515 | Cyber Security Update: Social Engineering & Pig Butchering

0:00Hello and welcome to Choose FI. Today on the show, we're actually going to do an update on securing your financial life. So Tom, who is a former FBI special agent and now works in cryptocurrency investigations for Binance, was last on in episode 397. And this was a real wonderful overview of really securing your financial life. It's the 80-20 analysis of, hey, what are the handful of things I can do to secure my financial life today? Now, is this going to get you in the top 1 %? Maybe, maybe not. It's going to get you close. But these are things you absolutely have to do. Now, as part of our quote-unquote in-house expert program that we've always thought of, I want Tom to come back on and just give us some updates from time to time on things that he's seeing in the larger cybersecurity world, things that we should be doing today, because this is constantly evolving, right?

0:53The bad guys, if you will, they are constantly trying to come up with new ways to hack us and attack us. And having someone like Tom who lives and breathes us is really just such a bonus for our community. So with that, welcome to Choose That Fine.

1:14Tom, thanks for coming back on the show. I really appreciate it. No, thank you, Brad. I really appreciate you having me back on. I told you this before we started recording, but I don't have a book to sell. I don't have a website to direct people to. I am here because I am part of this community. I have benefited personally. My life has changed drastically for the better because of you, because of JL, Jonathan, all the people that have been in the community, been interviewed. It's been a tremendous upgrade in my life. And so I want to give back in any way I can. And I want to talk about today what's called pig butchering or other types of scams that are really, really prevalent and really exploding and victimizing so many people.

2:02Okay, so that's quite a term, pig butchering. I've heard it in passing. And I got to be honest, I don't even know what that means precisely. So let's dive in. I'm just gonna let you run with this. Just give us the overview. Sure. Yeah. So pig butchering, it's obviously not a great term or an affectionate term when you start talking about like scamming people. But that's what it's just been called. So the sort of etymology of that term is when you fatten a pig up for slaughter, and then you kill them. And that's a horrible way of saying it. No nice way to describe that, I guess. Yeah. But the analogy to the scams is that the scammers are building up trust.

2:44They're developing relationships with people online, quote unquote, fattening them up, and then they will fleece them of their money. And that's the slaughtering or the butchering part of it. It's just kind of a horrible way of just saying, getting people to trust the scammer and then scamming them of their money. So that's really all you need to know. It's an investment scam. That's the main one I want to talk about today, because that's what I mainly investigate every single day of my life and where I see so many people lose all of their retirement funds. So it does target elderly people. It's called elder fraud, but not just elderly people.

3:22The demographic of 18 to 49 is also a huge part of this. So you have people that either have a lot of money invested and they are our target because maybe they're not as savvy or not able to discern what's a scam and what's not. But you also have people who are looking maybe on the younger side or just looking for that get rich quick type of option. And they see, oh, I can make a ton of returns over here, you know, oh, they're promising me 50 % returns as opposed to what is this 8 % VTI stuff, right? And people say, you know, in the crypto community, especially, they're like, I want 100x. That's all I want.

4:03100x or nothing. And when you have that sort of mindset, usually from a younger crowd, you're setting yourself up to be victimized. Yeah. And I know from being loosely a part of that kind of crypto world in the 2021, 2022, I had just such an interest in what was going on. And I mean, get rich quick is probably an understatement to describe like what these people and most of them are, like you said, kids really like what they anticipate. And it's just, it is so far adrift from reality. And I do fear that they are just exceedingly susceptible to scams generally, but also just mismatch expectations with, hey, what is an actual investment versus, like you said, I mean, 100x or people are expecting 100 plus percent return in six months as if that's a normal thing, right?

4:56Like, by no means is that normal. I think my back of the envelope heuristic is like, if something is earning guaranteed, quote unquote, like 10 % or more in a year, you got to your spidey sense needs to come up of like, okay, there might be more risk here than I otherwise anticipate. So total sidebar. But Tom, I think that's important just for people to have like their own back of the envelope. It might be higher for some people, 10, 12, 14%. But goodness, if anybody's trying to say you're going to get a guaranteed return of more than 14 % on something, I mean, you got to be really wary of that.

