I've talked about scams all the time, and for the most part,
usually once you know what to look for in a particular scam, it's easy to spot. But
that's not always the case. And recently, a more sophisticated scam has actually gotten
way more popular to the point where the FBI just recently released a warning about it.
Now even though it's not literally new, it's become so much more common than before,
even in just the last year that it's going to be new to most people,
who might not even know it's a thing. And even for those of us who are just naturally suspicious
of these kinds of things, it is still hard to spot.
There's different variations, but the scam generally involves a scammer taking over an actual
legitimate email account for a business or an organization, which then allows them to send out
really legitimate looking scam emails. And if the email itself is crafted right, and even if
someone goes to look at the sender, checks the domain, it will appear completely legitimate.
So in this video we'll go over more info about these scams, some examples, and how to potentially
spot these so you're more aware of them. Which is going to be extremely important because the more
sophisticated the scam is, that means they're more likely to be able to get victims. And because it
is tough to pull off, then the scammers are going to want to go for "bigger steals", you might say.
So if they do get you, it's going to be a lot more than usual. Speaking of being
protected from threats though, before we jump in I want to thank today's sponsor,
Guardio. Guardio is a browser extension that provides real time protection from
all sorts of threats while browsing the web. Even unexpected places like Google Search Result ads,
for example, it blocks malicious sites using more than just blacklists, but
also uses in-house developed methods for detecting phishing and malware sites and more.
And yes, this includes links clicked from emails. And that's all before the threats
even have a chance to do any harm. It also scans your other browser extensions and alerts you
if there are any disguised malicious extensions installed. And for websites
that generate shady notifications after tricking you to enable them,
Guardio will trace the actual source of these notifications and eliminate them.
Plus, there are other features such as information leak monitoring, which like I've mentioned in the
past, happens way more than you think. And search hijack correction if any sites attempt to change
your browser settings without your permission. Guardio also blocks other scam- related sites,
like those involving crypto scams that steal your wallet info, and even blocks sites used
in scams that try to have you install remote desktop software for malicious purposes.
You can scan your browser for threats for free by visiting Guard.io/ThioJoe and installing the
extension. And you'll also get a seven day free trial to the premium features such as real time
threat removal. So if you want a clean and secure browsing experience, again go to Guard.io/ThioJoe,
link in the description, and check out their affordable premium plan for full protection.
And with all that being said, let's continue. Now, the actual name of this scam that the
FBI is warning about is called "Business Email Compromise", and it usually is pretty targeted,
actually. So the scammers will try to compromise a legitimate email account,
like I said. Usually though, of a higher ranking person like an executive
or some department with authority, like accounting or payroll or something that is less likely
going to get pushback or questioning for requests.
So it may just be an individual email account for one person at the company, or a more general
one used by the whole business. After they do compromise a targeted account, there are several
methods they may use to gather whatever they want. The first thing they might do is what's called a
transfer of funds request, which is basically just fancy talk for straight up stealing money.
I'll go over this in more detail in a second so you'll be able to spot potential red flags,
but there aren't going to be as many as you might think. Other than stealing money though,
they may try to steal information such as personal identifying information to steal identities. For
example, they could request a W-2 tax form from someone. And for example, if they're pretending to
be the accounting department and actually emailing from that, that might not raise any flags at all.
Going back to the transfer of funds method though, this is going to take probably one
of two forms. Both of them are going to involve stealing money from the person,
it's just going to change where the money is initially sent. And this is maybe easier than
you might think. For example, if they steal the account for an executive for example,
it could be as easy as sending an email to the accounting department
and saying "Hey, we got some work done by this freelancer and here's their invoice.
Can you be sure to pay that invoice for them as soon as possible? And here's the payment details".
And then the accounting department, they may get that all the time,
not even think twice before sending the money. As for how these scammers receive the money,
the FBI described two different possibilities.
One is a direct transfer, and the other one is a second hop transfer. In a direct transfer,
from my understanding, the scammer directly just sets up some kind of account,
probably at a crypto exchange that doesn't really request that much personal information,
so they can set it up easily. And then the payment details go to that crypto account
where the person probably pre-arranged to say that they're going to deposit to that crypto account.
So when it comes wired in, it goes into that person's account where they instantly
convert it in crypto, move it away, and then it's gone. In the second hop transfer method though,
there's an extra step first, where at the beginning the scammer will actually steal some
personal information from another victim, maybe even using the method that I described before.
Then they'll use that information to set up either a bank account or a crypto account
in that first victim's name, but they won't know about that, the scammer will actually
control it. And it adds another layer between the scammer and the victims. Then the scammer
will have the second victim send the payment into this newly created account that the scammer
controls but is not under their name, and then they can again do whatever they want with it.
And this can seriously happen to anyone because of the wide variety of forms it
may appear as. And one real life example that you might be able to learn from
is Linus from LinusTechTips, actually was nearly scammed out of 90,000 Canadian
Dollars. He did actually end up sending the money, but fortunately was able to recover it.
Now he made a whole video talking about this in more detail, I'll have it pop out,
I recommend watching it. But the quick summary is basically he had been working already on his
new house with a landscaper doing work. And the scammer had apparently hacked into the company,
the landscaping company, and for a long time was just observing, not sending out any scam emails,
and learning the ins and outs of that company. And eventually
sent emails to all the customers and basically made a extremely plausible offer.
