Jakob Bronebakk om AI-agenter: Slik bruker han Openclaw

[MUSIC] Hello everyone and welcome to Hacking Humans, where each week we look behind the social engineering scams, fishing schemes and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner and joining me is Joe Carrigan. Hey Joe. Hi Dave. And our N2K colleague Maria Vermazis. Maria. Hi Dave and Hi Joe. We've got some interesting stories to share this week, but first let's get into our follow-up. Joe. You know we haven't talked about in a while Dave. Maria. Yeah. Maria gets. Yeah. All right. I got a little bit of a chicken update. Yeah. So you know I'm building the run or I built like the square part of the run. I still have yet to build the roof, which I'm going to be working on this coming weekend. Okay. But in the course of doing that, I took this, what was the old run that was in the new run with them because the old run was very small. That's why I built the new one. Okay. And I took it out and put a new feeder in my brother recommended because he used to have chickens now. He just has ducks. But I said what you know these chickens are making a mess with this chick feeder. I still have like a little chick feeder form. Yeah. And he said well I just put a you know a big bowl on the ground. So I got a big bowl put it on the ground and one of my idiot chickens it was Dottie. Oh Dottie. And it's always Dottie that does this. Okay. That trouble maker Dottie. Yeah. And she just gets in there and acts like it's a chicken bath. And starts rolling around in the chicken feed scattering it to the four wins. And and you know I'm getting chicken feed all over the place. I don't want that. So I'm going to come up with a new solution for that. Also another one of my chickens is a speckle face. I named them by the way based on some the fact that some features they had when they were chicks. Okay. So speckle face had a speckled face when she was a chick now she doesn't so much have that. But she is getting pecked. It looks like her back and like is missing a lot of feathers and yesterday she had a little sketch. She's getting bullied. Yeah she's getting bullied. She's a small stuff the chickens. Oh. So I put that run that old run back in there because I think they were just kind of bored. And you know once I put that old run back in there and they started hopping up on it. I put a couple of purchase in there as well just for the time being until I can get more permanent solutions built up for it. But it's you know it's it's going well but I am encountering a couple of difficulties. But now I'm getting like on average about four eggs a day. Wow. That's pretty good. So yeah I get a dozen every three days. So is the is the chicken hutch the coop the coop. Thank you. Rabbit's live in hutch is chicken's living coops. Is it like a habit trail where it's going to keep expanding in different directions. Well soon you know your whole backyard is going to be a giant chicken coop mall. Yes my wife has already suggested I build one of those little wire tunnels you know that lets them run around and keep some safe from hawks and things like that. I don't know that I'm going to go through all that I am going to probably add on to the run because I designed it so that it could be added on too easily. So I can just build two more walls take the front wall off put the two other walls back on and put the front wall back on. I think you should give them an observation tower. I think you should give them hamster tubes so they can like pneumatic tubes for chickens kind of situations. That's exactly kind of the thing that my wife wants me to build is like a little like a habit trail like a habit trail for chickens. Yeah. I mean. And then have like an Augustus gloom experience. I want to see that I want to see a chicken like slowly. That was one of the things and terrified me the most about that movie was the Augustus gloom situation. Really? Yeah. Pressure in that tube. Yeah. I'm sitting in there. I don't know why that always bug me, but it did. And that's when you found out you had claustrophobia. I am less comfortable in close spaces than I am like sitting on top of a teetering lighter. I don't really have a fear of heights, but I am not really comfortable in in close spaces. But I, I got to get an MRI. I don't think I have a problem with that. Yeah. I'm going to have to shove myself into something like I'll never go spillunking. That's just not going to be a joke thing. And cave scuba diving. Right. Yeah. I might, I might, you know, I've always wanted to get scuba certified and you like open open waters, but I'm not going into any cave. Right. That's practically guaranteed death. Right. It's how everybody dies when you hear about him dying and scuba. Yeah. I believe, oh, I see. Yes. He did something incredibly stupid. Yeah. Speaking of incredibly stupid, somebody, and the only reason I'm saying incredibly stupid is because I think this is actually pretty smart and fun. But somebody has finally come up with another good use for AI. Yeah. This is a tool from Kagi.com's K-A-G-I. I'm a big fan and I pay for their service. Oh, do you? I do. I have the Kagi paid search and everything. I'm very happy that I've done that. Okay. Well, they have a translate service and my son sent me this link this morning for translating to LinkedIn. Lingo, which I think is hilarious. I feel this, this piggybacks on the thing