47 min
Fraudology
Golpes de falsidade de identidade: quando um documento de identificação não é prova
47 min
Bem-vindos de volta ao Fraudology.
Nesta semana, conto com a participação de Frank McKenna, do Frank on Fraud e da Point Predictive, porque este era um daqueles casos para os quais eu precisava de uma segunda cabeça para me ajudar a processar tudo.
Eu estava totalmente concentrado a trabalhar na agenda da Merchant Fraud Alliance quando o meu telemóvel começou a vibrar sem parar. Era uma conversa de grupo com as pessoas em quem confio para me dizerem quando algo realmente importante está a acontecer, em vez de ser apenas ruído da Internet. E, desta vez, era mesmo algo importante. Brian Krebs tinha descoberto um portal na dark web que vendia cartas de condução verdadeiras. Frente, verso, código de barras e tudo o mais. Por cerca de cem dólares cada. Isso corresponde a aproximadamente 60% de toda a população dos EUA reunida numa base de dados que praticamente qualquer pessoa podia comprar.
O restante deste episódio conta, na verdade, duas histórias que estão mais interligadas do que se percebe à primeira vista, quando começamos a analisá-las mais a fundo. A violação de dados em si é apenas metade da história. A outra metade consiste em compreender o fornecedor que atua nos bastidores de um grande número de empresas conhecidas do público, cuidando da verificação de identidade delas. É isso que torna esta violação muito maior do que parece à primeira vista. Em seguida, passamos para o golpe que não me sai da cabeça desde que Frank chamou a atenção para ele pela primeira vez, no ano passado. A prisão digital é uma forma de golpe de cativeiro psicológico que agora chegou oficialmente da Índia aos Estados Unidos, com vítimas reais e prejuízos reais na casa dos milhões para comprovar isso.
Prepare-se, porque, para começar a combater isto, precisamos de saber o que estamos a enfrentar.
O que você vai ouvir neste episódio:
- Como uma violação na cadeia de suprimentos de um fornecedor de verificação de identidade expôs 153 milhões de carteiras de habilitação físicas e por que isso é diferente de uma violação de dados típica no varejo.
- Por que os cartões de identificação falsificados costumavam ser o principal alvo dos softwares de detecção de fraudes e por que toda essa abordagem deixa de funcionar quando o documento de identificação utilizado é verdadeiro.
- Como as técnicas de deepfake com IA aplicadas a carteiras de motorista permitem que alguém substitua a foto de uma carteira real roubada pela do próprio rosto e passe por uma verificação de vivacidade.
- O que é realmente a prisão digital e por que eu estava errado ao presumir que ela permaneceria restrita.
- Estudos de caso reais de vítimas nos EUA, incluindo uma mulher que foi mantida sob vigilância durante dois meses e perdeu US$ 4,2 milhões.
- Como a prisão digital evoluiu para versões locais, incluindo ligações de falsos policiais e falsos agentes do FBI, além de golpes de fiança relacionados ao serviço de júri.
- Os complexos de fraude e a infraestrutura de golpes de abate do porco no Camboja, que agora estão sendo reaproveitados para novos tipos de fraude.
- Por que algumas das ligações fraudulentas envolvendo convocação para júri e pagamento de fiança estariam sendo feitas de celulares contrabandeados dentro de prisões dos EUA.
Você deveria ouvir este episódio se:
- Trabalha com verificação de identidade, KYC ou prevenção de fraudes e precisa refletir sobre o que a afirmação «o documento de identificação é verdadeiro» realmente comprova.
- É profissional de fraude e risco em um banco e pode ser uma das primeiras pessoas a identificar uma vítima de golpes de prisão digital sacando grandes quantias sob coação.
- Alguém que queira entender como uma violação de segurança em um fornecedor pode expor silenciosamente os clientes de dezenas de marcas importantes e reconhecidas.
- Fazem parte de uma equipe de atendimento ao consumidor e talvez precisem treinar os funcionários da linha de frente para identificar um cliente que esteja ao telefone com um golpista enquanto está no balcão.
Notas do episódio
Por que essa violação é diferente das violações no varejo sobre as quais você costuma ouvir falar
Esta violação não ocorreu num retalhista. Ocorreu no fornecedor que grandes retalhistas, casinos, empresas de aluguer de automóveis e até organismos governamentais utilizam nos bastidores para verificar identidades. Isto significa que as empresas cujos nomes aparecem nas manchetes não são necessariamente aquelas onde ocorreu a falha. Significa também que uma única violação num fornecedor pode expor, de uma só vez, clientes de um vasto conjunto de setores sem qualquer relação entre si. Se não souber quais são os fornecedores que sustentam a sua própria infraestrutura de verificação de identidade, este é o tipo de violação que pode afetar a sua empresa sem que esta tenha sido diretamente pirateada.
Por que “real” já não significa “seguro” na verificação de identidade
A maioria dos softwares de verificação de identidade foi desenvolvida para detetar documentos de identificação falsificados. Essa abordagem parte do princípio de que a fraude está no próprio documento. Esta violação de dados inverte essa premissa. Agora, há 153 milhões de cartas de condução reais e válidas em circulação que podem ser combinadas com um código de barras roubado e uma substituição facial gerada por IA para passar facilmente por verificações de prova de vida que nunca foram concebidas para detetar um documento de identificação verdadeiro nas mãos erradas. As equipas antifraude já não precisam de perguntar «este documento é verdadeiro?». A pergunta que devem começar a fazer é: «este documento pertence realmente à pessoa que o apresenta?»
