Brad Deflin on How to Stay Safe and Private Online | EP 639

0:00Coming up next on PassionStruck. You have to be intentional to protect yourself in this digital age because nobody else is going to do it for you. The ISP, your internet provider, will not do it for you. They're trying to help with certain things, but the fact is your internet provider is sucking up all your personal information with everything you do back and forth. They're part of the game. You've got big tech and big business constantly looking to suck up our personal information, which invariably ends up in the wrong hands and goes sideways eventually. You have the government that really has not been a proponent down to the individual level, certainly on a national level or an enterprise level or a military level, but not on a consumer individual.

0:57You must take the initiative yourself on behalf of yourself as a head of household for your family. Welcome to PassionStruck. Hi, I'm your host, John R. Miles, and on the show, we decipher the secrets, tips, and guidance of the world's most inspiring people and turn their wisdom into practical advice for you and those around you. Our mission is to help you unlock the power of intentionality so that you can become the best version of yourself. If you're new to the show, I offer advice and answer listener questions on Fridays. We have long-form interviews the rest of the week with guests ranging from astronauts to authors, CEOs, creators, innovators, scientists, military leaders, visionaries, and athletes.

1:45Now, let's go out there and become PassionStruck. Coming up next on PassionStruck, welcome to episode 639 of PassionStruck. I'm your host, John Miles, and whether you're back for more or joining us for the first time, I am so glad that you're here. This month on the show, we're exploring the power to change, a series about evolving, not just in your habits, but in your identity, your relationships, and how you show up in the world. Earlier this week in episode 637, I sat down with cultural psychologist, Stephen Heine, to explore how our cultural programming silently shapes who we become. And in episode 638, Michelle Chalfant walked us through the power of emotional maturity and her adult chair model for self-leadership and inner healing.

2:34But what about the power to protect what you're building? Because let's face it, transformation isn't just about becoming someone new. It's also about safeguarding the life you've worked so hard to create. That's why today's episode is a little bit different. Instead of a solo episode, I wanted to bring you this urgent conversation with cybersecurity expert Brad Deflin, founder of Total Digital Security. A very good friend of mine has used Brad's services in the past and thought his message is so profound that he suggested that I do this interview for the benefit of the PassionStrap community.

3:12In a world where cyber threats are growing more personal, more invasive, and more invisible than ever before, Brad makes one thing clear. Cybersecurity isn't just a tech problem, it's a human one. Together, we'll explore why digital risk is now a personal crisis. We go into how scammers are using AI to mimic voices and hijack trust, and most importantly, the three steps you should take today to protect what you've built. This episode is a wake-up call, but also an empowering toolkit. And if you're ready to go deeper into intentional living in everything we do here at PassionStruck, then subscribe to The Ignited Life, then subscribe to our sub stack at theignitedlife.net for weekly insights.

3:59While you're there, join the Ignition Room, our members-only community, and show your support of the community by wearing apparel from our merchandise line. You can also follow along on YouTube at either John R. Miles or PassionStruck Clips for full episodes and bonus content. Here's my urgent and eye-opening conversation with Brad Deflin. Thank you for choosing PassionStruck and choosing me to be your host and guide on your journey to creating an intentional life. Now, let that journey begin.

4:30Hey friends, it's the beginning of 2026 and if you're like me, you didn't come into this year to coast. You came to live with purpose, to show up with energy, clarity, and intention. That's why how you start your day matters. And for me, that starts with Huel. Every morning, I reach for two things. First, Huel Daily Greens ready to drink. The peach and hibiscus flavor is crisp and refreshing. With 42 superfoods, vitamins, and minerals, all in just 25 calories and 1 gram of sugar. Then, I turn to Huel Black Edition ready to drink. With 35 grams of protein, 27 essential nutrients, and no junk, it's a full meal that fuels focus, not fatigue.

5:08I start with Huel because I want to be present, intentional, and ready. not just today, but every day. Start 2026 like a minute. Grab Huel today with my exclusive offer of 15 % off online with my code PASSION15 at Huel.com slash PASSION15. New customers only. Thank you to Huel for partnering and supporting our show.