They said, "Hey, if you prepay the full amount that you're going to pay in the next six months
or whatever for the upcoming work, then we'll give you a discount". And that again
seems extremely reasonable because they're already having work done they're already paying
this company, and all they're saying is, "Hey, if you pay early, we'll give you a discount".
Almost no alarm bells would be ringing there. And he said that they specifically
were talking in the style and tone of the original employees that they were impersonating. And they
were even using company letterhead stuff like that, so it was very sophisticated. And to be
clear, these emails were legitimately coming from the companies email servers and domain,
but they were being diverted to the scammers instead of the company.
So you wouldn't have just known necessarily looking at this unless you actually
specifically called them up and asked about it, you would never know. And eventually they
had him wire the money to a Canadian bank. Again, might not raise any red flags, it's not like it's
going in Nigeria or anything. Now fortunately, soon after they actually did wire the money,
the company let them know that this happened, they found out about it. And Linus did contact
the police who he says basically weren't able to help at all, they were almost useless. And
the only reason he was able to get that bank account frozen, and he did get his money back,
was because he had connections from just being in the YouTube media space.
So a normal person apparently would not have had any help from the authorities,
and he just happened to luck out and get his money back. But for a normal person,
that probably wouldn't have happened. Now another very recent example
is a hack of the National Health Service in the United Kingdom: NHS.
They had over 130 legitimate email accounts hacked that were used to send out phishing emails.
Apparently this started happening as early as October 2021,
and they only found out about it in April of this year and it allowed them to send
emails from legitimate NHS domains that did pass authentication. Now,
you might be wondering how this was able to go on for so long since October with nobody noticing,
and the reason is they kept a very low profile. So apparently they only sent out
just over a thousand scam emails in those several months, and most of them were in
the last month before they were discovered. So it's not like they were sending out too many,
though when they did start ramping up, that is when they were discovered.
So what they were probably doing at first, was just using the few accounts they had
or maybe just one account, to gradually increase the number they had, and then
to eventually send out a mass campaign to a bunch of people, which seems like
is what they did. But they still only seem to have sent out around a thousand emails.
So I wouldn't call that an extremely successful campaign, but still it could have been way
worse. Now the techniques the scammers used in this campaign mostly were fake "new document"
notifications. So they were saying like, "Oh, you got a new document from Adobe" or whatever. And
then it would take you to a credentials- stealing website to log in to view this "document".
And the emails looked reasonably real, especially if they were coming from a legitimate domain,
you might not have known, especially anyone who's not very tech literate. Though later on they did
become much more obvious, claiming to be from Jeff Bezos giving out millions of dollars. So
I don't know if that was a completely separate scammer that came in, and just kind of ruined
it for the original ones, or if they just decided to send out these more obvious ones, I don't know.
Very strange but still, goes to show you don't really know
what's going to happen with these. So what can you do to protect against these type of scams?
Well, the first line of defense for any email scams, again is to kind of look at
the email domain. And if it's not legitimate, then you know right away that it is a scam,
you don't even have to think about it further. However, knowing now though that there could be
scams even coming from legitimate domains and even legitimate people that you know of and
their actual email address, the main thing you kind of have to do is just be conscious
of "not typical requests" I would say from people, especially involving money.
Another specific real life example of this was actually posted on Reddit a while ago,
and it basically had where the executive email account was hacked and sent to this employee who
was on Reddit basically saying, "Hey, we're going to be giving out bonuses to the employees this
year for Christmas. And can you just go down to the store and buy a few gift cards for everyone?"
And even though this was unusual, it still is within the realm of being reasonable. Fortunately
though, this person did go and ask that person in real life or over the phone, and they said, "no,
I didn't do this", so they were able to avoid the scam. So that is one thing you can do if
you receive a request that might not even seem weird, but it just has never happened before.
Then it might be worth it, or definitely is worth it to either pick up the phone or walk down the
hall, depending on the situation, and speak to the person and say, "hey, just double checking.
You actually sent this, right?" And if you're worried about seeming dumb or silly for asking
if this person actually sent the real email, which you shouldn't be, but if you are,
what you could always do is call the person again and ask some question about the request.
For example if they requested W2 form, you could call them up and say,
"Oh, do you want a hard copy of that as well?" And if they say,
"what are you talking about?" Well, there you go. So as is usual, there's no hard fast
guaranteed rule for how to prevent these, the main defense is simply knowing about them. And
if you watched it this far, then obviously you are going to be more prepared than most people,
and you can be on a watch for this, especially in the coming years,
where this is probably going to become much more common. Thanks again to Guardio for
sponsoring this video. Again, be sure to check out Guard.io/ThioJoe where you can
install their extension and scan your browser for threats for free.
And that link will also be in the description. So let me know what you think down in the comments.
If you've come across this game before, be sure to tell your story so others can
watch out for it. If you want to keep watching, the next video I'd recommend
is a ultimate guide for spotting spoofed emails I made a while ago.
It won't tell you how to necessarily spot every scam, but it'll at least tell you
how to spot if an email itself is fake. So you can just click that right there,
and thanks for watching, I'll see in the next one.