Prisão digital, explicada desde o princípio
Quis explicar em detalhe como funciona exatamente este golpe, porque é realmente desconcertante quando se ouve falar dele pela primeira vez. Dizem às vítimas que estão sob investigação e isolam-nas dos amigos e da família. Por vezes, são obrigadas a assinar um falso acordo de confidencialidade. As vítimas são mantidas sob videovigilância constante — num dos casos, até enquanto dormiam. Tudo isto até pagarem enormes quantias para fazer desaparecer as «acusações». Este golpe funciona porque elimina todas as vozes externas que poderiam dizer à vítima para simplesmente desligar a chamada.
Como um golpe que começou na Índia chegou aos EUA
A previsão que Frank fez no ano passado concretizou-se quase exatamente como ele esperava. A detenção digital alastrou da Índia ao Japão, ao Brasil e, agora, aos EUA. O primeiro grande caso no país surgiu em julho. O padrão psicológico mantém-se, mesmo quando o pretexto muda. As vítimas podem ser levadas a acreditar que se trata de uma investigação policial, de uma chamada do departamento de fraudes transferida para um falso agente do FBI ou, por vezes, de uma burla relacionada com o dever de jurado ou com o pagamento de uma fiança. Independentemente da forma como é apresentada, se a chamada o isola e exige sigilo, esse é o sinal de alerta. A chamada não vem da entidade específica que os burlões afirmam representar.
Por que os bancos e seus funcionários da linha de frente estão na linha de frente desse golpe
Como esse golpe acaba exigindo que a vítima saque ou transfira dinheiro de verdade, os caixas bancários costumam ser a linha de defesa. Às vezes, eles atendem um cliente que está ao telefone com o golpista naquele exato momento, enquanto a vítima recebe instruções precisas sobre o que dizer. Um cliente aflito, segurando o telefone junto ao balcão, merece uma atenção redobrada e uma conversa, mesmo que a documentação pareça legítima — porque, a essa altura, provavelmente será.
Principais conclusões
Principais conclusões:
- Uma violação da cadeia de suprimentos no nível do fornecedor pode expor simultaneamente clientes de dezenas de setores distintos, pois o ponto de falha não é o varejista, mas sim o provedor de verificação de identidade que atua nos bastidores.
- 153 milhões de carteiras de motorista autênticas — o equivalente a cerca de 60% da população adulta dos EUA — podem agora estar circulando com os dados da frente, do verso e do código de barras intactos.
- A detecção de fraudes concebida para identificar documentos de identificação falsificados não ajuda quando a própria carteira de motorista é totalmente autêntica e foi roubada.
- A tecnologia de deepfake com IA agora pode combinar uma carteira de habilitação real e roubada com um rosto sintético para passar por muitas verificações padrão de prova de vida.
- Os golpes de prisão digital usam isolamento, documentos jurídicos falsos e vigilância constante para pressionar psicologicamente as vítimas a pagar quantias exorbitantes.
- O golpe da prisão digital já se espalhou da Índia para o Japão, o Brasil e os Estados Unidos, com perdas confirmadas de milhões de dólares nos EUA.
- As variações domésticas incluem falsas transferências para o FBI após ligações forjadas de departamentos antifraude, além de golpes envolvendo convocação para júri ou pagamento de fiança, alguns dos quais seriam operados por meio de celulares contrabandeados para dentro de presídios.
- Os funcionários das agências bancárias muitas vezes estão em posição de intervir em tempo real, já que esses golpes geralmente culminam em um saque ou uma transferência presencial de grande valor.
Conclusão final
O fio condutor destas histórias são as ferramentas em que confiamos, os sinais de confiança e os atalhos que usamos para decidir se algo é legítimo. Uma carta de condução que é lida corretamente. Uma chamada que parece oficial. Um documento com a formatação certa. Nenhum destes elementos, por si só, continua a ser fiável. Quer se trate de uma violação de dados que expõe documentos de identificação verdadeiros ou de uma fraude que explora o medo genuíno das autoridades, a fraude já não se esconde atrás de algo falso. Esconde-se atrás de algo real que pode ser manipulado. É por isso que manter-se a par de como estas fraudes realmente funcionam e partilhar esse conhecimento com as pessoas à sua volta já é meio caminho andado. Seja com um cliente, um colega ou um familiar, inicie a conversa.
Recursos e links do episódio
Conecte-se com Frank McKenna | LinkedIn
Estrategista-chefe de fraudes e cofundador da Point Predictive
Instrutor no Fraud Fight Club
Autor de Frank on Fraud
Conecte-se com Karisse Hendrick | LinkedIn
Apresentadora do podcast Fraudology
Especialista premiada em fraudes cibernéticas
Consultora de prevenção a fraudes no comércio eletrônico
Assessora de startups, palestrante e
consultora de empresas da Fortune 500
Episode transcript
Karisse Hendrick
00:07
Welcome back to the Fraudology podcast. I'm Karisse Hendrick and I am joined by the Frank McKenna of Frank on Fraud blog and also he's a co-founder of Point Predictive. I always enjoy talking about fraud with Frank and I know you guys enjoy listening to us and it's been a little while and we have some pretty big topics to talk about today. One is a new well I guess they're both kind of in the news. So Frank, welcome to Fraudology again.
