Oct. 6, 2026

Impersonation scams and malicious actors gaining access to your account

Show Notes
Transcript

We are reviewing a couple new FBI Public Service Announcements. One PSA is about OAuth scams - malicious actors gaining access to your accounts through consent phishing. Tune to learn more about this. We will also run through a few examples of how to protect yourself from permissions granted to apps and OAuth scams.

Let’s Talk About Scams is broadcast live Tuesdays at 8AM PT on K4HD Radio - Hollywood Talk Radio (www.k4hd.com) part of Talk 4 Radio (www.talk4radio.com) on the Talk 4 Media Network (www.talk4media.com). Let’s Talk About Scams TV Show is viewed on Talk 4 TV (www.talk4tv.com).

Let’s Talk About Scams Podcast is also available on Talk 4 Media (www.talk4media.com), Talk 4 Podcasting (www.talk4podcasting.com), iHeartRadio, Amazon Music, Pandora, Spotify, Audible, and over 100 other podcast outlets.

Disclaimer: The information contained in this podcast is intended for informational purposes only and is not a substitute for individual professional / legal advice. The podcast information was carefully compiled from vetted sources and references; however, R.O.S.E. Resources / Outreach to Safeguard the Elderly cannot guarantee that you will not fall victim to a scam.

Become a supporter of this podcast: https://www.spreaker.com/podcast/let-s-talk-about-scams--6483699/support.

This episode includes AI-generated content.

WEBVTT

1
00:00:00.150 --> 00:00:03.490
The information contained in this podcast is intended for informational

2
00:00:03.549 --> 00:00:07.049
purposes only and is not a substitute for individual professional

3
00:00:07.129 --> 00:00:10.910
legal advice. The podcast information was carefully compiled from vetted

4
00:00:10.960 --> 00:00:15.140
sources and references. However, Rose Resources outreach to safeguard the

5
00:00:15.179 --> 00:00:18.120
elderly cannot guarantee that you will not fall victim to

6
00:00:18.199 --> 00:00:23.949
a scam. Let's talk about scams. It's the must-listen show

7
00:00:24.010 --> 00:00:27.230
for anyone who wants to protect themselves and their loved

8
00:00:27.339 --> 00:00:31.500
ones from scams. Every Tuesday at 8 a.m. Pacific Time

9
00:00:31.579 --> 00:00:36.200
on K4HD Radio, Joyce Petrowski, founder of Rose, and her

10
00:00:36.320 --> 00:00:41.020
guests will provide valuable insights and practical tips on how

11
00:00:41.039 --> 00:00:46.149
to recognize and protect yourself from scams. And now, here

12
00:00:46.189 --> 00:00:48.509
is your host, Joyce Petrowski.

13
00:00:49.329 --> 00:00:49.869
Hi, everybody.

14
00:00:49.929 --> 00:00:50.530
Welcome back.

15
00:00:50.750 --> 00:00:54.119
I'm Joyce Petrowski, founder and board president of Rose Resources

16
00:00:54.200 --> 00:00:57.479
Outreach to Safeguard the Elderly. You can find more information

17
00:00:57.560 --> 00:01:04.040
on our website at roseadvocacy.org. Our social media links are

18
00:01:04.239 --> 00:01:06.579
at the top of the page. You can find all

19
00:01:06.599 --> 00:01:10.609
of our episodes from the radio show on our YouTube channel.

20
00:01:11.290 --> 00:01:13.170
And you're going to want to click subscribe so you

21
00:01:13.189 --> 00:01:17.650
get notified of the upcoming shows. You can also visit

22
00:01:17.689 --> 00:01:25.430
our letstalkaboutscams.com website dedicated specifically to this radio show. You

23
00:01:25.549 --> 00:01:28.430
scroll down to the bottom, you'll find where you can

24
00:01:29.150 --> 00:01:32.329
download our safety checklist, but you can also sign up

25
00:01:32.370 --> 00:01:35.849
for our newsletters each month. We do one that we

26
00:01:35.890 --> 00:01:39.049
send out in the mail. October's went out last week,

27
00:01:39.790 --> 00:01:43.310
and we do one that we send via email, and

28
00:01:43.439 --> 00:01:44.950
October's went out last Saturday.

29
00:01:45.510 --> 00:01:46.049
For that one.

30
00:01:46.129 --> 00:01:48.799
But every Tuesday morning, you're going to get a Tuesday tip.

31
00:01:49.439 --> 00:01:52.530
There's two benefits to that. One is the tip might

32
00:01:52.590 --> 00:01:57.290
be information that you didn't know. But then also just

33
00:01:57.349 --> 00:02:03.670
as important is it's reinforcing your scam prevention habits. Unfortunately,

34
00:02:03.709 --> 00:02:06.650
we're at a time where we have to make scam

35
00:02:06.689 --> 00:02:07.969
prevention a habit.

