47 min
Fraudologyへようこそ。
今週は「Frank on Fraud」とPoint Predictiveのフランク・マッケンナをゲストに迎えます。というのも、今回の件はあまりに複雑で、一緒に整理してくれるもう一人の頭脳が必要だったからです。
Merchant Fraud Allianceの議題作成に没頭していたところ、スマートフォンの通知が鳴りやまなくなりました。それは、重大な出来事なのか、単なるネット上の騒ぎなのかを見極めるうえで信頼している人たちとのグループチャットでした。そして今回は、本当に重大な出来事でした。Brian Krebsが、本物の運転免許証を販売するダークウェブ上のポータルを発見したのです。表面、裏面、バーコードまで、すべてそろっていました。価格は1件あたり約100ドル。米国の全人口のおよそ60％に相当するデータが、ほぼ誰でも購入できるデータベースに収められていたのです。
このエピソードの残りでは、掘り下げていくと想像以上に密接につながっている二つの話を取り上げます。データ侵害そのものは、話の半分にすぎません。もう半分は、誰もが知る数多くの企業の舞台裏で本人確認を担っているベンダーについて理解することです。だからこそ、この侵害は表面上見えるよりもはるかに重大なのです。続いて、昨年フランクが初めて警鐘を鳴らして以来、ずっと気になっていた詐欺に話を移します。「デジタル逮捕」は、被害者を心理的に拘束する詐欺の一種で、今やインドから米国へと正式に波及しています。実際に被害者が出ており、損失額も7桁に達していることが、その事実を物語っています。
覚悟してください。これと闘い始めるには、まず自分たちが何に立ち向かっているのかを知る必要があります。
このエピソードでお届けする内容：
- 本人確認サービス事業者で発生したサプライチェーン侵害により、1億5,300万件の運転免許証の現物データが流出した経緯と、それが一般的な小売業者のデータ侵害と異なる理由。
- かつて不正検知ソフトウェアが偽造身分証明書の検出を重視していた理由と、使用される身分証明書が本物である場合に、そのアプローチ全体が通用しなくなる理由。
- AIディープフェイクを使った運転免許証の偽装技術により、実在する盗難免許証の顔写真を自分の顔に差し替え、ライブネスチェックを通過できてしまう仕組み。
- デジタル逮捕とは実際にどのようなものなのか、そしてその影響は限定的な範囲にとどまると思い込んでいた私が、なぜ間違っていたのか。
- 2か月間にわたって監視下に置かれ、420万ドルを失った女性を含む、米国の被害者の実際の事例。
- デジタル逮捕詐欺が、警察官やFBI捜査官を装った電話、陪審員義務違反を口実に保釈金を要求する詐欺など、米国独自の手口へとどのように発展してきたか。
- カンボジアにある詐欺拠点や「豚の屠殺」詐欺のインフラが、現在、新たな種類の詐欺に転用されている実態。
- 陪審員義務や保釈金をかたる詐欺電話の一部が、米国の刑務所内に不正に持ち込まれた携帯電話からかけられていると報じられている理由。
次のような方は、ぜひこのエピソードをお聴きください：
- 本人確認、KYC、不正防止に携わっており、「身分証明書が本物である」ことが実際に何を証明するのかを考える必要がある方。
- 銀行で不正対策やリスク管理に携わり、デジタル逮捕詐欺の被害者が脅迫されて多額の現金を引き出す場面に最初に遭遇する可能性がある方。
- あるベンダーでの情報漏えいが、どのようにして数十もの有名大手ブランドの顧客をひそかに危険にさらすのかを理解したい方。
- 消費者対応チームの一員で、窓口にいる顧客が詐欺師と電話していることに気づけるよう、現場スタッフを訓練する必要がある方。
エピソードノート
今回の情報漏えいが、これまでよく耳にしてきた小売業界の情報漏えいと異なる理由
今回被害に遭ったのは小売業者ではありません。大手小売業者やカジノ、レンタカー会社、さらには政府機関までが、本人確認のために裏側で利用しているベンダーです。つまり、大きく報道される企業が、必ずしも問題の発生元とは限りません。また、1社のベンダーで情報漏えいが起きるだけで、互いに無関係な幅広い業界の顧客情報が一斉に流出する可能性があります。自社の本人確認システムを裏で支えているベンダーを把握していなければ、自社が直接ハッキングされていなくても、この種の情報漏えいによって被害を受けるおそれがあります。
本人確認において「本物」がもはや「安全」を意味しない理由
本人確認ソフトウェアの多くは、偽造された身分証明書を検出するよう設計されています。このアプローチは、不正が書類そのものにあることを前提としています。しかし、今回の情報漏えいによって、その前提は覆されました。現在、1億5,300万件もの真正かつ有効な運転免許証の情報が流出しており、盗まれたバーコードやAIで生成した顔のすり替えと組み合わせることで、本物の身分証明書が悪用されるケースを想定していない生体検知を難なく通過できてしまいます。不正対策チームが問うべきなのは、「この身分証明書は本物か」ではなく、「この身分証明書は本当に、それを提示している本人のものか」です。
デジタル逮捕を基礎から解説
この詐欺が具体的にどのようなものなのかを詳しく説明したいと思います。初めてその手口を聞くと、本当に混乱してしまうからです。被害者は捜査対象になっていると告げられ、友人や家族から隔離されます。偽の秘密保持契約書に署名させられることもあります。被害者は常にビデオで監視され、ある事例では睡眠中でさえ監視されていました。そして「容疑」を取り消してもらうために、巨額の金銭を支払うまでそれが続きます。この詐欺が成立するのは、電話を切るよう被害者に助言してくれる外部の声をすべて遮断するからです。
インドで始まった詐欺が米国に広がるまで
