Love, lies, and a fake 49er.

0:00You're listening to The Cyberwire Network, powered by N2K. Hello, everyone and welcome to the Hacking Humans Podcast. Where each week we look behind the social engineering scams, fishing schemes and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner and joining me is Joe Carrigan. Hey there, Joe. Hi, Dave. And our N2K colleague and host of the T-Mine is Space Cyber Briefing, Maria Vermazis. Maria. Hi, Dave and hi, Joe. We've got some good stories to share this week, but first let's get into some follow-up here. And I have to start things off here. Joe. Yes. You posted some photos of your chicken coop over on Facebook. I did. And I have to say, without reservation, I am very impressed. It's beautiful. It's nice. It does look nice. I mean, I don't want this to sound like a backhanded compliment.

1:04But I'm really impressed with the craftsmanship. And I mean that sincerely. It's not like, you know, I wasn't expecting this to be like, you know, look like something Homer Simpson built. But it's really lovely. It's lovely. Yeah. Yeah. That is why it took me all summer to do it because well, first off, I was only working on it nights and weekends, you know, I didn't just not my full-time job. Like? Not yet. Not yet. Yeah, might be. That might be somebody doing retirement. Who knows? I can see that. Chicken coop builder. Yeah. So, yeah, it looks very much like the like the third coast craftsman models that I see everywhere else. It is done pretty close to the plans. There's only some minor modifications I had to make. There is also one thing that I did not put on here. And Lisa has not noticed yet, but there's supposed to be like corner braces going between the back of the coop or the egg boxes and up to the roof. And I haven't put those in. I don't know that I want to put those in. Okay. I don't think they add anything structurally.

2:05Maybe they do. I don't know. Three stops sagging. Yeah, start sagging. I was just building a roof and put them on again. The roof wasn't hard. The hard part was building the actual structure of the coop and the T-111 sighting is just ungodly to work with this. Oh, so heavy. Oh, wow. I figured that part was like a kit. That's what I thought, too. You built this entirely from... I went to Home Depot and purchased lumber. Wow. That's what I did. I also went to Harbor Freight and bought a framing nailer. That was a game chain. Plush move. Yeah. Not making a chicken joke because it was... Right. Let's move. Oh, nice. Wow. Unintentional, but I'll take that one. That changed everything. That made a lot of these things. This goes so much faster. Yeah. I'm curious, the area below the part that looks like a barn, is that actually a useful area for the chickens or did you screen that off? Okay. They can get to it. It's essentially part of the run. It's an extra, like, was it four by...

3:05So 24 square feet of space form. They also like to hang out under there when the sun's out and beaten down on them. It gives them more shade and when it's raining, if the rains come in in sideways, they go over there. But they can... It's pretty nice. The landscaping is really what brings it together, though. That is my wife's doing and it is great. She came up with that sheet. I will say she did use a little bit of chat, GPT to help her out. Or maybe Gemini, I don't know. But she was like, how can I make this look like... Give me an idea and then she pulled it out. Of course, it looked like it was overgrown with flowers and everything. Right now, there's some mums along the outside of it. There's one of those old milk barrels. Yeah, they all have little jugs, big metal milk jugs. I'm actually not a fan of these things because I don't see the purpose in them. First off, you can't open them. They're sealed shut, so you can't put anything in there. They look for me. Yeah, exactly. It's aesthetic. It's aesthetic. That's about it.

4:05I'm much more of the... That's all you need. Right. And then we have this... I was going to say the coop is beautifully red with white trim. The whole thing is actually very tastefully done. I was surprised that you made something that looks that's not... Yeah, we had... My wife and I had a lot of conversation about the color of the coop. I mean, this was not something... We put a lot of thought into this. You clearly did. This really surpassed my expectations when you were describing this. I was expecting functional, and that's it. Yeah, my wife is not having that. She was. Good for her. Good for her. This is actually a pleasure to look at. Honestly, this is very nice looking. Yeah, her wife is that chicken coop better look bougie. Oh, yeah. It does look bougie. You did a great job. You genuinely did a great job. Yes, I agree. So what happens next if when you decide that you need more chicken coop in your life, do you expand this one or do you get a second chicken coop? Do you tear this one down to the studs and just start over like what happens?

5:09If I need more chicken coop, I can make... I don't need more chicken coop. This this coop will hold 12 chickens, which is the most I can have. Okay. But if I need if I get more than 10 chickens, I might want to extend the run a little bit or maybe bump it out to the to the back, the backside of this picture. I see. Or do something else. But I think we're going to probably cap out around 10 chickens to which might be Polish chickens. Okay. I have always wanted to have a Polish chicken or two Polish chickens. Okay. Because I think they are feeling like you're setting up a punch line or something. No, because you like you like the locky and parogi is that why? Are you? No, have you ever seen a Polish chicken? They're all right. No, I'm off to go to the lit hold on. All right. Right. They are chicken. This is not like some joke, right? This is not. No, no, this is not some kind of racist joke. Right. No, no, no, no, that's that was a good joke, Dave. Another press did chickens. They have. Okay, they are magnificent.