Frank McKenna
00:40
Thank you. I love uh getting on here and talking to you about what's new and what's happening in the world of fraud. I think it's been at least a couple months.
Karisse Hendrick
00:49
Mhm.
Frank McKenna
00:50
That we've gotten together and so much has happened, right? It's hard to hard to believe so much happened so fast, but we had some big hits this week, right?
Karisse Hendrick
00:59
We did. And that was kind of how I was going to kick off the episode was I mean, if anyone follows me on LinkedIn, they've probably seen it. I guess, you know, a few I over 5,000 people saw this, this uh post that I just literally did on a Wednesday night. Um, so, uh, backstory, the way I found out about this post is I was getting some work done on the Merchant Fraud Alliance, um, uh, agenda and my phone kept buzzing just like over and over and over again. I was like, what's going on? And I mean, I knew where my daughter was and I knew it wasn't like an emergency, but I was like, what? And it was my group chat with Frank along with Maryanne Miller, Matt Vega, and Hailey Windham. Um I am I think those are you know four of the greatest minds in fraud and we all have different perspectives. So um oftentimes we'll share you know news articles that we think are interesting or you know hey does anyone know anyone at this company or this bank or you know that type of thing. Um, I wouldn't say it's going off daily, but um, it usually doesn't go off as much as it was on the other day. And so I looked at it and then I had to like scroll backwards to try to figure out what was going on. And was it Maryanne that shared the article? Well, I think it was Maryanne that shared it first.
Frank McKenna
02:35
Well, it was uh I'll read you the the I got the text message right here. So, it's 4:30 on a Tuesday and I'm
Karisse Hendrick
02:44
Okay. Yeah. Tuesday
Frank McKenna
02:45
I was scrolling through LinkedIn and you know boop pops up from Brian Krebs. Uh who you know is journalist that covers cyber security, well-known guy. And he had, he said I got something really spicy And it turns out um he had found the day before, I think it was Monday, he had discovered there was a dark web uh channel that was offering 153 million driver's licenses on the dark web for sale for about $100 a piece. But this was, this portal was called Nexus and you could go in there and search any name and pull up the person's driver's license, uh scans of their face, uh
Karisse Hendrick
03:38
When it was scanned, right? Like the date when it was the day
Frank McKenna
03:43
And uh Pete Hexith was on there. Brian Krebs was on there. Uh family members of Brian Krebs when he searched were on there. 153 million. Yeah. So I think I immediately looked at that and go I said this this is crazy. And I posted in the chat and I said, "Oh man, this one's going to be bad." And then then it went from there. Me, you, Maryanne, Matt Vega were just going through. We could not believe it. And uh we call it we I think collectively I think I said breach of the year and Marian said this is the target breach of this year. And then uh you posted on LinkedIn. But yeah we're this is such a damaging breach because of what they got but also because of what they can do with it. Having the driver's licenses with AI now anybody can be deepfake, they simply change the face with AI. They have the whole driver's license. They have the barcode on the back. That barcode is used by a lot of these identity vendors to determine if it matches to the DMV. So, there's this is the biggest treasure trove of driver's licenses ever. It's it's not only the biggest breach of documents that I could ever that I could find this year. It's ever. Like this rivals like the impact would be up at like Equifax.
Karisse Hendrick
05:08
Oh.
Frank McKenna
05:09
So it's a it's a bad one. But three or four days later there's no information from the company about if this is true or not, and the database disappeared. So now
Karisse Hendrick
05:22
Well, the original database disappeared, right? But what Matt explained was that many people downloaded it and had copies of it. So, it's still available, but now I'm wondering how maybe they downloaded just the, just the marketplace piece. Cuz that they couldn't get the actual scans unless they paid $100 each. So maybe it is, maybe the source could have, maybe they just posted like the the listing. And the database where you can search for people. But maybe not the actual driver's licenses. I
Frank McKenna
06:02
Yeah. Appeared. Disappeared. It's a big deal. It's, but nobody knows anything. FBI hasn't said anything. But the story is not over with this. This is going to be, this is bad. And it's it's real. I mean, Brian Krebs uh knows what he's doing and he went out there and verified this information. He knows who
Karisse Hendrick
06:24
Well, and not only that, but I verified it with uh more than one merchant that uses this vendor.
Frank McKenna
06:34
Really? Did they get a notification from the vendor?
Karisse Hendrick
06:37
They did. They were made aware. They were made aware before I, before Krebs's article came out.
Frank McKenna
06:46
Oh. From the company.
Karisse Hendrick
06:47
Yep. From We'll we'll name them because Brian names them. Um ID Scan is the name of the vendor.
Frank McKenna
06:54
Oh, ID Scan. Yeah.
Karisse Hendrick
06:56
Yeah. Yeah. And ID Scan notified the merchants uh the the companies and the government agencies that use um that use them. Um the thing about ID scan, I've known about them in the market because a couple of merchants that I work with use them. Um they're not the on, they're starting to try to get into online verification with driver's licenses, but the majority of their scans and I can't remember maybe you have it handy from our text messages. How many thousands of is it like 200,000 driver's license scans a month or something like that that they process?
Frank McKenna
07:34
20 21 million a month.