昨年フランクが予測したことは、ほぼ彼の予想どおりに現実となりました。デジタル逮捕詐欺はインドから日本、ブラジルへと広がり、今では米国にも及んでいます。米国内で初の大規模な事例が明らかになったのは7月です。手口の見せ方が変わっても、心理的なパターンは一貫しています。被害者は、偽の捜査機関による捜査だと告げられることもあれば、詐欺対策部門からの電話を装って偽のFBI担当者に転送されたり、陪審員義務や保釈金を口実にした詐欺だったりすることもあります。どのような名目であれ、あなたを孤立させ、秘密にするよう求めてきたら、それが詐欺のサインです。その電話は、相手が名乗る機関からかかってきたものではありません。
なぜ銀行とその窓口担当者が、この詐欺への対応の最前線に立っているのか
この詐欺では最終的に被害者が実際のお金を引き出したり送金したりする必要があるため、銀行の窓口担当者が防波堤となることが少なくありません。被害者が詐欺師とリアルタイムで電話をつないだまま、何をどう言うべきか細かく指示されている状態で、窓口担当者が応対するケースもあります。窓口で携帯電話を握りしめて取り乱している顧客を見かけたら、たとえ書類に不審な点がなくても、改めて注意深く確認し、声をかけるべきです。この段階では、書類もおそらく正規のものに見えるからです。
重要なポイント
重要なポイント：
- ベンダーレベルのサプライチェーン侵害が発生すると、互いに無関係な数十の業界の顧客が同時に被害を受ける可能性があります。問題の発生源は小売業者ではなく、その背後でサービスを提供する本人確認事業者だからです。
- 米国の成人人口の推定60％に相当する1億5,300万件の実在する運転免許証が、表面・裏面・バーコードのデータが完全にそろった状態で流通している可能性があります。
- 偽造身分証明書を見破るための不正検知システムも、免許証そのものが完全に本物で、盗難品である場合には役に立ちません。
- 現在では、AIディープフェイク技術を使って、盗まれた本物の免許証と合成された顔を組み合わせ、多くの一般的な生体検知チェックをすり抜けることができます。
- デジタル逮捕詐欺では、被害者を孤立させ、偽の法的文書を見せ、常時監視することで心理的に追い詰め、巨額の金銭を支払わせます。
- デジタル逮捕詐欺はすでにインドから日本、ブラジル、米国へと広がっており、米国では数百万ドル規模の被害が確認されています。
- 米国内で見られる亜種には、詐欺対策部門を装った電話から偽のFBI担当者へ転送する手口や、陪審員義務・保釈金を口実にした詐欺などがあり、その一部は刑務所内に不正に持ち込まれた携帯電話を使って行われていると報告されています。
- こうした詐欺は通常、銀行窓口での多額の現金引き出しや送金に至るため、支店の職員がその場で介入できるケースが少なくありません。
最後に押さえておきたいポイント
これらの事例に共通しているのは、私たちが何かを正当なものかどうか判断する際に頼っているツールや信頼の手がかり、そして近道です。正しくスキャンできる運転免許証。公的機関からの連絡らしく聞こえる電話。適切な書式で作られた文書。今や、これらはどれも、それだけでは信頼できません。本物の身分証明書が流出する情報漏えいであれ、法執行機関に対する人々の現実の恐怖心につけ込む詐欺であれ、詐欺はもはや偽物の陰に隠れているのではありません。操作可能な本物の陰に潜んでいるのです。だからこそ、こうした詐欺が実際にどのような仕組みで行われているのか、最新の情報を把握し、その知識を周囲の人々と共有することが、被害を防ぐうえで非常に重要です。相手が顧客でも、同僚でも、家族でも、まずは話し合うことから始めましょう。
エピソードの参考資料とリンク
つながる：Frank McKenna | LinkedIn
Point Predictive 共同創業者兼チーフ不正対策ストラテジスト
Fraud Fight Club コーチ
著者：Frank on Fraud
つながる：Karisse Hendrick | LinkedIn
Fraudologyポッドキャストのホスト
受賞歴のあるサイバー詐欺対策の専門家
Eコマース詐欺防止コンサルタント
スタートアップアドバイザー、基調講演者、
フォーチュン500企業の小売事業者向けコンサルタント
Episode transcript
Karisse Hendrick
00:07
Welcome back to the Fraudology podcast. I'm Karisse Hendrick and I am joined by the Frank McKenna of Frank on Fraud blog and also he's a co-founder of Point Predictive. I always enjoy talking about fraud with Frank and I know you guys enjoy listening to us and it's been a little while and we have some pretty big topics to talk about today. One is a new well I guess they're both kind of in the news. So Frank, welcome to Fraudology again.
Frank McKenna
00:40
Thank you. I love uh getting on here and talking to you about what's new and what's happening in the world of fraud. I think it's been at least a couple months.
Karisse Hendrick
00:49
Mhm.
