Buy, buy, bye.

Joe gives an update on the Dajon Love case, which Maria had previously covered. Love allegedly pretended to be a San Francisco 49ers player in a romance scam run with another man. The FBI has searched Love’s phones and iCloud account, and investigators now believe the scheme may have continued for roughly 10 years—longer than the five-to-seven-year period initially discussed. Authorities have confirmed that two dozen women were defrauded of approximately $1.3 million, while investigators suspect there may be many more victims. The hosts note that the story continues to attract mainstream media attention because the fake-NFL-player angle makes it especially compelling. They also remark on the disturbing possibility that the conspirators began the scheme very young; Love is in his 30s, while his alleged partner is reportedly about 18 now. The hosts postpone Joe’s chicken update until the following week.

Maria discusses Forbes reporting by Katherine Schwab and Ian Martin about an alleged relaxation of TikTok’s advertising-enforcement rules in the second half of 2025. According to internal documents obtained by Forbes, the number of violations that could trigger an immediate advertiser ban reportedly fell from 37 to 13. Non-delivery scams—ads for products that never arrive—were allegedly removed from the list of violations serious enough to cause an automatic suspension. TikTok denied much or all of the reporting. The scams typically impersonated brands such as Aerie, Ralph Lauren, Nike, Hey Dude, and Figs. Ads offered implausible discounts, such as $80 pajamas for $6 or a $400 sweater for $40, and sent users to convincing but fraudulent external websites. Maria describes influencer Lottie Weaver, who paid $40 for supposed Aerie pajamas and shared the deal with her 700,000 followers before discovering that the products never arrived. She later fell for a second ad for discounted Ralph Lauren sweaters. The hosts stress that the scammers—not the victims—are responsible, while also noting how urgency and the apparent legitimacy of a major platform make these offers persuasive. Forbes found that Better Business Bureau complaints mentioning TikTok surged after the alleged policy changes, with non-delivery-scam reports increasing by more than 200% during the following six months. A chart showed a sharp rise beginning in mid-to-late 2025. Forbes sources who were current or former TikTok moderators reportedly said moderators often recognized suspicious ads but could not remove them under the new rules, and that advertisers who previously might have been banned were allowed to remain active. TikTok disputed the allegations. The hosts speculate about possible connections to TikTok parent company ByteDance’s U.S. regulatory and divestiture negotiations, while acknowledging that they cannot establish a cause. Maria also notes Forbes’ report that ByteDance generated $120 billion in revenue in the first half of 2026, up 30% year over year, but says the figure cannot be attributed specifically to scams. Kieran recommends treating extreme discounts as a major warning sign: a store offering an $80 product for $6 is almost certainly fraudulent. The panel emphasizes that a paid ad is not proof that a seller has been vetted, and social-media platforms may not apply meaningful or transparent standards to every advertiser. Their practical advice is to distrust offers, emails, phone calls, and other messages until independently verified rather than assuming something is legitimate merely because it appears on a familiar platform.

Joe examines a Wisconsin Watch investigation produced with the University of Wisconsin–Madison’s investigative journalism class. The story concerns cryptocurrency ATMs, which have been heavily used in scams. Tennessee, Minnesota, and Indiana have banned such machines, while Wisconsin adopted Act 226 instead. The law limits daily transactions to $1,000, requires customer identification and receipts, and provides a path for victims to seek refunds. Michael Gavigan, chief legal counsel for Wisconsin’s Department of Financial Institutions, said the agency had received fewer reports of illicit activity involving the kiosks since the law took effect. Cryptocurrency investigator Scott Simmons of the Greenville Police Department said the identification and transaction limits make it harder for fraudsters to use multiple accounts or send one victim to several machines. The practical effect, Joe explains, is that a scammer may be unable to extract $20,000 in one day and may choose a victim in a state without comparable restrictions instead. The scale of the problem surprised the hosts. A 2023 Iowa attorney general investigation found that 98% of money sent through Bitcoin Depot and nearly 95% of money sent through CoinFlip involved scam transactions. A Washington, D.C., lawsuit against Athena Bitcoin alleged that fraud accounted for 93% of deposits in that network. Fees can reach 30%, making these machines unattractive for ordinary cryptocurrency users. Mark Grenz, who helped found Digital Mint, said his company’s internal investigation found that nearly all customers making transactions around $1,000 or more were fraud victims; Digital Mint eventually shut down voluntarily. Bitcoin Depot later cited restrictive legislation and bans when it filed for bankruptcy. Victims who contact the ATM operator and relevant authorities within 30 days may now be eligible to recover their money. The group also discusses a Wisconsin law-enforcement practice of obtaining court permission to seize cash from kiosks after reported fraud. Joe supports helping victims but objects to simply taking an ATM without following due process, and Kieran agrees that the legal framework is difficult because cryptocurrency can move internationally very quickly. He notes that Bitcoin itself is highly traceable on its public ledger, but other cryptocurrencies or conversion methods can make funds effectively disappear within minutes.

Kieran reports that financial company Revolut received an email from what appeared to be an official government agency domain requesting sensitive information about specific high-net-worth customers. Revolut supplied names, dates of birth, copies of identity documents such as passports, and facial-verification scans. The government email account was legitimate, but it had been compromised, so the request was sent by an attacker using a trusted channel. The episode does not establish how many customers were affected. The hosts point out that Revolut may have followed its normal verification process and therefore did not necessarily do anything obviously wrong. Joe wonders whether the company also consulted attorneys or independently confirmed that the request was legally valid, such as by checking for warrants. Kieran compares the incident to business-email compromise, in which attackers remain inside an account long enough to learn the victim’s communication patterns before sending fraudulent requests to customers or banks. Kieran says the compromised government organization should have protected its cloud account so that stolen credentials or session tokens could not be used from an unauthorized device. Hardware- or device-based access controls could have prevented the attacker from sending emails even after compromising credentials. He also recommends that Revolut or similar organizations verify unusual sensitive-data requests through a second communication channel. The panel highlights that passports and biometric scans are particularly damaging because they cannot be changed as easily as a password.

Rachel sends in an email invitation from a hacked contact. It tells recipients to open the RSVP link using a Windows desktop, says the link will work properly only there, and instructs them to install the invitation after downloading it. Rachel received two similar invitations from different people in her network and submitted a screenshot while noting that her phone battery was fully charged. The hosts immediately identify the message as an attempt to deliver malware. Maria observes that people do not normally “install” an invitation, and Joe jokes about putting “Invitation.exe” on a refrigerator. They explain that the attacker is relying on a small percentage of recipients following the instructions, especially because the message appears to come from a trusted, compromised contact. The advice is simple: do not download or install software merely because an email claims it is an invitation or other familiar document.

Maria, Joe, and Kieran close by repeating the episode’s central lesson: social-media placement, a familiar brand, or a government-looking sender does not establish trust. Consumers should be suspicious of prices that are wildly below normal, and organizations should independently verify sensitive requests rather than relying only on the apparent legitimacy of an account or domain. Joe’s broadest recommendation is to treat emails, advertisements, and phone calls as potentially fraudulent until checked. Maria thanks Kieran Heumann, lead cybersecurity engineer at ThreatLocker, for joining while Dave Bittner is away. Kieran says he would be happy to return for another cryptocurrency story. The episode is produced by Liz Stokes, with Jennifer Iben as executive producer and Elliot Peltzman and Trey Hester handling the mix. Maria Varmazas hosted, with Joe “Beep” Kerrigan and Kieran Heumann also signing off.