36
00:02:08.590 --> 00:02:10.900
In this way, you're going to be more apt to

37
00:02:11.000 --> 00:02:11.599
when you're.

38
00:02:11.409 --> 00:02:15.819
Contacted by a scammer or you're looking to go on

39
00:02:15.860 --> 00:02:18.819
a website that maybe you're not sure about, you're going

40
00:02:18.840 --> 00:02:21.860
to think about scam and then look to your tips

41
00:02:21.919 --> 00:02:24.360
and tools that you need to do to verify scam.

42
00:02:25.330 --> 00:02:30.930
Whether the contact or the website is legitimate or not.

43
00:02:31.370 --> 00:02:34.280
So today I'm going to talk about some updates.

44
00:02:34.340 --> 00:02:36.069
I'm going to share my screen.

45
00:02:37.400 --> 00:02:40.360
All right. We are going to go to the internet

46
00:02:40.400 --> 00:02:44.479
crime complaint center website, the ic3.

47
00:02:43.919 --> 00:02:44.479
Gov.

48
00:02:44.740 --> 00:02:48.979
And I just went under this public information and clicked

49
00:02:49.000 --> 00:02:53.030
on public service announcements. Um, There's one that just came

50
00:02:53.090 --> 00:02:56.310
out a few weeks ago, scammers impersonating law enforcement and

51
00:02:56.349 --> 00:03:00.849
government officials in fraud schemes. So this is an update

52
00:03:00.930 --> 00:03:03.650
to an alert that was originally published back in March

53
00:03:03.689 --> 00:03:08.000
of 2022. So FBI is still seeing a lot of

54
00:03:08.090 --> 00:03:14.740
government impersonations, law enforcement impersonations, that they are continually updating this.

55
00:03:14.819 --> 00:03:20.580
So between January 2025 and July of 2026, So that

56
00:03:20.780 --> 00:03:24.759
is about a year and a half. They received nearly 61,000

57
00:03:24.759 --> 00:03:34.120
complaints of law enforcement or government impersonation scams, totaling about $ 1. 6

58
00:03:31.680 --> 00:03:35.699
billion in stolen funds. So here's a little bit about

59
00:03:35.740 --> 00:03:40.189
how the scam works. What they're seeing is that the

60
00:03:40.250 --> 00:03:44.949
scammers primarily contact the victims through unsolicited phone calls. However,

61
00:03:44.990 --> 00:03:49.210
they can use other methods, right, text messaging, e-mails, Um,

62
00:03:49.810 --> 00:03:53.759
but then they, uh, what they spoof the authentic phone numbers,

63
00:03:54.060 --> 00:03:58.110
email address, employees, names, credentials, all of that stuff. Um,

64
00:03:59.699 --> 00:04:03.280
they use a variety of approaches when they're impersonating these

65
00:04:03.580 --> 00:04:08.780
law enforcement officials, these government officials, um, urgency that seems

66
00:04:08.840 --> 00:04:11.590
to come up a lot. And they're in pretty much

67
00:04:11.650 --> 00:04:16.189
the majority of the scam messages out there, aggressive tones.

68
00:04:16.810 --> 00:04:19.370
They're going to get aggressive with you if you don't.

69
00:04:19.230 --> 00:04:22.750
Agree right away to, um, you know, pay over whatever

70
00:04:22.850 --> 00:04:26.629
fees they're, they're talking about or taxes or, or something

71
00:04:26.670 --> 00:04:31.810
like that. Um, refusing to speak or leave messages with

72
00:04:31.889 --> 00:04:36.370
anyone other than the targeted victim. And they are keeping

73
00:04:36.389 --> 00:04:38.810
the victims on the phone for the duration of the scam,

74
00:04:39.110 --> 00:04:41.009
which is something they've been doing for a while, but

75
00:04:41.060 --> 00:04:45.639
they're still seeing that with this uptick in the government

76
00:04:45.779 --> 00:04:49.410
and law enforcement impersonation scams. And urging people not to

77
00:04:49.449 --> 00:04:53.540
tell their family, friends, financial institutions, law enforcement, anything like that.

78
00:04:54.160 --> 00:04:58.860
Demanding payment through a variety of methods. Prepaid cards are

79
00:04:58.899 --> 00:05:03.259
coming up again. Well, I shouldn't say again. They've been...

80
00:05:03.639 --> 00:05:05.819
They've been using those as a method to get money

81
00:05:05.879 --> 00:05:06.819
for a long time.

82
00:05:06.980 --> 00:05:11.959
Couriers. So this is interesting. We heard about this probably

83
00:05:12.079 --> 00:05:12.639
last year.

