I Was Robbed at Gunpoint, They Took Everything

0:00What would happen if someone else got access to your phone? I'd not really thought about how serious that could be until this conversation with Victoria. Let's start on the day before the incident happened in Sao Paulo. Can you tell us what you were doing there? What was the day like? What was your mood? Yeah, I was in South America traveling for four months, two months in Argentina, which is the country where I'm originally from, where this sexy accent is from. and then we went with my partner to Brazil for two months. The last stop of that trip was Sao Paulo. We were going to be in Sao Paulo for eight days.

0:40I had never been in Sao Paulo before.

0:45And the mood was good. It was only four days until we flew to the UK. okay and this was like a traveling holiday for an extended period of time or well i have my own company so i travel and i work all the time okay since the moment i wake up to the moment i go sleep and uh i don't know if you have noticed that here the winter is horrendous so we decided to go uh away to the southern hemisphere for four months and at what moment did you realize it was something was wrong when did it go left well on the 24th of february uh uh we went for dinner to it was a cocktail bar had nibbles um and when we were walking back to the airbnb this is a touristic place it's not like a favela or anything um where there was perceive danger.

1:52We're walking back 20 minutes and we see two food delivery drivers, the equivalent of Deliveroo, which is called iFood or eFood in Brazil. So they're in a moped and one of them is carrying a red backpack and the one on the back jumps out of the moped with a gun and we were walking on the sidewalk like idiots looking at our phones, right? So the phone is unlocked. So they jump out of the moped with a gun, we'll give them the phones, which is what you do when somebody has a gun. And I wasn't very worried at that moment. I mean, I was worried, well I wasn't very worried because I was alive first that's a um a win I think those moments last a few seconds and then you're lucky you're alive right it lasts it's five seconds you're very scared but that's it um it's not kidnapping it's not uh it's not sustained it's not sustained And so, and again, maybe because I had been victim of gunpoint robbery in Argentina, not here, it wasn't, it was less of a novelty to me than to my girlfriend.

3:18My girlfriend was like, what just happened? She thought that the guns were fake. And it's like, well, we don't have time to figure out. And probably it's not. We are, you know, in a really hot city for crime. And I wasn't very worried because in my mind, they had only stolen a device. And I had been victim of theft before. So if somebody steals your device, you go home, you put the iPhone, define my iPhone and the button that says it's going to be wiped remotely. And that's it. Right? That's simple. Or that was the simple story before this night. That was my experience before this night with phone theft.

4:04But that is not what happened. That night, I realized that people that steal your phone, they don't want access to your phone. They want access to your identity. And the key to your identity is your phone. So how did I realize that? because for the next eight or nine hours, which I spend awake with my partner, every 10 or 20 minutes, we got an alert of different financial accounts that were compromised. Because I run my own business, I have personal accounts and business accounts. Here in the UK, it's really easy to get an account of anything. You have a lot of credit cards, a lot of digital banking.

4:51It's very easy, costs nothing. So why wouldn't you have five accounts, seven accounts, 20 accounts, personal, and some business? So that night I realized that that was a liability. And every 10 or 20 minutes, when my partner was sitting across each other like we are now, and it was like, oh, my God, my Revolut got hacked. My real business got hacked. My wife got hacked. My Binance got hacked. My Coinbase got hacked. For hours and hours. And I think I went to sleep like at 7 a.m. Because not only are the accounts compromised, but then you have the paranoia of the accounts they couldn't open, that you got a notification they couldn't open, and the other accounts, right?

5:48But so I went to sleep at that time. I woke up like at 9 a.m. I couldn't sleep. And then we went to buy a new phone and to try to make the police claim the following day. So we went to a police station and they sent us to a tourist police. Tourist police generally speaks in English. And I, well, we went there. I had already done a police report in English and in Portuguese. I don't speak Portuguese, but, you know, with JGPT. So it wouldn't take too long, but it took two hours. And one of the things that I claimed there was that one of my crypto accounts in Binance had been compromised. But I didn't know at that time that it wasn't just one transaction.

6:53It was two transactions. I realized the following day when I looked at just by chance at my trash, trash emails on Gmail. that there had been other transactions, that I got a notification to my email, and they have been erased. So people had been on my email, and they had erased these notifications. And then I realized that it was much more money than originally I had claimed. So I had to go back to amend my claim.