5:31I fully agree. And this is not to say that investing in crypto is bad. I invest in crypto so that I don't want that to come off. Of course. But it's risk, right? That's what it comes down to. Risk versus reward. It's what your personal risk tolerance is. But that's not the point of this episode. The point of this episode is to talk about how these scams work, their impact and how to protect yourself. And what I see every single day is people falling victim to this. And the figures that I've actually read are that I know this is not a US centered only podcast. But for Americans specifically, it's 57 ,000 Americans are being scammed every day, whether that's investment scam, fake job scams, tech support fraud, where you get that message that you have a virus or call us.

6:20All of these fall under the umbrella of scams. But the one I really want to harp on today, like I said, is the pig butchering side of things. That's what I see growing the most. It's exploding. It's becoming a$3 trillion industry. For anybody who wants to just grasp that figure, there are scam compounds that are doing$50 billion a year. That's crazy. So Tom, okay, how, I mean, this is massive, clearly. How does this type of scam start? What should someone be on the lookout for at the outset of this? I don't know if you'd call this like under the umbrella of social engineering or whatnot, but like you said, they're in essence trying to like befriend you or get in touch with you in some way.

7:03What are the initial touch points? Yeah, that's a great point. So how this actually normally starts is usually a random text message. I don't know if, Brad, if you've ever received one of those. I get them all the time. I don't know if it's because the scammers are specifically targeting me for battling against them. But I get this random like, hey, Cindy, when are we going to go play tennis? Some random text. That's an entry point to a conversation. What they want is for you to respond and say, my name's not Cindy, it's Tom, you know, or something. Any kind of response is all they're looking for.

7:38Because what they're going to then follow up with is saying, Oh, I'm so sorry, I must have gotten mixed up. How are you today? And you say, Oh, I'm fine. How are you? Rather than you know, you make a wrong phone call to the wrong number. And you say, I'm sorry, wrong number, End of conversation, end of relationship. That's not the goal here. What they're trying to do is get an in in the door. And then they say, Oh, I'm Susie. And I'm 38 years old. How are you today? What's your name? And where how old are you? And then they start this relationship, they start asking you personal questions, they say, Hey, and then it gets into maybe the romantic side of things where they'll be like, Oh, I hope you have sweet dreams, honey, you know, every single night, they will be peppering you with affection and looking to just develop some sort of relationship with you.

8:29That's one way. Other ways are dating apps. You're already receptive to being reached out to on a dating app. So that's a great way for them to reach out to you. LinkedIn, all kinds of different social media entries. My mother-in-law is a real estate agent. One end that they try to use is real estate leads. They will say, I am interested in buying this house. They're not interested in buying the house. What they're interested in is building a relationship with that realtor. So basically just being aware that they are using any method they can to start a conversation with you, especially if you have to be receptive.

9:07That's your profession as a realtor. You have to be receptive to incoming messages, right? But that's really what they're doing is they're looking for an in in some capacity to start building a conversation and building a relationship. Another really common one is if you have liked, say, a certain actor on social media, will they see your profile as liking, I don't know, George Clooney, right? So George Clooney, they will then make a fake George Clooney profile, and then specifically message you. I've received these myself from people on Twitter and other things. They make a similar profile and then reach out to you directly saying, hey, thanks for being a fan or whatever.

9:53Again, it's just an in. And I've seen multiple cases of people falling victim to thinking that's the actual person. They get excited, they build the relationship, and then they actually send money. To bring this down to a very personal level, I have people in my own neighborhood, many, many people who have reached out to me who have relatives who have fallen victim to these scams. That's why not only do I do it professionally, but even personally, I see these scams on a regular basis and it just tears me up inside to see someone lose everything they have, whether it's something that they've worked for at a young age or all of their retirement savings.

10:33Very common is to hear a story about they lost$700 ,000. That's not a small figure that I deal with every single day. That is a very common figure. And I've had people take out second mortgages, home equity lines of credits, do all kinds of stuff to generate more funds to send to these scammers. And that's where my mind directly goes to this ChooseFI community, because we are an investing community. And we are a community that has generally funds to invest. So I worry about this community specifically, not because they are not savvy, but because it can happen to anybody. I've fallen victim to these scams before.