5:34I am so excited today to welcome Brad Deflin to PassionStruck. Welcome, Brad. Glad to be here, John. As I talked about in my introduction, today isn't the typical episode that I do on the podcast, but I thought it was really important to bring you on today because I've personally lived the chaos of cybercrime. And back when I was a senior executive at Lowe's, I was hired to deal with what at that time was the largest retail hacking incident of its kind. Not sure many of the PassionStruck listeners know that. So I know firsthand that the thread is real, it's evolving. And on a human basis, it's deeply personal.

6:19So I think this is a good starting point. You walked away from a very successful financial career to build your company, Total Digital Security. And what did you see as the shift that was coming before most did that made you leave that successful financial career? So it was an aha moment. It was a sudden realization that the world, the face of risk, as I called it, was changing. When you are in the financial services business and you're dealing with ultra high net worth clients and families and family offices like me, like I was, everything is about risk mitigation, risk management. And that's not just their investments, their stocks and bonds, but it's other elements of risk.

7:14And so we always wanted to be value added and bring up topics that weren't necessarily directly related to the market, but were related to our clients that in many cases would be targets in crimes that others might not be targets like kidnapping, for example. And so I was at J.P. Morgan at the time, it was 2012, managing some of the bank's largest clients around the world, multi-billion dollar families. And we had a series of incidents with the clients where I noticed a pattern for the very first time. And that was that they were being targeted by hackers for a criminal transaction, that is to fake them into sending them money, which was very different.

8:09That sounds obvious today, right? That's what happens and that's what we see every day, all day long. Back then it was different. In 2012, cybercrime was an enterprise level problem. It was around theft of intellectual property. It was about corporate espionage, blackmail in some cases, state actors, Pentagon, very large enterprises, not so much a transaction for criminal gain. These were called black hat escapades or exploits, if you would. This was a very personal thing, and that was a little bit different. And it was happening at this tier because that's where the money was. But what we noticed with these clients is they were still using their AOL email accounts that they may have opened in 1996, or their Yahoo accounts or their MSN Hotmail accounts.

9:07While they were captains of industry in some cases, and they had the best IT departments ever in their companies, that was not transcending into their personal life. There were no defenses. There was no awareness. and I coined it the democratization of cyber risk. And what I meant was that those were the very first indications that there was a shift where it was going to begin focusing on anybody that was connected to the internet because at that point in 2012, we all were, which was a new phenomenon. It was coined the mobile revolution. It was unpredicted by anybody. But when Steve Jobs pointed to his first iPhone and he said, this changes everything, he was spot on.

9:55He wasn't talking about the iPhone necessarily. He was talking about a supercomputer in the palm of your hand connected to five or six billion others around the world. That's what changed. And people, the mobile revolution was all about people wanting to use their personal computer, their device, their phone, wherever they were, the subway, Starbucks, the hotel. They didn't want to have to come home and turn on the computer under the desk and then get to work. So then we had clouds and all of our information was dispersed and vulnerable. And that was really the moment that kicked off this enormous cybercrime epidemic that we see today.

10:40And so we noticed some of those fact patterns. We realized it was the start of something very big. And that's when we started the company. On PassionStruck, we talk a lot about human flourishing and building an intentional life. And the reason that you're here is because of a listener of the show who had a personal experience that they brought to my attention where because of a threat to them, they had to chase down their auto pays. They had to freeze accounts, reset passcodes. And it basically disrupted their life for almost two months. And I bring this up because that's who referred me to talk to you.

11:24And I thought it was important. but you go through all this trouble of creating a life with intention. You start building the life you want and creating this massive wealth that you want to bring into your life. And so when you and I were talking about the need to do this episode, the thought to me was you have to be intentional about how you protect it as well. So my question to you is why do you believe cybersecurity and our own personal security is now a pillar of living intentionally. What really attracted me to doing this podcast with you, besides having the mutual friend, the mutual client, when I looked into your podcast and understood where you were coming from and some of the value that you added to your listeners, I felt that it was very much aligned with the principles and what we see is our mission here, which we describe as cybersecurity for life.

12:23Let's think about that a minute. Cybersecurity for life, multiple innuendos there. And the point is that you have to be intentional to protect yourself in this digital age because nobody else is going to do it for you. The ISP, your internet provider, will not do it for you. They're trying to help with certain things, but the fact is your internet provider is sucking up all your personal information with everything you do back and forth. They're part of the game. You've got big tech, right, and big business constantly looking to suck up our personal information, which invariably ends up in the wrong hands and goes sideways eventually.