Frank McKenna
00:50
That we've gotten together and so much has happened, right? It's hard to hard to believe so much happened so fast, but we had some big hits this week, right?
Karisse Hendrick
00:59
We did. And that was kind of how I was going to kick off the episode was I mean, if anyone follows me on LinkedIn, they've probably seen it. I guess, you know, a few I over 5,000 people saw this, this uh post that I just literally did on a Wednesday night. Um, so, uh, backstory, the way I found out about this post is I was getting some work done on the Merchant Fraud Alliance, um, uh, agenda and my phone kept buzzing just like over and over and over again. I was like, what's going on? And I mean, I knew where my daughter was and I knew it wasn't like an emergency, but I was like, what? And it was my group chat with Frank along with Maryanne Miller, Matt Vega, and Hailey Windham. Um I am I think those are you know four of the greatest minds in fraud and we all have different perspectives. So um oftentimes we'll share you know news articles that we think are interesting or you know hey does anyone know anyone at this company or this bank or you know that type of thing. Um, I wouldn't say it's going off daily, but um, it usually doesn't go off as much as it was on the other day. And so I looked at it and then I had to like scroll backwards to try to figure out what was going on. And was it Maryanne that shared the article? Well, I think it was Maryanne that shared it first.
Frank McKenna
02:35
Well, it was uh I'll read you the the I got the text message right here. So, it's 4:30 on a Tuesday and I'm
Karisse Hendrick
02:44
Okay. Yeah. Tuesday
Frank McKenna
02:45
I was scrolling through LinkedIn and you know boop pops up from Brian Krebs. Uh who you know is journalist that covers cyber security, well-known guy. And he had, he said I got something really spicy And it turns out um he had found the day before, I think it was Monday, he had discovered there was a dark web uh channel that was offering 153 million driver's licenses on the dark web for sale for about $100 a piece. But this was, this portal was called Nexus and you could go in there and search any name and pull up the person's driver's license, uh scans of their face, uh
Karisse Hendrick
03:38
When it was scanned, right? Like the date when it was the day
Frank McKenna
03:43
And uh Pete Hexith was on there. Brian Krebs was on there. Uh family members of Brian Krebs when he searched were on there. 153 million. Yeah. So I think I immediately looked at that and go I said this this is crazy. And I posted in the chat and I said, "Oh man, this one's going to be bad." And then then it went from there. Me, you, Maryanne, Matt Vega were just going through. We could not believe it. And uh we call it we I think collectively I think I said breach of the year and Marian said this is the target breach of this year. And then uh you posted on LinkedIn. But yeah we're this is such a damaging breach because of what they got but also because of what they can do with it. Having the driver's licenses with AI now anybody can be deepfake, they simply change the face with AI. They have the whole driver's license. They have the barcode on the back. That barcode is used by a lot of these identity vendors to determine if it matches to the DMV. So, there's this is the biggest treasure trove of driver's licenses ever. It's it's not only the biggest breach of documents that I could ever that I could find this year. It's ever. Like this rivals like the impact would be up at like Equifax.
Karisse Hendrick
05:08
Oh.
Frank McKenna
05:09
So it's a it's a bad one. But three or four days later there's no information from the company about if this is true or not, and the database disappeared. So now
Karisse Hendrick
05:22
Well, the original database disappeared, right? But what Matt explained was that many people downloaded it and had copies of it. So, it's still available, but now I'm wondering how maybe they downloaded just the, just the marketplace piece. Cuz that they couldn't get the actual scans unless they paid $100 each. So maybe it is, maybe the source could have, maybe they just posted like the the listing. And the database where you can search for people. But maybe not the actual driver's licenses. I
Frank McKenna
06:02
Yeah. Appeared. Disappeared. It's a big deal. It's, but nobody knows anything. FBI hasn't said anything. But the story is not over with this. This is going to be, this is bad. And it's it's real. I mean, Brian Krebs uh knows what he's doing and he went out there and verified this information. He knows who
Karisse Hendrick
06:24
Well, and not only that, but I verified it with uh more than one merchant that uses this vendor.
Frank McKenna
06:34
Really? Did they get a notification from the vendor?
Karisse Hendrick
06:37
They did. They were made aware. They were made aware before I, before Krebs's article came out.
Frank McKenna
06:46
Oh. From the company.
Karisse Hendrick
06:47
Yep. From We'll we'll name them because Brian names them. Um ID Scan is the name of the vendor.
Frank McKenna
06:54
Oh, ID Scan. Yeah.
Karisse Hendrick
06:56
Yeah. Yeah. And ID Scan notified the merchants uh the the companies and the government agencies that use um that use them. Um the thing about ID scan, I've known about them in the market because a couple of merchants that I work with use them. Um they're not the on, they're starting to try to get into online verification with driver's licenses, but the majority of their scans and I can't remember maybe you have it handy from our text messages. How many thousands of is it like 200,000 driver's license scans a month or something like that that they process?
Frank McKenna
07:34
20 21 million a month.
Karisse Hendrick
07:36
21 Okay, I was off. 21 million.
Frank McKenna
07:40
Yeah, I thought it was 21 million. And they work with Herz, they work with uh
Karisse Hendrick
07:46
Target,
Frank McKenna
07:46
A bunch of, Target, a bunch of big companies. You go into any cannabis store. I think they're used to have like the cannabis industry. Uh rental car industry, uh Caesars, Las Vegas.
