Speaker 1: So what the coin bases and others of the world
have learned, and what the etends and horizons have learned,
is that, as you know, foresee ability equals liability. And
so if any of these companies can foresee that a
simswap is going to result in tens of thousands to
millions of dollars in losses for a consumer, if they
can foresee that it's going to happen, they need to
do something in addition to what they currently have in
place in regards to preventing that from happening.
Speaker 2: Therefore, what else can we do? They said?
Speaker 1: And they said, well, what if we knew the was
swapped out legitimately or illegitimately, how would we know that?
What do we need to do going forward?
Speaker 3: Thanks for listening to carry Letz's Financial Survival Network, your
solution to today's trying times. For the latest, go to Financial
Survivalnetwork dot com. Financial Survival Network now more than.
Speaker 4: Ever, and welcome you are listening to and watching the
Financial Survival Network. I'm your host, Terry Lutz. We have
security expert Robert Ceciliano with us. Now, Robert, you've been
warning people about scams. It seems like most of your
life and now they're after you. They're trying to scam you, right.
Speaker 1: Oh then, oh yeah, they have been trying to scam
me for quite quite a long time. Actually, I've received
I've received emails from bad guys with my social Security
number in the body of an email. Hey, security guy,
here's your social ha ha, with them basically flexing their
muscles showing me how cool they were and that they
got one up on me.
Speaker 2: And you know, like.
Speaker 1: When I see that, my response is, you know whatever,
because as far as I'm concerned, everybody's social Security number
at this point is in the hands of a criminal.
You know, Like how often asked by consumers, you know,
shouldy invest in services that you know find my information
on the dark web? What do you think about that?
And like, my information is on the dark web? Yardmations
of the dark web. Your your name, your email address,
likely your social Security number, your haul address, your phone number,
your email address, you know.
Speaker 2: Everything, Like it's it's all on the dark web.
Speaker 1: Because there's been like one hundred and seventy plus billion
records compromise at least in the last decade, and all
of that information, or at least most of it, is
available on the dark web. So what is a dark
web scan going to do other than tell you that
your data is exposed? And what do you do in response?
How do you react to the information? Basically, the idea
is to make the data useless to the thief right.
Speaker 2: And so what does that mean?
Speaker 1: What does it mean when they have your social What
does it mean when they have your credit card number?
Speaker 2: What does it mean when they have your email address?
Speaker 1: So?
Speaker 2: Or what does it mean when they have your passwords?
Speaker 1: Right? And I tell people all the time, don't worry
about it, but do something about it. So passwords, what
do you do? You change up your passcodes when you
find out that specific passwords will compromise, and you find
and you look through all your various logins to determine
where that password might have been affected, so you change
your passcodes. In addition to that, the end all pure
role for most password breaches is make sure you have
two factor authentication across all critical websites, because even if
they have your passcode save for your PayPal account, they
would need to have your mobile phone in their possession.
Speaker 2: As long as you have a two factor of authentication enabled, they.
Speaker 1: Would have to have your mobile phone in their possession
to be able to get into your PayPal account even
if they have had your past code. You know. So
just yesterday I got an alert that somebody's trying to
update my Instagram account. They want to reset the Instagram
which means that somebody probably has my email address, which
is public knowledge, and they probably just did a password reset.
And to most people, that's going to freak them out.
For me, you know, I've got two factor authentication. I've
got upper case lowercase I WAS and characters my passwords,
and they would need my mobile phone in their possession
to get into my Instagram account. As far as if
they had my social Security number, well that's kind of
a no brainer too. You know, I have identity that
protection services that monitor my information look for new lives
of credit being opened up under my name.
Speaker 2: Addition to that, I have a.
Speaker 1: Credit freeze across all three major credit bureaus so experience
transunient equifacts. So if somebody has my social Security number
their possession and they're trying to open up new lines
of credit under my name, well good luck. Because any lender,
any credit card company, any where they go to try
to process an application for credit, they're going to be
met with a credit freeze. They're not going to be
able to see what my credit scores are. Therefore, that lender,
that credit card company, that bank is going to bump that.
Speaker 2: Credit check back and say, can't approve this.
