Now, once they're inside the email, that gives them the ability to reset
the passcode on all the various accounts which are crypto, finance, banking,
whatever, credit card, Amazon, eBay, PayPal, whatever. Okay,
so they can reset the passcode on all the various accounts, but then they
still need that second factor for example, Coinbase, whatever it might be,
the crypto, they still need that second factor, which is once they gain
access to the email then and then once they have a handle on all the
various accounts, then the next thing they need to do is swap out that
SIMP. You're listening to Carrie Let'sa's Financial Survival Network where you get valuable information
you just can't find anywhere else to thrive in today's trying times. You need
the Financial Survival Network now more than ever. Go to Financial Survivalnetwork dot com
and get your free newsletter and gift. Financial Survival Network now more than ever.
Welcome you are listening to watching the Financial Survival Network of your own scary
lotz. Well, as we get to the end of October, we're getting
to Halloween, and nothing is spookier to think that somebody could get all of
your passwords to all your banking, to your credit cards, to everything,
to your email and take over your life. Well that's a real scary scenario.
So it's appropriate for Halloween. And our good friend Robert Ceciliano is with
us now. He is a security expert. Robert, you go around the
world lecturing about this stuff, password managers, all of this. My greatest
fear in life. One of them, and I guess I have a few,
is that somebody will crack the Apple password security scheme through neural network or
quantum computing and they'll have the keys to the match and if you will.
Is that fear overblown or is it realistic? So that's entirely possible. Now.
Password management is everything from making sure you're using strong passwords, which are
uppercase lowercase numbers and characters sometimes past phrases, to utilizing a password manager that
facilitates having a different password across every account. And then of course there's biometrics.
There's facial recognition, this's fingerprinting and so forth, and then of course
adding on additional security means two factor authentication, and whether that's using some type
of an authenticator app, or it's using SMS, texts right or eye message,
whatever it might be, and everything you know, beyond that and in
between, it's it's encryption and breaking encryption codes, and all of those concerns
need to be addressed at some level. Okay, But here's the thing,
Like, for for most of us, most of us are using the same
passcode across multiple accounts. The biggest mistake. Yeah, most of us are
not using two factor authentication for all of our critical accounts. Okay, most
of us. And when I say most of us, mistake, yeah,
And I know this because you know, statistically, that's what all the studies
show. But beyond that, I get in front of live audiences all the
time. So I might work with, like, you know, a financial
services professional who has like a book of business of I don't know, like
a billion dollars two billion dollars a year was worth their investments or whatever,
in clients, whatever, and he'll have you know, his top Like one
hundred people come in and I'll speak to them, and I'll ask them,
like how many of you use a password manager? And like ten of them
will raise their hand, And then then the next question is how many of
you use two factor authentication for email? And like five of them will raise
their hand you know, and these are moneyed individuals and then not doing much
in the way to protect their own data, their own devices, and these
are this is your client base. So if somebody breaks into your client's email
and then begins to communicate with you as one of your clients, right because
they're in your client's email, and you're thinking, this is my client reaching
out to me, communicating via email. And if that in this case,
you know, criminal hacker is good enough to impersonate your client from your client's
email, which isn't that difficult to do? You know, they can get
you in many ways to transfer money out of your client's account and so on.
It can just get as ugly as it can possibly be. Okay,
So I just did a presentation yesterday for real estate agents, and real estate
agents are handling handling a lot of sensitive client information. They're handling wire transfers
in many various states and so on. And I asked the same question of
real estate agents, who are service professionals who deal with transactions, who deal
with sensitive data, and they're not any more secure than your basic investor.
Unbelievable. You do two things. So a lot of the financial websites mandatory
two factor authentication now even to the point where they won't go with the SMS
code for you to type in. They actually make you approve it on your
device where it says are you trying to get into American Express? Yes?
Or no? I say no. That's the end of it. And the
other thing is there's a thing called SIM swapping. Know about this, but
a friend of mine, she got nailed from a crypto account. They went
into T Mobile in New York. She was in Florida, and they said
they were her. Maybe they even had some identification and they said they lost
their phone. They got a new phone with a SIM. They managed to
pull out eighteen grand from a crypto account, and they were in the process
of trying to steal money out of her bank account, but it was stop.
Now that bank account, you're going to be covered eventually, God knows
how long that's going to take. But the crypto account a lot more complicated.
Had to go to a lawyer, got to be suing these people.
And I didn't even know in the end if they're libel to you or not,
if they actually did what they set we're supposed to do. Yeah,
So this is like disaster in the making here. It's about the other.