13:10You have the government that really has not been a proponent down to the individual level, certainly on a national level or an enterprise level or a military level, but not on a consumer individual. You must take the initiative yourself on behalf of yourself as a head of household for your family, as a person that works with a small group. We deal with family offices, for example, because, again, nobody's going to do it for you. And if you think that the Internet service provider with their antivirus is going to help or if you think that the little features of it, it's not. But the perpetrators are so smart, are skilled at using state-of-the-art technology for efficacy that the only way you stand a chance in this hostile environment is to intentionally protect yourself, to take the responsibility on behalf of yourself and those that are counting on you to protect yourself.

14:17because probabilities are very high that something can go wrong. And yes, when it does go wrong, recovering in two months is not bad. I've seen cases where it's taken two years to recover. There is a long tail to recovering. We can talk about that in a little bit. But my point is to get to where I believe you need to be in today's hostile environment, much less the future with AI, you've got to take the first step. You've got to take the initiative. You've got to do some critical thinking and invest in protecting your personal information, having the privacy that you seek, and being able to enjoy everything the digital world has to offer, including the internet and artificial intelligence, in peace, with a sense of peace.

15:09It takes an intentional effort to accomplish that. And I'm sure you see it on an everyday basis almost, but I have heard it from my parents and friends of my parents and friends of mine and other colleagues that they're hit by ID theft, financial fraud. But in some cases, they're even being harassed by these perpetrators. From your view, how widespread is this epidemic and how much is it growing in magnitude? We see it every day, all day. But at the end of the day or at the end of the week, we still shake our heads with, wow, this stuff is crazy. And it just keeps getting crazier. We just keep saying that over and over.

15:58But from a higher point of view beyond what we do all day every day, the current statistics are that somebody in the U.S. has their ID stolen. Every 22 seconds in the U.S., a citizen of ours has their identity stolen. That amounts to something between$50 and$75 billion in losses, those ID theft cases, according to the FBI. And according to the FBI, it's growing at a rate of 20 to 25 % a year. Overall, besides ID theft, cybercrime is now costing global GDP about 1%. About 1 % of global GDP represents damages or damages represent about 1 % of global GDP, which is almost$10 trillion. dollars our estimate in damages just 18 months ago was six and a half trillion that was adjusted by all the ones that run these numbers to ten and a half trillion now so it's an enormous element when you put it together and what's really interesting john and i think that has to be understood is that when we started in the business 99 of these damages were enterprise state-level damages.

17:20It wasn't even on the radar screen where the consumer damages are. Today, when you look at damages in its totality, about 70 to 80 percent of those damages are now consumer damages. So the overall pie of damages and exploit is growing and growing, but the portion to consumers, individuals, everyday users of technology is even growing faster than the overall pie. And that brings us to where we are today. I think I shared with you that I have a very good friend who used to be the chief information security officer of a bank that was almost the size of JPMorgan Chase. My understanding is JPMorgan Chase is still the largest bank in the United States.

18:08This one was probably the second or third in term of size. And he shared with me candidly that on a weekly basis, tens of millions of dollars would disappear out of people's accounts and that the government would come back in and fill it back up because they didn't want to create wide-scale panic. Oftentimes, the victim didn't even know it was gone before the bank replaced it. Do you think that's going on across all the banks? And this is just something that most people aren't aware of? I don't know. I don't have that inside knowledge. It doesn't surprise me. I wouldn't doubt it. I do have a sense that broadly, the level of damages, the volume of damages has been under reported.

18:58I'm not sure exactly why. On one hand, I think that if you can use a big company name in your headline, the headline is more interesting. I don't know. Or if you can say the exploit was $100 million in damages, that might be a better headline than I lost$10 ,000, right? I don't know what the reason is, but we, by all means, feel that this is a massively underreported situation, certainly in the United States. I would tell you that next time you go to a retail branch at a bank, if anybody ever does that anymore, look to see where the line is. And you might see, they call them the private banker or the local banker, where you might want to go in and talk about getting a mortgage, a car loan, whatever.