Karisse Hendrick
07:36
21 Okay, I was off. 21 million.
Frank McKenna
07:40
Yeah, I thought it was 21 million. And they work with Herz, they work with uh
Karisse Hendrick
07:46
Target,
Frank McKenna
07:46
A bunch of, Target, a bunch of big companies. You go into any cannabis store. I think they're used to have like the cannabis industry. Uh rental car industry, uh Caesars, Las Vegas.
Karisse Hendrick
08:02
Yes.
Frank McKenna
08:03
So there's travel, you know, there's a lot of places where they're, I can't remember what they said, but thousands and thousands of locations world worldwide or
Karisse Hendrick
08:15
They also, yeah, the some of their other nameable ones are um GameStop, FedEx, Planet 13, which is for cannabis dispensary, ID scanning. Um, Circa Resort and Casino, um, you mentioned Caesar's Entertainment, uh, for age verification and casino compliance. So, um, the the thing I was going to say about them that makes this even worse than if it were an online retail, you know, like what are the online vendors? I'm not going to name any of them, but like the ones that, you know, do liveness checks for, you know, uh short-term vacation rentals. Or um you know, that type of thing. You know, or for um delivery drivers or that type of thing. Um there's those vendors, but then ID scan is different because they're actually scanning the physical driver's license. So, they have special technology with lighting, some kind of blue light technology that picks up the holograms and other um unique pieces of a driver's license that you can only pick up with special lights when they're scanning it. So, I guess they own, I think they own the patent on that. I was reading. So, um they're the only vendor that has like the holograms and all of that. Not only just a a picture of the driver's license, but it's like 3D almost. Um, yeah. And they have the back of the card with the barcode as you mentioned. Um, yeah. So, it's it's significant, right? Like I think you had said that 153 million is about a third of the the adult population of the United States. So, one in three.
Frank McKenna
10:10
It's uh 60% though.
Karisse Hendrick
10:13
Oh, it's 60%. Never mind. I was wrong.
Frank McKenna
10:16
Yeah,
Karisse Hendrick
10:17
I was taking the 30% that didn't. Okay. Yeah. So, 60% of the the US population has probably had their driver's license stolen. Um I know that I'm part of that because I I've been to at least two of the, I've had my ID scanned at at least two of their uh their customers. And um this is what they call in cyber security a um supply chain breach, right? Where the actual end target, like not no pun intended there. But like the target the store, Hertz, Caesars, you know FedEx, whatever. They might be who that the hacker wants to get you know they want to get the driver's license that have been scanned at those companies. But instead of attacking them directly because they don't store that information with themselves, they attack the vendor that you that stores that data. And the vendor that those merchants use. Unfortunately, those merchants now get dragged through the mud because the vendor they used got hacked.
Frank McKenna
11:28
Well, yeah. So, if you think about Caesar's Palace being one of those those companies that is a customer, they were hacked like a year ago, which was right around the time that they say they they broke into ID scan. You wonder if
Karisse Hendrick
11:47
Oh, really? I didn't put two and two together.
Frank McKenna
11:51
Well, so it's just interesting timing with this. I think Caesars was
Karisse Hendrick
11:55
I think, okay so I'm putting two and two together. And if I if I remember correctly, I remember talking about the Caesar's breach on the podcast. And I think that Scattered Spider, which is a Russian hacking organization. Kind of like their version of Anonymous. Um they took credit for the ransomware breach at Caesars. Um, our source that has a lot of credible threat intelligence, um, you know, did some deep dive uh, analysis on the dark web on when this, uh, portal or this channel was was live. And said that he was able to track it to one of the most prolific users uh, that is part of Scattered Spider. So, it's actually the same hacking group that hacked Caesars and did a ransomware scam or not ransom but ransomware breach uh a year ago is also responsible for ID scan. I didn't know that the ID scan breach was a year ago. I thought it was more recent than that.
Frank McKenna
13:08
No, the uh the Caesar's breach was actually
Karisse Hendrick
13:14
So yes, oh okay.
Frank McKenna
13:15
You have a, you just have these, you know, the fact that you have these hackers that are hitting multiple locations. You know, could there be a link between ID scam getting breached because the Caesar, the Caesar's environment was breached? And maybe they could infiltrate backwards into their vendor's cloud databases, and then they went from there. So this is this this is just guessing.
Karisse Hendrick
13:40
This is just hypothesis on our end. Yeah. Yeah. I want to be clear, like but I did put, yeah. I do think if I remember correctly Scattered Spider did Caesars and Scattered Spider is tied to this ID scan breach at least from the information I've been given. So, it's not, you know, it's not for sure, but it's just it's putting puzzle pieces together. Um, we should talk about what this means for everyone else, like consumers as well as businesses. Um, because you're right, it's not just what was stolen, it's how it's going to be used. And that's the scariest part, I think, of all of this.
Frank McKenna
14:26
Right. Yeah. So, you've seen maybe I've seen it too cuz I presented with it, but David Mimone showing how you can take an ordinary driver's license. Uh, create a deep fake picture with Google Gemini. Uh, create a deep fake of that license with the new deep fake picture you took and basically impose that AI image on top of the driver's license and do the selfie checks. You know, with the making the AI image move their, its head from left to right. So the fact you have these licenses that could be purchased for 60% of the population, it's just going to mean that people could have their licenses used uh and have AI deepfakes posing as them in the wild. Right? Because your barcode, which you know, there's a lot of those identity vendors that use that barcode as definitive proof that it's not counterfeit. And then you have all the right information on the front of the license. You have a new picture on that license that is either you or deepfake and you can go in and get a credit card, buy a car, go to, you know, online retailer. So, and again, we're just new using our experience. What happens in these breaches, they eventually get used uh in different ways. And with AI, I think this is going to be a very very good source of data for scammers and hackers, too. You know, if you want to really get a lot of money from somebody, get their license off of the uh off of the dark web, their actual license with your actual barcode.