84
00:05:12.680 --> 00:05:15.920
I think, when we did an episode on the gold

85
00:05:15.959 --> 00:05:22.300
bar scams where they were convincing people to transfer their money. uh,

86
00:05:22.459 --> 00:05:25.730
money into gold bars and then they would send couriers

87
00:05:25.790 --> 00:05:28.069
to come pick them up or they would meet you

88
00:05:28.209 --> 00:05:31.730
in a parking lot, um, to hand over the gold bars, uh,

89
00:05:31.790 --> 00:05:37.000
bank wires. Uh, again, they get the money instantly, the cryptocurrency, um,

90
00:05:38.240 --> 00:05:42.139
cash inserted into those cryptocurrency ATM machines. We talk about

91
00:05:42.180 --> 00:05:45.639
this every time we do a presentation. Um, and I'm

92
00:05:45.720 --> 00:05:49.120
just gonna, um, Take a side note here on the

93
00:05:49.180 --> 00:05:54.100
cryptocurrency ATMs and just remind everybody that Arizona has that

94
00:05:54.160 --> 00:05:56.300
new law that went into effect a little over a

95
00:05:56.360 --> 00:05:56.879
year ago.

96
00:05:57.519 --> 00:06:01.180
So our goal is that you are.

97
00:06:01.139 --> 00:06:02.899
Not going to go out there and put money into

98
00:06:02.920 --> 00:06:07.519
a cryptocurrency ATM machine. But if you hear somebody talking

99
00:06:07.560 --> 00:06:09.579
about that they did that and they realized it was

100
00:06:09.620 --> 00:06:13.120
a scam, ask them, has it been 30 days since

101
00:06:13.600 --> 00:06:16.620
you made that transaction or transactions if it was more

102
00:06:16.660 --> 00:06:20.550
than one? And do you have your receipts? If the

103
00:06:20.629 --> 00:06:22.850
answer is yes to both of those questions, it's been

104
00:06:22.889 --> 00:06:26.329
within 30 days from the transaction date, and they have

105
00:06:26.529 --> 00:06:29.389
all of their receipts, have them go immediately to law

106
00:06:29.410 --> 00:06:32.750
enforcement and file a report. Because then they can take

107
00:06:32.810 --> 00:06:36.100
that report along with their receipts and send it to

108
00:06:36.149 --> 00:06:41.009
the owner of the cryptocurrency ATM. and they can get

109
00:06:41.050 --> 00:06:46.430
their money refunded, including any fees that these ATMs charge. Now,

110
00:06:46.449 --> 00:06:49.639
30-day window is not a long window. It's a very

111
00:06:49.720 --> 00:06:52.199
short window. So we have to make sure that this

112
00:06:52.279 --> 00:06:56.120
new law gets out there, people know about it, because

113
00:06:56.139 --> 00:06:59.100
I really don't want people finding out about this after

114
00:06:59.139 --> 00:07:02.660
they've been victimized and it's day 35, because then you're

115
00:07:02.680 --> 00:07:05.300
going to be outside that window. So that 30 days

116
00:07:05.379 --> 00:07:07.839
is very important, and it's very important that you keep

117
00:07:07.879 --> 00:07:14.110
your receipts as well and file that report. So back

118
00:07:14.149 --> 00:07:18.670
to this public service announcement. Scammers use many different pretenses

119
00:07:19.230 --> 00:07:22.069
in their initial contact with victims. They accuse the victims

120
00:07:22.129 --> 00:07:26.850
of wrongdoing. Here's some examples. Scammer accuses a victim of

121
00:07:26.930 --> 00:07:29.689
committing or being connected to a crime and threatens the

122
00:07:29.730 --> 00:07:34.750
victim with arrest, prosecution, or imprisonment, if they do not

123
00:07:34.829 --> 00:07:38.699
pay to remove the charges or assist in the investigation

124
00:07:39.160 --> 00:07:44.259
against the real criminals. These are the majority of what

125
00:07:44.300 --> 00:07:45.420
the FBI.

126
00:07:45.060 --> 00:07:49.470
Is seeing on the government impersonation complaints. But here's another one.

127
00:07:49.509 --> 00:07:52.029
The scammer accuses the victim of not reporting for jury

128
00:07:52.069 --> 00:07:54.910
duty and threatens a fine or accuse the victim of

129
00:07:54.930 --> 00:07:57.269
missing a court date or there's a warrant out for

130
00:07:57.290 --> 00:07:59.560
their arrest unless a payment is made.

131
00:08:01.300 --> 00:08:02.620
During the same timeframe.

132
00:08:02.660 --> 00:08:07.600
January, 2025 to July of 2026, uh, the FBI reported

133
00:08:07.639 --> 00:08:11.500
there was over 6,800 of those complaints involving this specific

134
00:08:11.550 --> 00:08:16.949
type of scam with, uh, over 30 or nearly $ 36

135
00:08:16.350 --> 00:08:17.990
million in stolen money.

136
00:08:18.790 --> 00:08:21.029
Um, the jury duty one's been around.