Speaker 1: Loader, this credit card because you have a credit freeze,
Robert Cisleado slash identity thief, and therefore we can't issue
this line of credit, this credit card to you. So
a credit freeze in most cases makes the social security
number in most cases useless to the thief. And if
they have my credit card number, right, yeah, they could
probably make charges to my credit card. Sure, like that's
not that difficult. Every single time you use your credit card,
your credit card number over the phone, in person, whatever
that number, that credit card is at risk.
Speaker 2: However, I have push notifications or.
Speaker 1: You pop up notifications via all of my credit card
numbers and my bank account number. Or what that means
is every single time there's a charge, every single time
there's a transaction on my bank account on any of
my cards, card, present card, not present, international, below or
above a dollar, you name it, I either get an
email instantly, a text message instantly, or a pop up
via one of my credit card or bank mobile apps,
so I am made aware in real time every single
time there's a transaction on a card or a bank
card or a credit card, which doesn't necessarily make those
digits useless to the thief, but it makes it really
hard to use any of my credit card or bank
account account numbers in commerce because I am made aware
of it in real time, and I can immediately refuew
those charges, which in most cases should you know, stop
the bat guy in his tracks and prevent him or
her from doing any further damage, and then I'll just
get a new credit card in the mail shortly afterwards.
Speaker 2: And I've actually, probably in the past three to five years, have.
Speaker 1: Had to get two or three different new cards as
a result of those push notifications, you know, in post
notifications that I set up for my bank card, my
credit card are different than when the bank of credit
card company notices charges that are anomalists. Meaning, for example,
I might use my credit card and gas station in
Boston and then ten minutes later that card.
Speaker 2: Is used in Russia.
Speaker 1: I obviously can't get to Russia in ten minutes, you know, tough,
that's an anomaly, right, So the credit card companies and
banks they have anomaly detection technology that recognizes risk, which
is different than you setting up push notification, so credit cards,
you know, social cutting numbers, pass codes, it's the dark web.
It's a matter of making the data useless to the thief.
Speaker 4: So what about this thing of SIM swapping, which really
could be used to defeat third party factor ID for
the people like getting their crypto accounts, their bank accounts,
all sorts of things. Looks like the carriers are taking
additional precautions to stop it, but it's a little scary.
Speaker 1: Yeah, So I'm glad you touched on that because I've
I've actually been and I still function as an expert
witness revolving around SIM swapping and someone's you know, crypto account.
Speaker 2: Being drained, right, And I've seen that unfortunately too many times.
Speaker 1: And when somebody is targeted, usually the first thing that
happens is their email is compromised in some way, whether
they are phished when they don't have two factor authentication, right,
whether they're phished, or their credentials are exposed or the
dark lip. You know, so your email addresses relatively public,
but then your password password singular that's used across multiple
accounts is highly problematic. Okay, so I'll get to the
sim aspect of this, but it begins with your email
being compromised. And so once your email is compromised, once
the bad guys inside your email A because factor authentication
B because you use the same past code across multiple
accounts and that data is in fact exposed to the
dark Web, the bad guy doesn't necessarily hack into your email.
They just log in because they have your credentials, because
your credentials are exposed on the dark web, and you're
not doing the basic cybersecurity one on one to make
the data useless to the thief by setting up two
factor aboutthentdication never using the same passcode twice, which also
generally means using a password manager, which I do and
I have for over twenty years, right, And a password
manager facilitates the process of using a different passcode across
each account, uppercase lower case numbers and characters, long strong
passwords that generally aren't easily cracked, or words fond of
the dictionary, or consecutive strokes across the keyboard, and so forth.
And so once the email is compromised, bad guys inside
the email now they just search Coinbase, they search crypto,
they search binance and so forth, all the crypto exchanges right,
and once they're inside your email, they see, oh, he
or she has a coin based account, he or she
has a finance account and so forth. That's when they
begin the password reset if possible, from your email, and
if that doesn't get them in, they realize you have
two factor authentication.
Speaker 2: And that's when the simswap process begins.
Speaker 1: Now, once they're inside your email, they search out AT
and T, Verizon, Comcast, T Mobile, right, what Mint and
so on, and they just go down the line in
regards to all the mobile phone carrier companies to see
where you have an account, and the next best thing
for them is to reset the passcode for your telcode,
so that now they're in your telco. And even if
that has two factor authentication, they at least have at
this point enough intelligence because they're inside.
