App-arently it's legit.

The episode opens with follow-up from Crowchild Bob, a frequent contributor. Bob first asks whether “guys” is gender-neutral or only refers to men. Joe says he generally uses it as gender-neutral out of habit, while Dave notes that it can be neutral in some contexts but clearly not in others. Maria says she is not personally offended when included in “the guys,” but emphasizes that she speaks only for herself. The group settles on “folks” as a reliably gender-neutral alternative, while joking about the wording of Joe’s question and Maria’s earlier stories about sketchy rentals. Bob’s second comment concerns Joe’s math in the earlier Xinbi story. Joe had said that Xinbi moved $398 million through its wallets and then called that “almost a billion.” Joe explains that he had transposed the figure: the correct number was $938 million, not $398 million. He attributes the mistake partly to getting very little sleep while handling a heavy course load and apologizes. The hosts joke that once a number exceeds $100 million, it is technically only one order of magnitude from a billion, and Maria’s husband is predicted to reuse Joe’s dad joke: “I’d prefer teaching math over English because fractions speak louder than verbs.”

Dave’s first main story comes from a Microsoft security blog about a business email compromise campaign that sent more than one million scam emails over several days in August. Nearly 90% targeted people in the United States, especially finance staff and accounts-payable teams who could authorize payments. The scam emails appeared to come from a CEO, CFO, or other executive approving an invoice and requesting an automated clearing house payment of nearly $50,000. Rather than using a bare payment request, the criminals created a convincing business narrative: professional-looking fake ServiceNow invoices included branding, dates, line items, payment instructions, and information about the target company. They also inserted a supposedly forwarded conversation between the victim’s executive and a ServiceNow executive discussing the purchase. Microsoft found no evidence that ServiceNow or another impersonated organization had been compromised. The attackers used lookalike domains, fabricated conversations, and fraudulent banking details, with indicators that generative AI helped produce campaign templates. Warning signs remained, including missing email-thread headers, unusual wording, mismatches between sender addresses and displayed names, and contradictions in the story. Microsoft’s central recommendation was not to focus on determining whether an email was AI-written, but to ensure that one persuasive email cannot move money by itself. Independent verification should be required for major payments, banking-information changes, and unusual vendor requests. The hosts agree that slowing down payments with a second approval, an in-person confirmation, or another “speed bump” is worth the inconvenience.

Maria presents research from Allure Security titled “The Brand Was Real. The Desktop App Wasn’t.” Scammers impersonated legitimate human-resources and payroll providers whose real services are web-based but do not offer desktop applications. Victims were directed to imitation websites through malicious advertisements, search results, or email. The pages copied genuine logos, screenshots, and branding, and were quickly created with AI-assisted website-building tools. The key deception was a prominent invitation to download a desktop app. Because the legitimate provider had no real desktop app, victims had no genuine version to compare against and might assume the new offering was simply an ordinary product update. The fake applications were distributed through GitHub releases, while landing pages used Vercel, both legitimate services. The visible installer appeared to use Microsoft’s genuine .NET installation process, but it secretly installed ScreenConnect, a legitimate remote-management tool commonly used by IT departments. Attackers configured ScreenConnect for unattended access, allowing them to control a computer without obvious warnings, banners, or tray icons. The likely targets were people managing payroll and HR systems; persistent access could let criminals redirect payroll deposits, steal employee information, or drain payroll accounts. Allure found multiple fake payroll brands connected through shared infrastructure, including a common live-chat account, GitHub repositories, and remote-access server. Maria stresses that the attack used legitimate platforms and software throughout, illustrating “living off the land.” Users should verify that a desktop app actually exists through the vendor’s official site or a real employee, and IT teams should treat unexpected remote-management installations as serious security events.

Joe shares a message from Jay on LinkedIn pointing to Chase’s Security Center page, “How Scams Unfold.” He describes it as a long collection of real-life scam stories that functions like a compact version of the podcast. One bank-impersonation example begins with a caller ID that appears to say Chase. The advice explains that scammers claim there is fraud on an account and pressure victims to move money, while legitimate banks do not ask customers to move money to resolve a fund issue. Caller ID, email, and text messages can all be spoofed, so customers should call the number on the back of their card. Another story involves scammers telling victims not to visit a bank because employees are supposedly involved; Joe says that instruction is designed to isolate the victim. The page also covers investment scams that begin on social media, where a person builds trust through mutual connections before displaying fake cryptocurrency profits; professional-networking scams that exploit a victim’s confidence; urgent FBI-investigation impersonations; “dad, I’m in trouble” voicemails; and messages claiming a sister’s purse and phone were stolen. Other examples involve tempting marketplace listings and puppy advertisements. Chase’s advice includes treating quick deadlines as red flags and having supposed opportunities reviewed by an advisor or attorney. Joe praises the collection but suggests Chase create a short URL such as “chase.com/scams” and promote the advice in its commercials. The hosts discuss whether banks should revive public-service-style anti-scam advertising as a goodwill campaign.

The Catch of the Day, submitted from Twitter by Dr. Rachel Docterman, is a fake employment email written in awkward language. The sender claims extensive credentials: orthopedic and sports-medicine specialties, work with Northwest University, the U.S. women’s under-20 national soccer team, professional sports teams, and Cirque du Soleil. The message says the recipient has been selected through a university office for students with disabilities to assist students and perform social-service work. It offers $450 for two hours per day, three times a week, while the supposed doctor is away in Belgium. The actual duties reveal the fraud: purchasing items, mailing letters, making payments at Walmart, and receiving the sender’s personal mail. The recipient is asked to provide a name, address, phone numbers, alternate email, and résumé, and is promised advance payment. Dave identifies the arrangement as a request to become a money mule and warns that the only “long-term” outcome could be a prison sentence. He emphasizes that lack of criminal intent does not eliminate the legal danger of moving money for criminals. Maria says the offer feels familiar from college and admits that her younger, ambitious self might have found $450 a week—especially for apparently little work—very tempting. The others agree that students and people seeking flexible work are particularly vulnerable to this type of offer.