Karisse Hendrick
08:02
Yes.
Frank McKenna
08:03
So there's travel, you know, there's a lot of places where they're, I can't remember what they said, but thousands and thousands of locations world worldwide or
Karisse Hendrick
08:15
They also, yeah, the some of their other nameable ones are um GameStop, FedEx, Planet 13, which is for cannabis dispensary, ID scanning. Um, Circa Resort and Casino, um, you mentioned Caesar's Entertainment, uh, for age verification and casino compliance. So, um, the the thing I was going to say about them that makes this even worse than if it were an online retail, you know, like what are the online vendors? I'm not going to name any of them, but like the ones that, you know, do liveness checks for, you know, uh short-term vacation rentals. Or um you know, that type of thing. You know, or for um delivery drivers or that type of thing. Um there's those vendors, but then ID scan is different because they're actually scanning the physical driver's license. So, they have special technology with lighting, some kind of blue light technology that picks up the holograms and other um unique pieces of a driver's license that you can only pick up with special lights when they're scanning it. So, I guess they own, I think they own the patent on that. I was reading. So, um they're the only vendor that has like the holograms and all of that. Not only just a a picture of the driver's license, but it's like 3D almost. Um, yeah. And they have the back of the card with the barcode as you mentioned. Um, yeah. So, it's it's significant, right? Like I think you had said that 153 million is about a third of the the adult population of the United States. So, one in three.
Frank McKenna
10:10
It's uh 60% though.
Karisse Hendrick
10:13
Oh, it's 60%. Never mind. I was wrong.
Frank McKenna
10:16
Yeah,
Karisse Hendrick
10:17
I was taking the 30% that didn't. Okay. Yeah. So, 60% of the the US population has probably had their driver's license stolen. Um I know that I'm part of that because I I've been to at least two of the, I've had my ID scanned at at least two of their uh their customers. And um this is what they call in cyber security a um supply chain breach, right? Where the actual end target, like not no pun intended there. But like the target the store, Hertz, Caesars, you know FedEx, whatever. They might be who that the hacker wants to get you know they want to get the driver's license that have been scanned at those companies. But instead of attacking them directly because they don't store that information with themselves, they attack the vendor that you that stores that data. And the vendor that those merchants use. Unfortunately, those merchants now get dragged through the mud because the vendor they used got hacked.
Frank McKenna
11:28
Well, yeah. So, if you think about Caesar's Palace being one of those those companies that is a customer, they were hacked like a year ago, which was right around the time that they say they they broke into ID scan. You wonder if
Karisse Hendrick
11:47
Oh, really? I didn't put two and two together.
Frank McKenna
11:51
Well, so it's just interesting timing with this. I think Caesars was
Karisse Hendrick
11:55
I think, okay so I'm putting two and two together. And if I if I remember correctly, I remember talking about the Caesar's breach on the podcast. And I think that Scattered Spider, which is a Russian hacking organization. Kind of like their version of Anonymous. Um they took credit for the ransomware breach at Caesars. Um, our source that has a lot of credible threat intelligence, um, you know, did some deep dive uh, analysis on the dark web on when this, uh, portal or this channel was was live. And said that he was able to track it to one of the most prolific users uh, that is part of Scattered Spider. So, it's actually the same hacking group that hacked Caesars and did a ransomware scam or not ransom but ransomware breach uh a year ago is also responsible for ID scan. I didn't know that the ID scan breach was a year ago. I thought it was more recent than that.
Frank McKenna
13:08
No, the uh the Caesar's breach was actually
Karisse Hendrick
13:14
So yes, oh okay.
Frank McKenna
13:15
You have a, you just have these, you know, the fact that you have these hackers that are hitting multiple locations. You know, could there be a link between ID scam getting breached because the Caesar, the Caesar's environment was breached? And maybe they could infiltrate backwards into their vendor's cloud databases, and then they went from there. So this is this this is just guessing.
Karisse Hendrick
13:40
This is just hypothesis on our end. Yeah. Yeah. I want to be clear, like but I did put, yeah. I do think if I remember correctly Scattered Spider did Caesars and Scattered Spider is tied to this ID scan breach at least from the information I've been given. So, it's not, you know, it's not for sure, but it's just it's putting puzzle pieces together. Um, we should talk about what this means for everyone else, like consumers as well as businesses. Um, because you're right, it's not just what was stolen, it's how it's going to be used. And that's the scariest part, I think, of all of this.
Frank McKenna
14:26
Right. Yeah. So, you've seen maybe I've seen it too cuz I presented with it, but David Mimone showing how you can take an ordinary driver's license. Uh, create a deep fake picture with Google Gemini. Uh, create a deep fake of that license with the new deep fake picture you took and basically impose that AI image on top of the driver's license and do the selfie checks. You know, with the making the AI image move their, its head from left to right. So the fact you have these licenses that could be purchased for 60% of the population, it's just going to mean that people could have their licenses used uh and have AI deepfakes posing as them in the wild. Right? Because your barcode, which you know, there's a lot of those identity vendors that use that barcode as definitive proof that it's not counterfeit. And then you have all the right information on the front of the license. You have a new picture on that license that is either you or deepfake and you can go in and get a credit card, buy a car, go to, you know, online retailer. So, and again, we're just new using our experience. What happens in these breaches, they eventually get used uh in different ways. And with AI, I think this is going to be a very very good source of data for scammers and hackers, too. You know, if you want to really get a lot of money from somebody, get their license off of the uh off of the dark web, their actual license with your actual barcode.