Speaker 2: Your email that they know who you can use.
Speaker 1: For crypto, They know who you use as you sell
carrier and so forth. Now from there, that's when if
they can't we set any pass codes because of two
factor authentication, best case scenario, that's when they head out
to a physical store and then go to generally a
third party reseller. You know, some guy that has a
shop at a mall somewhere that you know sells mobile phones,
and he has access to much of the same tools
to swap out a SIM as one of the actual carriers,
you know, the team mobiles at at and ts and
ribs of the world. That third party reseller has that
same similar ancess and the problem here, And I've seen this,
and I've actually commented on this in same swap cases
in a court of law that like you'll find pockets
of these third parties resellers where like there's been a
few different SIM swaps have occurred as a result of
this particular reseller at that particular location. Why because he
or she was approached by a scammer and said, hey, listen,
I'll give you a thousand bucks if you could swap
out this SIM.
Speaker 2: He's like, I, okay, you got it.
Speaker 1: A thousand bucks is a thousand bucks. Yeah, you just
got one or two of them coming in a week.
That's you know, four, six, eight, ten, twelve grand a month,
you know, sure, right.
Speaker 2: Like that's easy, easy money.
Speaker 1: And so that reseller generally is the one who's defeating
whatever security measures that the telcos have in place, and
it's not just the third party.
Speaker 2: So in my own research.
Speaker 1: When it comes to simswaps, in my own research as
an expert witness, I've reached out to the Verizons and
the AT and ts and the boost Mobiles and the
Verizons and so forth as a consumer and made a
phone call and went in to the actual operations and said, listen,
I like, if what do I do? Like I lost
my password to my account and I got this mobile phone,
I got this iPhone, and I need to swap off
my sin because like my phone doesn't work anymore, and
I you know, everything's dead, and you know, what do
I do it? How do I go about it? He said, well,
you know generally, like we need to you know, two
forms of identification. He's like, well, I'm like, well, I've
got a driver's license. That's all I've got. And but
you know, beyond that, like I don't have anything else.
It's like, well, as long as you come in with
the job relations, we'll.
Speaker 2: Have no problem.
Speaker 1: We should be able to do it right right here
on the spot. Here's the problem with that. You go
on TikTok right now, you go on Instagram right now,
you go to any college in America right now, you
can easily find fake IDs easily, like two for eighty bucks,
two for eighty bucks.
Speaker 2: And they're good.
Speaker 1: They are good quality ideas and the only and I've
looked at these ideas, like I've handled and played with
these IDs, but compared up against mine, you know, And
the only difference in the fake ideas versus the real
ideas is that there's generally a hologram in the rail eye.
Then he isn't as good as the one that's the
fake ID. The fake ideas are a little duller. They're
just a little duller. Yeah, that's exactly what you need
dollar Yeah, but the but the but it's but there
is a hologram there. It's just a little duller. It's
a little more faint. And that's really it. And so
your every day Verizon Star employee, he's really not gonna
be really looking for that or know enough to look
for that. He may or may not have the experience.
He may may or may not know the difference. But
you walk in all you know, frazzle ands all, I did,
I just need this? And you all, you know, you've
got to like.
Speaker 2: You know, clean shiny teeth and good hygiene.
Speaker 4: So they're on a Friday, go there on a Friday
before closing, right.
Speaker 1: Yeah, they're not going to be like, I don't all
about you like your sketch, I mean you or I
walk in.
Speaker 2: We're not gonna be all sketch, you know, right exactly?
We look like taxpayer? Yeap, gotcha? So is there is
good news here?
Speaker 4: Though?
Speaker 1: Here's the deal, right, all is not lost. The good
news is that there's a lot you can do. Change
up all your past codes. Use two factor authentication for everything,
everything including email. Never use the same pass code twice.
You do all these different things.
Speaker 2: Okay.