You've got to make sure that your phone company will never give someone another phone
with a cloned simcord that you know, it's really tough. That one really
took me for a loop. Yeah, so I just just just two weeks
ago. I testified as an expert witness in a simswap case just two weeks
ago. And the victim in this case, which is the plaintiff, a
client and his attorney. He lost nineteen thousand dollars with the crypto because one
of the telco's facilitated his SIM card being swapped out, which meant that the
criminals were able to get into his coinbase account exactly, and they made like,
I don't know how many I need hundreds of like four and five dollars
transfers out of his account over the course of a long weekend. In the
back is working, right, his phone stopped working. He had no idea
why correctly even get through to the carrier, right, correct, correct,
So there's a few things going on there. In the case of your friend
and my client, I would bet that your client email was also compromised.
Had to be, had to be, because now else could they know about
the account. Yes, I would bet that the client's email was compromised first.
Same with my clients, because I'm confident that my client's email was compromised
first. Now, once they're inside the email, that gives them the ability
to reset the passcode on all the various accounts which are crypto, finance,
banking, whatever, credit card, Amazon, eBay, PayPal, whatever.
Okay, so they can reset the passcode on all the various accounts. But
then they still need that second factor, for example, Coinbase, whatever it
might be, the crypto, they still need that second factor, which is
once they gain access to the email then and then once they have a handle
on all the various accounts, then the next thing they need to do is
swap out that SIM. And so the main problem with swapping out the SIM
for the user is that your AT and ts and T mobiles and boosts and
all that they have authorized resellers, authorized dealers. And you know what the
authorized dealer is. It's like it's like a it's a guy on the corner
of downtown Main Street between the gas station and the convenience store and the dry
cleaner, and he's selling gum candy and T mobile phones and he's an authorized
reseller. Yeah, and so in order for and he's also selling SIM cards,
and in order for him to activate a SIM card, all he's got
to do is just be an authorized reseller. And while the big telcodes,
the AT and T s, the T mobiles of the world have all these
various systems in place that require that reseller to check ID, well, yeah,
the reseller could say, yeah, I saw ID. They showed me
an ID. Whether they showed ID or not, that's just you, honestly
probably not an expert either and identifying fraudulent ID. That's it. And if
a guy walks in and says, I'll give you one thousand dollars to swap
out this SIM, you think he's going to resist. And chances are he
If somebody's walked in and said I'll give you a thousand, they already have
a relationship. Yeah like that. Yeah, this is not the first time
that reseller has swapped out a SIM like. This is something he does.
This is something he's known for. And in the case that I testify to,
there were two resellers in different parts of the country that had swapped out
the particular SIM of this guy's phone multiple times over the course of two and
three days. Wow. So what they did was is they had actually swapped
up the SIM, were able to log in, change the passcode of a
particular account, get that one time text message to his phone via SMS,
logged into the accounts and then swapped the SIM back of the original just like
that. And they did that over a period of time, and they got
into a number of different accounts over a two and three day period of time.
So that's where utilizing an authenticator app is better than utilizing your mobile phone
number as that second factor. All right, So authenticator apps and any viewers
are probably not familiar with it, they can be a pain. Google has
an authenticator there's a number of number of them out there. From what you're
saying, Robert, that is the safest route to go rather than two factor,
although coinbased has three factor authentication sometimes, certainly when you're opening an account.
So all of this you really you really got to think seriously about it.
Yes, it requires you, as a user, somebody who has something
to lose and an account holder to focus on what it is you're getting yourself
into when it comes to setting up two factor authentication versus an authenticator app and
then determining what your best options are. The easiest thing obviously is the SMS
to using your mobile phone, but the authenticator as an actual app on your
device is a different story entirely, and that's the direction you want to head.
Yeah. In addition to that, if you ever have the opportunity to
use a Google Voice phone number as that second factor as a phone number versus
your mobile phone number, utilizing Google Voice as a phone number, your second
factor is actually more secure than your actual phone number. Sure you can't.
There's no SIM involved in a Google Voice number. You can't swap out the
Google Voice number. So this is why all the carriers are going to simless,
cardless sims, electronic sims, because they see the potential for fraud here
and in theory, at least that should eliminate it. But it's pretty scary.
I mean, right now, both of my phones are sim are cardless
sims. So that's where you don't actually have the SIM that can be reprogrammed.