137
00:08:20.790 --> 00:08:24.350
For a while and it seems like they're continuing to

138
00:08:24.490 --> 00:08:29.319
change their techniques with the jury duty scam. Um, they're

139
00:08:29.339 --> 00:08:32.200
changing it about missing a court date or, um, the

140
00:08:32.220 --> 00:08:34.159
warrant is out for the victim's arrest.

141
00:08:34.879 --> 00:08:36.879
Um, excuse me.

142
00:08:37.159 --> 00:08:40.279
Uh, the scammer claims the victim's passport driver's license or

143
00:08:40.320 --> 00:08:44.850
professional license is expiring and demands payment for renewal. So

144
00:08:45.110 --> 00:08:49.110
the FBI received almost 500 of those complaints with, uh,

145
00:08:49.610 --> 00:08:51.809
over or yet more than $ 348, 000 in money stolen with this. Um,

146
00:08:57.919 --> 00:09:01.139
So be aware of that one. Your driver's license, your

147
00:09:01.179 --> 00:09:04.600
professional license, your passport, they all have an expiration date

148
00:09:04.700 --> 00:09:04.919
on them.

149
00:09:05.399 --> 00:09:07.580
And that's when they expire.

150
00:09:07.840 --> 00:09:10.950
So your way to verify in that situation is you

151
00:09:10.990 --> 00:09:13.740
just pull that documentation out and you look at it.

152
00:09:13.870 --> 00:09:16.899
It will have an expiration date. if you're thinking that

153
00:09:16.980 --> 00:09:24.419
maybe something had changed at whatever department that issues those, um, uh,

154
00:09:24.539 --> 00:09:30.350
those identifications, then call that department directly through their official

155
00:09:30.399 --> 00:09:33.490
phone number and ask them the question. If, if you

156
00:09:33.529 --> 00:09:38.370
feel you need to have that added assurance, um, let's

157
00:09:38.389 --> 00:09:42.210
see that scammers are tailoring their tactics for specific types

158
00:09:42.490 --> 00:09:43.049
of victims.

159
00:09:43.409 --> 00:09:44.210
This is interesting.

160
00:09:45.500 --> 00:09:50.000
They accuse medical practitioners of having an expired medical license

161
00:09:50.080 --> 00:09:53.039
or claim their license was used in the commission of

162
00:09:53.100 --> 00:09:57.580
a crime. The scammers then threatened to revoke the practitioner's license,

163
00:09:57.639 --> 00:10:01.600
compelling the practitioner to pay to renew their license or

164
00:10:01.639 --> 00:10:07.190
protect their professional reputation. In those 18 months, the FBI

165
00:10:07.250 --> 00:10:13.830
received over 3,300 of those types of complaints, and there

166
00:10:13.889 --> 00:10:19.710
were more than $ 37 million in stolen money specifically related

167
00:10:19.809 --> 00:10:21.450
to the scams against.

168
00:10:21.190 --> 00:10:22.529
The medical practitioners.

169
00:10:24.250 --> 00:10:29.980
They may also target Americans from different ethnic communities, foreign nationals,

170
00:10:30.179 --> 00:10:35.379
or international students in the U.S. They impersonate foreign law

171
00:10:35.419 --> 00:10:42.649
enforcement agencies or U.S.-based foreign diplomat officials. They may threaten

172
00:10:42.669 --> 00:10:46.529
the victims associated with these nations with extradition or the

173
00:10:46.570 --> 00:10:50.269
canceling of their home country passport. In some situations, the

174
00:10:50.309 --> 00:10:53.879
scammers wear fake police uniforms and use mock sets of

175
00:10:53.960 --> 00:10:59.090
official-looking facilities to add legitimacy to the scam. So those

176
00:10:59.149 --> 00:11:04.049
threats can be challenging to verify due to the threat

177
00:11:04.340 --> 00:11:10.419
involving these unknown officials being overseas. So the FBI received

178
00:11:10.500 --> 00:11:14.580
over 1,800 of those complaints with more than $ 150 million

179
00:11:14.620 --> 00:11:27.220
stolen from those victims. So If you are from a

180
00:11:27.259 --> 00:11:32.019
different country, you are an international student, you're a foreign national,

181
00:11:34.500 --> 00:11:38.250
go back to verify the same place, the same department

182
00:11:38.289 --> 00:11:41.750
that you went through to get your visa, to get

183
00:11:41.809 --> 00:11:45.690
whatever documentation you needed in order to come to the

184
00:11:45.769 --> 00:11:49.289
United States and work or go to school. Go directly

185
00:11:49.370 --> 00:11:55.299
back to those official departments and check things out. um, to,

186
00:11:55.399 --> 00:12:00.240
to verify what's, what's going on. Um, Scammers are using

187
00:12:00.299 --> 00:12:06.120
new technologies, artificial intelligence, to support these impersonation schemes.

188
00:12:06.570 --> 00:12:13.049
We've seen a huge uptick in the amount of losses.