6:09They are. Wow. Okay. So you can get bougie chickens for your bougie chicken, chicken, chicken, chicken, chicken. Yeah. Yeah. The rabbit's living the hot chickens, a little bit of the coop. All right. Well, I, some, we will attempt to, if it's okay with you, Joe, we will attempt some way to include this photo in the show notes or show image or something like that so we can show off your, your handy work here. Yeah. And people can enjoy it. So we'll see if that's possible to do. All right. I tell you what, let's take a quick break here to hear from our show sponsors. We'll be right back with our stories after this. And now a word from our sponsor, Threat Locker. AI coding agents are writing code and reaching outside systems, often without human approval. OOS calls that risk excessive agency. Threat Locker helps fix it, giving every AI agent only the access it needs, controlling

7:11what it can run, touch and reach on your network. Threat Locker offers ready to deploy policies for popular, agentech AI tools. Learn more during our next break. And we are back. I'm going to kick things off for us this week. My story comes from the AP, actually, the Associated Press. They put this story together along with the folks at PBS, Frontline, the TV program that I'm investigating. Yeah. Big fan. I'm a big fan of Frontline. Yeah, good show. Good show, Frontline. So they've put together a special called Inside the Scam. And this is sort of the print version of that, I guess, the one that'll be on PBS. But really interesting story here. I just sort of run down it.

8:12It begins with a gentleman named Simon, who sadly lost his wife after 43 years of marriage. And he was feeling lonely and grieving the loss of his wife. So he went online looking for companionship. And he met a woman named Emily. And over the next few months, they developed what Simon thought was a real relationship. But of course, Emily was not real. And by the time Simon realized he was being scammed, he'd lost about $800,000. I see. Okay. Yep, all right. Yeah. So it gets worse. So it gets worse than $800,000. Well, some of the money he lost, he had borrowed. So now he had to pay that back. But the thing I really want to focus on that this story highlights that I don't think we've really touched on very much is he had to pay tens of thousands of dollars in taxes from

9:14money he'd withdrawn from his retirement accounts. Yep. He says he contacted the police and the FBI. He didn't get very much help from them. And then someone reached out to him and promised to connect him with the secret service to help recover his money all for a low, low fee. Oh my God. This guy just keeps getting this. Oh, no. And it was a power to be clear. No, no, no. No, no. No, no. No, no, no. I'm angry with this organization that is so expertly, and I don't mean that in a good way, expertly exploited this guy. Yeah. So for this report, AP in front line, they interviewed 58 victims between the ages of 32 and 90, all walks of life. They talked to doctors, IT professionals, academics. They say some lost thousands of dollars. Others lost millions. And they say what we say here all the time, modern scams aren't about gullibility. They're sophisticated criminal exercises and they're designed to exploit the fact that

10:17we're human, loneliness, grief, fear, trust, and financial insecurity. The interesting point, I want to get back to the thing about the taxes, but before I do, yeah, I'm happy to talk about that. Oh, I'll strap in everybody. Okay. Yeah. They highlighted that in America, consumers have relatively limited protections. Yes. So if somebody steals your credit card and spends your money without permission, you have a backup there. Like the bank will generally make you whole because you didn't do anything wrong, right? But if a scammer manipulates you into authorizing the transaction yourself, the banks are not required to reimburse you. Right. Because from the bank's point of view, you authorize the transaction. Right. The bank did nothing wrong. This is your, I'm putting air quotes around fault for having transferred the money or return the money over or withdrawn the money. But I want to get back to this thing about the taxes.

11:20They talked to a retired nurse who had lost more than $200,000 after being tricked into, she was tricked by someone who's impersonating a federal agent. And after she lost the $200,000, the IRS sent her a bill for $80,000. Yeah, it sounds about right. Because she'd withdrawn the money from her retirement account. Yeah. And eventually she had to sell her house. And she's kind of making due by selling quilts. So heads up to Lisa, Joe. Right. Competition out there that's highly motivated. Right. Yeah. Well, I mean, lives being ruined on so many levels. I mean, this is not, I mean, when we talk about, oh, a romance scam, it sounds like somebody just lost a little lunch money. It's, I mean, these are, right. Yeah. I mean, so I. I want to talk about the tax issue for a second. So what happens when you, when you go to make a withdrawal from your retirement account, like a 401k, a 4013b or an IRA, those are all tax deferred accounts.