Karisse Hendrick
16:14
Yeah. Because and I think the problem is that a lot of the detection software for for IDVs, for identity verification documents, um or you know identity document verification. Like at banks, at lenders, at you know, like I said long-term you know vacation rentals, all kind you know uh actual rental, like so many services online, require a copy of your driver's license, and or a selfie check. And what they're looking for is fake IDs. What that software is looking for is, you know, um forged identification cards. They're looking for fake driver's licenses. The problem is 153 million real driver's licenses are now exposed. So the detection that banks and lenders and retailers and, you know anyone in e-commerce from gambling, to you know uh marketplaces, etc, the gig economy, whatever. They're all relying on software that can tell them if it's fake. But but if it's a real driver's license, they can't tell you that that doesn't belong to the person that's holding it. There's there's no way to do that. So they can, it will be real. So it will pass a lot of those checks which I think is what makes us you know, so worried right? Uh for synthetic ID and everything else. Yeah.
Frank McKenna
17:54
And even though the company hasn't uh, I just was looking over the news. I was trying to see did anything happened today.
Karisse Hendrick
18:00
Yeah. I haven't seen
Frank McKenna
18:03
There, nothing from the company yet, but there are lawsuits already being launched by class action attorneys. So,
Karisse Hendrick
18:10
Wow.
Frank McKenna
18:11
They're uh, they're actively advertising, you know, that they're going to do a class action lawsuit. Now, whether or not happens, I don't know. But yeah, there's a lot of attention here. People are waiting to see what happens with this breach.
Karisse Hendrick
18:24
Yeah, I do see that NBC News covered it a day ago. That's the first legitimate news source other than Brian Krebs that I've seen uh do. I mean Bleving Computer and TechCrunch picked it up of course from Krebs, but. Oh, I didn't know the ID scan is uh based in New Orleans.
Frank McKenna
18:43
Yeah, based on New Orleans.
Karisse Hendrick
18:46
Yeah. But um yeah, so that that was a huge piece of news. Um that I definitely wanted to make sure that we talked about. But I actually before that news even came out, I asked you to come on the podcast to talk about a topic that you have been talking about since the end of last year. When we got together with Maryanne and and Matt to do our annual predictions and fraud. You introduced us to this concept of digital arrests. And they were happening in India and you were keeping an eye on them happening in India. And your prediction was that they were going to expand outside of India into Europe and the US and maybe South America and other places. Um can you explain what a digital arrest is first?
Frank McKenna
19:42
A digital arrest is a fictional term that scammers will use to remotely, you know, contact somebody through text or a phone call and impersonate law enforcement and say, you know, you've been implicated in a crime. Typically, they're calling you to say they intercepted a package that was going to your address filled with drugs. Um, that's one version of it. And when they call you, they say, uh, you are hereby under digital arrest. And what does that mean? That means you are now, have to stay in your host house. You have to sometimes sign an NDA with uh, you know, this law enforcement agency. You have to communicate with them exclusively. You can't call anybody else. You have to check in with them on video calls, hourly or or every few hours. Um, and they isolate you. And during that period of isolation, they're progressively telling you how much trouble you're going to be in. And during that time, they're letting they're informing you that you can get out of the trouble by paying, you know, administrative fines, you know, bail money. Uh, you know, uh, investigation, compensation fees, whatever they can do to get you to send them money, uh, under the promise that you will be, uh, freed of your digital arrest. So it's a psychological torture that has gained has become an epidemic in India. It's the fastest growing most damaging scam in India. Um these scams are being perpetrated sometimes in India but more often than not in scam compounds in Cambodia. So there are these pig butchering compounds that are in Cambodia, have shifted their operations to focus on not the romance crypto scams, but half of it is now these digital arrests. So they establish video rooms that are meant to look like police stations with backdrops of police, you know, police backdrops. They've gone into pig butchering compounds with FBI backdrops, right? Where there's Federal Bureau of Investigation, United States. You know, uniforms, badges. So, they're meant to look like, you know, on a video call would look like you're actually talking to real police. But they're interacting with, you know, thousands and thousands of people in India and taking billions of dollars from from uh Indian citizens. The at the end of last year, you know, we looked at this and you always know with scams, whatever's happening in India, because there's so many scams there, eventually make their way into the United States. Because India uh is a place where a lot of these scams are perfected, and then they they're used in other parts of the world. So, the prediction was last year that hey this is like a cancer spreading through India that that is going to now spread throughout the rest of the world. And sure enough, you know, you I know you were probably a little skeptical because that sounds incredibly bizarre to be arrested over the phone, right? To be arrested. I don't know. What do you think? Does that sound like probable?