7:35and at that point I was worried I mean I think it's pretty scary somebody gets into your email it's more scary than somebody gets into your email that it gets into your bank account I mean this is not the person that steals your phone

7:52I don't know in Paddington Station the way they move the crypto from Binance to three other accounts to three other exchanges immediately shows a level of sophistication and preparedness that I had never seen before. Do you think you were targeted? Were they opportunistic and just saw you walking down the street or were you being followed around the city? I think it was opportunistic. I think that they were looking at people with an unlocked phone and many times we are sending emails looking for directions i mean every time that you if you're abroad you are generally or i have terrible sense of direction so i have google maps on google maps on means that your phone is unlocked so if you're walking with your phone unlocked that's a target it happens a lot in london but obviously without the guns normally just come on the electric bikes and then you see it all the time just go past oxford street just take three people's phones because they're on their phone a couple of months before i was walking to the gym and two guys in a in a bike tried to grab my phone so they um maybe i'm a target you've got a target on your back yeah you're very lucky statistically yeah i'm you know in charts when you say what is this point or this thing that you're like the outlier hello it's me um so but But I didn't understand that day exactly the logic because the guy sort of hits my arm.

9:33The phone falls down, like flew in the air, falls down like two or three meters away. And they leave. And he's like, what kind of crime is this? Without effort. British crime, clearly. It's like, I have to pick up my own phone? What are you doing? You're two guys. You couldn't steal from me. I walk like an idiot sending voice notes. You couldn't steal from me. Like, what is this? But the phone falls down and they leave. And it's like, I thought, again, it was a joke about the effort of the locals. But no, it's because the phone needs to be unlocked. They don't want the phone that you dismantle and you sell, I don't know, for 300 pounds and it ends up in China.

10:18Because the phone, you can never use an iPhone again once this notification on iCloud happens, right? And also because you blacklist the email and all of those things. So the key here is your identity. If I want to steal your identity, I steal your phone. Unlocked. and how easy was it for them to go through your phone and get all of that information like how quickly after your phone was taken were you was all this going on um well the biggest price was within the first hour these two transactions from binance which i didn't realize at the time that there were two i only saw one because they didn't erase it in time the second one.

11:13So the biggest, the first hour was the worst. And then, um, there were a couple of transactions for the rest of the night. Also, you might not know all of the accounts that you have on your phone or that can be compromised from your phone. You don't have that inventory and these people are professionals. So as a professional thief, let's say gang member, probably you have a list of apps you're going to look for Revolut, Binance, Wise, because it was systematically very, very fast and the same accounts. It's not like you're finding out that people in Europe use Revolut. Probably you have a list of all of the accounts that you're going to check on the phone for this to happen very quickly.

12:00The only thing more annoying than an ad slot is compliance. Facts, but both are crucial. Compliance often gets in the way of scaling a business, because as you grow, you need to prove you're compliant with various rules and regulations for other businesses to work with you. This is where our partner Vanta comes in. They automate compliance with security protocols like GDPR, HIPAA, ISO 27001, and SOC2. Compliance is one of those things that you have to do to have a seat at the table, but it takes time, effort, and lots of money, which is why we love Vanta. Vanta saves you up to 90 % of the time it takes to prove you're compliant with these standards.

12:35and on average, half a million dollars. If proving your compliance is something that you need to get done, you can get started at vanta.com forward slash making money. There's a link in the description and we've also put a QR code on screen. They know this is from top to bottom. The easiest one for us to get money off is a crypto app. Look for those first. And like, you know, like a complete idiot that I am, I have a folder on my phone called finance apps. I have one, I have one. ordered by how easy they are to steal from. I had one as well. I had one as well. Here's my finance apps, all my money right here.

13:10Hi guys, this is a finance folder and these are my passwords. Yeah, yeah, yeah. But the thing that we don't realize is that convenience and security are opposites. So every time you go log into an app and it's really easy and it says, would you like to remain logged in in this device for the next 30 days? Yes. No, make it hard. make it hard to remain locked to Vanguard or to any financial app. Also, those apps are locked in. Sometimes they have a token that is locked in. You don't log out of Trade212. Yeah, Trade212 all the time. Just to be clear on this point, had you logged into Binance at all while you'd been in Sao Paulo?