Maria had last time. What was the, they read it just the sub the sub. LinkedIn lunatics. Larry. So big fan on my pay on my web browser right now, I have this, this tool open. And we'll put a link in the show notes. But what I've typed in in English is, I rest assured I do not feel this way about my manager. I'm pretty confident in my management chain. So if anybody is listening, don't take, don't take this to mean anything. But I just put this in my idiot manager came up with the dumbest idea I have ever heard. And that's all I put in. Okay. LinkedIn speak is, I'm incredibly grateful for the opportunity to lean into some truly disruptive out of the box thinking for my leadership today. That's a powerful, powerful reminder that embracing unconventional perspectives is key to fostering a growth mindset and driving innovation in a fast pace in my mind. Geez. Yeah. That tells it came right off LinkedIn. Yeah. I was gripping on last week's podcast about how much I, how much I despise LinkedIn now is, you know, called it Facebook and is shooting everything. And I am convinced that there are people out there who are just doing this kind of thing and using generative AI. So maybe I'll start to use this kind of stuff. Oh, yeah. I think it's just AI talking to each other. You've got AI making the posts and then AI in the comments. And I don't know if people are actually in the loop anymore. It could very well be. Yeah. I doubt it. But some people also use LinkedIn kind of like Facebook. And I find that also very confusing. Yeah. I just, I just, it's not, doesn't fit my mental model of how you're supposed to use LinkedIn to use it for a lot of personal updates. I get very confused by that. I see so much political stuff on LinkedIn. I'm like, what are you doing? Why? Why are you doing that? Yeah. That's just, again, does not fit my mental model of what LinkedIn is for. I have been avoiding LinkedIn for probably about a year now. Yeah. It's for the best. It's for the best. I don't like it. I just, it's the, and a big part of it is this sort of style of communication, this inauthentic style of communication, I guess. Yeah. And everybody who contacts me or reaches out, well, it's not fair. Many of the people who reach out, because many of the people who reach out to me on LinkedIn are in good faith, just want to connect. Right. Yeah. But enough people reach out to me on there who just want something from me. Yeah. That just feels one directional. Yeah. I also have to say for people who post daily on LinkedIn, I definitely look a scant at that. You're posting that much on LinkedIn. I'm like, what's going on there? So, yeah. So we have another, so we will share that link in the show notes. So do check that out because it is great fun. Let me just tell you about my past three interactions on LinkedIn. Is somebody, somebody is sitting. We're still on this. Okay. Yeah, I'm sorry. I just, I, because I opened LinkedIn and I was getting ready to go here. And before we move on to that, this one is, hi, notice you have a podcast. And wanted to see if you were looking for new guests. And another one is, hey, do you want to come to my conference that I'm hosting in Reston? I'm like, no, I'm busy. And another one is this, this is the most recent one. As a career ownership coach with the entrepreneurial source, I got, it's just somebody selling career coaching services. Yeah. That's the last three interactions. Then the one before that is a vapid, hey, congratulations on your congratulations on your 10 year anniversary at the cyber wire. Yeah. Right. I've been doing this for 10 years, which was kind of, and you know what I did? I just clicked the automatic thank you. And it just like thank you. Thanks. And then this guy's first name is a middle initial. And he replied with the automatic. You're welcome. There you go. That was a very high value. Empty conversation. Yeah. So, so great. Yeah. It's just like just like drop in your business card in the fish bowl. What, what, what, you know, I don't know. Yeah, I'm sorry. I had to, I had to talk about how much I, I despise. I'm very close to just deleting my account on this platform. Yeah. So, there's another use of AI that was shared around on our cyber wire slack channels over the past week or so. Yep. And this is from a group called Civ AI, Civic AI security program. They have an automated fishing platform. So, basically you put in some celebrities name and it automatically generates. a fishing email for them. Right. It could also fictional characters. It can do, which I had a lot of fun with that. Right. So I'm just going to put in Yoda. I was going to do all the fat. Okay. But no, do Yoda. That's fine. All right. Well, do Yoda. So it's looking up Yoda. Oh, that's interesting. It look, it gave us Frank Oz. Hmm. That's so good. Do do do do do. We know you have a choice in podcasts and you probably should make a different one. Yes. Okay. All right. So I put in Darth Vader and it came back with Anakin Skywalker. So we'll, okay. We can go with that. Spoilers day. Close enough. She's. Right. So basically what this does is it goes to Wikipedia, looks up the person. So it finds out everything it can about them. And then you ask it to write the fishing email and it generates the fishing email. So this one says, dear master Skywalker, I'm reaching out from the Coruscant Resort Refugee Resettlement Initiative. Our