Karisse Hendrick
23:29
No. And I yeah. To be honest, when you first started talking about it, I thought, well, maybe it's a cultural thing that people in India, you know, believe this. And um go through with this. And will spend days and weeks on a phone, you know, in their house under digital arrest. And keep sending money to the authorities that they think, you know, have them under this digital arrest. But I didn't think that it would come to the US. And maybe that's arrogant of me, but I I feel like Americans are inherently skeptical. At least a lot of them are. Um, and that it would be hard to believe that a law enforcement agency wouldn't, I mean, if you really did something wrong, you would think that they would come to your door. Um you know not text message you or call you or video call or anything like that. So yeah, I didn't think it was possible. But you have started to find signs um on the internet that this is in the US and is happening in the US. Um, can you talk a little bit about how you're, how you, I think it's kind of interesting how you are, because you have a weekly newsletter that I highly recommend anyone listening to this subscribes to. It's like one of the weekly emails I actually read and don't just put in my trash bin in my inbox. Um, but I I really it's where I get my fraud news half the time. Um, or most of the time. Um you know, but you you have a process now that you go through to look for stories. And it pulls up things from Reddit and things from Facebook Public and other things that, um yeah. It'd be fun for you to kind of share how that process works and then what you've been seeing in the US.
Frank McKenna
25:32
Yeah. So I think when I, there was a period of six months when I stopped doing the newsletter because it was it becoming too much work. Yeah. And uh
Karisse Hendrick
25:42
Right
Frank McKenna
25:43
I actually published like all the money that I spend uh creating that newsletter. And it's about $14,000 a year that I spend. But it's it's uh, most of that money that I'm spending is through artificial intelligence. So I have a Max Claude account. I have a Max Gemini account. I have a Max Chat GPT account, and I have a Super Grog. So those AIs ,and maybe I overdo it, but I have I assemble projects which are uh fraud article hunters. So, I have a a project and I basically upload a thousand different, you know, media sites. A um you know, a tons of different links like BBB, Scam Tracker, Reddit, Tik Tok, you know, I have all these links and the AI will go out and hunt down the most unusual, wild, different stories. The most obscure stories that it can find off of all these sites. And so on Saturdays, I'm running that usually for an hour or two. And I accumulate about 400 articles or so that to me are the AI's pulling to me saying, These are really interesting. They're probably new trends happening in fraud. And then I go through like all 400 and I scan them and read them. And then I select about 20 or 30 that to me are different and that are new and that are things I've never seen before. So, what I'm trying to do is find stories that are not covered in CNN or Time magazine or whoever, all these major publications, and find the real juicy nuggets that are out there that are indicative of where fraud's going, right? Because usually fraud starts off as a very one-off event somewhere and it grows a little bit bigger and it grows a little bit bigger and then you're seeing more and more and more stories. So week after week you start to see what's building and what's what's trending. And like you, at the end of last year I wasn't seeing a lot. Because I was really hunting down is is this digital rest going to spread beyond the India.
Karisse Hendrick
28:12
Yeah.
Frank McKenna
28:12
And sure enough and sure enough all sorts of things started to bubble up in like February and March. First it was in Japan then it was in Brazil. Then there is stories of scam compounds that I just talked to you about where they've got these video rooms where they're finding FBI, you know, backdrops in in Cambodia. So these stories started to emerge in all sorts of different countries of this pattern of a police impersonation, holding people hostage and demanding money from them. Um, and it wasn't until probably two months ago that I started to see a huge increase here in the United States. It started off, and I'll give you the exact date because the first digital arrest case that I was able to find that was of scale was in July of this year. And this happened in San Francisco. Uh, a woman, she was Indian. Actually, she had just gotten back from India, but she was living in San Francisco. She was a college professor. Um the police officer from India called her and said, you know, you have been implicated in a crime in India and we're going to extradite you back to India. Uh but you need to uh, what we can do is we can offer you a digital arrest, so you don't have to go back to so we don't extradite you. And we can do this all over video calls. So for 24 hours a day, 7 days a week, they had an ongoing Microsoft Teams call with her. Um when she went to sleep, she says that they made her keep her computer on pointed towards her bed so they could watch her sleep. Uh so they put her under constant surveillance. They had a police officer on the team's call that was apparently watching her while she slept. In which he would get up, they would be there and he was behind the scenes, you know, trying to be her friend apparently, but he was just trying to convince her that she had to pay a bunch of money. Now, she went through this. It was a a long ongoing, I don't know how many days it was, but she was um she had all of her documents. It's on the blog. You can see she signed confidentiality agreements that she wouldn't tell anybody. She um, she was talking to an officer named Shaktiv, officer Shaktibl from India and she paid hundreds of thousands of dollars for these penalties. And she wrote about her uh she wrote about her experience with the San Francisco Chronicle I believe. And that was back in July. So when I
Karisse Hendrick
31:06
Did she not go to work? Like she never left the apartment. Like she didn't, and she never talked to family members like for two months.
Frank McKenna
31:14
Yeah. She signed an NDA. I This was not two months. This one was weeks. But
Karisse Hendrick
31:20
Okay. Okay.
Frank McKenna
31:20
About one month later.
Karisse Hendrick
31:22
Yeah. Frank McKenna(31:23): In Arizona.
Karisse Hendrick
31:24
Yeah. I didn't mean to. Yeah.
Frank McKenna
31:27
But she she was, it was several weeks I think it was. Let's see.
Karisse Hendrick
31:32
Wow.