13:56I never did. The previous time that I logged in into that account was a couple of months before. I think, I don't remember, it was two or three months, but I have the SAR report from Binance, which all of my transactions and all my activity in that account, right? So I never accessed the device in Sao Paulo. I had never been to Sao Paulo, and I have never withdrawn that amount of money ever from that account. None of those things seem to raise enough questions for Binance as to stop the transaction. When I say enough questions, in the SAR report, you can see that those transactions were flagged.

14:34They were flagged as risk, but they didn't stop it. So other financial institutions, well, Binance is not a financial institution. Can I call it a clown institution? A school for clowns. You edit, you edit. I see you like them, right? Yeah, besties. So I think it's pretty shocking, though, that what you're saying there is you had not locked into this platform for two to three months and you remained logged in. Even though you went to a completely different country and, you know, like they don't log you out when you cross a border or a time zone. Well, I want to clarify. It's not that I'm going to defend Binance right now.

15:14But I was checking before coming to the podcast the timeline and the SAR transactions. So I see in the SAR transactions that there is an iOS activity, right? There's iPhone activity. But I don't know exactly if the device remains locked or if they access it through the phone. because again as many of many people my second factor authentication was also on the phone so there is a redundancy i think most people probably think of two fa as oh if someone's trying to access my stuff from a different place but yeah it's completely compromised if they have your device basically i think that most people have a two fa redundancy meaning that the second factor authentication comes to the same device that is being compromised.

16:11So in the case of Binance, I don't know exactly if the app was still locked because you have a permanence token, something like that's called, or if they said, I don't remember my password, send me a code to this email, email that then I realized that they have erased several transactions from that service. So either way, it's pretty bad. It's bad. If you combine the Binance and all the bank accounts, all the money, how much did you lose overall? And also, how much did you manage to recover? Yeah, before you got the money back, what was the total amount that they got out of the accounts? I don't want to say the exact number, but thousands of pounds.

16:55Now, from that, 30 % was banks and the rest was Binance. So 70 % of it was with Binance as a platform. Yeah. The banks, how was the experience with them around, you know, the protections in place, the 2FA, the checks? Did you find it was different there? Well, I think that the banks tend to be pretty good because they need to have a UK banking license, meaning that if you can prove that this was fraud or identity theft, they will give you back the money. Also, it's not that you need to prove. They need to investigate by law. So you provide a police report. You see, OK, these transactions were flagged.

17:44And generally within two weeks, they give you back the money. All of them have to do it. And they have helpdesk and mechanisms for you to recover. There's a fraud recovery path. Crypto exchanges don't have that. And that is the worrying part. Because 8 % of the total population of the UK has crypto. Right now, every time I have tried to get answers from Binance, they say they will not speak to me. They want the Sao Paulo police to log into their Binance portal. I don't know what for, because I already have a police report, right? And I don't know, do something, provide more information. The Binance police portal, which probably is also in English.

18:33Like, what are the chances of that happening? And that is not only Binance. That is the other two exchanges, which are European exchanges. one is coin hero and the other one is coinify that want um yeah i wonder the sao paulo police to get in touch with them which i'm sure the sao paulo police has no other priorities than they're not too busy over there well this must be happening hundreds of times a day across the city yeah well when i went to the police they told me that that uh that there is a lot of uh foreigner looking women European looking women I don't know how to call it that that they target also he said like older older European so they said you look like an older European woman you're like what what yeah so okay and they told me there was a two friends there was one person from Czech that got 20k stolen there was two women from Spain that got 50k stolen okay so they're targeting women a lot as well was it was it crypto that they got stolen as well um they didn't they didn't um specify and you don't know the rules of the banking systems in other countries we our uk banking system has pretty strong protections people people uh might not consider that another country might not have those so they might it might be like crypto in those countries where you lose your money you lost your money right i did what one thing i'm interested in though is with the the banks is how easy was it for them to get the money off say like your bank account or your business account you mentioned revolu i don't know particular brands and i don't think the brands are that important but was there a big difference between say the crypto versus high street bank account yeah the crypto just left did they have to but they still got money off some of these high street accounts um some of them were flagged uh many of the transactions were also crypto or, you know, exchanges that you can buy fiat for crypto.

