getting talked to my boss and the boss is out of town. And I actually ended up talking up with somebody else and realized that, "Yeah, of course, you're never the first person to have an idea." I talked to somebody else who was buying these gift cards and he said, "Yeah, I was trying to talk to this rep at this company." I said, "Oh, shit. This rep," said his name. He's like, "Oh, yeah, are you talking to him too?" I said, "Well, I guess he's got a couple people on the hook. One of us has to get it, right?" And one of us did. It wasn't me or him. It was a third party. He got to his state. He got them direct order, these gift cards. And that was the end of the program and we never heard anything about it after that. So I asked Mike if he's making more now than he was before he got into Advantage Play. He said, "It's not close. He's making ten times as much as he did when he had a regular job." Yes, I would say, like mixing in manufacturing, spending, not just profiting from that because you're going out and buying gift cards, selling the gift cards, pocketing what remains with the credit card points. There are a lot of different store rewards programs, in case in a few rewards programs even. You go out and you pocket the fuel points. Depending on what promotional period, what things you're buying, what kind of accounts you're building. In the past, you could go in full time, a million or more points a month, and then selling them to somebody who is going to be redeeming them for discounted fuel. I think it would be fair to describe Mike and Jordan as unburdened by convention. It's difficult to get them off an idea simply because it's too weird, but this kind of thinking can also reach absurd lengths. Yeah, when we were Jordan and I over at MetBash, when we were really excited about fuel rewards programs, and we were like, "Okay, we're not in the, if we get a lot of fuel rewards, that's a lot of fuel. We're in the energy business. What do we do? What's energy?" Just kind of going back and forth, getting each other excited. What if we just get a bunch of diesel generators because we've got free fuel, and then we just use the diesel generators to get electricity. What's electricity? What's valuable with electricity? Bitcoin. We were laying this all out before you. You took a sip of your drink and you're like, "Are you out of your minds? Sell the points. You know how much that equipment costs? Why do you want to have any, why do you want to have a bunch of thousands of dollars of equipment and overhead? Just sell the points." I kind of remember this, and it does sound like me. Anyway, even though Mike hasn't figured out the grocery points to Bitcoin conversion, he has gone to decent lengths to see if there's any more value in fuel points. Most credit card ARBS just sell their points in bulk. They're not actually using them to get a dollar of gallon discount on their own fill-ups. But if you do that, you are also going to pay a middleman. Well, Mike looked into whether it might be possible to sell to fuel buyers directly. I wanted to get a better grasp on how the whole supply chain worked, and I knew there were some popular areas where people were redeeming a lot of fuel rewards. Like my different than I, I just went down there for a weekend and he picked one location and I picked another. We just did a stakeout. I just sat there and I watched the fucking fuel pumps for a weekend, trying to see if anybody would come by and redeem a thousand gallons of fuel out of this count. And maybe I'll go talk to him and say, "What's going on, man? You want to buy fuel points? Didn't that work out? I didn't see a single person. I mean, maybe if I had dedicated more time to it, I just had to build my network the old fashioned way, just by being a reliable supplier and kind of worm my way in there. I couldn't just walk out to somebody, catch them in the act and say, "Hi, do you want to buy stuff?" Eventually Mike decided it was better to just take the haircut on the sale of his fuel points and leave the market making to someone that knows what they're doing. Do I know anything about trucking logistics? Do I, I could go cold calling anybody that might need fuel and say, "Hey, do you want to buy these discounts from me? Here's how you redeem them. Here's how you do this. Here's how you do that." Or you just kind of look under a different rock and you take a wide review and you just, "There's other people doing this. There are people that have been doing this. I just got to, I just got to talk to them and they'll buy this off me, I'm sure." I think it's interesting that a good amount of this episode has been related to plays that almost worked, which as a producer of the show, I really appreciate because I think that advanced play stories often have a survivor bias problem. No one ever remembers the stuff that didn't work out. So it sounds like APs just win all the time, which kind of distorts the whole job since the thing that APs tend to be really good at is persistence in the face of setbacks. Here's Jordan again. I wouldn't