12:25Right. So you don't pay taxes when you put it in there unless you get a Roth IRA, it's the opposite. So you, but you do pay taxes when you withdraw them and you pay them at the regular income rate. So if you make a $200,000 withdrawal, that very quickly bumps you up to a pretty high tax bracket. So unlike the last, whatever, with $50,000 of that, you're paying like, like 24% tax on that. And it's because in the US, we have a marginal tax rate, which means you get tax lower at the lower income levels. And as you move up and income levels, the next bunch of money you make gets taxed at a higher level than the next bunch of money you make gets taxed at a higher level. But if you make a withdrawal from an IRA before you are 59 and a half years old, there is a 10% penalty. So immediately you bump up your tax rate and all those brackets by 10%. So when, when you say that this woman took out 20 or $200,000 and owed $80,000 in taxes,

13:30that sounds about right. Now when you make a withdrawal, your retirement, your account holder will say, would you like us to withhold taxes? And you can say yes. And then the IRS won't send you a bill. You'll get a, I think a 1099, some form from your retirement account holder and then you'll file your taxes normally. But you don't have to worry about that if you have them with hold it. They can do that. But it sounds to me like the scammers convinced her, especially if they were impersonating federal agents that they don't know where the federal government, you don't need to withhold taxes. We'll take care of it and you won't have to worry about this when this is all over. But now here's, here's my question about this. Okay. Is there some recourse she has from a tax standpoint where she can claim some kind of loss from criminal activity? Well, I'm glad you asked Joe because the article talks about that. Okay. Okay. So at this point, no, not really.

14:33But the Congress is starting to respond with proposed legislation. So there is a bill that has been put before Congress that is designed to help people in this exact situation. Okay. So they designed so that they can claim this as a loss for fraud and they will not have the same tax liability that they have if they had just withdrawn it. They should have it. I think they should have no tax liability. Well, it may be, I don't know the details of the bill, but I think it's just recognition that as more and more people are falling victim these sorts of things. Yeah. The tax bill is insult to injury. Right. It sure is. Exactly. Because now you, she does owe these back taxes. Yeah. And it's so crazy. I'm just, I just, yeah. This anger's me so much. This anger's me almost as much as my story does.

15:36Okay. It's a visceral anger. I'm feeling that too. It's just, it, it, it just feels emblematic of so many. Yeah. It's, it just feels very emblematic of how much people are really in our country, especially really on their own with this stuff. And the, the, the, the pace at which the threat of facing the average person on these kinds of scams has just become far more than our certainly our legislation and regulations I've been able to keep up with. Yeah. I really want, I hope that that bill comes to fruition, but I'm very cynical. I can see that very easily not happening. Even how old everybody in Congress is, I'm hoping you're right. I'm hoping you're right. I really am. But, but you know, I really hope you're going to get scanned out of my money. That's right. That's right. I really hope that it works. And I really hope it works in this bill's favor because, yeah, I mean, this, I'm getting so mad just thing. And we've talked about this before. And it's, so it's not even new to me, but still every time I'm reminded that this is a

16:38thing I get so angry. Right. Well, and also the UK requires banks to reimburse customers who are tricked into sending money to scammers. Wow. So they have more of a backstop than we do. Yeah. Nope. What's that like? A couple other interesting. No, I'm getting really mad. Yeah. A couple other interesting tidbits here. In their reporting, the AP and frontline talk to a former FBI official who worked at the IC3, the Internet Complaints Center, Internet Crime Complaints Center. And they learn that the IC3 gets about 3,000 complaints every day. But they're only able to address about 10 to 12% of them just because of the manpower issues. Of course. Yeah. The odds of you getting help are quite low, unfortunately. Yeah. That 3,000 a day as high as that number is, you know, that's a tiny fraction of what's

17:39going on. That's actually happening, yeah. So many people don't bother to report it. And can you blame them? I mean, it's what we always recommend. I will always recommend it. But at the same time, I don't blame people for going, what's the point? Oh, yeah. And they point out here that underneath all this is shame that so many victims don't tell their friends or family because they're embarrassed. And that isolation helps the criminals. Yeah, it does. So hopefully this will help shine a light on some of this stuff and maybe get that legislation passed and just get the word out that more people have to be wary of these sorts of things. So we'll have a link to that in the show notes. As I said, this is the version of it from AP. I have not looked to see if there's a front line show coming about this, but I suspect there is because that's what they do. Yeah. So look for that as well. I'll have to watch it. I don't have cable anymore. Find a way. All right. That is my story, Joe. You are up next. What do you got for us? So I really wanted to start off with one of those Dr. Farne's words from future.

18:43I'm a good news everyone. Right. Good news everyone. Oh, a lot of it. Which always means really, really bad news, right? So the FBI is now probing a service online that is selling 153 million drivers licenses. This comes from Brian Krebs. It Krebs on Security. And he's talking about this new identity theft service that was launched on the dark web is selling digital scans of more than 153 million drivers licenses. And he was alerted to it on August 31st because somebody checked it out and said in a Russian cyber crime forum said, hey, Brian, you're, you're, you're, your stuff is on here. So, my God. The service is calling itself Nexus. Right. That's the first thing you do. Oh, and one of the great things about this is Brian did some poking around. And the very first picture is of somebody named Peter Hague, something.

