Episode Transcript
[00:00:04] Speaker A: Hello and welcome to another episode of Cyber Matters. I'm your host, Russ Dorsey, principal and CIO at Kasuf and Company. Cyber Matters is part of the Kasuf podcast network. This show is where we talk about cyber that matters to us, our clients, their families. It's the things that we use in technology and cyber to enrich our lives, but also, certainly, and unfortunately, the things we sometimes have to do to protect ourselves in an ever changing and very dangerous world.
We've been talking in the last few episodes of different types of fraud and phishing and scams and those kinds of things and to kind of bring this part of the series to a point, we've invited Amanda Sin, the director of the Alabama Securities Commission, to join us.
Amanda, I'm going to go ahead and bring you on camera here.
[00:00:52] Speaker B: Hey, Russ, thanks so much for having me. I know this is the last here, but it's certainly not best for last. You've had an incredible line of speakers this summer, and I've enjoyed listening to them.
[00:01:00] Speaker A: Well, it's an interesting but disheartening thing that we have to deal with. I mean, it's a shame that every time some fantastic new technology comes out, I mean, even going back to the printing press or mail, phone, TV, it doesn't matter. The fraudsters and criminals are just sitting there waiting to see how they can exploit it.
But it's good information, and some of the things that are going on are just fascinating.
My dad always said it was amazing what somebody can do in the criminal enterprise if they have 40 or 50 hours of free time a week.
[00:01:35] Speaker B: Right. We say if these criminals would just apply the efforts and their wares to a legitimate trade, they'd make just as much money and not risk going to prison. So we also said that they ripped their latest frauds out of the headlines. And we see that happening, especially during COVID The scams are rampant. They just tracked the front of the Wall Street Journal.
[00:01:52] Speaker A: That's amazing. Well, let me introduce you formally. Director Sin has been employed with the commission since 2008. Former role as Chief Deputy Director, you were responsible for supervising the activities of the Commission in regulating the security industry, protecting investors, and promoting the stability in Alabama financial matters. You advise the Commission on security related matters, investigating and prosecuting fraudulent actions surrounding the sales of securities through the state of Alabama. You're a Montgomery native. I note here that you went to Huntington College and then up here to Cumberland School of Law. So you are an attorney, right? Is that correct? By trade?
[00:02:31] Speaker B: Correct.
[00:02:33] Speaker A: But you've recently stepped into the role of director of the Commission, you said, in May, right?
[00:02:40] Speaker B: That's correct. My predecessor and an extraordinary mentor to me, Joe Borg, held this position for nearly 30 years. So the transition was so seamless. I feel like I've been in this role for some time now.
[00:02:51] Speaker A: Well, congratulations on the position. It sounds like an exciting place to be, an exciting time. And I'm really glad that, again, you could take time out of your busy schedule to come on and talk about some of these things. I think the first thing would be to tell us, for those of us that I've only become aware of the Commission probably in the last couple of years through some other work I was doing and really appreciate the support and the partnership we've had on some things. But for our listeners tell us about the Commission exactly.
[00:03:28] Speaker B: Sure. I tell folks this is Alabama's best kept secret. And I often ask this question of members of the public when we're out at outreach events. And I'll say, have you guys ever heard of the securities Commission? And some of them raise their hands and they say, sure, you guys regulate security guards. That is not the case unless they are selling investment advice securities or dispensing investment advice. So our office is situated in Montgomery, Alabama. And we are the agency responsible for I hate to use term regulating because we're often a resource. But the watchdog on the securities investment side, we have approximately 70 employees here. We investigate and prosecute our own cases. So we see, believe it or not, in Alabama a ton of securities type fraud, investment fraud. We enforce the Money Transmission Act, which is probably something you guys have never heard of, but it has become a very popular act since the evolution of digital currency. So people that transmit stored value, including cryptocurrency, fall within our jurisdiction. We do a couple of other things like enforce Lisa's Law to be sure that criminals that are prosecuted aren't profiting from any books they may have written or any publicity that they've garnered around their crimes. And we ensure that our victims are repaid those funds, our victims families. And we also have a Registration and Auditing division.
