The suite spot for scammers.

Joe opens by announcing that Maria Varmazis has reached her 100th episode of Hacking Humans, probably this episode or possibly the previous one. The hosts joke that two years had passed quickly, congratulate Maria, and say the show would feel strange without her. Maria thanks Dave and Joe for making space for her and says she would not have guessed she had done 100 episodes. The hosts then respond to Brian, a listener who asked whether the recurring feature should be called “Catch of the Week” rather than “Catch of the Day,” since the show is published daily. Maria explains that “catch of the day” is an idiom associated with a fisherman’s fresh catch or a restaurant’s daily special; “catch of the week” evokes stale fish or “day-old gas station sushi.” The hosts agree that Brian is technically correct, while celebrating him as a member of the “Pedantic Club.” That leads to a second language tangent about “begging the question.” Dave recalls being corrected by a listener who even created a website explaining that the phrase means circular reasoning, not merely “raises the question.” Dave says he now avoids using the expression rather than risk misusing it. Joe later identifies the site as begthequestion.com and enjoys its blunt “You are wrong” link.

Before the sponsor break, Joe follows up on a resource he had promised to examine: FINRA’s Market Data and Investment Explorer. He says the tool is fairly basic but “lucidly clear,” making it a good starting point for someone learning the differences among stocks, exchange-traded funds, and mutual funds. Joe cautions that the site will not provide everything an investor needs once they become more advanced or begin doing serious investment research. Its value, in his view, is as an accessible first step that explains basic investment categories and provides key particulars without overwhelming a new user. He confirms that he actually looked at the tool after mentioning it on the previous episode.

Joe’s first news story concerns nearly $15 million missing from Mobile, Alabama, taxpayer funds. He quotes Mobile Mayor Spiro Cheragotis saying, “Obviously, this is bad. This is bad. There’s nothing I can say to make it good.” The incident appears to involve business email compromise or an impersonation scam in which someone redirected money to a fraudulent account, although the report did not provide many details. Joe also mentions other municipal losses: Lexington, Kentucky, reportedly lost $4 million to fake housing payments, while Petersburg, New Hampshire, lost $2.3 million connected to a school and bridge project. Federal and state law enforcement are investigating, but Joe expects recovering the money to be difficult. Joe emphasizes that this is taxpayer money, not an abstract government loss, and says the attack could have been prevented through process rather than a specialized cybersecurity product. Before paying a contractor, an organization should agree on the correct payment account, and any later change should require an in-person or otherwise independently verified request. An email asking for funds to be redirected to a new bank account should never be sufficient. He recommends similar controls for small businesses and nonprofits, noting that many organizations he has worked with required two people to approve significant payments or changes.

Joe’s second story is a BBC article by Kevin Peachey titled “Don’t Fall for This: How to Protect Yourself from AI Scams.” The article describes rapidly created, polished fake websites that imitate legitimate services and collect credentials. It also covers romance scams in which AI can remember a victim’s personal details and maintain a convincing conversation for weeks or months. The hosts compare this to a South Park plot in which a character copies messages into an AI system to communicate with his girlfriend without remembering the conversations himself. The article also warns about AI-generated deepfake video, voice cloning, error-free personalized phishing messages, and social-media scams. Joe says data from breaches and public postings can be combined into detailed dossiers, allowing criminals to make an initial message appear unusually credible. He recommends family conversations about verification rules—for example, telling relatives that a request for emergency money will never be made by phone and that the person will appear in person instead. Dave tests ChatGPT by asking what kind of phishing email would likely work against him. It identifies professional requests involving podcast guests, cybersecurity research, production, conferences, sponsorships, and collaborations—messages that would be difficult to distinguish from his normal inbox. The hosts conclude that the scale and personalization of these attacks make ordinary verification habits increasingly important.