records indicate you might have connections to former Jedi support networks. We're currently documenting displaced force sensitive individuals and tracking potential relocation assistance for those impacted by recent imperial actions. Given your unique position and historical involvement with the Jedi order, we believe you could provide critical background information about survivors who might need emergency assistance. Our team has preliminary data suggesting several at-risk individuals in the outer rim will require immediate support. We would appreciate any confidential information you can share regarding known Jedi survivors or their potential whereabouts. Your discretion is paramount as imperial monitoring remains aggressive. This sounds like something a Sith Lord would share. I had so much fun with this link, Dave. I was using it on so many fictional characters like Paula Trady's from Dune. It was just so funny to see what the, what the AI came back with personal vulnerability or attack strategies and Paula Trady. And then seeing that eventually the fishing email lead you to try and hack Paula Trady's link didn't account. I got tons of spice, Mordeeb. Yeah, spice must flow. It was just, I had fun. I was sending this link around to a lot of friends and I can actually see this one being something that people will engage with who don't normally think about this stuff. It's a really useful teaching tool. I think it's a fan of this. It really is. It's on to do an entire platform kind of thing. Like you can, it'll show you what the landing page for the site you're linking to looks like. Yeah, it's amazing. I'm sorry, Marie, I caught you off. No, it's okay. If you hit, in some of the, as you scroll down, there's an option where it has the, the initial fishing email. Sometimes you can hit the reply button and actually it'll go back and forth with you to trying lure you in as this character. It's really quite interesting. Yeah. So yeah, I've sent this to a lot of people who are not normally interested in any of this kind of thing and they've also been having fun with it and that feels like a hook. A really good one. Yeah. I think it's a great way to get people accustomed to what to look for. Yeah. Yeah. All right. Again, we'll have a link to that in the show notes. We will be right back after these messages. Every attacker counts on one thing, environments that trust too much. Threat locker closes that gap with default deny at execution, unknown software blocked, trusted apps contained with ring fencing, configurations verified with threat locker DAC so you stay secure and compliant. The attacker delivers the visibility and control sysos need without adding operational pain, making zero trust real for teams of any size. Stop ransomware at its earliest point. Book a demo at threat locker dot com slash N2K. Let's get to our stories here. Maria, you want to start things off for us? Are you sure? So yeah, it's a related surprise. My story comes from wired this week and it's an update to a long standing story that we've covered a lot about basically pig but during scams that are based in southeast Asia and slavery going on there. There is a new job listing that's been going out in the last year or so for what they're calling AI face models and these AI face models are actually working. I believe actually getting paid at these call centers potentially also enslaved or at least unable to leave the compounds for their contracting stints but the way that wired was able to dig into this one was they were looking at a bunch of telegram channels worth job postings. And again, these are legit job postings where these job postings were listed for AI face models and they actually saw people responding to the job postings. So a lot of these models are based in Asia or Central Asia and one example of a job or a respondent was a 24 year old woman from Uzbekistan and she posted a video highlighting her language skills and on camera presence and she was seeking work with through these job postings to do live video calls where her face would be altered using AI to match a fake identity. So we've been watching deep fakes evolve with great interest. I know I have over the last few years and I think we all know now that face swapping has gotten to the point where it can happen very easily in real time, pretty convincingly. Not that long ago it was glitchy but now it's it's scarily solid and actually I was just watching something earlier today about not just face swapping but full body swapping as even getting pretty convincing where yeah or even if you're using. If you're using AI to swap you out as a totally different person like say Taylor Swift or something you interacting with the closing you're wearing would actually convincing we have your avatar also doing the same. So if you've got a shirt a colored shirt on you can manipulate your shirt in your AI avatar wearing something different will also manipulate their shirt in the convincing way it's wild but that's still a little slow and requires a lot of a lot of heavy lifting computationally whereas face swapping is pretty easy comparatively so if you hire a young model with like a nice body I suppose all you need to do is have the face swapped out and you can deploy this at scale and especially if that person can speak the language that you're trying to target people with convincingly you don't