Frank McKenna
31:32
Yeah. It was several weeks. But one month later, the exact same thing happened in uh Arizona. But this woman was under surveillance for two months. Same story. So she was under surveillance with Microsoft Team calls for two months. She actually lost $4.2 million in that process. Right. So she
Karisse Hendrick
31:57
Who has $4.2 million first of all, but yeah,
Frank McKenna
32:04
She added and she was uh she was held hostage. That case was very obscure. That was just written about in a tiny newspaper in Arizona, in the middle of, you know, Yavapai, Arizona. So, that one didn't get a lot of exposure, but it was $4.2 million, the the biggest digital arrest scheme in the US. But it shows, Karisse, that people will believe this in the US. And that they will pay millions of dollars. And it and it doesn't stop there with the traditional digital arrest. What we're seeing is police impersonation, FBI impersonation has skyrocketed. Particularly with, I I wrote about another one that is that is all over Reddit. People are getting scammed every day with this where they get a call from their bank. The bank says you were making charges for guns or our fraud department found that you might be buying drugs with your credit card and we're going to need to transfer you to the FBI. Because you are now implicated in a crime. So they'll actually transfer you. So, you go from a fraud analyst to an FBI agent who's sitting, they want to do a Zoom call with you. So, you'll get on the Zoom call with you because they want to do an interview with the FBI. They are wearing FBI coats, the FBI insignias on the on the back. And they make you show your driver's license front and back. And now they know your name, they know where you live, they have your license, they can use that for extortion, and then they proceed to get money off of you. And that's happening all over the US. I see these brought up all over Reddit. So that's a version of digital arrest, right? That's an Americanized version. Where they're using the the fraud analyst, that's a very common call. And having you transferred to FBI agent. Don't forget about the jury the the bail scams that are everywhere. Where you get the call that you miss jury duty. That's a version of a digital arrest because they're basically having you uh pay fines, police fines in crypto ATMs and things like that. So, police impersonation, digital arrest is gaining a ton of traction here in the US. It's only going to get worse by this time next year. Is going to be I think a even much worse problem because we're just starting, so.
Karisse Hendrick
34:38
Mhm.
Frank McKenna
34:39
That's why I've been pretty vocal about it because I think it's going to be a big a somewhat big epidemic.
Karisse Hendrick
34:45
I think, I I mean I think you're right. I, you know I mean I I was skeptical. But I it I've read some of the firsthand accounts. Um, I I read one of the firsthand accounts uh that you found um on the podcast a couple weeks ago. And I understand why they seem believable. You know, I I can get why they seem believable and especially to people that, you know, are not as well versed in scams as we are. You know, we know that the, you know, the federal law enforcement will never call, will never ask for money, we'll never ask for gift cards, we'll never, you know, we know all those things. But I think the other piece that I thought was interesting was uh when I was reading the firsthand account of the woman, I can't remember her name, but she said she she Googled the person's name or she Googled the phone number that called her and it was from the the sheriff's office. You know, they spoofed the phone number, right, to make it look like it was from the sheriff's office that said that they were calling her. And then she, you know, Googled the name of the person calling her. And it, according to LinkedIn that's who, you know, ran the cyber division, not the FBI, you know, like whatever it was or the the sheriff's office or whatever. So like she felt like, okay, I I must be talking to them. And then her husband was trying to get a hold of her. Um, and she said, I can't right now, but I need to transfer money over to our account. And he's like, "Wait, what?" And so I think his dad was like a retired law enforcement,
Frank McKenna
36:31
Yeah. Karisse Hendrick(36:31): Uh uh official. And um so he called his dad and then he tried to get his wife off the phone as soon as possible, which was really smart. But, you know, that's it's kind of a play on other impersonation scams. Where they want to play on your sense of urgency, and it's, you know, impersonating someone that you trust and or an organization that you trust and, you know, they're asking for small bits of money at first. And then it's just a little bit more and a little bit more. So, similar to an impersonation scam, except for the fact that they're watching their victim 24/7 on Microsoft Teams, which is just creepy, especially watching them sleep. That doesn't sound like a fun. It's not a fun shift for the scammer.
Frank McKenna
37:22
Yeah. The psychology of a digital arrest. When you confine somebody like that and you put them under an NDA. And you and you make sure they're not calling family and you make sure that they're afraid of you. And they're fearful of something bad happening, they're inclination is to do whatever it takes to get out of the situation. I don't care how much it is. You know, if you or I were ever arrested, let's say it was for something we didn't do, and we were going to be thrown to jail for the rest of our lives, we'd probably pay any amount to get out of that issue. If we believed we were, we probably give a lot of our life savings because you don't want to be in jail for the rest of your life. And I think people, gut reaction, especially if they don't have somebody to confide in, is going to be to make it go away. Um, and that's why it's so successful. This is why you can get millions of dollars, you know, from people. Especially if they're elderly and they, and they obey law enforcement, right? They're they're of a generation where you listen to police, you don't you don't question them. So, lots of ramifications with the digital arrest. It's a you know, something that I continue to look for every weekend.
Karisse Hendrick
38:45
Wow. Yeah. And I stand corrected that it can come to the US and I am sure that if it's in the US, it's also in the UK and the EU and other parts of the world. Uh, especially with all those scam compounds in, you know Eastern Asia. Or you know Southeastern Asia. I, they, you know they've got to put all of them to work somehow. And I think that romance and um crypto investment scams are starting to fizzle out, because of education campaigns, especially all the work that Erin West and her colleagues have done. Um so it doesn't surprise me that they're cross training their uh human trafficking victims to commit digital arrest fraud as well.