11:13Like I do this every single day. So we, in what sense have you fallen victim to it? I'm assuming you haven't like sent money to anybody, but like how far into it did you get? No, I didn't mean specifically this type of scam, but like just recently, literally just recently, I had someone in our local community page post about, Hey, I'm getting my air ducts cleaned. If we get a bunch of people together, we can get a group rate. And I was like, oh, that's been on my to-do list forever. I'll do that. Count me in. Well, little did I know because I don't know every scam out there. That's a scam. People will join local Facebook groups or anything like that who are not part of that community to generate business for their company.

11:59And then they will get in the door and it's a bait and switch is what they do. They get in the door at a cheap rate. And then they'll say, hey, you've got this problem. You've got mold, you've got this. Then they'll charge you way higher than what is actually the cost to remediate that issue. That's just one scam that I didn't even know about that I fell victim to recently. I had someone come and do that. So just to say that anybody can be a victim, don't ever think I am so savvy and I am so good at this. I literally investigate scams every single day of my life and I have fallen victim to that scam that I wasn't aware of.

12:35So that's why I want to bring this conversation to the Chooseify community. I was talking about that one, like George Clooney example. I had a family in my neighborhood reach out to me because their relative literally is going through a divorce because they think that they're in a relationship with this actor. And unfortunately, they're very good at what they do. They're very good. These victims should not feel ashamed. If you fall victim to this, that's the other thing is like, we hear this number of 57 ,000 Americans a day or so many billions of dollars. That's what we know about. That's what's been reported.

13:12Most people are not going to be public about falling victim to a scam. It is a shameful thing to think like, oh, I fell victim to this. But you shouldn't. These people that are doing these scams are very good. They're using tools like AI. Jeremy Schneider, I think his name is, that runs the Personal Finance Club. He's the guy who puts out those amazing infographs. He's so good. And he's coming on the podcast very, very soon. Depending on when this goes live, it'll be within a week or two, probably. Oh, nice. Yeah, I follow him on Instagram, and he just put out a thing, I think yesterday, about how someone took his voice because he's all the time, just like you, Brad, your voice is out there.

13:51Now there are AI tools where I could take your voice, Brad, and make it say whatever I want. I could say Brad said, you know what, that whole VTSAX thing, that's not what we're doing anymore. Things have changed. Now you need to go all in on Bradcoin. Bradcoin's the future. And literally, it'll be your voice saying it. And that's what Jeremy Schneider posted. Someone had taken his voice and said, hey, we're going to do this whole other investing thing. So they're very good. That's what I don't want people to feel is ashamed if you fall victim to this. The key, though, is to talk about it. Talk about how it starts.

14:24Like I said, they get that in, they develop that relationship. And then they also try to isolate you. The example I used of the relative in my community who's literally filing a divorce because she thinks that this relationship she's built up with this quote unquote actor is real. So she's going through a divorce right now. She's already sent five figures to this scammer. And I assume she plans to send a lot more once she has access to more funds. And that's where the family didn't even know until they started asking more and more questions. They try to isolate the victim so that they don't talk to their family about it.

15:01Because as soon as you talk, like if my dad eventually told me, hey, by the way, I've been talking, you know, I'd be like, whoa, whoa, whoa, whoa, whoa. That's a scam. Usually people not in the tunnel of that relationship can see what it is. Right. Right. Like Jennifer Aniston is not like texting your dad. Let's be clear. But like you said, when you talk about it, I'm picturing it almost like a spell is broken. Exactly. Like there's some odd spell they have over you. But as soon as it gets aired out a little bit, it's very obvious to everyone involved that this is not real. Exactly. And there you have very, like, this is not a whimsical thing they're doing.

15:38They're scripted. Every action and every conversation, it literally says, day one script, talk about this. Day two script, talk about this. Day three script, talk about this. Then it gets handed off to another scammer up the chain. Once you start talking about actually investing, okay, then this scammer will say, hey, go to this website and you can invest. And they make it seem like you're investing your funds on your own into a platform that is legitimate. They are not taking your money. It's just you're investing. And then you'll put in, say,$50 ,000 and you'll see that money grow on the screen.

