When Trust Becomes a Trap

When Trust Becomes a Trap

Most people use technology all day without giving much thought to what is happening behind the screen. We trust routers that may not have been updated in years, depend on internet systems few of us understand, and now turn to artificial intelligence for everything from travel plans to home repairs. That convenience comes with tradeoffs. In this episode, we look at the weaknesses built into our connected world and what happens when our technical knowledge fails to keep pace with the technology surrounding us. Sherrod DeGrippo leads threat intelligence for Unit 42 at Palo Alto Networks, where she oversees teams working to identify and respond to increasingly complex cyber threats. During more than two decades in information security, she has held senior leadership roles at Microsoft and Proofpoint, along with positions at Nexum, Symantec, Secureworks, and the National Nuclear Security Administration. Sherrod was named Cyber Security Woman of the Year in 2022 and regularly shares her expertise at industry conferences and through outlets including BBC News, The Wall Street Journal, CNN, and The New York Times. She is also the author of *Threat Driven Software Development: Defending Modern Online Services*. We discuss how outdated home routers become tools for criminal and nation-state attacks, what could happen as technical knowledge disappears, and why foundational internet systems may be more vulnerable than people realize. Sherrod also explains why the greatest danger from AI may not be a dramatic technological disaster, but the gradual loss of human connection as people choose frictionless answers over real conversations. Along the way, she shares practical examples of where AI genuinely helps, where its limits become obvious, and why slowing down still matters when emotion or urgency begins driving a decision. Show Notes: * [01:48] Sherrod introduces herself and traces her 23-year career from government network security to threat intelligence. * [03:00] An early lesson in buffer overflows sparked a lasting interest in both hacking and protecting systems. * [05:10] Growing up around AT&T gave Sherrod firsthand experience with telephone networks, copper lines, and beige boxing. * [08:17] Technology has shifted from something people opened and explored into consumer devices few people truly understand. * [11:24] As technical knowledge disappears, the people who understand how systems actually work are becoming increasingly rare. * [13:41] Older internet users often understood where their data traveled, while today's devices constantly communicate in the background. * [16:22] Network security remains critical because once malicious traffic reaches a device, the problem has already become much larger. * [17:57] Outdated home routers provide an attractive attack surface for criminals and foreign governments. * [20:12] The conversation turns to the fragility of DNS, internet protocols, and the systems supporting the global network. * [22:13] Chris shares his experience with denial-of-service attacks and seeing legitimate online services exploited by malware. * [25:48] Sherrod explains why AI's greatest danger may be the gradual loss of human relationships rather than a dramatic physical threat. * [29:23] AI works well for tedious tasks, but human connection, creativity, and judgment should not be handed over so easily. * [31:35] Living intentionally means deciding what experiences matter instead of allowing technology or other outside forces to decide for us. * [34:10] Frictionless technology may leave people more vulnerable to scams by training them to expect immediate and effortless results. * [35:33] Social engineering uses modern tools, but manipulation, espionage, and theft have existed for thousands of years. * [38:14] AI may eliminate certain jobs while also giving people more time to focus on customers, relationships, and other human-centered work. * [40:44] A furnace repair shows how AI can guide basic troubleshooting and reduce the need for some professional diagnostic visits. * [43:08] AI can help someone become competent in many areas, but having access to it does not make anyone an expert. * [45:44] Used intentionally, AI can remove unwanted planning and create more opportunities for people to spend time together. * [47:18] Strong prompts, detailed skill files, and personalized instructions may become more valuable than traditional prompt engineering. * [49:10] A gift card scam demonstrates how fear and urgency can push someone to ignore repeated warnings from others. * [51:30] Sherrod advises pausing whenever a strong emotion begins driving an unusual financial or personal decision. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Sherrod DeGrippo [https://sherrod.im/] * Sherrod DeGrippo - LinkedIn [https://www.linkedin.com/in/sherroddegrippo/] * Palo Alto Networks Unit 42 [https://unit42.paloaltonetworks.com/] * Threat Driven Software Development: Defending Modern Online Services [https://www.amazon.com/dp/0135567386]