19:46Yeah. Exactly. Yeah. And it's got a picture of the picture of his face. And yeah, it kind of looks like Pete Hague's. Yeah. So Brian went out there and he looked at this. He did a quick look around and he thinks they're not exaggerating because when he doesn't do any filtering and just does a search, he gets one or 11.5 million pages of results with roughly 15 results per page. Some of these are listing their records as having a source of being a CDL, which means a commercial drivers license. I am. There are other categories on here as well. There's drivers licenses. That's 153 million identification cards, 10 million uncategorized cards, 5 million travel documents. I don't know what that means, perhaps passports. Passports, probably. Yeah. 0.9 million international drivers license or IDs, 1.3 million medical cards, over 500,000 common access cards. Oh, oh, close to half a million cacks in this database.

20:51Wait, wait, wait, stop. What are what are common access cards? That's wicked bad. I would say that's a, the card the government uses is an identification. Oh, okay. And it also has a smart chip in it so that you can use it to authenticate yourself to a network. I see. Okay. So you have keys and certificates on it. It's like a UB key, but it's a little bit more advanced in a UB key, but kind of the same thing. Okay. And it has a picture of you on it. And it's pinned protected as well. So my, the first question obviously is where are they getting all this data? Right. I'm getting this. And the people behind Nexus claim these images are coming from an active breach at a major identity verification company. All right. Okay. Sorry. I can't wait to hear how you do your stuff. I cannot. I cannot. I cannot. I cannot. I'm sorry. I'm even matter now. And here's a quote from one of the actors. We have been continuously ex-filterated.

21:51Get ready, Maria. Buckle in. This is not a good story. We're continually ex-filterating new data for over a year to our private database, the service. Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available or not customer, but I guess customer of the ID service. So Krebs says that indeed within the past 24 hours, the number of drivers license records has increased by nearly 400,000. They're still stealing these drivers. They're doing it right now. As Krebs is writing this, they're doing it. What are we doing here? Seriously. What are we doing here? So Brian talks about his record in this database. It had six images that were of his license front and back in a regular photo, then an infrared version of the photo, and then an ultraviolet version of the photo. So apparently there are anti-tamper things on licenses that show up under ultraviolet light and maybe infrared as well.

22:53So that's why these are in here. The date and the timestamp, now this is where Brian gets into the investigation. Like, okay, you talk about a major identification company. Who is that? So he looks at the date and timestamp attached to his images and he finds that they connected to or coincide with a date back in June of 2025 where he took a flight from the mid, flight to the Midwest to attend a family funeral. So he calls up a bunch of friends and says, can I look up your information in this database which is actually very ethical thing to do? I don't know. I would have asked I was just from Krebs. Yeah. I would have just gone ahead and looked at somebody up and then called him and said, hey, you're in the database. And you should be ashamed of yourself. No, no, and get ready because somebody's coming with identity theft. Yeah. But they said one person whose license was in this system had not flown recently but was running a car from Hertz for several months around the date of their timestamps. Okay. Also, two of the people that he asked were federal employees who said they shared other

23:56forms of government identification when passing through the airport security. So they may be a CAC, maybe your government ID card, maybe whatever your military ID is. And those didn't show up in the database. But they did say they scanned their or they shared their state issue drivers license with Hertz for renting a car. Here's where it gets interesting. Ryan says he was able to find his mother's drivers license in the service as well. And the timestamps for her image are just a few seconds apart from the timestamps for his image. And he says that's important because we both handed our licenses to the Hertz rental representative at the same time. And that person just dropped it into one of those scanners and handed it back to him. Yeah. Okay. Then Brian asked a friend of his Zach Edwards, who's a well-known security researcher. If he can do his research, he gives Zach Edwards. And Edwards says sure, go ahead and Zach's license is in there.

24:58Now Zach said a timestamp on his record matched up with Defcon last month when he was in Vegas. Okay. A big hacker conference. Right. Yeah. Maybe you've heard of it. Yes. Not rent a car in Vegas, which is interesting. So maybe, I don't know, it could be Hertz, could put me not Hertz, but we're going to get there. He did hand over his license at the TSA. He did buy some marijuana at the marijuana dispensary in Vegas. And he handed over his license in hotel, but he said the only one of those three that scanned his ID was a dispensary. Okay. So when he bought the weed, the the dispensary, which is planet 13, which is a big multi-billion, chain marijuana distributor, all over the West Coast. Now here's where Krebs has done a little bit of digging around because this is fascinating work. And thank you, Brian Krebs for doing this because I think we have our answer in this article, although we can't really say for sure.