16:14It's not actually growing. The money is gone. But what you see is the money is growing. That's how this snowballs into$700 ,000 of losses. And then the final thing to be aware of is when you go to take it out, they will say, oh, there's a whatever,$10 ,000 processing fee. What they're doing is they're just saying like, okay, the person clearly is probably going to stop sending us money soon. Let's grasp at the last straw and try to get them to send one more time. And people will do that. They'll be like, if I just send them one more chunk of money, then I'll be able to get my whole thing, a million dollars that it's grown to.

16:53And that's just their last ditch effort to scam you. And then they're gone. Wow. Okay. Yeah, that's wild. All right. I think we've done an amazing job of setting this up, giving an understanding of what it is, the potential ramifications, but I guess action steps now. What do you do? I mean, I think the obvious thing that comes to my mind is anytime you get an unsolicited text or I don't phone call. I don't know if they even do that, but let's assume text or emails. I mean, I engage with 0 % of those things. I just assume they are all spam. And if by some free chance it's not spam and I blocked it or whatever, so be it.

17:29Maybe they can get in touch with me another way, but I just, anything I see another thing, like these USPS, I'm always getting links, like the post office sending you this and here's a link. I get those a couple times a week at this point. Just delete immediately. But that's kind of like a broad stroke. But realistically, Tom, how would you advise? What do people do? What are the actual action steps here? No, you're going down the right road. So I personally also get all those like, hey, you have a delayed delivery. Click here to track your package. And if you're not expecting a package, then your antenna goes way up and you delete it.

18:04But what if there's a very important package that you're waiting on, that's when it works. Because it's the sense of urgency and just not being totally aware at the moment. That's when it gets you. So that go back to your question about action steps. The action steps are even if you engage with somebody and say, sorry, wrong number, or, oh, you click a link, you know, or something, we're going to make mistakes. None of us are going to be perfect. You do your best to not do those things. But the ultimate end point of knowing when to stop is the key of this person that you just met online to not invest based on their advice.

18:45Do not send money even to what appears to be a legitimate avenue. They will send you lookalike domains that are spoofed in some way. Just never take advice from someone you met online about sending money or investing at all in terms of like, here's a link here's a relationship i'm building up and i'm trying to you know i get it i say all of this when brad may just be someone online that you're listening to and we're sharing advice but that's different because what they're directing you to is saying like go to vanguard fidelity schwab do it on your own brad is never if if you ever receive a link from brad do not click it because brad did not send you that link.

19:28Brad will never send you a link personally to invest in anything. Buy yourself, Google Vanguard, find the actual website for these companies, invest in legitimate platforms. And legitimate platforms could be cryptocurrency. Again, Coinbase, Binance, if you're not in the US, there are legitimate platforms to invest in cryptocurrency if you want to do that. I do invest in cryptocurrency. So again, I don't want this to be about crypto bad. It's about scammer bad. And the key is using only reputable companies and not sending money to people online that have just sent you a link or a unsolicited text message or anything like that.

20:09So that's the real big takeaway. But not only that, you may be fine now that you listen to this episode. But now I'm challenging you guys, they're always saying takeaways from a Choose FI episode, actionable steps, right? not only do this for yourself, but more importantly, talk to your friends and family, especially maybe your parents or grandparents or anything like that. Like I, I'd say this all the time. And I actually realized to myself that I had not talked specifically to my dad about this until literally three days ago. And I called my dad. I was like, you know what? I know I've talked generally about this, but we need to sit down and have a conversation about you not clicking links or not sending money.

20:50And I gave them the whole spiel, right? Do that. I go get my haircut at Great Clips. I start talking to the lady about pig butchering because I'm like, I need to tell everyone about this. I'm looking to protect everyone. So that's what I'm challenging everyone in this community to do, to not only listen to this episode and be aware of the problem, but then to also spread awareness and talk to people, bring it up because you never know, someone could already be a victim. Like I said, 57 ,000 Americans every single day. I've had multiple families in my community reach out to me. And that's only the ones that I'm aware of.