So if you come to Alabama and you want to engage in the securities industry, you check in with us. We get you properly registered or licensed. We have auditors that go out every three years generally, unless it's for calls. For example, if we get a complaint from the public that says, this broker just stole all my money, I know he did. That's very rarely the case. We have a fantastic financial community in this state. We partner with them regularly to combat fraud and do other types of things for the public. But so this division is available. Like I said, they're making sure our industry, we don't have bad actors. Just like in the legal field. We want the bad lawyers out, we want the bad players out. Which, again, in Alabama, we don't have very many. But we're also a resource to our financial industry as well. We get calls all the time from industry participants just bouncing ideas or if they want to better understand a new rule or regulation. So we're here for that as well. And we also have this small division, but they do so much on the investor education and public outreach side. So, for example, last year we conducted over 100 in person educational events were hosted by various organizations or possibly district attorneys in town. We've had school systems that wanted us to come in and talk to students about investing and saving elder senior groups. I hate to even use the term elder because all of us are victims of fraud, but we do a ton of educational work there to make people aware about financial exploitation and fraudulent practices, because the best way to prevent fraud and from losing money to fraudsters is through education. And we've learned that here. I've been with the commission now 15 years, and I was hired in as a prosecutor, so I was on one side of the house, and now I split my time. I still keep a few criminal cases, but primarily I'm focused on reviewing the reports that come in and helping our public with various matters that our agency can and services that we can provide.
[00:07:03] Speaker A: That's quite a lot being done. How big is the ACS staff? How many people do you have working on this mission?
[00:07:09] Speaker B: We have approximately 70. I didn't even mention our enforcement division. I said we investigated crimes, that we have 14 Apost law enforcement certified personnel that receive the complaints from the public. We would get referrals from the SEC, the CFTC, FTC, our federal counterparts, and the FBI and Secret Service, and we investigate those. So we're all on the same floor. It helps to have our law enforcement team here, and our legal department is just down the hall. So when we receive a complaint from the public, we can hit the ground running and investigate it. And if it rises to the level of an enforcement action, whether it's an administrative type action, which we can do in house, civil or criminal, which is what we do mostly prosecute criminal cases, we can go ahead and draft the indictments. And through our colleagues in the District Attorney's offices, our DA friends, we present it to the grand jury in the proper circuit. So we move pretty swiftly on the criminal side, and we take those responsibilities very seriously. I know I just took over for a 30 year veteran, and it's hard to follow in his footsteps, but it is an honor to serve Alabama in this way, and we hope that the listeners will use this as a resource as well. We take phone calls. I have two live people at the desk answering calls. You won't receive an automated response here unless occasionally we have to put the voicemail on if someone has to run and pick up mail, and we're shorthanded.
[00:08:33] Speaker A: That day, and we'll make sure to get the numbers and things in the notes.
It is an active organization that consumers, really, as consumer fraud can just reach out directly, make the reports and then you guys are then following it all the way through to the grand jury and getting the cases built. So, yeah, it's quite an amazing organization. I learned in past presentations that I've attended that we're actually a national leader in a lot of ways, that the commission is under the leadership and has pioneered a lot of things as far as that goes. So it's a great thing for the state and appreciate it.
[00:09:20] Speaker B: On that vein, let me just give a shout out to our agency and our legislature who assisted in this endeavor. In 2016, Alabama was by maybe a few days the first state to pass the Financial Exploitation Reporting law. So in 2016, we worked with the legislature, our governor's office and with industry who had asked for this to mandate reporting of suspected financial exploitation of our seniors.