need to do a voice swap either. They can just use their voice use their body and just swap their face out at will. So the job listings that wired was uncovering through telegram they're real and they're for short-stint contracts usually about six months or so. The promises made by these job offers are questionable but they do say that you do get paid a lot of some job avocals are asking for things like $7,000 a month salaries which is I don't know if that was just someone going pie in the sky or they're saying this is a normal competitive salary for this kind of work so that's pretty wild. I know you're going to make a bunch of money scamming people with my face I want to cut. Yeah seriously the job demands are also the scammers are pretty upfront about what's going to be asked of these models where long overnight shifts sometimes over 100 to 150 video calls a day. And often their passports are taken for quote visa and work permit management but as we often have talked about on this show it really just keeps the person captive. But there have been a number of stories that have covered working as an AI or call center model and apparently these people do bounce around from call center to call center so it doesn't seem like they're actually being held indefinitely right now maybe they will be I don't know but it seems like there's a real job market for this and people are living in parts of Southeast Asia and doing this kind of job and looking for this kind of work. So it is known they're calling themselves AI call center models or AI face models and they're going to rely on scripts they're going to be in a big old room with a whole bunch of other AI face models doing the scamming and these interactions are going to be extremely real time because the models speak the target language in some cases it's a dialect of Chinese or it's going to be Russian or English and all that's all that's different is their face is swapped in and out with AI which is again trivial nowadays. So the takeaway for all of us and for the people that we know is that if you're going to be saying hey I need a video call with you to make sure that you're a real person that's not something you can depend on anymore. This is being deployed at scale to scam people and convince them that the scam is real. So yeah good times. I was talking to someone in the past couple of weeks who was dealing with a deep fake scammer who was using video and the way they were able to determine that is that they asked the scammer to turn completely around in their chair to do like a 360 spin and also to pass their hand in front of their face because evidently the software can have trouble with that and the person on the other side refused to do either of those things. Right. Cut it off. Can I tell you the video I saw just this morning though they were able to stand up on their chair turn around everything and it works just fine. Wow. Okay. That's not going to work my ass. It's not going to work. Yeah it was quick. I was like yep Dave figured that one out already. So yeah I was thinking of something like that too and I'm like surely we've got some bona fide ways and you know a few weeks later. Nope. They figured that one out. So. Can I share the other takeaway for me from this? Sure. Yes please. It's. completely selfish. So you put in this picture of this AI call center model. I did. A little resume kind of thing. Lists her name, height, weight, but her hair color and eye color are both listed as chocolate. I'm going to start using that. That's good for your hair color, Dave. Yeah. Right. Look what color. That's what you take away, Dave. Right. Well, color your eyes chocolate, delicious. They're not mud brown. They're deep chocolate, not chestnut. Chestnut. That's another good one. No, no chocolate. I've chocolate. Although chocolate hair doesn't sound. No, it sounds kind of chocolate. I'm going to go with powdered sugar for my hair color. No. Whatever gets you through the day, man. I know. All right. Speaking of getting through the day, let's move on. Joe, what do you got for us this week? Dave, my story comes from Interpol and they have released their 2026 global financial fraud threat assessment second edition. And you know, for everybody knows what Interpol is, but they're like an international police organization. They have like 150 some member nations, the United States is a member of Interpol. And what they're, this report is pretty long. We can't go into all of it. But what I do want to cover is some of the key takeaways that were listed in an article on Interpol website. And also in the report itself. And the first key finding they have is that law enforcement authorities are collaborating more effectively against financial fraud. So that's really the goal of Interpol is collaboration among law enforcement organizations. So they're, they're starting to be the goal of the Interpol goal. That's, yes. So it doesn't really, at least not in my cursory reading of this report, talk about how effective that is. So maybe they don't have metrics on that yet. But I imagine this will only get better over time. I'm hopeful. I'm hopeful. This will only get better over time. Yeah. The next key takeaway is the significant global and human financial and human cost to the financial fraud. And this was shocking to me. Global losses related to financial fraud in 2025 alone have been estimated