21:23There are unknown victims out there right now that don't even know they're victims. And if you start having this conversation and saying, yeah, they build up this relationship, they send you to a website to invest, or they get you to go to another common one is they will get people to go to a Bitcoin ATM, they'll say, hey, you're 20 minutes away from a 7-Eleven with a Bitcoin ATM in it. All I need you to do is go down to that Bitcoin ATM, deposit some funds, and then send it here for whatever reason that they've conjured up, whether it's tech support fraud. They say, oh, you've got a warrant out for your arrest.

21:59So this is what cracks me up. They'll say, you've got a - Send Bitcoin. Yeah. They say, you've got a warrant out for your arrest, but if you send us some amount in Bitcoin, we're not going to come arrest you. As a former FBI agent, I will say in every one of my plans that I wrote up to go out and arrest somebody, never is there a caveat that if that person sends me some Bitcoin, you know what, we're going to throw the case out. You're off the hook. Yeah. And let's be clear, obviously, you work for a crypto company. You've mentioned crypto a bunch of times. But for anybody writing this off saying like, oh, I'm not involved in the crypto world, this doesn't apply to me.

22:37That is not the takeaway from this at all. Zero percent. Crypto on some levels makes scams a little bit easier. There's the untraceability aspect of it, or potentially that it's easier. Once the money's gone, it's gone. There's no like big brother watching over. So I think it makes the fraud a little bit easier from my kind of outside perspective. But Tom is not saying like, this is only valuable for people in the crypto world. Clearly not the case. It's the exact opposite. Like he said at the outset, this is for people. Many people who are an older demographic may be more susceptible to it. But like he also said, 18 to 49, I think was the age range.

23:13And frankly, I actually just texted my daughter while we were recording this because she had remarked, Tom, and I didn't even tell you this a couple of months ago, that she got on the same day, two identical text messages from two totally different numbers. You talk about scripts, right? This was so fascinating. It was two totally different area codes, like seemingly having nothing to do with each other. And she just texted to me. It was quote, I feel like cooking steak. Do you want to come over for dinner tonight? And she got one in the morning from like whatever X area code. And then seven hours later from a totally different number, totally different area code.

23:48And I mean, I guess that was page one of this script of, Hey, let's socially engineer this person on the other line. They didn't know that it was a 12 year old kid in this case, but I mean, she, luckily I've, I've tried to drill this into her head that like, never engage with people on online, never click anything. My kids are like, at this point in time, you would be so maybe I'm a little overboard, frankly, but like they click on nothing. I have like drilled into their head. I'm like one bad click can mean the end of a whole lot of money potentially, or somebody hacking in, et cetera, et cetera.

24:19So like my kids are maybe now a little too scared, but I guess that's not so bad, but of clicking anything. So I would advise anyone listening to this, just please exercise extreme caution. There is no reason to ever click on anything, anything from anybody that you don't know. I mean, I would even argue from anybody, but certainly from people you don't know, never click on anything. If you get an email that even if it looks legit and there was just a simple way, like I got a UPS tracking number the other day, I was like, there's a 98 % chance this is the legitimate person, but they just gave me a tracking number.

24:56I literally copied it, went over to ups.com, pasted it in and saw, okay, this actually was legit, but I'll be damned if I'm going to click on a link for no reason whatsoever. There was no benefit other than just a little bit of ease, but the downside is so disproportionate Tom. So like, that's how I think about it. So I don't know if maybe I'm a little overboard, but I think I'm pretty buttoned up on this. Yeah, no, the lesson there is exactly what you do is take whatever information, if you're getting an email or a text or anything, like let's say, for example, you got an email saying, oh, your bank accounts in jeopardy in some way.

25:31Okay, great. Delete email, log into my app or the website the way I always do and verify that. You know, I always tell the story of a judge when I was swearing out a warrant, after I was done swearing out the warrant, he said, hey, by the way, my wife got an email saying that we spent$80 on the Apple store, but we didn't. And I said, okay, well, let's do this. Have your wife... He called his wife right then and there. I said, go into your Apple account. Is there some sort of purchase? She said, no. I said, okay, then you're probably fine. Let's just go one step further. Let's look at the email address that they sent it from.