Because you can stop fraud on the front end. Once the money is gone, the chances of recovering it is nil. So this law now has been adopted by over 32 states and our efforts have been highlighted because of the millions of dollars that we've been able to prevent through this law. And it's just been a fantastic opportunity to partner with our industry to combat fraud against our seniors. And so Alabama took the lead and that was because of the support of the great.
[00:10:21] Speaker A: Well, to talk about some of the things that are going on, what types of scams are we aware of to jump right in with both feet. What is currently trending? You'd mentioned to start with that the bad guys are following the headlines, but what are you seeing right now that's really at the top of the list?
[00:10:46] Speaker B: Russ, there's so many.
Like I said, I'm in a unique situation here that we get reports.
[00:10:53] Speaker A: Just pick your favorite five.
Just pick the top five.
[00:10:56] Speaker B: That makes it easy, but a very popular one now. And like I said, with the evolution of cryptocurrency has been a scam that is unfortunately referred to as pig butchering. I hate to use the term, but it has been coined pig butchering by the public industry, people that are seeing these crimes. And that involves a fraudster who contacts someone through the Internet primarily and gains their trust. And these are crimes of trust which are why they have such devastating consequences, not only physically but emotionally. So the victim will gain the fraudster will gain the victim's trust.
They usually direct them to a phony website that indicates that the fraudster has made millions of dollars in cryptocurrency. And Russ, crypto is still something new and exciting and unknown despite its near tenure existence. Now, it's been out for some time, but people are still unsure about how crypto operates and they're still hearing that people are making millions of dollars off cryptocurrency. So there's an allure there. And so these fraudsters capitalize on those types of things so they draw the victim in. And this is where the term pig butchering comes in. They often go in small at first, so our victim will see the website, see that this guy has made our gal tons of money, and he'll ask for an investment. He or she, the fraudster will ask for an investment. Because we've had female fraudsters in these schemes, usually a small amount at first, a modest investment, the investor receives a return on it as promised, and the fraudster may do this two or three times before going in for fattening up and going in for the kill. And like I said, I use that term because it's a term that has been widely used and popularized, but it is something that we're seeing. We have several enforcement orders out on our website that describe these scams.
And nationally, I've talked to our colleagues nationwide, and they're seeing a lot of these cryptocurrency type scams. And like I said, it's called pig butchering.
[00:13:09] Speaker A: I imagine there's a bit of a Ponzi scheme because to make those returns, they're probably pulling money out of the next victim and giving it to the current one. So you say they'll cycle two or three times. I might put 5000 in, get ten back, and they might let me do that a time or two before they hit me for the 50 or the 100. Right, sure.
[00:13:28] Speaker B: We've been able to trace these funds. We have this fascinating software, cryptocurrency tracing software, so we can see, we can't often determine identities, and that's the allure for fraudsters to use. Cryptocurrency is the anonymity. But we can see the funds being transferred from wallet, digital wallet to wallet, and certainly all of the money that is being given back to the victim in order to further gain the trust and confidence of the victim. Is either the victim's money already that's just being returned in part or a collection of funds that they've stolen from.
[00:14:03] Speaker A: Other individuals, sadly, because they might have turned the investment around. Maybe it took a week, maybe it took two weeks. If they really pace it out, when they do get me for the 50 or the 100,000, I'm not expecting that money back in a couple of weeks. So I've lost my window to do the bec kill chain or do any kind of recovery because they've taken the money and then I've been sitting there for a couple of weeks waiting for my return. Right, so they really do.
[00:14:32] Speaker B: Yeah, that happens all the time. Once the fraudster determines that he or she is sufficiently stolen, what money they can steal, or if the victim starts asking the right questions and maybe gives some indication that the victim has contacted authorities, the fraudster will run off and you don't hear from that person again.
[00:14:59] Speaker A: And when they do take things down, of course, I imagine they could even lynn Chaubin, one of his episodes, mentioned this, next time I may have lost money. This week, but next week I'll make it back. So I imagine they could take me for well, yeah, they probably could take me for 50. I'm that gullible and then give me a reason. And they might could come back and get another 50 or another 100, say, well, we're going to let you win that back. That's, that's I mean, that's just straight up house rules at that point. Well, let's go double or nothing, because, yeah, you lost that 50, but this opportunity will come back. So they really can get into people.