Speaker 1: The good news is that the cryptocurrency companies, right the
bitcoins and so forth, they now have developed relationships with
the telcos. And what that means is they know if
you all, if you already have say a coin Base account,
and your stuff is, how is that coin Base? And
you're on AT and T, you've got two factor authentication,
you're doing all the things that you're supposed to do
at Coinbase to make sure that your crypto isn't hacked.
And you've tightened up your AT and T account like
you've got two factor authentication there.
Speaker 2: But then you're like, you know what, AT and T.
Speaker 1: Is too expensive, I'm going to go to mid Mobile,
right because mid Mobile is like a third of the price.
So the process of setting up at mid Mobile, Coinbase
knows that you no longer are at AT and T,
You're at mid Mobile. They have backdoor access and know
that you've swapped out your SIM to go from AT
and T to mid Mobile. They know that now, so
that backdoor access, that relationship that coinbase has with AT
and T and others is a good thing, and that
protects Coinbase and it.
Speaker 2: Protects their users.
Speaker 1: Yeah, it's getting harder to swap out of SIM for
the bad guy in it not be detected by the
coin bases of the world.
Speaker 4: And I can tell you a personal story. I don't
want to say what carrier I use and what major
bank it was, but I had gotten a new phone
upgrade my iPhone and you know it's an e SIM.
But when I logged onto that bank the first time,
it said it appears that you're using a new phone
or a new SIM. We have to do additional verifications
and uh, and you know they nailed it because obviously
it was me, but I saw that they were really
taking precautions. So I guess there will be some universal
verification of sims a SIMS as well as physical sims.
So when someone has a new one and it pops
up for the account, then they have to go through
an additional phase of verifications more than one. It was
two or three. I had to do a couple of
credit cards, my ADM card, and.
Speaker 2: Yeah, it was. It was extensive. So I didn't seem
to think, so it's a pot but it's a good thing.
Speaker 1: And so what what the coin bases and others of
the world have learned, and what the aten ds and
horizons I've learned is that, as you know, foresee ability
equals liability. And so if any of these companies can
foresee that a SIM swap is going to result in
tens of thousands to millions of dollars in losses for
a consumer, if they can foresee that it's going to happen,
they need to do something in addition to what they
currently have in place in regards to preventing that from happening. Therefore,
what else can we do? They said, And they say, well,
what if we knew the was swapped? Out legitimately or illegitimately,
how would we know that? What do we need to
do going forward? And they developed that relationship, they begin
to shake hands with each other and now they know
via an API or something to that effect. And so
that does protect consumers in the end, that does not
mean that consumers should still sit in their hands and
do nothing. They still need to engage in all the
various you know, through virtual authentication, change up your passos
to San Pasco twice and listened to password bandage RK
and so on and so forth, at all your various
critical accounts, including anything related to any finance, crypto and
everything and anything.
Speaker 2: And generally you're going.
Speaker 1: To become a tougher target for the bad guy, and
they're going to go after the path of leash resistance,
which is the people who don't have those basics in place.
Speaker 4: And as we were speaking, I changed my Google password
because it had been too long, and it sent a
notification to my phone. I was doing it online on
my desktop, sent a notification in my phone. Your password's
just been changed. Was that you yes or no? And
of course I said yes, So yeah, you can never
be too careful here, Robert and a friend of mine
that had happened to in Florida. Coinbase account got drained.
They tried to drain her bank account but they were
not able to. But they took twenty eight thousand dollars
worth of crypto from her account and she had to
sue them. I didn't hear what happened. I believe it
was settled out of court and that was that. Hey, well,
appreciate you coming on telling us about this new emerging
threat as well as the way that they're after you personally.
Just tell us where do we find you? How do
we connect with you on the web?
Speaker 1: Sure, I am at protect now LLC dot com again
protect now LLC dot com and I can also be
found at safer dot me. That's SA sa f R
dot me or just google Robertslaati.
Speaker 4: You can't miss me, all right, and the links are
in the show notes of this interview on Financial Survival
Network dot com. While you're there, sign up for your
free newsletter. You got a lot of valuable info from
this and Robert, we'll talk to you again real soon.
Thanks for stopping by.
Speaker 3: Hey, buddy, thanks for listening to carry Lets's Financial Survival Network.
Your solution to today's trying times. For the latest, go
to Financial Survival Network dot com. Financial Survival Network now
more than ever