20:32Some of them were flagged and some of them went through. One thing that they did - Were they buying crypto with your bank accounts? Is that what you're saying? They were like buying crypto. Yes. Yeah. Okay. They can't really transfer, like steal your card and send the money to Damien. They'll be like, well, let's go to Damien's account. We know where the money is. So they used your bank accounts to buy crypto. So it was less traceable. Yeah, but they also sent to people's account, which probably are fake or not, but I have the names of the people that the money was sent to. Now, every time that an account was blocked, because sometimes if I had to send money to you and you're the first time I send you, sometimes you need another verification.

21:12Every time they did that, they send the money to another of my accounts to see if that account was easier. No way. So imagine, if you cannot send money from Revolut, you send it to Monzo. And you see Monzo allows you to add a new person and send them the money, which they did. Monzo did. Then they returned the money. But yeah, they were trying. So they mapped all of my accounts. And they tried to very quickly. I didn't know. Also, I didn't even, I had, I don't use Monzo a lot. because, again, it's one of those free accounts that you get. It just sits as an app on your phone. Yeah, and I forget.

21:59Yeah. Do the criminals keep the money that they've taken? So when you're getting reimbursed from the bank, they're not clawing this back off the criminals. These criminals, they got away with it. They got the money. So they're still incentivized to carry on doing it, basically, because the bank's out of pocket because they reimburse you. They got their money. it's kind of it's mental isn't it really that like it's good that you're protected but in a sense like they just got away with it yeah well you're protected because you said and i agree that the uk has strong banking regulations actually i have a friend in argentina who went to argentina before sao paulo uh whose uh card was stolen and she had to go to court against the card company because you don't have those protections.

22:47Like, how would you, why would you put people through that? But here it's very clear. If somebody says that they have been stolen, there is a record you investigate and you give the money back. If that has been proven. But the bank has to do it. Not me, which is something I have tried to, to prove to Binance many times. It's like, here's all of the tracing of the money. Here's my investigation. Here it is. What happened? Here's the police report. And, like, why should I prove that what happened happened? It's insane. But, and I'm going to quote Binance in this, Binance Helpdesk. Have you tried doing your own investigation?

23:30Yes, I did. I have more than 100 pages of material. It's just I shouldn't be doing that. You should do that because you were the, I don't know, custodial of my money. Custodial, yeah. And they didn't. And there's an absolute lack of empathy and accountability. I mean, empathy is a human thing. It's fine. I can live without empathy. But accountability comes from a legal perspective. So we know that generally companies are not sometimes very inclined to do what is best for the consumer. But you have laws. So if the FCA, which is the highest authority for financial institutions here, cannot force Binance to be regulated, because when I complain to the FCA, I say, oh, well, here's a list of institutions that are regulated.

24:26Binance is not. Goodbye. Knowing that the biggest exchange in terms of users and transactions is Binance. I think that is really worrying. Yeah, I think the hard thing for the regulator is that consumer choice element. So part of the cryptocurrency promise is it's free of the system and people have the ability to self-custody, own their own assets, be out of the monetary system. And then, you know, if the FCA come out and go, we are banning this business completely, a lot of people would be like, I should have the choice of where I put my money. The downside of that is there are no protections, right?

25:12And it's this kind of this counterintuitive aspect to cryptocurrency sometimes of people want no regulation to be able to do whatever they want with their money until it goes wrong. And then they go, oh, I would quite like those regulations to protect me at this point and to give me my money back. I'm not saying that's the case for you, but I can see, do you see what I mean about the industry? It has that element to it. Yeah, of course. But you are saying, I think in your point, when you say I am my own bank, I am the custodial of my money, you are referring to self-hosted wallets. Binance is a company.

25:46Binance is an exchange. It's an e-money provider, if you want to call it that way. And so you allow them to operate. You allow a company that says they're not going to have a license to operate. Yeah, I think plenty of exchanges go down and people lose all their money. This is a common feature of cryptocurrency. Lots of people get burned. I mean, Mt. Gox, FTX, I could just go on and on and on. I was a bit like, I used to have, I think the most I've ever had on Binance had like£20 ,000 on Binance. My friend had almost the same amount on FTX and then he lost it all. And the way he was so emotional telling me about it, I was like, I work in the industry, I'm no longer keeping any money on exchanges.