You actually have to program a new phone. So they must have some
means of going about it to prevent that new phone from being cloned. What
they do at the corporate level and at the authorized actual eighteen, took T
store the actual T mobile store. Like at the actual T Mobile store,
when you walk in because you want to swap up out a SIM, they're
requesting your driver's license and then they will actually scan the back of the the
bar cord or the back of the driver's license to make sure that it's a
legit driver's license correct, and they'll have that on record, and that reduces
T Mobiles liability in that regard. And AT and T had has similar but
not the same processes. Keeping in mind that prior to me testifying as an
expert witness in the simswap case, I'm not going to name the defendant in
the case. The day before I testified, I called Boost Mobile, I
called T Mobile, I called AT and T. I called my own AT
and T to find out one of my options as far as swapping out my
SIM because my toilet, my phone fell on the toilet. What do I
do? And the woman on the phone told me all my auctions, and
she was like very you know, direct with me and all that, you
know, very helpful. And she said, all you've got to do is
going to an AT and T store with the driver's license and they'll take care
of you. I said, okay. I go, like, do they
ask me for a pin code or anything? She said, well, they
probably won't. As long as you have the driver's license, you should be
fine. I said okay. I said, but like, what if somebody
goes in with a fake driver's license. She said, well, you know,
they're not skilled in detecting that, but you know, like the likelihood
of that happening is small. I go, okay, but if somebody does
going with the fake driver's license, they could posess me. Well, I'm
not positioned to comment on that. That was with the AT and T.
So I called Team Mobile and I asked them the same all the same questions,
and they said, well, we have on our iPads we have an
app where we have to scan the driver's license. I said, good,
that's great. And then I called Boost Bobo and I asked them all the
same questions and they said, well, you're supposed to have a pin code
in order to swap ont you sim I says, well, I don't know
what my pin code is, and she said, well a lot of times
it's like the last we usually suggest either like the four numbers of your birthdate
or the last four digits of their social Security number. Oh, that's real
clever there. She suggested that to me that if you don't know what it
is, it might be that that's often what it is. I go,
well, what if it's not any of those? And she says, well,
they can usually call corporate and they can override that and they can get
somebody to take care of it right on the spot. So all of them,
that everybody that I spoke to, they were very accommodating, you know
what I mean, Like they were very nice, Like they didn't know that
they were dealing with somebody who was doing some research. They didn't know they
were dealing with what we would consider an ethical hacker, little social engineering exactly.
And so that all being very helpful and being very helpful is what gets
you and I a liquidated bag account. So there's a few things that you
know, we want to as system, but you want to put in place
now. Number one, you want to do your own research on your own,
you know devices, you don't in calling your own telcode and finding out
you know, if somebody posed as me, what would by options be.
You want to make sure right now that you have an additional passcode on your
account, that's not your last four of your social and your in your birth
Yeah right, if anybody is going to swap out your sim, you want
to make sure that it's not going to be easy. And then beyond that,
in your digital life, I suggest that everybody use a password manager.
So a password manager, of course, is a software program that manages all
your passwords. And when I say all of your passwords, that means that
you should have multiple passwords, that your using the same passcode twice, which
is really important because look at I'm fifty five years old, I don't know
more than three or four passcodes that I possess in military or four. It's
my Google passcode, it's my Apple passcode, it's the passcode and my password
manager, and I think the one for my alarm system. That's it.
That's all I know. My password manager remembers the rest. And often people
say, well, what if the password manager gets hacked. I'm not worried
about that at all. And the reason why I'm not worried about that is
because password managers are security companies. The low hanging fruit is not the password
manager for the hacker. The low hanging fruit is the fact that we are
using all the same passcodes across multiple accounts. And what the bad guys do
is they use a tool called credential stuffing. So here's an article that I
wrote. I think you could see that over my shoulder over here right.
Credential stuffing, What it is and why you should be concerned. A recent
credential stuffing attack on twenty three and meters left most people bemused if they noticed
it at all. Similarly muted response to following the leaks of millions of user
records. Basically, an anatomy of a credential stuffing attack is what the criminals
will do is they'll go to the dark web and they'll grab millions and millions
of stolen records, and they'll feed those millions of usernames and passcodes into a
credential stuffing software program. And your credentials are then stuffed into this software and
they'll see if they can get it to twenty three and meters. They'll see
if they can get into Amazon to PayPal, the eBay to your email,
and so on, and they'll stuff your credentials in say the top one hundred
five hundred one thousand websites, and the software will log the bad guy in
remotely. That's credential stuffing. Right now. The way you keep the bad
guy out is number one, you never use the same passcode twice. That's
number one. Number two, you used two factor authentication with all your critical
accounts, all of them. Okay, let me show you something here.