Maria reports that the European Commission is investigating Booking.com over concerns that the platform has not done enough to prevent scams. She stresses that an investigation is not a finding of wrongdoing and says she could not access the EU’s primary announcement because the site was unavailable, so she relied on reporting from The Guardian and Bitdefender. The regulators are examining fake accommodation listings, phishing attacks against people with legitimate reservations, and whether paid promotional listings are clearly labeled. Maria describes two main scam patterns. In the first, criminals advertise properties they do not own or that do not exist, sometimes impersonating real owners. Victims pay in advance and discover the fraud only when they arrive. Consumer watchdog Which? tested how easy this was by creating a fake one-bedroom apartment at 10 Downing Street, using a photo of the building and a fabricated review praising the stay and mentioning Larry the cat. Booking.com accepted payment, the fake review appeared almost immediately, and the listing remained live for six weeks—from June 18 to August 27, 2026, as stated in the discussion. Which? said its payment had not been refunded more than six weeks after the test began. The second pattern begins with a real booking. If a hotel’s Booking.com account is compromised, attackers can use the legitimate account to message guests about failed payments, card verification, or cancellation threats. They then direct travelers to an outside payment link or service such as WhatsApp. Which? also found that supposedly fraudulent payment links were not effectively blocked. Maria says Dutch authorities recorded more than 1,000 Booking.com fraud reports in early 2026, with average reported losses of about €82,000 per incident, a tenfold increase over the same period in 2025. Booking.com had previously acknowledged a 500% to 900% increase in travel scams over an 18-month period leading up to June 2024. Travelers should independently contact the property before making an unexpected payment, avoid random links, compare suspiciously cheap prices with other listings, and immediately contact their bank and Booking.com if they pay a scammer.

Dave discusses a new Federal Trade Commission report on fraud targeting Americans aged 60 and older. In 2020, this group reported approximately $600 million in losses. By 2025, reported losses had reached $3 billion—a fivefold increase. The FTC says those figures exclude much fraud that is never reported and estimates that the actual 2025 losses could range from $13.5 billion to nearly $120 billion. The agency also notes that baby boomers hold about half of all U.S. wealth, making older adults attractive targets. Adults over 80 reported the highest median individual losses, at $2,000, while reports of losses exceeding $100,000 increased nearly sevenfold since 2020. Investment fraud, government impersonation, and business impersonation were among the largest categories. Social media was the most common starting point for reported scams, but scams that began with phone calls produced larger individual losses. Older Americans were 324% more likely than younger people to report losing money to tech-support scams, while they were 48% more likely to report losing money to romance scams. The hosts discuss whether younger people will become less vulnerable as they gain experience or whether their susceptibility will persist as they age. Dave gives the example of a Washington woman in her seventies who reportedly lost $63,000 to someone impersonating Elon Musk and claiming to need money for dental surgery. The hosts stress that the core issue is not stupidity: scammers exploit trust, loneliness, authority, and emotional vulnerability. AI-generated voices, images, and conversations may make these approaches more persuasive, but the underlying manipulation is familiar.

The Catch of the Day comes from Michael, who submits a screenshot of an email claiming that his ChatGPT Plus payment had failed. The message says “OpenAI Ireland Limited” was unable to process a $20 monthly payment and urges him to update his billing information to keep the subscription active. It includes an “Update payment method” button and links labeled “OpenAI Help Center,” “Billing and payments,” and “Start a chat from help.openai.com.” Michael’s key clue is that he does not have a ChatGPT subscription, so he did not click the link. The hosts note that the payment link appears to point to an Amazon Web Services bucket rather than an OpenAI page, and they assume the other links are similarly controlled by the scammers. They also question why a supposed OpenAI Ireland charge would be presented in U.S. dollars, although they acknowledge that $20 is consistent with the entry-level paid ChatGPT tier. The lesson is straightforward: an unexpected billing message should be checked against whether the recipient actually uses the service, and links in the message should not be trusted merely because they mention a familiar company or support address.