189
00:12:14.149 --> 00:12:19.070
To different scams over the last few years, and artificial

190
00:12:19.110 --> 00:12:23.159
intelligence plays a big role in that. Artificial intelligence is

191
00:12:23.259 --> 00:12:26.679
making it all the more difficult to determine what is

192
00:12:26.759 --> 00:12:30.539
legitimate and what is a scam. Um, because a lot

193
00:12:30.600 --> 00:12:34.830
of photos and videos are being faked. Uh, they're making

194
00:12:34.870 --> 00:12:38.129
those photos and videos look exactly like the pictures they're

195
00:12:38.149 --> 00:12:43.500
sending you, um, in a romance scam. And, um, the

196
00:12:43.539 --> 00:12:47.600
voice cloning. There are some voice cloning softwares that only

197
00:12:47.679 --> 00:12:51.179
need maybe three to five seconds of your voice. And

198
00:12:51.220 --> 00:12:53.519
then they can make that voice say whatever they want.

199
00:12:53.580 --> 00:12:56.639
So in a grandparent scam, they originally never knew if

200
00:12:56.679 --> 00:12:58.669
you had grandkids, it was a shot in the dark.

201
00:12:59.190 --> 00:13:01.590
Well then through a lot of online sources, they're able

202
00:13:01.610 --> 00:13:04.370
to figure out, yes, you have grandkids. These are their

203
00:13:04.409 --> 00:13:06.590
names and they can do it with other family members

204
00:13:06.669 --> 00:13:09.009
as well too. They can figure all that out through

205
00:13:09.049 --> 00:13:12.450
a variety of online sources. Um, But a lot of

206
00:13:12.490 --> 00:13:14.340
people were like, well, I know it's a scam because

207
00:13:14.389 --> 00:13:16.679
it's not my grandkid's voice or it's not my family

208
00:13:16.720 --> 00:13:19.940
member's voice. Well, now that voice sounds exactly like your

209
00:13:19.960 --> 00:13:23.100
grandkid or family member. And so it's making it all

210
00:13:23.139 --> 00:13:28.899
the harder to detect that it is a scam. But

211
00:13:28.940 --> 00:13:33.159
you still have your verification methods that you can use.

212
00:13:33.259 --> 00:13:35.639
If it's a family member, you have their phone number.

213
00:13:36.879 --> 00:13:40.460
call them directly with their phone number that you already have.

214
00:13:40.879 --> 00:13:43.139
Don't let the scammer try to tell you that their

215
00:13:43.179 --> 00:13:45.580
phone number changed and let me give you the new

216
00:13:45.639 --> 00:13:49.110
phone number. You already have their phone number. You use

217
00:13:49.139 --> 00:13:49.870
that phone number.

218
00:13:49.929 --> 00:13:52.389
Can't get a hold of them? Call another family member.

219
00:13:52.809 --> 00:13:54.309
Find out somebody.

220
00:13:54.090 --> 00:13:57.750
Else in that person's immediate family and find out what's

221
00:13:57.789 --> 00:14:01.200
going on. But just pausing and stopping and going through

222
00:14:01.240 --> 00:14:07.230
some verification processes is really going to help you make

223
00:14:07.289 --> 00:14:10.490
an educated decision whether something is a scam or whether

224
00:14:10.529 --> 00:14:13.210
it is actually legitimate.

225
00:14:13.970 --> 00:14:15.490
Here's some tips to protect yourself.

226
00:14:15.570 --> 00:14:19.309
Just know law enforcement and government authorities will never contact

227
00:14:19.370 --> 00:14:22.470
members of the public by telephone or text message to

228
00:14:22.529 --> 00:14:26.610
demand any form of payment or to request personal or

229
00:14:26.690 --> 00:14:32.730
sensitive information. They will never request payment via prepaid cards, cryptocurrency,

230
00:14:32.809 --> 00:14:37.610
or courier. So don't give your personal information to anyone

231
00:14:37.649 --> 00:14:39.950
without verifying who the person.

232
00:14:39.769 --> 00:14:42.679
Is that they say they are. Ask for credentials.

233
00:14:43.259 --> 00:14:47.019
Use the official publicly available information to contact the government

234
00:14:47.059 --> 00:14:50.840
or law enforcement agency to verify the caller and their credentials.

235
00:14:51.460 --> 00:14:54.830
Do not use the contact information provided by the person

236
00:14:54.870 --> 00:14:55.610
contacting you.

237
00:14:55.629 --> 00:14:59.509
We just talked about that. You got their credentials.

238
00:14:59.570 --> 00:15:02.169
If it's over the phone and they gave you their name,

239
00:15:02.269 --> 00:15:06.200
their badge number, whatever it is, and what law enforcement

240
00:15:06.279 --> 00:15:09.620
office they're with, well, then you look up that official

241
00:15:10.000 --> 00:15:14.720
law enforcement office's verified contact information. You call them and say,

242
00:15:14.799 --> 00:15:18.049
I had such and such person with badge number this

243
00:15:18.129 --> 00:15:21.090
that just called me about this. And you talk to

244
00:15:21.649 --> 00:15:25.350
that office directly and let them help you navigate what

245
00:15:25.429 --> 00:15:26.139
is going on.