Karisse Hendrick
16:14
Yeah. Because and I think the problem is that a lot of the detection software for for IDVs, for identity verification documents, um or you know identity document verification. Like at banks, at lenders, at you know, like I said long-term you know vacation rentals, all kind you know uh actual rental, like so many services online, require a copy of your driver's license, and or a selfie check. And what they're looking for is fake IDs. What that software is looking for is, you know, um forged identification cards. They're looking for fake driver's licenses. The problem is 153 million real driver's licenses are now exposed. So the detection that banks and lenders and retailers and, you know anyone in e-commerce from gambling, to you know uh marketplaces, etc, the gig economy, whatever. They're all relying on software that can tell them if it's fake. But but if it's a real driver's license, they can't tell you that that doesn't belong to the person that's holding it. There's there's no way to do that. So they can, it will be real. So it will pass a lot of those checks which I think is what makes us you know, so worried right? Uh for synthetic ID and everything else. Yeah.
Frank McKenna
17:54
And even though the company hasn't uh, I just was looking over the news. I was trying to see did anything happened today.
Karisse Hendrick
18:00
Yeah. I haven't seen
Frank McKenna
18:03
There, nothing from the company yet, but there are lawsuits already being launched by class action attorneys. So,
Karisse Hendrick
18:10
Wow.
Frank McKenna
18:11
They're uh, they're actively advertising, you know, that they're going to do a class action lawsuit. Now, whether or not happens, I don't know. But yeah, there's a lot of attention here. People are waiting to see what happens with this breach.
Karisse Hendrick
18:24
Yeah, I do see that NBC News covered it a day ago. That's the first legitimate news source other than Brian Krebs that I've seen uh do. I mean Bleving Computer and TechCrunch picked it up of course from Krebs, but. Oh, I didn't know the ID scan is uh based in New Orleans.
Frank McKenna
18:43
Yeah, based on New Orleans.
Karisse Hendrick
18:46
Yeah. But um yeah, so that that was a huge piece of news. Um that I definitely wanted to make sure that we talked about. But I actually before that news even came out, I asked you to come on the podcast to talk about a topic that you have been talking about since the end of last year. When we got together with Maryanne and and Matt to do our annual predictions and fraud. You introduced us to this concept of digital arrests. And they were happening in India and you were keeping an eye on them happening in India. And your prediction was that they were going to expand outside of India into Europe and the US and maybe South America and other places. Um can you explain what a digital arrest is first?
Frank McKenna
19:42
A digital arrest is a fictional term that scammers will use to remotely, you know, contact somebody through text or a phone call and impersonate law enforcement and say, you know, you've been implicated in a crime. Typically, they're calling you to say they intercepted a package that was going to your address filled with drugs. Um, that's one version of it. And when they call you, they say, uh, you are hereby under digital arrest. And what does that mean? That means you are now, have to stay in your host house. You have to sometimes sign an NDA with uh, you know, this law enforcement agency. You have to communicate with them exclusively. You can't call anybody else. You have to check in with them on video calls, hourly or or every few hours. Um, and they isolate you. And during that period of isolation, they're progressively telling you how much trouble you're going to be in. And during that time, they're letting they're informing you that you can get out of the trouble by paying, you know, administrative fines, you know, bail money. Uh, you know, uh, investigation, compensation fees, whatever they can do to get you to send them money, uh, under the promise that you will be, uh, freed of your digital arrest. So it's a psychological torture that has gained has become an epidemic in India. It's the fastest growing most damaging scam in India. Um these scams are being perpetrated sometimes in India but more often than not in scam compounds in Cambodia. So there are these pig butchering compounds that are in Cambodia, have shifted their operations to focus on not the romance crypto scams, but half of it is now these digital arrests. So they establish video rooms that are meant to look like police stations with backdrops of police, you know, police backdrops. They've gone into pig butchering compounds with FBI backdrops, right? Where there's Federal Bureau of Investigation, United States. You know, uniforms, badges. So, they're meant to look like, you know, on a video call would look like you're actually talking to real police. But they're interacting with, you know, thousands and thousands of people in India and taking billions of dollars from from uh Indian citizens. The at the end of last year, you know, we looked at this and you always know with scams, whatever's happening in India, because there's so many scams there, eventually make their way into the United States. Because India uh is a place where a lot of these scams are perfected, and then they they're used in other parts of the world. So, the prediction was last year that hey this is like a cancer spreading through India that that is going to now spread throughout the rest of the world. And sure enough, you know, you I know you were probably a little skeptical because that sounds incredibly bizarre to be arrested over the phone, right? To be arrested. I don't know. What do you think? Does that sound like probable?