Scam Compounds

When most people think about online scams, they picture criminals sitting behind a screen and stealing from victims around the world. But in Southeast Asia, many of the people sending those messages are victims too. Some were promised legitimate jobs, flown across borders, trapped inside guarded compounds, and forced to scam others while trying to survive. In this episode, I talk with Ivan Franceschini, a lecturer in Chinese Studies at the Center for Contemporary Chinese Studies Asia Institute. After years of studying labor rights, civil society, and Chinese investment in Cambodia, Ivan's work led him to the online scam industry and the cybercrime compounds that have spread across Southeast Asia. He is the co-author of Scam: Inside Southeast Asia's Cybercrime Compounds, and through the EOS Collective, he and his colleagues also help support people who have been trafficked into these operations. I talk with Ivan about how small scam operations grew into large compounds, why COVID helped the industry expand, and how fake job offers are used to recruit people from around the world. We also talk about the blurred line between victim and criminal, the local economies that grow around these compounds, and what happens when people escape or are left stranded without money, documents, or a safe way home. Show Notes: * [01:27] Ivan Franceschini explains how his academic background in China studies and labor rights eventually led him to research scam compounds in Southeast Asia. * [04:39] Early scam operations in Cambodia started as smaller setups in villas, apartments, and hotels before expanding into large, organized compounds. * [07:53] COVID becomes a major turning point as isolation, financial desperation, and new technology help the online scam industry grow rapidly. * [10:42] The industry expands beyond Chinese-speaking networks and begins recruiting people from many countries, including large numbers from Africa. * [13:29] Criminal groups, businesspeople, local elites, and trafficking networks all play different roles in keeping the scam compound industry running. * [15:50] Fake job offers are used to recruit people from abroad, with many victims believing they are traveling for legitimate work in customer service, teaching, sales, or other fields. * [18:19] Recruiters use believable salaries and convincing explanations to lure people who may be desperate for work or unfamiliar with the region. * [21:43] Many trafficked workers are not highly trained scammers, but poor or vulnerable people who are taught scripts, given tools, and assigned small parts of the scam process. * [24:05] Language barriers are no longer a major obstacle because scammers can use translation tools, AI tools, and backstories that make mistakes seem believable. * [26:40] Scam compounds become embedded in local economies through guards, cleaners, restaurants, construction workers, delivery services, and other support jobs. * [31:22] Getting out of a compound can involve paying a ransom, escaping physically, or risking a message to an embassy, family member, NGO, or government official. * [33:40] Some trapped workers are able to ask for help online, but contacting authorities can also be dangerous if local police alert the compound operators. * [35:17] Crackdowns in Cambodia have left many people stranded without money, valid visas, housing, or a safe way to return home. * [37:27] Survivors released from compounds may end up sleeping on the street, begging for food, and trying to find help while facing fines and deportation barriers. * [40:14] Survivor support often means meeting immediate needs such as food, basic medical care, and flights home for people who have nowhere else to turn. * [41:29] Ivan explains that sanctions and enforcement need to consider the human beings inside the industry, not just the money and criminal networks behind it. * [42:49] Survivors often have valuable information about trafficking networks, scam techniques, and specific operations, but that intelligence is lost when they are abandoned. * [45:15] Verifying survivor stories requires interviews, embassy coordination, compound maps, cross-checking details, and recognizing that victim and criminal roles can overlap. * [48:53] Ivan shares where people can find his book, Scam: Inside Southeast Asia's Cybercrime Compounds, and learn more about the EOS Collective's work. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Ivan Franceschini - LinkedIn [https://www.linkedin.com/in/ivan-franceschini-1414004/] * Scam: Inside Southeast Asia's Cybercrime Compounds [https://www.amazon.com/Scam-Inside-Southeast-Cybercrime-Compounds-ebook/dp/B0DJQC55MM] * EOS Collective [https://eoscollective.net/]