246
00:15:27.129 --> 00:15:28.129
If you're sent any.

247
00:15:27.990 --> 00:15:33.860
Webpage URLs, you really need to review those URLs. If

248
00:15:33.899 --> 00:15:37.220
they're not, if the URL is not shown, you can

249
00:15:37.299 --> 00:15:40.940
hover your mouse over it without clicking and look at

250
00:15:41.000 --> 00:15:46.529
the actual website address or email address that it wants

251
00:15:46.590 --> 00:15:51.389
to take you to. And You can look at it

252
00:15:51.470 --> 00:15:55.009
and read it, but scammers are getting really sneaky and

253
00:15:55.629 --> 00:15:59.529
they're using typosquatting and they're just doing a very, very

254
00:15:59.690 --> 00:16:04.750
slight change in the domain name that maybe your naked

255
00:16:04.889 --> 00:16:07.230
eye is not going to pick up just by reading

256
00:16:07.289 --> 00:16:14.840
it because you're already thinking Microsoft, Amazon, FedEx, USPS, FBI.

257
00:16:14.879 --> 00:16:17.600
You're already thinking that in your mind because that's what

258
00:16:17.639 --> 00:16:22.000
the message is talking about. you might not see that

259
00:16:22.120 --> 00:16:24.970
slight little change. And I'm going to use Microsoft, for example.

260
00:16:25.409 --> 00:16:30.820
We use this in our presentations. The email comes across Microsoft.

261
00:16:31.539 --> 00:16:37.039
It says, you know, Microsoft password reset. And, you know,

262
00:16:37.059 --> 00:16:38.120
the email.

263
00:16:37.940 --> 00:16:38.720
Is no reply.

264
00:16:38.740 --> 00:16:41.279
A lot of big companies use a no reply email address.

265
00:16:41.679 --> 00:16:45.779
And so your eye is already reading Microsoft. But are

266
00:16:45.850 --> 00:16:49.950
you noticing that that M is really a lowercase R

267
00:16:49.970 --> 00:16:53.169
and N? And are you going to see that little

268
00:16:53.230 --> 00:16:57.200
space between that R and that N? Your naked eye

269
00:16:57.240 --> 00:17:00.600
might not because your brain, your mind is already thinking Microsoft.

270
00:17:01.019 --> 00:17:04.980
So please write every character down that you see. Look

271
00:17:05.009 --> 00:17:08.569
at the individual characters. Write it down and look and

272
00:17:08.670 --> 00:17:12.029
make sure those characters, when put together, make sense. Some

273
00:17:12.069 --> 00:17:14.400
people have said they like to read it backwards, that

274
00:17:14.440 --> 00:17:19.680
that helps them be able to see little tweaks by

275
00:17:19.740 --> 00:17:23.109
reading it backwards. Whatever works for you, but looking at

276
00:17:23.150 --> 00:17:28.210
the individual characters so you can see what it actually

277
00:17:28.329 --> 00:17:32.480
is saying in that website or that email address. And

278
00:17:33.460 --> 00:17:35.920
whether or not you've had money stolen from you, it

279
00:17:36.200 --> 00:17:39.279
is always good to report it. It gives law enforcement

280
00:17:39.480 --> 00:17:42.480
more information to be able to try to find these

281
00:17:42.539 --> 00:17:46.220
people and prosecute these people. You are not the only one. Um,

282
00:17:47.160 --> 00:17:49.859
there are hundreds, if not thousands of other people, as

283
00:17:49.900 --> 00:17:54.829
you saw from the statistics that have, um, experienced that

284
00:17:54.930 --> 00:18:00.910
specific scam and your information helps add pieces to the puzzle. Um,

285
00:18:01.789 --> 00:18:03.930
I'm going to go back here because there's one more

286
00:18:03.950 --> 00:18:06.779
I want to go over. And this was about a

287
00:18:06.859 --> 00:18:07.460
month ago.

288
00:18:07.480 --> 00:18:08.460
All right.

289
00:18:08.579 --> 00:18:14.930
Malicious cyber actors gain access to victim accounts through consent phishing.

290
00:18:15.849 --> 00:18:19.000
So this started late 2025. They've been targeting....

291
00:18:21.299 --> 00:18:23.259
At least the FBI has been seeing, they've been targeting

292
00:18:23.339 --> 00:18:28.180
prominent victims, their family members, personal acquaintance, by directly messaging

293
00:18:28.259 --> 00:18:34.670
personal accounts with malicious links, leveraging a technique known as OAuth.

294
00:18:36.130 --> 00:18:37.049
Consent phishing.