Karisse Hendrick
23:29
No. And I yeah. To be honest, when you first started talking about it, I thought, well, maybe it's a cultural thing that people in India, you know, believe this. And um go through with this. And will spend days and weeks on a phone, you know, in their house under digital arrest. And keep sending money to the authorities that they think, you know, have them under this digital arrest. But I didn't think that it would come to the US. And maybe that's arrogant of me, but I I feel like Americans are inherently skeptical. At least a lot of them are. Um, and that it would be hard to believe that a law enforcement agency wouldn't, I mean, if you really did something wrong, you would think that they would come to your door. Um you know not text message you or call you or video call or anything like that. So yeah, I didn't think it was possible. But you have started to find signs um on the internet that this is in the US and is happening in the US. Um, can you talk a little bit about how you're, how you, I think it's kind of interesting how you are, because you have a weekly newsletter that I highly recommend anyone listening to this subscribes to. It's like one of the weekly emails I actually read and don't just put in my trash bin in my inbox. Um, but I I really it's where I get my fraud news half the time. Um, or most of the time. Um you know, but you you have a process now that you go through to look for stories. And it pulls up things from Reddit and things from Facebook Public and other things that, um yeah. It'd be fun for you to kind of share how that process works and then what you've been seeing in the US.
Frank McKenna
25:32
Yeah. So I think when I, there was a period of six months when I stopped doing the newsletter because it was it becoming too much work. Yeah. And uh
Karisse Hendrick
25:42
Right
Frank McKenna
25:43
I actually published like all the money that I spend uh creating that newsletter. And it's about $14,000 a year that I spend. But it's it's uh, most of that money that I'm spending is through artificial intelligence. So I have a Max Claude account. I have a Max Gemini account. I have a Max Chat GPT account, and I have a Super Grog. So those AIs ,and maybe I overdo it, but I have I assemble projects which are uh fraud article hunters. So, I have a a project and I basically upload a thousand different, you know, media sites. A um you know, a tons of different links like BBB, Scam Tracker, Reddit, Tik Tok, you know, I have all these links and the AI will go out and hunt down the most unusual, wild, different stories. The most obscure stories that it can find off of all these sites. And so on Saturdays, I'm running that usually for an hour or two. And I accumulate about 400 articles or so that to me are the AI's pulling to me saying, These are really interesting. They're probably new trends happening in fraud. And then I go through like all 400 and I scan them and read them. And then I select about 20 or 30 that to me are different and that are new and that are things I've never seen before. So, what I'm trying to do is find stories that are not covered in CNN or Time magazine or whoever, all these major publications, and find the real juicy nuggets that are out there that are indicative of where fraud's going, right? Because usually fraud starts off as a very one-off event somewhere and it grows a little bit bigger and it grows a little bit bigger and then you're seeing more and more and more stories. So week after week you start to see what's building and what's what's trending. And like you, at the end of last year I wasn't seeing a lot. Because I was really hunting down is is this digital rest going to spread beyond the India.
Karisse Hendrick
28:12
Yeah.
Frank McKenna
28:12
And sure enough and sure enough all sorts of things started to bubble up in like February and March. First it was in Japan then it was in Brazil. Then there is stories of scam compounds that I just talked to you about where they've got these video rooms where they're finding FBI, you know, backdrops in in Cambodia. So these stories started to emerge in all sorts of different countries of this pattern of a police impersonation, holding people hostage and demanding money from them. Um, and it wasn't until probably two months ago that I started to see a huge increase here in the United States. It started off, and I'll give you the exact date because the first digital arrest case that I was able to find that was of scale was in July of this year. And this happened in San Francisco. Uh, a woman, she was Indian. Actually, she had just gotten back from India, but she was living in San Francisco. She was a college professor. Um the police officer from India called her and said, you know, you have been implicated in a crime in India and we're going to extradite you back to India. Uh but you need to uh, what we can do is we can offer you a digital arrest, so you don't have to go back to so we don't extradite you. And we can do this all over video calls. So for 24 hours a day, 7 days a week, they had an ongoing Microsoft Teams call with her. Um when she went to sleep, she says that they made her keep her computer on pointed towards her bed so they could watch her sleep. Uh so they put her under constant surveillance. They had a police officer on the team's call that was apparently watching her while she slept. In which he would get up, they would be there and he was behind the scenes, you know, trying to be her friend apparently, but he was just trying to convince her that she had to pay a bunch of money. Now, she went through this. It was a a long ongoing, I don't know how many days it was, but she was um she had all of her documents. It's on the blog. You can see she signed confidentiality agreements that she wouldn't tell anybody. She um, she was talking to an officer named Shaktiv, officer Shaktibl from India and she paid hundreds of thousands of dollars for these penalties. And she wrote about her uh she wrote about her experience with the San Francisco Chronicle I believe. And that was back in July. So when I
Karisse Hendrick
31:06
Did she not go to work? Like she never left the apartment. Like she didn't, and she never talked to family members like for two months.
Frank McKenna
31:14
Yeah. She signed an NDA. I This was not two months. This one was weeks. But
Karisse Hendrick
31:20
Okay. Okay.
Frank McKenna
31:20
About one month later.
Karisse Hendrick
31:22
Yeah. Frank McKenna(31:23): In Arizona.
Karisse Hendrick
31:24
Yeah. I didn't mean to. Yeah.
Frank McKenna
31:27
But she she was, it was several weeks I think it was. Let's see.
Karisse Hendrick
31:32
Wow.