Sports Betting

Sports betting is everywhere now. It is in the commercials, on the apps, wrapped into game broadcasts, and sold as a fun way to make sports more exciting. But behind the easy sign-ups and "risk-free" offers is an industry built on odds most people do not fully understand, fine print that can cost real money, and a business model that depends on customers losing. In this episode, I talk with Danny Funt, an investigative reporter and the author of Everybody Loses: The Tumultuous Rise of American Sports Gambling. His reporting on sports betting, politics, news, and sports media has appeared in The Washington Post, The New Yorker, The Wall Street Journal, Columbia Journalism Review, and other publications. Through his work, Danny has taken a close look at how legal sports betting expanded so quickly in the United States and what that boom has meant for everyday customers. I talk with Danny about misleading promotions, why "risk-free" bets are not always what they sound like, and how betting apps encourage people to remember their wins while downplaying their losses. Danny also explains why the customers who actually win can be limited or pushed away, while big spenders who lose heavily may be rewarded with VIP perks and personal attention. This episode is a closer look at the gap between the fun, harmless image of sports betting and the way the industry really works. Show Notes: * [01:20] Danny Funt introduces his work as an investigative reporter and explains how his book, Everybody Loses, examines the rapid rise of legal sports betting in America. * [03:57] A "risk-free" betting promotion turns out to be much more complicated than it sounds, leaving customers with bonus bets instead of a simple refund. * [05:25] The fine print behind bonus bets shows how customers can still lose real money, even when the offer is marketed as safe or risk-free. * [07:26] Legal sports betting has grown from a Nevada-based industry into a massive national business, with billions wagered every year across dozens of states. * [10:00] Easy access through phone apps, constant advertising, and in-game micro bets have changed how people engage with sports and gambling. * [12:21] Sportsbooks often highlight customer wins while downplaying losses, creating a distorted picture of how much money people are actually losing. * [15:59] Misleading promotions and advertising claims make betting look like a real way to profit from sports knowledge, even though very few people win long term. * [20:03] Customers who show signs of being skilled or profitable can be restricted or limited, which contradicts the message that anyone can win. * [21:51] The difference between prediction markets and sportsbooks helps explain why sportsbooks care so much about who wins and who loses. * [26:24] VIP programs for high-spending customers go far beyond casino perks, offering exclusive sports experiences and personal attention to keep people betting. * [28:19] Personal relationships between VIP hosts and customers can blur ethical lines, especially when big losers are treated like valued friends. * [34:17] Unlike bars that are expected to cut off visibly drunk customers, sportsbooks often have no clear requirement to intervene when betting behavior becomes dangerous. * [37:14] State lawmakers are beginning to consider tighter regulation, but tax revenue and industry lobbying make meaningful reform difficult. * [41:24] Industry insiders acknowledge the tension between protecting customers and maximizing profits, with many suggesting real change will require legislation. * [43:37] Professional bettors and industry critics are pushing back by warning people how difficult it really is to win and how risky the current betting culture has become. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Danny Funt [https://dannyfunt.com/] * Everybody Loses: The Tumultuous Rise of American Sports Gambling [https://www.simonandschuster.com/books/Everybody-Loses/Danny-Funt/9781668062029] * Danny Funt - Facebook [https://www.linkedin.com/in/danny-funt-2695b4a3/] * Danny Funt - Instagram [https://www.instagram.com/dannyfunt/]

Google Maps Scams

Most people are not thinking clearly when they need a locksmith or a plumber. They are locked out, water is leaking, something broke, and they just want somebody nearby who can fix it. So they open Google, tap one of the first businesses that comes up, and assume the listing is real. Unfortunately, that is exactly the kind of situation scammers count on. In this episode, Mike Blumenthal, co-founder and analyst at Near Media, talks about fake local business listings and the ways bad actors have learned to game Google Maps. Mike has been following this problem for years, going back to the early days of map spam, when locksmiths were creating fake listings all over major cities. We learn how listings can look legitimate with complete addresses, phone numbers, and reviews without actually existing. We also talk about what regular people can actually do about it. Mike explains why it helps to keep a short list of trusted local businesses before an emergency happens, and what to watch for if you do have to search online at the moment. A generic phone greeting, mismatched company names, fake-looking reviews, or an unmarked truck can all be warning signs. Show Notes: * [1:08] Mike Blumenthal shares how losing his family business led him into SEO, local search, and eventually years of work focused on Google Maps and local digital marketing. * [3:47] Early Google Maps abuse showed up in a big way when locksmiths created thousands of fake listings across Manhattan to capture emergency service calls. * [6:28] Fake listings can work especially well on mobile because Google's local results often favor businesses that appear to be physically close to the person searching. * [9:13] Map spam creates real harm for legitimate businesses and consumers, including in a recent plumbing case tied to millions of dollars in alleged consumer losses. * [12:04] Consumers can protect themselves by checking more than one platform, looking for consistent branding, and being cautious when hiring emergency service providers. * [15:22] Reports can be made to Google, the FTC, or state attorneys general, but fake listing problems are not always fixed quickly or easily. * [18:46] The Premier Plumbing case shows how troubling the problem still is, with thousands of fake listings allegedly created despite years of known abuse in local search. * [21:37] Real local businesses should not depend entirely on Google and need to build direct customer relationships through email, text, repeat service, and trust. * [24:42] Small customer service details, from professional arrival to respecting someone's home, can make a major difference in whether people trust and recommend a business. * [28:04] Pressure-based reviews can mislead consumers, especially when customers feel pushed to leave positive feedback or mention specific employees by name. * [31:24] Review volume alone does not prove a business is trustworthy because reviews can be fake, pressured, incentivized, or difficult to judge at a glance. * [33:19] Stressful emergencies make people more vulnerable to scams because they are trying to solve an urgent problem quickly and may not stop to verify the business. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Mike Blumenthal [https://blumenthals.com/blog/about-mike-blumenthal/] * Near Media [https://www.nearmedia.co/]