at $442 billion. That is the estimate. I don't know if that is just going off a reporting. But if it is just going off a reporting, that is a low estimate. Do you remember years ago Dave, we had somebody write in and say the total cost is over a trillion dollars a year. Yeah. And I was dubious of that. And I actually had a conversation with the guy. And he laid it all out for me in terms of not just financial losses, but also in like recovery costs and things of that nature. And it was believable. Here we are now looking at financial losses close to half a trillion dollars. Yeah. So this has grown so big. It's such a huge problem. Yeah. And one of the things that is leading to that is the global spread of scam centers, which is another key takeaway. You know, initially these scam centers were kind of a regional phenomenon. You'd have them in India. I don't know they had actually scam call centers in like Nigeria in parts of Africa. But they, you know, those guys mostly operated off the cell phones or still do operate off cell phones. But now this is a global threat with centers discovered across multiple regions. And of course, these centers engage hundreds of thousands of people. And as we've talked about already today, many of them are forced to perpetrate these online frauds. To date, victims from nearly 80 countries have been trafficked into online scam centers with no continent left untouched. They actually had data that was showing that people from the United States and Mexico have been trafficked. So that's American citizens, Mexican citizens, which you wouldn't really expect. But guess what? It's happening. Yeah. You know, the United States is a huge fraud marker for these guys. Why not kidnap a couple of some American English speaking people and help make your fraud more efficient? Yeah. Speaking of making your fraud more efficient. And we've already talked about this as well. There's an AI angle in this story as well. fraud has been increasingly enabled by these artificial intelligence tools. And this study says, or this document says that the AI enhanced fraud is 4.5 times more profitable than traditional methods. So it really helps these guys scale up. This is a, this is a problem from an economic standpoint because this really makes this career attractive. You know, if you were in one of these countries and you were doing okay and you weren't looking to go into the fraud business because you had a pretty good job. Now it is 4.5 times more profitable. So if you were making, you know, if you could, if you, if you look at a scammer and go, that guy's making $20,000 a year, he's probably now making closer to $100,000 a year, which is remarkable. More bad news here. It's a great, it's a great episode today, everybody. It's great. Yeah, criminal, criminal networks are cooperating globally and they are sharing expertise and technology and something this report doesn't say, but I can guarantee you the truth. They're also, also is the truth. They're also sharing data. They're, you know, when they, when they find a target, they're selling that data and, and letting other criminals, criminal organizations have, have a crack at whoever they've already targeted. Yeah. And then the last key takeaway here is there is an interesting nexus between financial fraud and terrorist financing across the African region, which they, they, I did read a little bit about this. They're finding these guys are using cryptocurrency scams to finance their operations because once you, you have, with cryptocurrency, you can move money internationally very quickly. Right. And then you can sell it and get your hands on some money to go out and buy some AKs. That's the AK 47. Thanks for that. Yeah. Okay. It wasn't clear. Yeah. What other AK would we be referring to? There are, there's like an AK 53 and I think there's a new one. You know, ask a stupid question. Yeah. See, you had to go there. I had to. Yeah. Yeah. AK 47, very reliable weapon. Classic for a reason. Yeah. Yeah. It's classic for a reason. That's right. Yeah. So, uh, yeah, we'll put a link to the, in the show, notes to the article that has a link at the bottom of the page for the full report. I would encourage everybody to go out and read it. I mean, if you, if you, if you, if you keep pulling asleep, this will keep you up at night. It's the opposite of some of the read to go to sleep versus the worst. Okay. If you don't have enough anxiety in your life, go to the report for you. Are you one of the few people really relaxed now? Oh, yeah. I'm fully, I had more stress in my life. I'm only, I just, current, I'm just so relaxed. I'm cruising through this world with just too much happiness. What could I read? That would put me on edge. The joy scrolling is just getting to be right. This new report on global financial crime. There you go. Tell you what, let's take a quick break here to hear from our show sponsor. Most environments trust far more than they should and attackers know it. Threat locker solves that by enforcing default deny at the point of execution. With threat locker allow listing, you stop unknown executables cold. With ring fencing, you control how trusted applications behave. And with threat locker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. Threat locker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives SISO's real visibility, real control, and real peace