Frank McKenna
31:32
Yeah. It was several weeks. But one month later, the exact same thing happened in uh Arizona. But this woman was under surveillance for two months. Same story. So she was under surveillance with Microsoft Team calls for two months. She actually lost $4.2 million in that process. Right. So she
Karisse Hendrick
31:57
Who has $4.2 million first of all, but yeah,
Frank McKenna
32:04
She added and she was uh she was held hostage. That case was very obscure. That was just written about in a tiny newspaper in Arizona, in the middle of, you know, Yavapai, Arizona. So, that one didn't get a lot of exposure, but it was $4.2 million, the the biggest digital arrest scheme in the US. But it shows, Karisse, that people will believe this in the US. And that they will pay millions of dollars. And it and it doesn't stop there with the traditional digital arrest. What we're seeing is police impersonation, FBI impersonation has skyrocketed. Particularly with, I I wrote about another one that is that is all over Reddit. People are getting scammed every day with this where they get a call from their bank. The bank says you were making charges for guns or our fraud department found that you might be buying drugs with your credit card and we're going to need to transfer you to the FBI. Because you are now implicated in a crime. So they'll actually transfer you. So, you go from a fraud analyst to an FBI agent who's sitting, they want to do a Zoom call with you. So, you'll get on the Zoom call with you because they want to do an interview with the FBI. They are wearing FBI coats, the FBI insignias on the on the back. And they make you show your driver's license front and back. And now they know your name, they know where you live, they have your license, they can use that for extortion, and then they proceed to get money off of you. And that's happening all over the US. I see these brought up all over Reddit. So that's a version of digital arrest, right? That's an Americanized version. Where they're using the the fraud analyst, that's a very common call. And having you transferred to FBI agent. Don't forget about the jury the the bail scams that are everywhere. Where you get the call that you miss jury duty. That's a version of a digital arrest because they're basically having you uh pay fines, police fines in crypto ATMs and things like that. So, police impersonation, digital arrest is gaining a ton of traction here in the US. It's only going to get worse by this time next year. Is going to be I think a even much worse problem because we're just starting, so.
Karisse Hendrick
34:38
Mhm.
Frank McKenna
34:39
That's why I've been pretty vocal about it because I think it's going to be a big a somewhat big epidemic.
Karisse Hendrick
34:45
I think, I I mean I think you're right. I, you know I mean I I was skeptical. But I it I've read some of the firsthand accounts. Um, I I read one of the firsthand accounts uh that you found um on the podcast a couple weeks ago. And I understand why they seem believable. You know, I I can get why they seem believable and especially to people that, you know, are not as well versed in scams as we are. You know, we know that the, you know, the federal law enforcement will never call, will never ask for money, we'll never ask for gift cards, we'll never, you know, we know all those things. But I think the other piece that I thought was interesting was uh when I was reading the firsthand account of the woman, I can't remember her name, but she said she she Googled the person's name or she Googled the phone number that called her and it was from the the sheriff's office. You know, they spoofed the phone number, right, to make it look like it was from the sheriff's office that said that they were calling her. And then she, you know, Googled the name of the person calling her. And it, according to LinkedIn that's who, you know, ran the cyber division, not the FBI, you know, like whatever it was or the the sheriff's office or whatever. So like she felt like, okay, I I must be talking to them. And then her husband was trying to get a hold of her. Um, and she said, I can't right now, but I need to transfer money over to our account. And he's like, "Wait, what?" And so I think his dad was like a retired law enforcement,
Frank McKenna
36:31
Yeah. Karisse Hendrick(36:31): Uh uh official. And um so he called his dad and then he tried to get his wife off the phone as soon as possible, which was really smart. But, you know, that's it's kind of a play on other impersonation scams. Where they want to play on your sense of urgency, and it's, you know, impersonating someone that you trust and or an organization that you trust and, you know, they're asking for small bits of money at first. And then it's just a little bit more and a little bit more. So, similar to an impersonation scam, except for the fact that they're watching their victim 24/7 on Microsoft Teams, which is just creepy, especially watching them sleep. That doesn't sound like a fun. It's not a fun shift for the scammer.
Frank McKenna
37:22
Yeah. The psychology of a digital arrest. When you confine somebody like that and you put them under an NDA. And you and you make sure they're not calling family and you make sure that they're afraid of you. And they're fearful of something bad happening, they're inclination is to do whatever it takes to get out of the situation. I don't care how much it is. You know, if you or I were ever arrested, let's say it was for something we didn't do, and we were going to be thrown to jail for the rest of our lives, we'd probably pay any amount to get out of that issue. If we believed we were, we probably give a lot of our life savings because you don't want to be in jail for the rest of your life. And I think people, gut reaction, especially if they don't have somebody to confide in, is going to be to make it go away. Um, and that's why it's so successful. This is why you can get millions of dollars, you know, from people. Especially if they're elderly and they, and they obey law enforcement, right? They're they're of a generation where you listen to police, you don't you don't question them. So, lots of ramifications with the digital arrest. It's a you know, something that I continue to look for every weekend.
Karisse Hendrick
38:45
Wow. Yeah. And I stand corrected that it can come to the US and I am sure that if it's in the US, it's also in the UK and the EU and other parts of the world. Uh, especially with all those scam compounds in, you know Eastern Asia. Or you know Southeastern Asia. I, they, you know they've got to put all of them to work somehow. And I think that romance and um crypto investment scams are starting to fizzle out, because of education campaigns, especially all the work that Erin West and her colleagues have done. Um so it doesn't surprise me that they're cross training their uh human trafficking victims to commit digital arrest fraud as well.