What is probably the largest loss that comes to mind that, you know, that an individual was taken for? I mean, just to give us some scale here.
[00:15:49] Speaker B: Individual loss. We have collective losses of over 1.6 billion, and one of the largest Ponzi schemes that we coordinated with other jurisdictions on. But I've seen one individual lose twelve to 13 million.
More than that, I don't have my data here, but this is a recent Elder exploitation case, and so it's a particularly egregious crime, and she was taken advantage of by a caretaker. I know we hear these scenarios all the time, but it does happen in Alabama, and I don't want your listeners to say, all right, well, I'm firing. All the caretakers are stealing from us, and that is not the case. We have a fantastic caregiving community. Just be sure that you have the right person. And I could talk about the registry that was created and passed and that the Department of Human Resources now maintains. So to determine whether that particular caregiver is on a list, if that's something that your listeners might be interested in at some time, or you can link to it. But this woman trusted her caregiver, and she was placed in a hospital for some time. And during that time, the caregiver obtained a power of attorney, went to the advisor, transferred over $12 million out, bought houses and cars, and just blew it. It was the caregiver and her daughter and a co conspirator, and so all three were prosecuted. But this was a crime that happened in the physical world. It wasn't one of our online scams.
[00:17:18] Speaker A: You say, so 1.6 billion just in a scheme that you guys were working. So it doesn't take much with elderly.
They've got most of the national wealth because of where they are in life, and some are sitting on six, seven, eight figures.
I guess when the scheme collapses, they take the websites down. I imagine they're branding these websites out 30 a minute. So they just change over to an URL and keep on going, but they just take everything down and ghost everybody.
[00:17:52] Speaker B: And pop up, pops up. It's like whack a mole. Our office, early in COVID, we said, well, what can we do? We know that the frauds are about to be rampant from day one. We received a picture from Homeland Security. A friend of mine sent over a photo of a pop up tent that once people started testing and everyone was trying to figure out what was going on. So if the fraudsters put up a pop up tent, they donned their white like HVAC suits and had people fill out forms to get tested and give all their personal information and went through the motions of testing people and of course the whole thing was a fraud. So beginning with that, the frauds pop up so quickly, our office said, hey, what can we do? So we initiated a COVID suite and we had investigators that were trained to identify fraudulent websites. And Russ, we discovered over 200,000 COVID related websites that were generated within weeks of this virus ripping through our country and taking lives. And so fraudsters were on top of it. They were faster obviously, than the authorities could get there. And so we notified the domain providers to take these fraudulent websites down, several of them, but as soon as you take them down, another one pops up. You just have to be careful. And that's what we encourage our friends in Alabama to do when they are online because there are so many fraudulent websites and the they, they listen to law enforcement and they take down websites when we notify them, but but they're just so voluminous that the domain providers have a hard time discerning fraud versus legitimate. And so it's incumbent upon people that are on the internet are online users to be sure that they are not on a fraudulent website.
[00:19:44] Speaker A: And yeah, we'll come back to that with some tips here towards the end. But I'm looking down again the list Nick sent me as far as cryptocurrency investment scams, we talk about pig butchering, which is really the long game, if you will. So what are some of the other scams that might be just quicker hits or what are some other things just to make us aware of that you're seeing?
[00:20:11] Speaker B: We still see the impostor scams fraudsters pretending to be someone official government personnel online. I know during COVID a lot of people who weren't social media users turned into social media users. There were a lot of us that didn't really online shop or use online retailers. We've learned now that we can conduct nearly our entire lives online. So imposter scams take advantage of social media sites. You see the pop ups, we see a lot of artificial intelligence driven scams or AI type fraud. And those pop up windows that you see online, if you're on a website and it says, hey, how can I help you, those type things come up and it causes the user to engage quickly. And once users engage, especially some of our widowed seniors who are just looking for friendship will engage the fraudster online.