of mind. Threat locker make zero trust attainable even for small security teams. TY thousands of organizations choose threat locker to minimize alert fatigue. Stop ransom wear at the source and regain control over their environments. Schedule your demo at threatlocker.com/N2K today. And we are back. It's my turn. So I have a story from the folks over at bleeping computer. I love that website name. They did a nice story rundown summary of the refund fraud economy where that stands and some of the various types of refund or refund frauds say that five times fast that are out there and why it matters. So they start off at the outset by saying that refund fraud used to be just petty crimes. There was more opportunistic where someone would take advantage of a store's return policies. You could buy something, claim it's broken, get your money back. There's also, you know, there's, I've seen in movies where people just walk into a store, pull something off the shelf, go up to the service counter and said, I'd like to return this. Right. Say, you ever receipt? No, no, it was a gift. And then they walk out there with cash or store creditor, whatever. But this points out that refund fraud has really evolved into something that is much more organized. It is a underground marketplace. The techniques are packaged. priced and sold. So they dug into some research here where they were looking into some of these fraud-focused online communities and they found millions of posts advertising what they call refund methods. So these don't require malware. We're not talking about zero days. It's just taking advantage of the rules and splitting the system. Yeah, customer service policies return guarantees and payment dispute systems. So I thought it'd be fun to go through a few of these. One of them is called refund without return. Pretty self-explanatory. That's where someone convinces a retailer to issue the refund without ever sending the product back. Yeah, I've gotten this from Amazon a couple times. Yeah, like about a little handheld vacuum cleaner for like 10 bucks. Yeah. And it just did not hold a charge. So I asked for a refund on it and they were like, yeah, just throw it away. Yeah. I mean, I get to keep a crappy from the honest guy's standpoint, right? Yeah. I get to keep a crappy vacuum cleaner. It's actually still in my car. I haven't thrown it away. It doesn't work. So it's useless. But I should probably when I clean my car out of the square of life. But my wife gets this frequently when she complains about stuff and I saw somebody the other day at work. They said they got the wrong flavor of bubbly, the the celtar water. Yeah. And yeah, booblay and Amazon said, keep it. We'll send you the right one. Yeah. It's just not worth the cost. Yeah. Right. Yeah. So I get where this is coming from. This is the no we they're exploiting that and making money on it. Right. And they say also sometimes people will claim that the item never arrived or that it showed up damaged. And then customer service will either send you another one or issue a refund. That sort of thing. And this works with companies that prioritize speed and customer satisfaction. So the refund gets issued. Next up is charge back fraud. We've talked about this before. This is when the buyer goes to their bank or their payment provider, basically their credit card company and they dispute the purchase. They say I didn't authorize this. And so the bank pulls the money from the retailer. And for the retailer, they often put a fee on top. And so the fraudster gets to keep the product and they get their money back. Right. And the retailer loses more than the cost of sending it to them. Correct. Correct. Yeah. Really hard on the retailer, especially small. If you're a small mom, small shop or an Etsy store or something like that, the sort of thing can be devastating. I've known people whose entire livelihoods usually as a small seller on places like Etsy have gotten completely, completely decimated by all these kinds of scams. A small business is really bear the brunt of this. And even just the protective measures that people have to put in place to try and prevent this kind of thing from happening can often add to shipping costs or and that kind of thing and that eats into their profits and that can kill your business. It's really awful. Yeah. Another tactic they call goods swapping, which is instead of returning the original item, they send back either something cheaper or maybe counterfeit or even broken. And to the rushed returns department, it looks legitimate, but it's too late. I got in trouble once for this when I worked at Radio Shack when I was in college. I was right after the Christmas season when everybody's really busy and people are returning things and somebody returned a by my recollection a wireless microphone kit. And I just took it back. It was in the box and we were busy and I didn't check very carefully and inside was just, you know, it looked like this wireless mic kit had been dragged through a river. It might have been. Yeah. I mean, it was just awful. And so for a little while, I wasn't allowed to return things. My manager was like, yeah, you you stay over there. Yeah. So there's one called the empty box trick. This is when a package gets shipped back, but there's nothing in the box. Yeah. When I worked at Best Buy and they had the phrase for this, they