25:59But in 2022, the New Orleans based identity provider, ID scan, published a press release that said, we have reached an exclusive identity verification deal with planet 13. Oh, yep. So, okay, that's interesting. So ID scan says it processes verification for more than a thousand dispensaries in 19 states. So then if you go to ID scans website, you know how you when you go to a company's website, they have these big look at our big customers, right? Oh, yeah, marketing departments love those. Guess who's on the list? Planet 13. Well, planet 13 is on the list. Your big hurts. Oh, hurts. Yeah. Yeah. It's on the list. Yeah. How are there you go? Now, ID scan is based in New Orleans. Uh-huh. Guess which field office of the FBI has opened up an investigation into this Alaska? No. It's New Orleans. Oh, okay. Gosh, sorry. Yeah. So all signs are pointing to ID scan.

27:01So I don't know if there's been any, any public stuff. One of my favorite things about reading crepes on security is going through the comments. And I found this comment on this story from VBB. I'm just going to read this for Baydem. It's a little, little late to hold ID vendors to a higher security standard when the ID data has been exfiltrating for over a year. ID scan is so concerned about it. They sent a marketing person to talk to you, which is I guess the, the, I guess crebs reach out and they got a marketing person. Yeah. Surely the next step for ID scans to issue a press release saying your securities are top priority. Yeah, yeah. We take it very seriously. A lot of, a lot of, a lot of, a lot of, and someone named Stephen Tinius says, and the showers this year, here's a free identity theft service for a year. Yeah. Yeah. Well, you know, a whole bunch of emails that you will ignore because you're getting 20 of them already. Yep. Ask me how I know. So if, if you, I remember when I was working up at Hopkins, Tony DeBurr, Dr. DeBurr, and

28:05I did a, a, a survey of Maryland people, Maryland residents on their cybersecurity. And we asked, has your data been in a breach and something like 50% of people said no. And that is incorrect. This is 150 million records. Right. Now, there may be duplicates in there, but it's big. Yeah. It's big. Yeah. And this is our, your data, if you're listening to this and you live in the US and Canada, your data is probably in here. Yep. Yeah. Uh, it, so I, I think part of the reason this, this story incenses us all so much. Yeah. Is we try to tell people on this show in practice in general, what people can do to try and protect themselves. There's no stink and recourse for something like this. Right. Like what, what alternative do you have? Not show your driver's license when you want to rent a car. I mean, you just, I mean, you can just stay home. And do nothing. Right. But like you, you have no recourse here. No, I was at the doctor's office. How is this just about to say that, David?

29:06Yeah. Last month, just, you know, I'll just hand it over my insurance card in my driver's license. And they scanned both of them. Yeah. And, and, and could have been this company. Who knows? Yeah. Your data could very well be in here from your doctor's office. Who knows? Yeah. Yeah. We try to hold, you know, the businesses that we all deal with. We try to, you know, if you're very security conscious, you try to get a sense of, you know, what are they going to do with my data? Are they good data stewards? That's like five full time jobs right there, just tracking that all down. But I mean, I get, would you think that, I don't, I don't even know how this works. Is it a little device on the employees desk that, you know, calls into an app or something? I mean, yeah. Would you even think? It's a scanner that probably has a software. Yeah. Yeah. It's a software play. It's a software play. It's a software play. Right. Yeah. Would you even think that that's something that you had to even worry about? It's too late. I'm going to tell you, when I walked into the doctor's office and she said, can I have a driver's license in your ID and your insurance card and she scans them. I looked at her, I said, where does that go?

30:06Where do the images go? And she goes, I don't know. Yeah. I mean, how would they know? Yeah. Of course, the person at the front test doesn't know, but I'd like to know. I'd like to know where it goes. But I think I might have an idea where it went. Yeah. Yeah. It becomes, you become the in person equivalent of the guy who reads the terms and conditions in full, right? Which is a very rare specimen. I mean, right. I will add to your story, Joe, because we've been following this on the cyber wire. First of all, I want to echo your praise of Brian Krebs. Yeah. So there's a few people come at something like this better than he does, because tenacity of just hunting down the details. I think he got pissed off. He's dead. He's dead. He's dead. He's dead. But his mom's dead. His mom's dead. You go after someone's mom. Come on. Right. So you mentioned this service is called Nexus. The day after Krebs published his report, Nexus went offline.

31:07Really? Yeah. They said this service is no longer available. Oh, good. So. Which doesn't mean. Doesn't mean anything. Is what it means. Right. So, the data is still out there. The data still has value, so the data is being bought and sold on the black market. It might just be not so publicly facing as it was before. Right. All they've done is relocate the website. I'll bet they haven't even changed the software. Yeah. Yeah. And honestly, that's ads of the time of this recording. By the time this episode goes live, this story may have a huge update or five to it. So I guess we'll see. Yeah. We'll see how the FBI does. Yeah. All right. I'll go into that report from Brian Krebs in the show notes. Tell what. Let's take a quick break here. We'll be right back after this message with Maria's story. And now a word from our sponsor, Threat Locker, the workplaces evolving.