Job Recruiter Scams

Job hunting is hard enough without having to stop and ask whether the recruiter in your inbox is even real. My guest today, Jay Jones, ran into that problem firsthand after being laid off in December 2023. With his daughter due to be born just weeks later, Jay began receiving messages from recruiters that looked promising at first, but quickly turned out to be fake. Jay, also known as The Profiler, decided not to ignore what was happening. He started investigating the patterns behind these scams and has since identified and helped remove thousands of fake profiles, fraudulent companies, and deceptive job postings from LinkedIn. His work now helps job seekers, businesses, and executives understand how fake recruiters operate and how much damage these scams can do. In this episode, we discuss how fake recruiting scams work, why public resumes and the "Open to Work" banner can make job seekers easier targets, and what red flags to watch for before responding. We also talk about fake background checks, resume-writing scams, equipment-check schemes, one-way interview risks, fake applicants, and practical ways to verify opportunities before sharing personal information. Show Notes: * [0055] Jay Jones introduces his work as The Profiler and explains how he helps companies and job seekers protect themselves from fake recruiters, fake jobs, impersonation, and online risk. * [01:23] Jay shares how being laid off in December 2023 led him to LinkedIn, where he quickly realized many of the recruiters contacting him were not real. * [02:20] Fake recruiters often outnumber legitimate outreach because scam operations have dedicated teams sending generic messages around the clock. * [03:23] The goal behind many fake recruiter messages is to collect personal data, steal money, or gather enough information to impersonate someone. * [06:00] Scammers layer different tactics together, including fake background checks, resume-writing referrals, equipment-check scams, and fraudulent vendors. * [07:40] The "Open to Work" banner can make job seekers easier targets because it signals vulnerability and invites unsolicited outreach. * [08:36] Checking your inbox can quickly expose a fake recruiter who claims to have received an application you never actually submitted. * [10:16] Job seekers need to stay vigilant by treating each opportunity as potentially risky until they can verify the recruiter, company, and posting. * [11:06] Red flags include minimal connections, no company-related posts, no digital footprint, and recruiter profiles that only seem to exist on LinkedIn. * [12:01] Email domains matter, especially when someone claims to work for a major company but contacts you from Gmail, Outlook, AOL, or another unrelated address. * [13:26] Scam operations can involve people and organizations across multiple countries, with different levels of sophistication depending on the type of scheme. * [14:44] Legitimate recruiters are paid by companies to find candidates, not by job seekers through resume-writing side businesses or upfront fees. * [16:09] Engagement pods and fake online credibility can make scammers look more legitimate than they are by inflating likes, comments, and followers. * [17:16] Fake job postings often include copied descriptions, formatting errors, unrealistic salaries, conflicting remote-work details, or buried instructions to email outside the platform. * [18:42] Requests for credit checks or background checks before an interview or offer are major warning signs, even though some legitimate jobs may require checks later in the process. * [19:21] Fake interviews can be used to collect personal information, record a candidate's face or voice, or gather intelligence about a previous employer. * [20:53] Fake job offers often move unusually fast, rely only on email or chat, and may include equipment-check schemes designed to steal money and card information. * [22:14] Asking detailed questions about benefits, recent hires, or company procedures can disrupt scammers because they often rely on prepared scripts. * [23:36] Companies also face fake applicants, especially in technical and engineering roles where scammers may be trying to gain access to systems or data. * [25:13] Anyone who has shared sensitive information with a fake employer should freeze their credit, set up alerts, and consider whether their phone number or personal data has been compromised. * [26:18] Using a dedicated job-search email and a separate phone number can create a safer barrier between recruiting activity and personal information. * [27:17] Jay describes why he began reporting fake profiles and job postings, and why he expected platforms to take the problem more seriously. * [29:25] Jay discusses his ongoing friction with LinkedIn over fake job postings, scraped positions, and shell operations that insert themselves into the application process. * [31:33] Jay shares his own experience with identity theft after discovering that a credit card had been opened in his name when he was young. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * The Profiler [https://www.theprofiler.org/] * Jay Jones - LinkedIn [https://www.linkedin.com/in/jonesdoyoucopy/] * Jones, do you copy? [https://jonesdoyoucopy.wordpress.com/]