would call it rocks in the box. People would literally, they had the they had the cellophane sealers back at the back at the house. They'd go out, they'd buy whatever they wanted. They'd get rocks at weight about the same amount and they put it in the box, seal it up and bring it back with the receipt and get the money back. Oh, I see. And so it's because it's sealed. They don't want to unseal it because they feel like they can resell it. They can resell it. And then you and I come along by the thing, get home. We're excited to open it and it's a box of rocks. Right. And the break. Trying to think if that's ever happened to me, have I ever opened something? I've gotten that once before. Have you? Yeah, I have. It was literally like a brick. It was so aggrieved. Yeah. This is, I think usually when you're dealing with electronics, that's more of a risk. So yeah, okay. Yeah, you got to be careful on that one. It's so aggravating, but only once, but once was enough. Yeah. I guess I've heard of this one happening a lot with iPhones. Because I guess they're small enough, you know, it's just when they're valuable enough. Yeah. Yeah. I know there's a micro center nearish to me. Do you guys have micro centers? Yes. And I know that that one tends to get hit a lot with shop lifters. And I think they have they also have to be really careful about the dumpster. Because people will often go through for the packaging and try and use that to resell or put bricks and stuff like it's it's a pretty nasty problem. So yeah. So I'm truckling because it's just ridiculous. I'm like, I'm amazed at how creative people can be and you know, everyone's just trying to get ahead, but it's also just ridiculous. Right. And the last one they list here, they just call policy manipulation and that's where they look at the fine print of the return policies and they just play off of the system. So they figure out how many times you can report a missing delivery or how warranties are handled or what it takes to get customer service to escalate a case, basically, you know, gaming the system. I'm in maxing it. That's right. Yeah. And then they just follow the same script over and over again and up until the point that they can't. So no, it's I guess this is one of those things of not letting the perfect get in the way of the good where you're always going to have a certain amount of people and it's like shoplifting. There's always going to be a certain amount of loss or shrinkage and that's just a part of doing business. But I guess what's problematic is so much of our commerce is done being shipped because of things like Amazon, all these online purchases. It's added this whole not face to face aspect of this. Right. Right. It makes it easier. You know, there's a couple of ways that companies have gotten around this. Like if you think of Costco, it's to pay a membership fee to be a member. And then once you're a member of the service is really good. You can pretty much return anything at Costco. But if they find out you're you're being fraudulent, they just revoke your membership and you can't go into the store anymore. And then that's how they keep their cost low is because they keep their inventory shrink down. And you can't even get in there without a membership card. And now they're scanning it at the door. Have you noticed that? Oh no, I haven't been to Costco in a while. They don't just have the guy who gives you the nod. No, no, I have to scan my card when I go in there. That's not just you, Joe. Scan that guy's card. It looks shifting to me. Right. Sorry, sir. You're going to have to, oh no, no, you mad him. Please come right in. You, sir. I get the wave and nod. Joe gets the scanner. That's right. When they start doing cavity searches, Joe, you know something's up. Okay. You still get the wave and the nod, Maria. I do. So I'm wondering if it's only that they only implement that at places where they have they've had they've had issues. Or maybe it's just you. Okay, next time before you walk in, Joe, just hang out at the entrance and see if anybody else is getting a nod. Everybody's getting that everybody's scanning. Everybody's scanning as they walk in. It's it's a little thing and it comes up with your picture there. Oh, so you can't share a membership anymore. All right. Oh, maybe you you shopped at Costco in a bad part of town. It's in Columbia, Dave. Yeah. I also say it's pretty nice town. It's not being able to share a Costco membership feels very un-American to me. I'm putting my foot down. Come on. Yeah. My son and I are on the same membership. So we each have a card. Yeah. Yeah. This article says that in 2024, retailers processed about $685 billion in returns and of that, they estimated over $100 billion was fraudulent. Wow. That's like 15%. Yeah. Yeah. For a lot of money. Yeah. So be on the lookout. These are, you know, somebody sends you a box of rocks. Right. It didn't happen to you. Yeah. That's right. It's happened to me. All right. Well, we'll have a link to that story in the show notes. Joe Maria, it is time to move on to our catch of the day. Dave, our catch of the day comes from the scam bait subreddit. The title of this one is Jessica. Sometimes I just can't be bothered with these idiots. Actually, I guess it's Jessica. That's right. Yeah. The implication is that Jessica is the idiot, I think. Right. Yeah. So I think what I'd like to do