32:09AI coding agents are already writing code, managing files, and reaching outside systems on their own. And they're not even willing without a human approving every step. OOS calls the risk that comes with that excessive agency, an AI agent with more capability than its task actually requires. Threat Locker helps organizations enforce the fix instead, giving every agent only the access it needs and nothing more. That means controlling which programs an AI agent is even allowed to run, restricting what it can touch once it's running, files, other applications, sensitive data, and the locking down which systems and websites it's permitted to reach on the network. Threat Locker has even published ready to deploy starting policies for popular agentic AI tools, so your team isn't building these controls from scratch. Adopting AI doesn't mean giving up control of your environment. Learn how to apply zero trust to agentic AI at Threat Locker.com slash HH.

33:09And we thank Threat Locker for sponsoring our show. And we are back. Maria, what do you have for us this week? I have a good old fashioned romance scam that that is also an investment scam that the FBI recently busted. Oh, good. And this story kind of missed my usual scans of stories because it comes from the world of US football, which is not one that I am normally in. I don't know about you too, but it's not. I mean, I'm sure people will be shocked to hear I'm not a big football fan. That's the one with the pointy ball, right? It's the pointy one. Yeah, it was the one that you kick. Yeah, the pointy ball. There's one. Rugby has a less pointy ball. Okay. Good. Yeah, that's true. Well, no, what if I forgot that I shouldn't unleash that. Anyway, let me tell you about rugby. Oh, no, what have I done? So the district attorney's office, the attorney's office for the district of Oregon and the

34:16Justice Department in Portland, Oregon put out a press release at the end of August, saying that they had busted love and investment scam that had been running for like five years and defrauded at least 26 women across the states of Oregon, Washington, Idaho and California, out of roughly a total of $1.3 million. And the way and the key name in this story, so people who listened to our show who are also US football fans, they may have heard this name as Dejon Love is the name of the scammer. He was recently arrested with his accomplished Taylor Chan. So Dejon Love is 35. Taylor Chan is the ripe old age of 18. Wow. And they were turned your life around Taylor. Right. She's going to have some time to think about it. And again, this scam had been running for years. So it was Taylor, like 15 and a half. Yeah, that was horrifying. They were arrested on August 24th, 2026 and both charged with wire fraud and conspiracy

35:20to commit wire fraud. So the way that this scam worked, I'm not even saying that this is necessarily a novel take on the scam. I just, I just, I'm sort of reminded of dirty rotten scowl and there's a little bit this actually strikes me. It's a little bit old school. It is. It's one of my favorites. Great film, great film. But it just, to me, we talk about romance scams a lot and we talk about how they tend to affect the elderly. This one is one that went right after young people on dating apps. So there's, I want to go over first how the scam worked and then how one person figured it out, which is my favorite part of the story. So the scammer Dejon Love would meet people through dating apps and social media. And to convince them that he was actually an NFL player, he is not, but he would tell people he was, he created a number of multiple fake identities and social media accounts where he would show himself as being a wealthy San Francisco 49ers player or depending on the year you caught him doing this in a successful real estate investor.

36:22I guess depend on his mood. I'm not really sure. So was he pretending to be a real football player? He was, he was genuinely pretending to be an active member of the San Francisco 49ers. Was he impersonating somebody or is there no? He's just saying, I'm Dejon Love. I'm on the San Francisco. Oh, he's using his real name. So you can even go to the San Francisco 49ers website, look at their roster and see these non-honest. So, so you know, it's funny that you mentioned that. That is actually how I found out about the scam this past week was the Kelsey's of the Taylor Swift world. Yeah, yeah. Okay. The brother Jason Kelsey was apparently talking to his more famous brother, I guess, saying the quote that I saw was, it's hard to feel bad when it's just as easy to Google it essentially. They were talking about this scam specific and specifically and said, I'll be honest, I'll be, it's hard to feel bad when it's as easy as just googling it. Like you're going to give $50,000 without googling the guy's name and find out what happened before this was noteworthy.

37:24If you Google his name, it would show up, you know, like even if you're not well known, at some point you'll have some documentation that this guy was actually a real or not. And he was like, why didn't anyone Google this guy? Well, they didn't. I don't know what to tell you, Sir Kelsey. Well, 26 women didn't. Yeah, 26 women didn't. I've been a lot of other women did and we're like, I don't, I don't know who you are. Goodbye. Yes. And he's just like, well, you got, you got to, you got to lie to 100 to get one that believes you. That's exactly it. Yeah. I get his point. I do understand that, but I like to try and still default on the side of sympathy for people because. Yes, I do. Yeah, I just like, that's just me. So he, so day down love with, and his social media accounts do the sort of bragadocio that many people think that rich people would do of showing off their luxury cars. Right. Expensive lifestyles. And then also random football imagery to sort of reinforce this story, like walking across the turf or, you know, in being in the stadium when no one else is there, that kind of thing. Opposite husband, Troy.