19:53That line to get into one of those private offices at your local branch, more often than not, is a line of people that have just lost money that are receiving texts that they don't know if they're real or not, are receiving emails and voicemails, and they're very confused about what's happening, and they need to talk to somebody about straightening it out. Those indicators tell me that we have an underreported situation here at the current time. I just closed on a house, and I have to tell you a couple things are always nerve-wracking for me. One is when you wire the money, going through those digits so many times to make sure that you're sending it to the right place, especially if it's a lot of money.

20:43You push the button. For as much as people have gone to online banking, I was shocked this last time how difficult it was to get an appointment in one of these branches. And I bank at a well-known bank that had probably seven or eight branch offices within about a 10-mile radiance from me. And I could only find one appointment on the day I needed to wire the money because they're all so busy. So I think maybe what you're saying, you're on to something. So for the average listener or average viewer of this, a lot of what we're talking about feels invisible until it's too late. What are some of the most overlooked ways people are exposing themselves every day without even realizing they're doing it?

21:31You're right. It's a very abstract subject. People struggle to see in their mind's eye the risk, what's going on. And it's very frustrating, very unlike traditional crime. There really aren't forensics that you can speak of or certainly not traditional forensics. We are not taught certain life skills. We're taught don't walk down the dark road, dark alley, don't cross a busy street, right? But we're not taught necessarily about what's the right way to use social media. What's the art and science of using passwords? How do you optimize your browsers to defend yourself? Are you using MFA on every single account that you have?

22:24Have you transcended considering MFA an inconvenience to considering it an empowering element of protecting yourself, an empowering element of taking the initiative and the intention to keep yourself safe on the internet. So we try to talk to people in ways that they can build in their mind's eye the different elements that make a difference so that they can focus, they can pay attention, and they can develop what we call critical thinking skills. But you have to go back to the fundamentals in anything you work with. You have to go back to the fundamentals, and the fundamentals here are, number one, email is a very popular attack vector.

23:09When you are at your inbox, you've got to be on your toes. You've got to treat emails as guilty until proven innocent, right? And you've got to be really discriminating around how you treat your inbox. You've got to use good passwords. And I can talk about that in detail on how to use good, the art and science of passwords, if you want, John. You've got to use MFA, okay? Just before you go on, can you explain what MFA is in case someone doesn't understand? MFA, 2FA, two-factor authentication, it all essentially refers to the same thing. and what it is it's an added proof that you're the right person trying to get into that account is it assures through two methods that you're the right two separate completely separate methods one might be well they know the password okay but do they also have the device they say they have with the phone number so they can send you a code so if you entered your password on the website and you also got a text and entered the code that you got on your phone, that's two factors saying you're the right guy.

24:26Just adding that additional factor of getting that code mitigates the risk of somebody having stolen your password and getting into your email account immeasurably, like 90 % is mitigated, right? It's one of those easy things. So any account that makes any difference at all to you, apply and enable two-factor authentication, MFA they may call it, and get those codes before you get in to your website. It will make your life much more secure. Yeah, and it's not just that. I've had some colleagues who are on YouTube who had successful YouTube accounts where they were making a lot of monetization on them.

25:13They didn't have two-factor authentication on them. Someone takes over the account and then holds them hostage and charges them a ransom to get access back to the account. Are you also seeing things like that happening with other social media accounts? Absolutely, all the time. And so I think the default is any online account you have, enable two-factor, because there may be other information that could be interesting, personal information. Maybe they won't hack the account. Maybe there's no ability to financially move money, but there would be the ability to gather more personal information, to compose some sort of exploit, because they know certain information that's on that.

26:00website it's so just basic habit enable two-factor authentication MFA and I would say one more thing especially if you're a crypto trader especially if you move money in motion right is a honey trap that's money in motion is what hackers are looking all over the internet for every day an estate settlement a closing transaction on a home a wire transfer a stock option exercise that might be public, et cetera, et cetera. If you are of that type that is moving money for whatever reason, instead of getting SMS codes on your text, opt to get an authenticator. That adds another level of security. Microsoft makes an authenticator, Microsoft authenticator.

26:56Google makes an authenticator, Google Authenticator. I prefer Google Authenticator. It's user-friendly and it's easier when you get a new phone than Microsoft is. However, some Microsoft products require you to use Microsoft Authenticator. What happens, though, when you use Authenticator is it lops off a whole other element of risk, and that is if the phone company has been hacked or there's an insider at the phone company. there's a third party that somehow is able to get those texted codes to you that's a risk when you use an authenticator you eliminate that risk so again if you're an investor crypto trader whatever you're wiring money around whatever your duties are as a fiduciary by all means download an authenticator and start using it with these important accounts i use it for everything from my YouTube accounts to my social accounts to my major bank accounts.