Frank McKenna
39:37
Yeah, I think uh I was going through the news over the last week and all sorts of, you know, impersonation scams involving FBI agents, and federal, a guy in Ohio. 20 he gave $20,000 because he was contacted by the FBI that he was in a federal investigation. They made him sign an NDA. Um they sent him fake documents. Um, yeah, it's it's
Karisse Hendrick
40:06
I would say Yeah. And I would say that that sounds like a lot of work on their part to create the NDA and the documents and all of that, but not anymore. They can just ask chat GPT to create it. Like, you know, that's where when we say like AI is enhancing it. It's making it cheaper and faster and easier to commit fraud than ever before. It's not necessarily, yes, there are some fraud attacks that are AI enabled, but a lot of this is AI just makes it more believable and is faster and cheaper. And I've always said that, you know, the goal of the of the cyber criminal is to steal money for the least amount of money, in a short amount of time. And the goal of the fraud fighter is to make it cost as much as possible to steal from you, and make it take as long as possible for the fraudster to steal. So like we have we're, you know, in two different sides of this battle. And one of us wants to make it, you know, they want it cheap and fast and easy and we want it to be slow and expensive. Because we're never going to be able to eradicate it, right? But that's kind of our our goals. So, um, yeah, they're using AI to make it faster, cheaper, and easier.
Frank McKenna
41:24
And, um, right. The other thing is a lot of these, you may not realize it, but a lot of these jury duty bail scams, you know, the ones that you get the text and the phone calls. And I know because I I went through one myself just to see what it was. But those phone calls you're getting are coming from jail inmates in jail. Oftentimes they're using contraband they're using contraband cell phones. Karisse Hendrick(41:53): Mhm.
Frank McKenna
41:53
So you're, they're having people on the outside, or maybe they're doing it in the jail. They send those text messages. Um but they'll put the cellmate that the, the phone of the inmate in jail. So, you'll be talking to an inmate in jail who's pretending to be a police officer or sheriff typically in your own city, and then they'll get you to send Venmos and Zelles to uh their girlfriends or husbands on the outside. So, they have people on the outside that are collecting the payments. And so, a lot of these are running in prisons. As ironic as that sounds, you're not talking to a sheriff, you're talking to an inmate. And it's in Georgia typically. So,
Karisse Hendrick
42:39
Wow. Yeah. I mean, I didn't know that about this particular scam, but that doesn't surprise me necessarily. Uh there's a lot of fraud that occurs in prisons, in a lot of different ways. Um especially with contraband phones. So, uh it would make sense that this would be it, too. Um so I think as far as I mean this particular fraud vector is targeting consumers. Um it's not necessarily targeting banks or you know online companies. However, um I think getting the word out to Fraudology listeners that especially, at banks and financial institutions, that they may have a frantic person come to their, you know, to a teller there. And they um they maybe on the phone. That's one sign that it's fraud. Even if they have documents that kind of look legit, that still doesn't mean that they are legitimate. Um, so things like that, you know, to be aware of. So that you can educate consumers if you think that they're a victim of this.
Frank McKenna
43:56
Yeah, it's um banks are going to see this from their customers. Whether it's the digital arrest or one of these FBI impersonation scams, they're going to feel the calls from their customers and they're going to see these people in their branches who are coming in
Karisse Hendrick
44:14
To get money out of their accounts. Yeah.
Frank McKenna
44:18
And they're going to be with somebody in their ear who's telling them exactly what to say, who's instructing them that, you know, often times they'll tell them the bank teller is involved. Don't trust the bank teller, don't answer questions. The bank teller is part of the fraud. So, they they really psychologically manipulate these people. Um, which is why you have to get those people off of the floor and maybe bring them in an office and talk to them behind closed doors, you know, to warn them what might be happening if you see this type of thing. And there are a lot of tellers, you know, I always say the tellers are on the front lines of fraud because uh a lot of the fraud is happening in the branches again, right? Where people are going into branches. They're getting the money out um and turning it over to the scammers.
Karisse Hendrick
45:11
Absolutely. Well, gosh, Frank, I really appreciate you coming on. Between these two stories, I feel like I mean, and I'm not a drinker, but I almost feel like I need a drink. Um just because there, you know it's always a little depressing. But knowledge is power and knowing about these is half the battle. Um so that you can educate your customers your you know uh colleagues, your employees, etc. That this is a new scam. And then as far as the you know ID scan data breach, I'll bring updates when there are some. But it has gone noticeably quiet since Tuesday late afternoon, early evening, uh when my phone was blowing up um in in the best way with some of the best people. So, I was fine. I was just like, "What is going on?" Um and it was justified. Uh it was justified to pull the fire alarm in the fraud group text.
Frank McKenna
46:13
That's funny. Well,
Karisse Hendrick
46:15
Well, I appreciate. Right, exactly.
Frank McKenna
46:16
Breaking news in the in the message chats.
Karisse Hendrick
46:20
Yes. Yes. Um yeah, I just really appreciate you coming by as always. Um I think everyone knows how to get a hold of you on LinkedIn, and I, uh if you're not subscribed to Frank's newsletter yet, like I don't I don't know if I can help you. But I hope that you are and that you go do that. Um and I just I always appreciate talking fraud with you, Frank. Thanks so much for stopping by.
Frank McKenna
46:46
A lot of fun. Thanks for having me and we'll talk again soon.
Karisse Hendrick
46:50
Yes, we will. I'm sure there will be more to report on soon.
View full transcript