They're typically asking for help or assistance. If it's a romance type thing, we see fraud, IRS, those IRS scams are still alive and well, especially around tax season, a pop up window will show up on the screen and say, hey, we just received your return, but you owe X number of dollars and people click on it. And once you click on it, sometimes it'll give it hacker access to your account.
Last summer, we saw an investment firm, an investment firm's website ripped off. So clients of the firm or any user clients, if they were interested in logging in to transact business or just checking the balance on their account or looking at their portfolio, would log on and log in immediately. A pop up window appeared on the screen and notified the customer that this website was being updated and that 5G towers were now in play and that they needed to click here to be redirected. I can't tell you how many individuals lost money in Alabama and around the country on that scam. And so once they were redirected, the fraudster had the information that was already logged in and all transfers or transactions that were initiated and those accounts were just directly sent to the fraudster. And I'm sorry, I have probably a fraud complaint calling in. I intended to turn this phone down.
[00:22:50] Speaker A: No, that's quite all right. And it's interesting, when I ask you that question about other scams, basically your answer is, everything that can be twisted and exploited, they are finding a way to do it. The hijacking of the sites, we can talk about some of the ways and actually, Lynn mentioned that in his last episode too, was this is how law enforcement there's certain ways that organizations are going to engage you.
I think we've talked quite a bit about elder fraud and obviously there's a sense of pride there and a sense of independence that the elderly have that gets preyed upon. I'm not going to be a victim. I'm smarter than that. Those kinds of things. That's how I feel the older I get. I remember feeling this way as a teenager. I was pretty smart and invincible. And then I realized how dumb I was for a while, but now I'm getting to the point, so I imagine that just gets worse.
[00:23:48] Speaker B: You've been listening to all these podcasts. You're well informed now, protected from fraud.
[00:23:54] Speaker A: You'd be surprised. I remember when my family was in the retail grocery business, and I remember the first time a guy gave me a 20 and got changed back for a 50. By the time he was done with me and my dad explaining what flim flam was, I never figured that stuff out. It was always just right over my head.
There's a spider sense some people have about this, but you're right. When you talk about websites and those kinds of things for the elderly, you hope there's a sense of, you're right. We can educate and say, hey, mom and dad or uncle aunt, let's make sure we understand this. The sites that are popping up, you can't trust things. But as far as the younger people that have grown up immersed in this I have a hard time when I talk to these letter generations X, Gen Z and all these sometimes they are very savvy on this and sometimes you wonder a little bit and then you see all this financial stuff popping up. I mean, the mint banking.
Here's this credit card that makes your life easier. And it seems like the same thing I saw in college.
The first thing that they handed me when I got to college, other than my room key, was an application for a credit card, it seemed like in the college T shirt. Now they're just hitting them straight on the Internet in high school.
[00:25:17] Speaker B: Same method, different platform, different environment.
[00:25:20] Speaker A: Yeah. So you're seeing as far as demographics, I guess they go just basically after everybody that might have an income, right?
[00:25:28] Speaker B: Right.
FTC, the Federal Trade Commission releases a report every year, and they identify or reveal their statistics because people file complaints from all over the world with FTC. And so they identify trends. And last year they revealed that the most targeted, the most vulnerable, the ones that fell for not targeted because senior group, but the group that fell for the fraud most likely was the millennials. And it's because they conduct their lives online. They share more than any generation. It may be Gen Z now, but they put theirselves out there so fraudsters can easily collect tons of information about them and specifically target them. And they also do a lot of online shopping. And we've seen several retailers that are fraudulent offering discounted luxury items. So if you're younger I was always looking for the cheapest product I could find. At the time, I didn't have any money. So if I saw a good deal, I thought, oh man, this is really something, and this is out in the real world. So I could pick it up and touch it and see it. We didn't have online shopping when I was growing up, believe it or not. And so these younger generations, they are losing money to retail scams. And also several of them, as they get closer to college, are looking for grant money. We've seen a lot of grant student loan type scams.