38:24I suppose I actually. And so I, this convinced enough victims that he was genuine. And he actually would see them in person. So this was like, he got something out of this physically. He actually would physically be with these women. So he was, he was not just like a voice through the screen or whatever. He was actually like courting these women to put it playly. And he would convince them that like he was the real deal pro NFL player, which for many women in this world, I am not one of them. But for many women in this world, that is like as great a catch as you can get. Like that is the goal. So I can keep it in the gym. Yeah. I mean, he looks physically, he, I, if I saw him and you told me he was a pro NFL player player, you believe it. Pro, I mean, I wouldn't go, well, he's obviously not. I mean, I don't, right. But it wouldn't, it wouldn't strike me as implausible. I mean, but it's okay. Yeah. Um, so I guess during the course of their courtships, he and his friend, Taylor Chan would start to drop the little fish hook in about, oh, I've got these exclusive investment opportunities

39:30that could generate huge returns. Like, you know, I'm already so wealthy. So I want to like share the wealth. And since I'm, you know, in love with you, maybe you want to get rich alongside me. So we can both be rich. And he would use fake bank screenshots and investment apps to show like multi million dollar balances to sort of legitimize this fake story. And Taylor Chan was also posing as loves financial advisor. And so they would be on like, I mean, if you don't know that he's 18, maybe he has a really deep voice. I don't know. My son had an amazingly deep voice at 18. And some, some guys do. And also if you can talk a lot of financial bloody blah, you know, and people who don't know a lot about this stuff, they might go, that sounds real enough to me. Sure, I'm in. And also I love this guy. So why would he want to defraud me? It's not where their brain is at. They're not thinking. This is what's going on. Right. Um, so, you know, they, basically, the, you know, that Day John love and Taylor Chan would work the victim. I mean, there's no other way to put it. They would just convince his victim to give them loads and loads of money.

40:32And they were encouraged to send money directly, invest their savings. And in some cases, take out personal loans. There you go. Yeah. And then once the victims either ran out of money or started asking questions, they were immediately cut off. Um, so, and, and just to be clear, uh, the, the prosecutors in this case have said that absolutely not a single victim who's been identified has actually received any investment return or payment. So that's not, not a huge surprise. So they're out of the money. So that's how that scam worked. I, when I was researching this story, uh, and this, as you might imagine, this story has gone gangbusters on social media and, uh, sort of mainstream media because it's, you know, a romance scam that involves the NFL kind of, right? So everyone's got to take on this one. So there's, there's a story from this woman named Ayanna Velasquez, uh, about, she actually met Day John love through a dating app in 2021. And apparently at that time, he was going by Jonathan love. And she, John, John, John, and the thing I love about Ayanna Velasquez is, it is a scientific

41:32fact that if your last name starts with a V that you are a very smart person. Oh, sure. Yeah. And she makes sense. Don't lay here in the alphabet. Yeah, the smarter you are. Yeah, some of us are a slum in it. The, the funer in the, yeah, the bees, but those of us at the V's were just like we, we can catch on real fast. Yeah, sure. So Ayanna figured out this guy was a scammer really easy, but I love how she figured it out. She immediately was skeptical of his very too good to be true claims. Like apparently at that time, Jonathan love was saying his family was among the richest in Switzerland and owned several extensive real estate properties. And that seems a little bit hard to believe. And then he reappeared in 2024, then also saying that he was now a pro NFL player and she was going, hmm, he would send Ayanna photos and videos of himself. Appearing to show himself as not just a San Francisco 49er, but as I mentioned earlier,

42:33like him walking the turf of the stadium or being waived at by fans in his, in the bus, like the bus that they take in between games, I guess. And she did a little investigation of herself. She checked the files that he would send her and looked at the metadata and realized that there was no metadata that these were all screen recordings. And not original footage. And that was how she immediately figured out this guy was no good. And as soon as she figured that out, she just stopped and dropped him immediately. But I love that she was like, hang on a second, let me check the metadata, the skies, videos and photos. Go to Ayanna. I want to be Ayanna. Yeah. She does sound like a very smart person. She is. And if she doesn't work in InfoSec, maybe she could consider a career in it. Because honestly, that is so amazing. And I love that they did that. So good for you. So yeah, this is not necessarily like a big hot new scam that does something that we've

43:34never seen before. A lot of these are really classic scam tactics of like extraordinary claims and trying to fake what you're saying with social media presence that sort of makes you seem more trustworthy. But there's always the ask. There's always the financial ask. It came later after I suppose the scammer got his physical dues as well. And the financial ask was huge. In this case, in many cases, $1.6 million, I think they said, was $1.3 million rather, is how much the victims lost in total. That is a lot of money. So romance scams can often blend into an investment scam. This is a classic example of that. And so he took his time. The scam ran for five years. So he would really take his time working on getting these women to trust him, emesiting himself in their lives, like getting them to fall in love with him. And then once that trust was there and rock solid, then he would make the financial ask and he brought his friend in to make it seem more plausible.

