To octopi, or not to octopi.

The episode opens with what the hosts jokingly call follow-up, although Dave points out that the first item is completely unrelated to anything previously discussed. The hosts explain that “octopus” has three accepted plurals: “octopuses,” “octopi,” and “octopodes,” the last derived from Ancient Greek. Maria, who has Greek parents and has spent her life being corrected on Greek pronunciation, says she would initially have pronounced it “octopodes,” while the others settle on the more Greek-sounding “octopodes.” They joke that Octopodes sounds like a Greek philosopher who never gives one answer, only “eight ways to look at this.” Maria also mentions seeing a story about Bank of America, or “BOFA,” being hit with a money-laundering issue, though the group does not investigate that story further. Joe then gives his chicken update: he has acquired three more chickens, two bought at Tractor Supply and one Wyandott given to him by his daughter. The new birds are being bullied and have not integrated well, bringing his total to eight chickens. The rooster has been “disposed of” and sent to the same upstate farm where his old dog lives, prompting jokes that the rooster may now be beating up the dog instead of Joe’s wife. The hosts close the segment by calling the eight chickens an “octopodes of chickens.”

Dave introduces three new investor-protection tools from FINRA, the Financial Industry Regulatory Authority. He explains that FINRA is a nonprofit organization regulating U.S. brokerage firms under the oversight of the Securities and Exchange Commission, although it is independent rather than being part of the SEC. The first tool, the Risk Meter, asks users 10 questions about their circumstances and behavior, estimates how vulnerable they may be to financial fraud, and offers practical ways to reduce that vulnerability. The second tool, the Scam Meter, presents five real-world scam scenarios and asks users how they would respond. It then identifies warning signs they may have missed, explains the tactics used by the scammer, and gives them a score showing how well they recognized the red flags. The hosts like this simulation-based approach because users can practice making decisions without risking their retirement savings. The third tool, the Market Data and Investments Explorer, combines stock-market information, company profiles, regulatory filings, investment data, and educational resources in one place. Joe notes that much of this information is already available through sources such as the SEC’s EDGAR system, including an API, but says consolidating it could help ordinary investors research investments more easily. Maria tries the Risk Meter while the others discuss it and reports that it is quick, clear, and easy to understand rather than feeling like a difficult exam. The hosts recommend that listeners try the tools themselves and share them with friends and family as a low-pressure way to start conversations about financial security and scam awareness.

Joe’s main story concerns Apate, an Australian startup founded in 2024 by Dolly Kaffar. Years earlier, Kaffar received a scam call during a family picnic. He immediately recognized it as fraudulent but played dumb for his children’s amusement and kept the scammer occupied for 44 minutes. He realized that those 44 minutes were time the scammer could not spend targeting a real victim, but also recognized that manually scam-baiting people would not scale. That led to research at Macquarie University, where Kaffar and colleagues used machine learning and natural-language processing to study scam-call content and improve detection and prevention. Apate now deploys thousands of AI agents that pretend to be innocent victims. They answer scam calls, reply to fraudulent emails, follow phishing links, and join social-media groups to bait fraudsters. The agents can pose as people of different ages, genders, accents, and language backgrounds, with the goal of keeping scammers engaged long enough to learn their content, techniques, tactics, and procedures. According to the company, its agents have wasted 17 years of scammer time across 2.5 million conversations. The hosts joke about whether one scammer somehow experienced all 17 years, comparing the claim to a Saturday Night Live sketch about one person being mugged repeatedly. Apate co-founder and chief commercial officer Brad Jaffe says the company is trying to get ahead of the attack: telecommunications companies often block numbers only after scammers use them, and banks monitor transactions after a customer has already been targeted. Apate instead talks directly to scammers and sells the resulting intelligence to organizations such as telecommunications companies and financial institutions. Maria begins skeptical of scam-baiting as entertainment, but says automated agents gathering intelligence from malicious AI agents could make the practice genuinely useful. Dave reinforces the point with a story about an attorney who unknowingly listened to an AI-generated “client” conversation, showing how convincing real-time artificial interactions have become.

Maria discusses a series of blog posts by Chris Thomas, also known as Space Rogue, including “It’s Time to Rename Cybersecurity Awareness Month” and “Cybersecurity Awareness Won’t Save You. Readiness Might.” Thomas argues that Cybersecurity Awareness Month has done its job after 20 years: people generally understand that security matters, but the repeated advice has become familiar enough that many people tune it out. He proposes shifting the emphasis to “Cybersecurity Readiness Month,” focused on what someone would actually do after an account, device, or data breach. Maria reads Thomas’s readiness test: if a primary email were compromised, how would it be recovered; if a phone disappeared, could important accounts still be accessed; if one password were stolen, what else would it unlock; if a laptop died or ransomware encrypted it, what would be lost; and, if someone clicked a malicious link, would they know what to do during the first 10 minutes? The hosts agree that these questions are more practical than simply asking whether someone knows what phishing is. Dave connects readiness to the growing industry focus on resilience—how an organization responds when prevention fails—while Joe says the spread of AI is pushing people to ask what happens after an attacker gets through rather than assuming every device and account can be perfectly protected. The discussion reveals gaps in the hosts’ own recovery plans. Maria and Joe both see a potential problem if their primary email and phone disappeared or were compromised at the same time. Dave thinks his phone has strong enough authentication to protect his email, but acknowledges that losing both access to the phone and the email could leave him stuck. The hosts agree that cloud-based work makes a dead or stolen laptop less serious, while losing or encrypting important data remains the bigger concern. Maria adds that people should ask not only how they would recover a compromised email account, but how they would know an attacker was quietly inside it. They recommend robust multifactor authentication and treating readiness as an active skill rather than a passive awareness of security advice.

The Catch of the Day comes from Anthony, who filed a trademark application and then received two suspicious messages. Joe reads the first email, which begins with “Action required! Mandatory verification appointment” and claims that an examining attorney has scheduled an appointment. It warns that failure to attend could result in abandonment, says the application is ready to be “verified, tested, and endorsed,” and claims the appointment will allow the United States Patent and Trademark Office to reserve the mark with every Secretary of State in the country. The recipient is told to call the examining attorney at a specified time, verify owner details, and possibly provide an EIN. The message emphasizes that this is not an incoming call and that Anthony must initiate contact. The hosts point out that this instruction is designed to evade familiar advice about hanging up on suspicious incoming calls and calling back through a trusted number. Although the recipient initiates the call, the number in the email is still untrusted. Joe investigates the USPTO’s public trademark-search site and confirms that the scammers appear to have copied Anthony’s real application details from public records. He notes that more than 1,000 trademark applications may be filed each day and that the USPTO provides convenient ways to export records, making it possible for scammers to automate collection and send convincing messages to new applicants. The hosts infer that the eventual goal would likely be money, an EIN, or other information useful for business identity theft. Dave notes that he has received similar letters over the years offering to renew trademarks for a fee. Such companies may perform a real renewal service, but the renewal can be completed without paying them, and the letters are designed to look like official government correspondence. The segment’s lesson is that publicly available information can make a fraudulent message highly personalized without making it legitimate; recipients should verify through the USPTO’s official channels rather than using contact details supplied in the message.