It's just so easy. You don't know which sites are legitimate. And there are so many now lenders offering different rates, and with inflation, you want to find the lowest rate. So I just encourage everybody. The safest place to be is just locked up in a closet. No Internet. Keep people out. But we can't live that way, so we do. Technology does provide a lot of conveniences and services that we appreciate, but the trade off is that you risk being targeted or a victim of fraud.
[00:27:24] Speaker A: We've got so much more to discuss. We're definitely going to break this into two segments. So we'll come up on a break here in just a minute. But you kind of alluded to that. I mean, some of the things that we need to be doing, obviously in families, is making sure that there's education and awareness. That's the first thing, without a doubt.
But as far as vetting a site, there's definitely fear of missing out there. There's a feeling. Well, I'll get online, it's like you said, if it's the secret shopper things and then things. I mean, my wife, the stuff, she comes across and says, this looks interesting. And I say, no, it doesn't.
But all the things that they push at you if you do find something that looks like a legitimate thing, obviously you guys, from what you mentioned earlier, are on top of these trends pretty quickly. So you've got sites or list or are there places they can go to vet things?
Just in general terms?
[00:28:25] Speaker B: Yeah. If we receive it, we can send a letter to the domain provider. They're pretty good about taking down websites that we submit and list as fraudulent. If you want to just verify every website, I tell people to Google and take the URL, post it. There are websites that identify scams. Oftentimes they'll pop up in one of our orders. But you can find out a ton of information just by googling the name of the site that you are searching. And if you Google it and there's not a lot, maybe when you look at the list of sites that come up in response to a Google search and maybe this website doesn't appear in the first ten sites, it's just down then. It usually is an indicator of fraud, but they're always welcome to contact us. The FTC maintains a database of certain fraudulent. Not sure of websites I know, like phone numbers and businesses. But it's so prevalent and innumerable that it would be hard to keep up with all of them because they change quickly. Once one comes down, another one pops up. But doing the research before you purchase from a website or certainly have any type of financial transaction executed on that website, you've got to be diligent before transmitting money or exchanging any type of money.
[00:29:43] Speaker A: Yeah, the search engines have gotten so much more aggressive. That's a very good point. You bring up the sites when they come up. If I'm dealing with a site that's got any legitimacy at all, it'll have a social media and a Google presence and a search presence that ought to go back for a long time. Now, they can fake some of that, but you're right, a new site isn't going to have anything. Then I guess the bad guys there's a sweet spot in there of a couple of weeks, and then you're going to start seeing the complaints hit in the search engines and you're going to say, this is fraud.
And you obviously can't call the numbers. Used to be you would think, well, we'll call and talk to them, just like I. Might if I wanted to bank with a bank out west or something. But now with AI and with the voice synthesis and things they're doing, you can't count on being able to vet somebody through a phone conversation.
[00:30:35] Speaker B: Many of these places don't even have brick and mortar offices any longer. You can't go to a physical location to verify a retailer's website or a banking institution website. And so it's harder now to verify when the business exists exclusively online.
[00:30:54] Speaker A: Well, that's probably a good place for us to wrap this first segment, unless we're going to come back and get into some more details. So, Amanda, I appreciate you being here with us for this first part. We're going to take a quick break. Let me reset and come back. So I want to thank everybody. Let me see if I press the right buttons here. I want to thank everybody for joining us for this first segment. Please catch us in a week or so after we post part two of this. But we've been speaking with Amanda Sin, the director of the Alabama Securities Commission, and this, of course, has been Cyber Matters, powered by the Kazoof Podcast Network. I'm your host, Russ Dorsey, and we will be talking to you again soon.