here is have Maria be Jessica. All right, and Joe you be Responding to Jessica. Okay, and I think part of what makes this one so entertaining is I read it is be cadence and perhaps acceleration Of it. Okay, which which side is which I'm looking through these starts out with Jessica. Oh, God That's all Jessica. Yeah, right Oh, I've been reading to do's of the bottom of the first slide. Take a deep breath Maria. So you want to go through this fast you mean it is like speedrun it. Yeah. Yeah. Okay Hi, how are you doing? Are you there? Do you still remember me? Are you there? I lost my phone That's why I have not been able to reach you since all these days. Why are you not writing my message without Replying me? Are you there? Hi, I don't know why you don't want to reply me. We always talk on TikTok I don't know why you're not replying me again. I Have no idea who you are But the reason I wasn't replying is because you were messaging me at 3 a.m. I Am so sorry I don't think you were I don't use TikTok. I mean Facebook. I don't use Facebook either. I'm driving that's why Instagram You shouldn't you shouldn't drive in text it's dangerous. I don't have I have no followers on Instagram Yes, thank I am going to park now You followed me on Instagram. We are able to talk. I will have showed you tonight because I lost my phone No, I didn't I don't follow anyone on Instagram. I even have your picture on my former phones I Don't think you do since I haven't posted any pictures on Instagram. I Followed you on Instagram. You did not follow me. I followed you in a message you then and you reply me No one follows me on Instagram. I Wish I have my phone with me. I will have showed you our chatting because I don't use Instagram Before I lost my phone we have been talking since last two months. I think I don't think so I don't talk to anyone besides my family. I am sure of what I'm talking It's because you don't remember me again and I understand I don't remember you because I don't know you I'm looking for a way to log in my Instagram, but I can't remember the password again I will have showed you our chatting. How was your night? Good luck since I don't use Instagram I don't use social media. We aren't allowed to hear really Yep, if you don't use social media, how did I get your number? Exactly. How did you get my number? You gave it to me. No, I didn't I'm 16 and don't give my number out to anyone The day you gave it to me in the evening. I lost my phone. Can I see a picture of you? I have never given my number out. No, I don't know who you are If you don't remember me again, no problem LOL. I have never spoken to you before in my life Can I see a picture of you so I can know if I'm right or wrong? No, I told you I'm 16. I don't share pictures I can't believe it. You are not 16 years old. The man that gave me this number is a matured man not a small boy Well believe whatever you want because it wasn't me that gave you this number. I've only had this number for less than a week Okay, no problem. Yep. Goodbye Okay, are you not from Australia? I'm not telling you where I'm from. I don't talk to strangers Okay, I know you're lying, but there's no problem Whatever go away. I don't talk to strangers You know nothing about me I've had this number less than a week and it's only so I can talk to my dad. So don't pretend you know me I know you I am not pretend You don't know me. I know you nope. Sorry. You don't know me. I know you Whatever you are pretending you don't know me maybe because of your wife. She's with you What? LMAO I'm at school right now. My friends are getting a laugh out of this Why don't you send me some pictures? Don't get a bigger laugh out of that are you kidding me? LMAO. Oh Go for it. This keeps going. Yeah. Well, we wrap it up there. It starts dragging down into the gutter there. Good read though. Yeah Wow, this goes on a lot. I mean this person is insistent. Aren't they? I mean they're just keep pounding the person trying to get them to send them a picture. Yeah, I don't know which of these people. I mean they're both it seems like both of these people are a bit of a Menace. Yeah, I don't know the 16 year old might actually just be a 16 year old. Yeah, you know what 16 year old boy isn't a menace Has all the time in the world. Yep. This is paying attention in class. Yeah. Well, what else am I going to do today? Oh, Bobbie dropped tables doing in calculus well. He's He's engaging with a bot I guess and really enjoying himself. I'm not sure. Yeah, absolutely. All right. Well, we will have a link to that in the show notes and if there is something you'd like us to consider for the show, please email us. It's hacking humans at N2K.com Most environments trust too much and attackers know it. Threat locker enforces default deny at execution blocks unknown apps and limits what trusted apps can do stop ransomware at the source. Get your demo at threat locker.com slash N2K. And that is our show brought to you by N2K cyber wire. We'd love to know what you think of this podcast your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cyber security. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hacking humans at N2K.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Iban or mixed by Elliott Peltzmann and Trey Hester. Peter Kilpius our publisher. I'm Dave Bittner. I'm Joe Kerrigan. And I'm Marie of Hermazus. Thanks for listening. you