say, "Oh, hey, everybody should get into a advanced play because of the money's great." That's not it all. If this isn't something that you're going to enjoy, you're not going to make the money because you're not going to be obsessed with it, like, obsessed with solving the problems. Mike has various stories of social engineering his way into information and I always like them because on one hand, the person on the other end of the phone has to be thinking, "Yeah, who cares? Here you go, buddy." And on the other hand, I think, "Do these companies get legitimate requests that sound like this? Or does their phone only ring from advanced players who have some weird excuse to be calling for a list of, you know, every shuffle master decimate, too, in existence?" I mean, how often does the employee at shuffle master hang up the phone and think, "Yeah, that guy is up to no good." There was this certain machine that we wanted to play in the casino and I'd just call it up and said, "Hey, my wife and I are going on an RV road trip and I want, and we love this machine and I want to see if I could get a list of them all." And they just sent me a PDF with a list of every one of these machines in the country. I think that in the same way that recreational gamblers halfway enjoy losing because losses make the wins even better. APs actually enjoy the cat and mouse game. If it was easy, it wouldn't be fun. Because that's part of what I like about it, "Advanced plays," the "Aha moment" where you're going, "Oh, wait, if this means this, then I could, what if there's no cap on how much you could earn with that, the anticipation of and the planning of plays in the future?" Further to the idea that it's the challenge these guys are after. Here's Jordan again. I think it's a balance between doing things that we know is within our skill set. This is something we've done before or similar to something that we've done before. But I definitely try to make it a point to say, "Okay, this is something that we've never done before." And it's a little bit outside of our comfort zone, or at least my comfort zone. But I might need to learn some new things, some new concepts to be able to actually beat it. Like, yeah, that's part of the fun, I think, is saying, "Oh, this is a new challenge. We've never done this before." And I'm pretty sure that we can actually beat it. And it's a lot of fun doing things like that rather than the same stuff over and over and over. I always ask the guests, "When people want to know what you do for a living, what do you say?" And I've struggled with that question for many, many years. Like almost my entire adult life, I'm like, "What do I do? What developer?" Kind of, I'm a bug hunter. Am I a professional gambler? So at this point, just generally, my default answer is, "Is I'm a programmer?" And that's honest, that's true. I am a programmer. I write code for various applications. It tends to do better than scaring people off of a professional gambler. Even though these guys are looking for angles in the casino or even looking for angles with wedding gift registries, it doesn't work to always be taking angles. They have to have some trust with their partners. I think the main thing that, like, for me determines all the different people I'm working with is just trustworthiness, right? I've seen a lot of, again, different circles. I've seen relationships that build and fall and people come and go. And I keep coming back to, like, my scene for people I'm working with. Often we have pretty different styles of it. Like, Jordan's the only tech literary person among all of us. I kind of do like, I've been moving around doing a bit of everything. And I think all of us just, despite all the different stuff that we get out of it, we all like the challenge and we all trust each other. If I say that someone is a card counter, then it kind of sounds like their job is doing quick math in their head. But if I say that someone is an advantage player, I hope that by now you are getting a sense that their real job is the relentless pursuit of overlooked opportunities. I think that learning the math. to do this stuff is probably trivial while having the personality orientation to find edges is definitely not. Mike says that when he started, he had a conversation with his brother that drew a big red circle around this dynamic. He got really deep on me really quick. I was like, "Hey, I've been doing this. These are my first six months of results and I'm going to be scaling this up more and working so stuff." And he got the concept of it really quickly, but his first question was, "Why do you feel the need to do this type of thing?" Like, "What?" It's like, "Why do you feel like in your soul, why is he doing this type of thing?" And I hadn't really thought of it until he asked me. I just thought it was a cool thing to do. But I don't know, maybe the kind of person that feels like it feels like they have to be getting away with something. Risk of Ruin is written and produced by me. [Music] [Music] [Music] [Music] [Music] [Music]