27:57And I also use services similar to LastPass and others help me generate strong passwords. What would be your advice on the password side? So those are great habits. And I think a password manager is essential. You still have people that say, I don't want all my eggs in one basket. And I understand that, but we have to think a little bit deeper. If you keep a spreadsheet of your passwords, all your eggs are in one basket. Whatever you're doing, you have that risk. The fact is, though, that the best password managers, and I think most of them in the industry now, separate the keys to the encryption of your passwords.

28:44They're in two separate places. So LastPass could be hacked, and LastPass has been act but they're not going to get the passwords because the encryption key is someplace completely different we prefer one pass there are other good password managers but one pass one password i should say is the name it's the number one password is consistently ranked in our due diligence consistently is at the top in terms of governance technology user experience and really importantly innovation. They're now making it easier to add pass keys. So you don't even need to enter any SMS codes because you're taking the pass key approach built into your password manager.

29:33So all you do is click a button without entering any codes or numbers, and you're in without compromising any security. So password manager is essential. Pick one of the top ones. They're all in the top two, three, four. We like one password. And let's talk for a minute about the art and science of making passwords. First of all, when you use a password manager, you really only need to remember one password. And that's your master password to get in to the password manager. That is your vault of passwords. That should be long and it should be unpredictable. And this is why. We've always been taught that a good password should be long, should be unpredictable, and should be complex.

30:19That is lowercase, uppercase, numbers, symbols, right? Honestly, complexity is not what drives a good password. Only two things drive a good password, and that is length and lack of predictability. Some websites still require you to add complexity, uppercase, lowercase, and that's okay. but you can make it easy on yourself by just putting an exclamation point in a one two three after a long password the science of passwords is this if you use up to 12 or 14 characters and that's a long password to a lot of people but if you use up to 12 or 14 anybody can buy a password hacking software program or get it for free now on the internet they can hack a 12 14 character password in less than an hour sometimes even minutes but the law of large numbers helps us when we go to 16 characters that will take years to crack using these password managers it's simply much harder to do with long chains of numbers and characters how though can you remember nobody the human brain is not wired to remember 16 18 20 22 random characters in a row don't even try what to do is to use two three four words or a phrase it can't don't make it predictable don't make it don't make it a success in 2025 all right three or four words for example a good password might be and I use this in the past think about this cowboy palm tree moon and then a number one and an exclamation point because most websites require the complexity now in my mind's eye when I try to remember that password I see a cowboy leaning against a palm tree on the moon.

32:26I capitalize cowboy, P on palm tree, M on moon. It satisfies the needs for my master password. I still write it down and put it in my sock drawer because the brain is a weird thing and you do not want to lose that master password. You will have issues, right? But that's the way to at least construct it. Now, when you've got a long, good master password, you get into your password manager vault and everything else is done for you. I have mine set to 22 characters. My Amazon account has 22 random characters. All accounts have very long, complex passwords that nobody could ever guess or hack using any modern password hacking software.

33:15And I will commit to you, any of the listeners, viewers, that if you just take a little bit of time to download the password manager get used to the user interface and make a habit of using it for all of your accounts i commit to you not only will your life become vastly more secure online your life will become vastly more convenient you go to amazon and bing it fills in 22 long characters and you're ready to go you're not looking around you're not you eliminate all that frustration and friction and it works really well so we actually hold one hour we call them computer coaches to help people just ramp up the learning what here's how you look at the user interface here's how you get started that expedites the learning curve the process for individuals and then they're on their way and you've got a lifetime partner in your password manager to stay secure and be convenient.

34:18Awesome advice. Brad, I now want to take us to a topic of what's really happening under the surface right now, especially the rise of something called the smishing triad. What is it and why should every listener and viewer be paying attention to this emerging threat? Thank you for that question because it's a really big deal and it's something that we must be aware of. And I'm going to tell you why. First of all, smishing. We all know what phishing is. And that is, for example, an email comes in and it purports to be somebody else. And we've seen the awkward versions from Nigeria, the prints and all that.