295
00:18:37.690 --> 00:18:42.940
So, It's a commonly used authorization framework which enables websites

296
00:18:43.160 --> 00:18:47.950
and web application to request access to your account on

297
00:18:47.990 --> 00:18:54.039
another application without you exposing your login credentials.

298
00:18:55.940 --> 00:18:56.890
I actually found a.

299
00:18:58.579 --> 00:19:05.339
Really nice infographic on this. This is training only this,

300
00:19:05.559 --> 00:19:07.359
you know, real screens look different.

301
00:19:07.480 --> 00:19:09.880
This is just an example. It's for training.

302
00:19:10.299 --> 00:19:13.680
It's not an actual one that someone has received. It's

303
00:19:13.759 --> 00:19:18.240
just one that I will be honest with you. I

304
00:19:18.339 --> 00:19:23.549
used Claude and artificial intelligence to help me put this together.

305
00:19:24.569 --> 00:19:29.609
But you get a, an email from, or a notification,

306
00:19:29.650 --> 00:19:33.700
and this is Doc Viewer Pro. A lot of people

307
00:19:33.859 --> 00:19:37.539
use DocuSign. That's a big one that's out there. And yes,

308
00:19:37.579 --> 00:19:42.140
scammers will impersonate DocuSign. So before you just arbitrarily click

309
00:19:42.200 --> 00:19:45.289
on a link to sign documents through DocuSign, you need

310
00:19:45.309 --> 00:19:50.400
to verify and make sure that these are... coming from

311
00:19:50.440 --> 00:19:55.099
a legitimate person and there's a legitimate reason why you

312
00:19:55.140 --> 00:19:59.309
need to access the DocuSign. But Over here, let's look

313
00:19:59.349 --> 00:20:01.809
at this. So there's an app name you don't recognize.

314
00:20:02.490 --> 00:20:07.109
But even if you recognize it, you need to still verify.

315
00:20:07.809 --> 00:20:11.259
If this said DocuSign, you still need to verify, right?

316
00:20:11.279 --> 00:20:15.700
Especially if you weren't expecting anything to sign through DocuSign.

317
00:20:15.720 --> 00:20:19.740
But even if you were, call the person that you

318
00:20:19.769 --> 00:20:23.269
were expecting it from to say, hey, I just received

319
00:20:23.309 --> 00:20:27.529
this from you um, is, is this legitimate? You know, did,

320
00:20:27.589 --> 00:20:30.549
did you just send this? So, but scammers can also

321
00:20:30.630 --> 00:20:33.680
try to catch you and you can see here, doc

322
00:20:33.759 --> 00:20:37.220
viewer pro, um, you know, somebody might read that and

323
00:20:37.279 --> 00:20:39.240
see doc and go, okay, doc, you sign and not

324
00:20:39.279 --> 00:20:43.259
read the rest of it. So they pick official sounding names. Um,

325
00:20:43.519 --> 00:20:46.789
it asks for far more than it needs. So by

326
00:20:46.849 --> 00:20:52.920
going in and, um, hitting this doc, you doc viewer

327
00:20:52.960 --> 00:20:56.900
pro wants you to allow them to read, send, delete,

328
00:20:56.940 --> 00:20:59.960
manage your email, see and download all of your contacts,

329
00:21:00.420 --> 00:21:04.130
see and edit and delete all of your files. But in,

330
00:21:04.329 --> 00:21:06.990
you know, very small print down here, it says, make

331
00:21:07.029 --> 00:21:09.150
sure you trust doc viewer pro. You may be sharing

332
00:21:09.210 --> 00:21:12.069
sensitive information with this site or this app.

333
00:21:12.730 --> 00:21:13.890
And a lot of times if.

334
00:21:13.849 --> 00:21:16.130
People are in a hurry and they're actually thinking, well,

335
00:21:16.150 --> 00:21:19.640
this is a doc, you sign and, and, um, cause

336
00:21:19.660 --> 00:21:24.440
they're just, you know, scanning it really quickly. Um, and yes,

337
00:21:24.480 --> 00:21:29.619
I'm expecting something from, from DocuSign that, um, uh, that

338
00:21:29.640 --> 00:21:31.759
they're just going to be allow, you know, really quickly.

339
00:21:31.900 --> 00:21:36.640
So be very careful with, with this. Um, I mentioned

340
00:21:36.660 --> 00:21:40.119
the warning is in small, you know, gray print, um,

341
00:21:40.440 --> 00:21:42.240
allow is the big bright button.

342
00:21:42.460 --> 00:21:45.059
So unless you know.

343
00:21:44.920 --> 00:21:51.700
For sure that this is an actual verified, um, email

344
00:21:52.599 --> 00:21:55.940
link that you're getting and you verified it, hit cancel

345
00:21:56.140 --> 00:22:00.309
over here. The one that is not the bright button

346
00:22:00.549 --> 00:22:04.329
that's already highlighted for you to click.