Carry really quick and I know that like the clock is ticking on us here.
Yeah, So on my website, right, I scroll to the bottom
of the website and actually go to my homepage. Right, go to my
homepage and on the bottom of my homepage, one second you'll see one second,
I know the clock is ticking. Thank you for your patient sofa tight
down. Here you see the cybersecurity awareness check right, and you see check
it for email has been breached. And we click on email checker. Hey
to watch this right, so check it for email hasn't breached. I type
in R O B E R T S I C I L I A.
N Oh what side this? What side are we on? Right now?
We're on protect now LLC dot com, Protect now LLC dot com, Protect
now LLC dot com right all right, which is my website and at the
bottom of the homepage, research my email address robertsisanwimail dot com and then you
see your email and possibly a password of in stolen in the following breaches.
Now what this means is is that my email address, Robert tis leonoimail dot
com has been a part of numerous data breaches, not because I did anything
wrong, but because these particular companies were hacked. Okay, So this tool
that we have on our website allows us, allows me and my team to
facilitate you researching over twelve billion stolen records. We have access to twelve billion
stolen records, so including email addresses and passcodes. So you see right here,
like right at the top, a data dub of a massive collection of
three thousand alleged data breaches was found online, including eighty million unique email addresses
and associated passcodes. Oh my god. Okay, we have the ability to
allow you to research all of that. Here. In July twenty eighteen,
Apollo had what is it, dumb, I don't even know how many millions
of records in pass roads allow uh is Yahoo? Yes, one hundred and
twenty six million unique email addresses. Right, here's a bitcoin for him from
back in twenty fourteen, Billy, we have five million and nine million using
it, the one that makes custom links yes, right to read exactly redirect
so you don't have to use these monster URLs. So Bittley got hacked too,
Bitley code halfway mom discus Juice books showing this is exactly why you need
the pass word manager to create those in those unique passwords for every site.
I mean, I have my standard password, but I change it every single
month. And you know, so like all the old ones that are out
there aren't going to do anybody any good and all likely good. How often
should you change your password on your email? So here's the deal, right,
Like I don't you know, like I haven't changed my password in an
email for a while because I use two factor authentication. So here's the deal,
right, even if they have your password, if you have two factor
authentication, whether it's Smaster or the authenticator app, right, better the authenticator
app or use Google Voice number, even if they have your passcode, they
can't get in if they don't possess your mobile soon. Right, So the
idea is to make the data useless to the thief. So changing up your
password is always a good thing, okay, And if you want to do
it, every month. Fine, But for most of us, I would
I say that security needs to be easy. If it's not easy, you're
not going to do it. So I would rather you use a different passcode
across every account, use a password manager that manages all those various passwords,
and then have two factor authentication. If you do that, in most cases,
you're going to keep the bad guy out because most other people aren't doing
any of those things. You become a teper target. They become the path
of leash resistance. Makes sense about it, yeah, totally. And then
two factor authentication right Like, next thing you do is you just google it
team wo factor Gmail. Right now, when you do that on the first
page of serch you see two step verification at my account dog Google dot com.
You could do the same thing for yao, the same thing for AOL.
And the main, main thing for most of your listeners viewers is that
you've got to tighten up email. Man, Like everybody's got to tighten up
email. Email. If they get into your email, bad guys say own
the email, you own the person. So that's it. The first thing,
no question about it, all right, I know your crunch for a
time, Robert, where we find you. How do we get that neat
little security checkup that you just showed. I tell everybody going to protect now
LA dot com, Protect now LLC dot com. Scroll towards the bottom and
you'll see use our free email checker to check if your email address and or
your passwords are part of any specific data breaches. All right, excellent.
Hey, you got a question for Robert myself, Just send me an email
at kl at Carrie LUTs dot com. And there's a link to Robert's site
in the show notes of this interview on Financial Survival Network dot com. Make
sure you use it while you're there. Sign up for your free newsletter.
Robert always a pleasure, always enlightening, and always gives me something to think
about what I should be doing that I'm not. And that's the most important
thing. Hey, you buddy, I appreciate you. Hey. Likewise,
take care, Robert, have a good day. Thanks for listening to Carrie
Letz's Financial Survival Network your solution to today's trying times. For the latest,
go to Financial Survivalnetwork dot com. Financial Survival Network now more than ever