404: scam not found.

The episode opens with follow-up from Robert, a Swedish listener who says he has kept the same mobile number for almost 20 years and has received literally zero scam calls. He wonders whether Sweden’s comparatively small language population makes it unattractive to scammers, even though many Swedes speak English and Swedish-speaking criminals exist. Robert also praises a previous “Duke Silver” reference and sends in an elaborate image of Ron Swanson edited with a cowboy hat, chickens, a Maryland flag, bacon and eggs, and a backpack resembling Joe Kerrigan’s. The hosts suggest several possible explanations for the difference between Sweden and the United States. Joe says scammers may not see a sufficient return on investment in calling Sweden in Swedish, while Dave jokes that the United States gets so many scam calls because its large, diverse population offers criminals an unusually broad target market. They also wonder whether Sweden’s telephone system has stronger protections. Estonia is mentioned as another country worth comparing because the hosts consider its national cybersecurity and general IT infrastructure exceptionally strong. The segment ends with jokes about Swedish and Greek heritage, Ron Swanson actor Nick Offerman, and the hosts’ facial hair.

Maria Varmazis describes Automated Customer Account Transfer Service, or ACATS, as the financial-industry mechanism used to move investments such as ETFs, brokerage holdings, and retirement savings from one brokerage firm to another. A legitimate example would be rolling a 401(k) or other account from one provider to another after changing jobs or finding lower fees. The hosts initially recognize the mechanism without knowing its name, comparing it loosely to older unauthorized “slamming” of telephone services. The fraud begins not with a compromised brokerage login, but with stolen identity information—potentially just a person’s name, phone number, mailing address, and Social Security number. A criminal opens a fake brokerage account in the victim’s name and submits an ACATS request as though the fake firm were legitimately pulling assets from the victim’s real account. Because account transfers are common and the identifying information appears to match, the process can be largely automated. Once the investments reach the fraudulent account, the criminal can sell them for cash and disappear, potentially without the victim learning what happened until the money is gone. Maria cites a Reddit report involving an unauthorized transfer of $150,000 and says the scam is still relatively rare but increasing. Maria says Senators Elizabeth Warren and Ron Wyden are pressing regulators for stronger, consistent protections. Fidelity and Vanguard offer customer-controlled account-locking features, while JPMorgan Chase, Robinhood, Webull, and Wells Fargo may require customers to contact support to enable comparable controls. Protections also vary in scope: some locks block only ACATS transfers, while others may stop legitimate withdrawals or external-bank transfers. The hosts agree that retirement rollovers should be slower and more heavily verified, not optimized for maximum speed. Maria recommends enabling every available transfer and login alert, checking for an ACATS lock, using ordinary account security such as two-factor authentication and unique passwords, and contacting the brokerage immediately about any unrequested transfer or login.

Dave recounts a listener-submitted story about journalist Joan Westenberg, who believed she had been booked as a podcast guest. The preparation appeared unusually convincing, with detailed interview questions that seemed better than those asked by many real journalists. But when Westenberg used the supplied joining link, she was told to run a terminal command to install a custom webinar tool. She stopped immediately rather than executing it. The hosts identify this as part of a broader “click-fix” campaign. In these schemes, criminals persuade targets to copy and paste commands into a Windows, Mac, or Linux command-line interface while presenting the action as routine troubleshooting or verification. Here, the fake hosts could claim that their Zoom or podcast system was malfunctioning and that the command would install the software needed to proceed. Running it would instead install malware. After Westenberg backed out, the scammers sent screenshots of themselves waiting on the call, trying to create urgency, guilt, and social pressure. The hosts caution that legitimate webinar platforms sometimes require an app for hosts, even if viewers can use a browser, so the existence of an application alone is not conclusive. However, a supposedly ordinary podcast invitation that demands an unexplained terminal command or custom software should be treated as a major warning sign. They recommend never copying commands into a terminal at another person’s direction and note that the fake site’s carefully structured URL was designed to resemble an official Apple-related address.

Joe Kerrigan discusses a story from WBAL reporter Ashley Hinson about Maryland resident Lauren Starr. Starr received three consecutive calls from an unknown number; after the third call, she answered because she feared the calls might concern a family emergency. The caller claimed to be from Wells Fargo’s fraud department and said someone had opened a credit card in Starr’s name and used it to buy thousands of dollars in guns and ammunition. The caller then claimed the card could not be canceled until Starr filed a police report in San Francisco. The scam felt credible because the criminals supplied detailed information, including an actual Wells Fargo card number, an address in San Francisco where the card supposedly had been delivered, and an application date. The caller transferred Starr to a second person posing as a San Francisco police officer. That person questioned her, moved the conversation to Cisco WebEx, sent fake police files, and claimed her information was linked to a federal money-laundering case. The scammer told her not to tell anyone and threatened jail and extradition to California. Starr says the threats left her thinking about her dogs, picking up her daughter from New York, and finding a lawyer. Joe explains that this confusion is deliberate: the criminals are trying to trigger fear and suppress critical thinking. The hosts stress that a bank can cancel or investigate a fraudulent card without requiring a victim to file a police report in another state, and legitimate police do not give targets a countdown before arresting them or forbid them from consulting a lawyer. Anyone who receives such a call should independently contact the bank through a trusted number and avoid following the caller’s instructions.

The Catch of the Day comes from the r/scambaiting subreddit. A person says a scammer nearly targeted their daughter, so they decided to engage the scammer and “get in on the fun.” The exchange begins as a supposed babysitting opportunity. The fake parent claims to have two children, offers $20 per hour for weekday care, and promises holiday bonuses and a shopping allowance. The conversation quickly expands into a request that the prospective sitter buy blue helium balloons, party poppers, Xbox gift cards, and milk chocolate before the family arrives. The scammer asks how close the sitter is to Walmart, shops, and gas stations, then offers payment in advance by check or money transfer. When the target questions how the money would be sent, the scammer proposes a Bank of America mobile-deposit arrangement and says the target could deposit a check through the bank’s app. The target deliberately keeps asking practical questions, forcing the scammer away from a polished script. The scammer eventually suggests sending account credentials and produces increasingly confused explanations about checks, Walmart, and mobile deposits. The scam baiter then sends a shortened Grabify link that leads to a fake Bank of America login page. When the scammer clicks it, the baiter obtains technical information including an IP address, approximate location, and device details. The scammer is identified as being in Lagos, Nigeria, rather than Morrow, Georgia, where the supposed babysitting parent claimed to live. The conversation eventually switches into Yoruba, with the scammer apparently realizing the deception. The hosts present the exchange as an example of a fake-job and gift-card/check scam, while noting that the baiter’s tracking tactic was what exposed the claimed location.