26:36He trusted FTX, I don't trust any of them. So I moved it onto cold storage, but like the same thing could have happened to me. If Binance went under, I could have lost lots of money. You can also lose your cold storage. I could have got hacked. Yeah, you can lose your cold storage. You can lose all that money. Crypto is risky, but at the same time, on the other side, when there's like a war in Russia and all your bank accounts gets frozen by the government, they can't freeze your crypto. So it's kind of like you've got the freedom that no one can take it unless they literally take it. So like the government can't freeze your crypto, but you can, someone can take it and you can't do anything about it.

27:10So it is, it is very risky, but it's, it gives you the freedom. But at the same time of the freedom, like Damien says, the other side is you don't have protection. So it's, it is, it is scary. Did you think you were protected as a Binance customer? You ask because their title and slogan is the most trusted crypto exchange in the world. Yeah, because what I'm trying to get to the bottom of is, do you think, and it's a bit of a leading question, and I think you probably answer yes, but do you think that people in the UK think that Binance is protected, regulated? Do you understand? I would say most people think it is.

27:50What did you think your protections were before being robbed? Honestly, I never thought about it before being robbed. All of these questions and new perceptions on security banking came after the theft. But I, yeah, I have read that it was, that it had decided to decline the license, but I never paid attention to what that really meant. I thought that it would have a recovery path, that there would be a recovery path to fraud. And there is not. The worst thing is it's all, there's like evidence of it on the blockchain. and they can see this crypto was sent to this wallet. And you're like, can't you just go and find who owns a wallet and get me my money back?

28:43So it is very frustrating because you're like, there's literally a record of this on the blockchain. You can see where my money went to. I have it. I have it. I have showed it. And they said, I think, we think, they actually told me, we think that your money went to Coinify. So I follow the trace to Coinify. I sent some emails and Coinify said, no, this account is within our liquidity provider, which is called Change Hero. Change Hero is, again, fiat to crypto service, so you can buy with real money crypto. That exchange is in CoinFace, is in Denmark, and the other one is in Luxembourg. Therefore, they are covered, they should be covered by European law.

29:28What did that change? Did that change the story? no because both of them said the police should contact us the police is not going to contact you one of the things so we're going to reach out to the fca for comment on on this and i imagine like one of the things that they might say is we do not regulate them right like you faced one thing i'm interested in is public perception versus the actual regulation and you mentioned the advertising standards agency prior to our conversation it might have been in the conversation so i'm guessing you've had a look at that are binance allowed to run adverts in the uk market about their service to UK consumers.

30:02When you approached the ASA, I'm guessing it's in relation to advertising. So first of all, you explain, why were you approaching the ASA? Well, one day I had to decide if to continue sad and angry, sad and angry, or to do something about it. And that's the day I contacted you and I made many official claims to institutions that I thought would help me. But my claim to the ASA is that Binance says on their website that they are the most trusted exchange in the world. When I say on the website, this is in the copy and in the title and meta description of the search results. But they say that this is not advertising.

30:49Therefore, they cannot hold Binance accountable. Because you're calling it false advertisement, basically. Well, based on my experience, I think that there are some misleading claims, like you say. It's interesting that a brand could put out a perception of trust and being regulated when they're not, ultimately. And probably somebody should take a look at that. Yeah. I am interested. What I thought you might have looked at was whether Binance still advertised within the UK market. I don't know if that's the case or not. I don't think they can. No, so they can't advertise their services to the UK public.

31:21They can't run a TV ad, basically. No. Because the FCA basically said, you can't. Yeah. You're not able. Yeah, but at these conferences, though, they still have big, big, huge stands. But where are the conferences? In the UK? Okay, so they have... They have representatives. They have like... Yeah, you've seen them. I would call that advertising because you've got to pay tens of thousands of pounds for your stands. They're giving away T-shirts and all these kind of things. Yeah, and they're kind of like such a massive brand. I couldn't tell you if I'd seen a Binance advert or not. I just know who they are by osmosis of them being in the industry, right?