44:35It's pretty insidious. Yeah, you're going to be hearing about this all over the news if you haven't already. Very water cooler stuff. But do you know what eventually led to his downfall? The FBI was actually tracing him for a while and both love and Chan were flying to meet together in Idaho and Boise, Idaho. And that is where the FBI got them both at Boise Airport. And they were there to meet a new victim. And I guess just from July to August of 2026 alone, love had traveled to New Mexico, California, Oregon, Nevada, Utah, and Idaho. So he had been real busy tracking down a lot of different victims. So that's just crazy. But I guess if you scan people out of 1.3 million, you can afford some flights, but still. Yeah. It's a business. Yeah, business. Yeah, sure was. All right. Wow. Interesting. All right. Well, we will have a link to that story in our show notes. And of course, we'd love to hear from you. If there's something you'd like us to consider for the show, please email us.

45:36It's hackinghumans at n2k.com. Joe Maria, it is time for our Catch of the Day. Dave, our Catch of the Day comes from the R-slash Fishing, PHI fishing. This title of this post is clicked on a fishing link from Calendly. Yeah. I can never say Calendly properly. That is such an awkward company name. But it looks good. I know what it means when I see it. So maybe it's not so bad, but it's hard to say. Yeah. But here is the link right here. We'll put a link in the show notes. All right. Well, it reads like this. Your payout is ready for collection. Confirm the order to receive it. Click the link below to complete your transaction and get your funds. We're excited to see your store grow with every new listing you add. Need any help?

46:36Just reply. Our dedicated support team is here for you. We learn from every sale you make and use that knowledge to drive improvements. Our goal is to make selling so smooth you never have to think about the platform. We're constantly building new tools to save you time and boost your sales. We know you have many choices. We're so glad you're part of our community. Regards, Calendly team. PS, good to know, schedule your inventory weekly to speed up payouts. Now here's the thing. Okay. Yeah. You have some thoughts. I know it. I know it. We use Calendly every day. We sure do. Cyberwire. It is one of our primary. It is a load bearing tool for us. It sure is. Yep. Yes it is. I have to say, when I years ago, probably nine years ago or so, and I first tried using Calendly, it was a major lifestyle upgrade just in terms of scheduling people. We use it every day.

47:37We rely on it. Great tool. Highly recommended. Love it. Well, it's just worked great for us. Yeah, five out of five. It has a great beat. You can dance to it. But Calendly is not an e-commerce site. No. No. I was going to ask, because there's some reading this. I'm thinking, is Calendly updating their, are upping their game? They're moving into like Shopify and Wix territory. No. They have added an AI component. I was just going to say that. I mean, this is one of those things where it could be plausible in the future that maybe they're going to start doing stuff like this and then we won't know. No, no. No. So they're not in any commerce platform at all. But so here's what I wonder. When you have a major platform like Calendly, could it be that these scammers are relying on the fact that Calendly really can't be blacklisted?

48:37Could be. Is there such a ubiquitous tool? And there's such a part of doing business. So is this, is this like a Calendly, I really can't say it. Calendly invite, is this, that would, this is, this is nothing like, I don't, you mean is what the person got a Calendly invite? Right. I don't know the answer to that. No, I don't, I don't, I do not know and I don't think so. No, it was probably just an email that was using an alias to make it look like it was a legitimate Calendly email. Right. Yeah. Right. So they should be able to block it with like demark and whatever the other thing is, I never remember. Yeah. If you say so. Yeah. I think this has been an issue plaguing Calendly for quite some time. Yes. I'm sure there's a reason why they're still dealing with this and they haven't just been able to shut it down. And it's probably because of the wide reach that they need to have to be able to get people that I don't know. I'm sure this is technical explanation. No, one of, well, in fact, Ria, one of the comments here says that on the Reddit thread

49:38says, I got tons of these emails. Apparently, Calendly, Calendly, you got me now. Apparently, apparently, Calendly, a legit business is unable to stop it. I informed them several times of this issue. So they're aware of it. But yeah, for whatever reason, they can't put a stop to it. But it's just an odd mismatch. And I suppose there are plenty of people out there who have no idea what Calendly is. They see a link that says get paid and they're like, oh, maybe I'll get paid. Right. And click through and away they go. Yep. All right. Well, we will have a link to that in our show notes. And again, we would love to hear from you. If there's something you'd like us to consider for the show, please email us. It's hackinghumans at n2k.com. Thank you to Threat Locker for sponsoring hackinghumans. Sign up for a free demo today and see how you can implement a default deny posture at

50:39your organization by visiting threatlocker.com slash hh. And that is our show brought to you by n2k cyberwire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans at n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Iban. We're mixed by Elliott Teltzman and Trey Hester. Peter Kielpies our publisher, I'm Dave Bittner. I'm Joe probably in the data carigan. And I'm Maria Varma. I'm a boss. With a capital V. With a capital V. Thanks for listening.