I just want to give you $25 million!

Key takeaways

Always access sensitive healthcare portals through bookmarked links or official apps instead of clicking unsolicited email links.
Beware of phishing scams involving fake medical results, especially those that urge you to run commands or download executables; legitimate systems will never prompt you to do so.
Large financial scam schemes, whether targeting corporations like Amazon or individual residents, often rely on exploiting internal processes or creating fake invoices, and vigorous anomaly detection can help uncover them.
Responding to scam texts or emails can verify your number as active, making it more vulnerable to future exploitation; it's best to ignore or report these messages.
Scammers operate with a clear profit motive, often using automated tools and AI to maximize outreach and success, highlighting the need for vigilance and skepticism in digital communications.

Summary

Overview and Listener Engagement

The hosts open the episode by engaging with listeners' feedback, sharing amusing and relatable stories, including chickens and the ongoing chicken coop project. They highlight listener Ann's positive review and her interest in the Shields Up campaign. The segment promotes listener interaction via email and discusses the importance of community and feedback in cybersecurity discourse.

Medical Phishing Scams and Healthcare Security Risks

Maria discusses recent increases in phishing schemes targeting the healthcare system, specifically through the MyChart portal, which many Americans use to access medical records. She explains two prominent scams: fake MyChart results that impersonate lab results to steal login credentials and AI-crafted alarming health reports, as well as bogus Medicare giveaway offers. Maria emphasizes the importance of accessing healthcare portals through bookmarked links rather than unsolicited emails and warns against downloading executables or executing commands prompted by suspicious messages.

Business Fraud and Large-Scale Invoice Scams

Joe covers a case from Georgia involving a woman who was sentenced to 16 years for facilitating a $9.4 million scheme involving fraudulent invoices submitted to Amazon. The crooks exploited invoice approval systems for large sums and attempted to start a franchise with forged documents after being caught. This exemplifies how internal fraud detection and anomaly detection systems can uncover massive financial crimes. Another scam alert comes from Michigan, where residents are warned of fake invoice emails requesting wire transfers, with red flags such as mismatched logos, unrealistic due dates, and non-official email domains.

Phone Number Verification and Low-Tech Fraud Tactics

Dave explains how scammers verify active phone numbers by engaging in initial polite responses to their texts, which can later be used for scams such as romance fraud, identity theft, or scam calls. He highlights the economic incentive for scammers—small investments in vast campaigns can generate significant profits—using malware bites' research to underline the danger of replying with even a simple 'wrong number' message. The discussion underscores best practices like ignoring such messages and reporting them.

Listener-Created Content and Call for Contributions

The episode concludes with a call for listener contributions for the next 'Catch of the Day' story. It encourages sharing scam stories with a focus on real-world scams, emphasizing the importance of practical cybersecurity lessons for the audience.

Show notes

This week, hosts of N2K CyberWire ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ and⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ alongside ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up from Anne, who writes in to share how much she enjoys the show, how she used the “Shields Up” message with her coworkers, and—most importantly another chicken update! Maria covers a pair of MyChart scams that use fake medical results and bogus Medicare giveaways to steal credentials, personal information, and payment details. Joe looks at two scams—one targeting a business through a massive Amazon fraud scheme and another warning residents about fake invoices designed to steal their money. Dave explores the surprising value of simply replying to a wrong-number text, as scammers use responses to identify active phone numbers and find potential targets for increasingly sophisticated fraud campaigns. Our Catch of the Day promises a piece of a mysterious $25 million overpayment. All you have to do is reply with your phone number and your desired cut—what could possibly go wrong?

Resources and links to stories:

Health systems warn patients of MyChart phishing scam

Woman sentenced after nearly $10M Amazon scam funds luxury lifestyle

South Haven warns of invoice scam targeting residents

Your polite reply to that text is worth $2 on the dark web

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.