347
00:22:04.950 --> 00:22:07.049
So why does this fool people?

348
00:22:07.109 --> 00:22:10.670
Because there's no password to type and the screen is

349
00:22:10.849 --> 00:22:15.170
on the real website so it feels safe. So that's

350
00:22:15.230 --> 00:22:18.369
that OAuth is that you don't actually need to use

351
00:22:18.390 --> 00:22:23.670
your a login to get into something. And there's a

352
00:22:23.710 --> 00:22:30.079
lot of different applications that would use this. And so

353
00:22:30.140 --> 00:22:35.619
scammers are taking advantage of people through this type of

354
00:22:36.240 --> 00:22:41.130
consent phishing. So let's look at what the FBI has

355
00:22:41.150 --> 00:22:45.779
been seeing. They've been impersonating government officials, media, and other

356
00:22:45.880 --> 00:22:52.000
publicly known personalities on a commercial messaging application and soliciting

357
00:22:52.759 --> 00:22:55.720
the targeted individual to access a malicious link under the

358
00:22:55.759 --> 00:23:00.599
guise of a file sharing service through an application under

359
00:23:00.619 --> 00:23:04.779
the malicious actors control. So that's the scammers control. And

360
00:23:04.819 --> 00:23:09.009
you think it's a legitimate file sharing application. So previous

361
00:23:09.029 --> 00:23:15.140
phishing campaigns have also impersonated event coordinators and planners who

362
00:23:15.579 --> 00:23:18.630
the scammers then sent malicious links to the targets under

363
00:23:18.670 --> 00:23:22.099
the guise of an invitation to an event. and the

364
00:23:22.140 --> 00:23:25.789
need to verify the target's identity through a malicious application

365
00:23:25.900 --> 00:23:31.690
under the scammer's control. So spear phishing efforts focused on

366
00:23:31.750 --> 00:23:35.269
social engineering ruses with links or access to malicious credential

367
00:23:35.309 --> 00:23:39.759
harvesting sites or malware to gain access to your accounts

368
00:23:39.799 --> 00:23:44.339
or devices. This OAuth consent phishing provides the scammers with

369
00:23:44.440 --> 00:23:49.289
persistent access to a target's account Because once you give

370
00:23:49.430 --> 00:23:54.250
permission the first time, it can only be revoked by

371
00:23:54.369 --> 00:24:01.799
you invalidating you taking away that permission in that application

372
00:24:01.859 --> 00:24:05.980
security setting, not by changing the password. You can change

373
00:24:06.000 --> 00:24:08.480
your password to get into the app, but if you

374
00:24:08.519 --> 00:24:12.509
have already given permission to for them to access all

375
00:24:12.549 --> 00:24:16.150
this other information, then they have it. They don't need

376
00:24:16.170 --> 00:24:18.869
you to give them permission again. And the only way

377
00:24:18.910 --> 00:24:22.150
to revoke it is to actually going into that app,

378
00:24:22.630 --> 00:24:28.589
going into the security settings and revoking the permission. So

379
00:24:28.769 --> 00:24:32.589
this can get a little bit more difficult, um, just

380
00:24:32.630 --> 00:24:35.529
because you don't, uh, um, a scammer doesn't need to

381
00:24:35.650 --> 00:24:42.880
actually have your login to those apps. Um, So what

382
00:24:43.039 --> 00:24:45.440
the FBI is seeing is that it usually begins with

383
00:24:45.500 --> 00:24:47.670
a phishing email or a direct message.

384
00:24:48.869 --> 00:24:50.230
The user clicks on the link.

385
00:24:50.269 --> 00:24:55.990
They're redirected to a legitimate communication provider permission request screen.

386
00:24:57.269 --> 00:25:00.319
But if the user approves the request, they unwittingly grant

387
00:25:00.380 --> 00:25:04.460
high-level access to the scammer or to the malicious application,

388
00:25:04.480 --> 00:25:08.339
which is under the control of the scammer. And then

389
00:25:08.400 --> 00:25:10.829
from that moment on, the scammer can act on behalf

390
00:25:11.140 --> 00:25:15.680
of the user. So let's look at some things that

391
00:25:15.720 --> 00:25:19.329
the FBI has put together. So the bad actors activities,

392
00:25:19.369 --> 00:25:23.349
they create an application. So they create a malicious application

393
00:25:23.509 --> 00:25:27.930
and they register it with a legitimate OAuth provider. The

394
00:25:27.970 --> 00:25:31.809
malicious application may be named to look like something legitimate,

395
00:25:31.910 --> 00:25:37.670
such as third-party personal storage or identify verification service.

396
00:25:39.349 --> 00:25:40.750

Impersonation scams and malicious actors gaining access to your account

Listen On

Recent Episodes

Impersonation scams and malicious actors gaining access to your account

Subscribe

Listen On

Recent Episodes