Frank McKenna
39:37
Yeah, I think uh I was going through the news over the last week and all sorts of, you know, impersonation scams involving FBI agents, and federal, a guy in Ohio. 20 he gave $20,000 because he was contacted by the FBI that he was in a federal investigation. They made him sign an NDA. Um they sent him fake documents. Um, yeah, it's it's
Karisse Hendrick
40:06
I would say Yeah. And I would say that that sounds like a lot of work on their part to create the NDA and the documents and all of that, but not anymore. They can just ask chat GPT to create it. Like, you know, that's where when we say like AI is enhancing it. It's making it cheaper and faster and easier to commit fraud than ever before. It's not necessarily, yes, there are some fraud attacks that are AI enabled, but a lot of this is AI just makes it more believable and is faster and cheaper. And I've always said that, you know, the goal of the of the cyber criminal is to steal money for the least amount of money, in a short amount of time. And the goal of the fraud fighter is to make it cost as much as possible to steal from you, and make it take as long as possible for the fraudster to steal. So like we have we're, you know, in two different sides of this battle. And one of us wants to make it, you know, they want it cheap and fast and easy and we want it to be slow and expensive. Because we're never going to be able to eradicate it, right? But that's kind of our our goals. So, um, yeah, they're using AI to make it faster, cheaper, and easier.
Frank McKenna
41:24
And, um, right. The other thing is a lot of these, you may not realize it, but a lot of these jury duty bail scams, you know, the ones that you get the text and the phone calls. And I know because I I went through one myself just to see what it was. But those phone calls you're getting are coming from jail inmates in jail. Oftentimes they're using contraband they're using contraband cell phones. Karisse Hendrick(41:53): Mhm.
Frank McKenna
41:53
So you're, they're having people on the outside, or maybe they're doing it in the jail. They send those text messages. Um but they'll put the cellmate that the, the phone of the inmate in jail. So, you'll be talking to an inmate in jail who's pretending to be a police officer or sheriff typically in your own city, and then they'll get you to send Venmos and Zelles to uh their girlfriends or husbands on the outside. So, they have people on the outside that are collecting the payments. And so, a lot of these are running in prisons. As ironic as that sounds, you're not talking to a sheriff, you're talking to an inmate. And it's in Georgia typically. So,
Karisse Hendrick
42:39
Wow. Yeah. I mean, I didn't know that about this particular scam, but that doesn't surprise me necessarily. Uh there's a lot of fraud that occurs in prisons, in a lot of different ways. Um especially with contraband phones. So, uh it would make sense that this would be it, too. Um so I think as far as I mean this particular fraud vector is targeting consumers. Um it's not necessarily targeting banks or you know online companies. However, um I think getting the word out to Fraudology listeners that especially, at banks and financial institutions, that they may have a frantic person come to their, you know, to a teller there. And they um they maybe on the phone. That's one sign that it's fraud. Even if they have documents that kind of look legit, that still doesn't mean that they are legitimate. Um, so things like that, you know, to be aware of. So that you can educate consumers if you think that they're a victim of this.
Frank McKenna
43:56
Yeah, it's um banks are going to see this from their customers. Whether it's the digital arrest or one of these FBI impersonation scams, they're going to feel the calls from their customers and they're going to see these people in their branches who are coming in
Karisse Hendrick
44:14
To get money out of their accounts. Yeah.
Frank McKenna
44:18
And they're going to be with somebody in their ear who's telling them exactly what to say, who's instructing them that, you know, often times they'll tell them the bank teller is involved. Don't trust the bank teller, don't answer questions. The bank teller is part of the fraud. So, they they really psychologically manipulate these people. Um, which is why you have to get those people off of the floor and maybe bring them in an office and talk to them behind closed doors, you know, to warn them what might be happening if you see this type of thing. And there are a lot of tellers, you know, I always say the tellers are on the front lines of fraud because uh a lot of the fraud is happening in the branches again, right? Where people are going into branches. They're getting the money out um and turning it over to the scammers.
Karisse Hendrick
45:11
Absolutely. Well, gosh, Frank, I really appreciate you coming on. Between these two stories, I feel like I mean, and I'm not a drinker, but I almost feel like I need a drink. Um just because there, you know it's always a little depressing. But knowledge is power and knowing about these is half the battle. Um so that you can educate your customers your you know uh colleagues, your employees, etc. That this is a new scam. And then as far as the you know ID scan data breach, I'll bring updates when there are some. But it has gone noticeably quiet since Tuesday late afternoon, early evening, uh when my phone was blowing up um in in the best way with some of the best people. So, I was fine. I was just like, "What is going on?" Um and it was justified. Uh it was justified to pull the fire alarm in the fraud group text.
Frank McKenna
46:13
That's funny. Well,
Karisse Hendrick
46:15
Well, I appreciate. Right, exactly.
Frank McKenna
46:16
Breaking news in the in the message chats.
Karisse Hendrick
46:20
Yes. Yes. Um yeah, I just really appreciate you coming by as always. Um I think everyone knows how to get a hold of you on LinkedIn, and I, uh if you're not subscribed to Frank's newsletter yet, like I don't I don't know if I can help you. But I hope that you are and that you go do that. Um and I just I always appreciate talking fraud with you, Frank. Thanks so much for stopping by.
Frank McKenna
46:46
A lot of fun. Thanks for having me and we'll talk again soon.
Karisse Hendrick
46:50
Yes, we will. I'm sure there will be more to report on soon.
View full transcript
