No such thing as a free parking spot.

Maria reports feedback on her previous discussion of ACAT fraud, the process by which money can be transferred between financial institutions. Many listeners checked with their own financial-services companies and found that the relevant protective feature was harder to locate or activate than expected, although most ultimately had some success. Maria emphasizes again that this scam is very rare and that listeners should prioritize multifactor authentication and strong, unique passwords before worrying about ACAT-specific protections. She also says her mother listened to the episode for the first time, appreciated the attention given to her tip, and felt validated that the issue turned out to be real. Joe follows up with an informal experiment involving ChatGPT, which he has named “Sophie” after walking through a naming process with the system. When he asked it to “open the pod bay doors,” it replied, “I’m sorry, Joe. I’m afraid I can’t do that,” echoing HAL from 2001: A Space Odyssey. The hosts then compared supposedly random numbers generated by ChatGPT. Joe received 17, then 23, while Dave received 24; when Joe asked for another number, the system produced 8. They compare this behavior with early computers and text-adventure games, where identical random sequences resulted from predictable seeds. Joe recalls using a keypress or the computer clock to create a more variable seed, while ChatGPT’s explanation that it was “pulling it out of the LLM” struck the hosts as a vague, nontechnical explanation.

Joe’s first news story concerns Mahai Theodore Inescu, whom New York prosecutors have arraigned in connection with an alleged QR-code parking scam. The scheme targeted drivers using Manhattan parking kiosks: someone placed stickers over the legitimate “scan here to pay” instructions, directing people to a fraudulent website that appeared to be affiliated with ParkNYC, the approved parking app and payment platform. Prosecutors allege that Inescu placed the stickers on 64 kiosks around Manhattan. Inescu says he does not know what authorities are talking about and that he works as an Amazon delivery driver. The hosts speculate that investigators may have evidence such as video, but note that the defense would learn the details during discovery. The practical lesson is that a QR code attached to a public payment terminal should not automatically be trusted, even when the surrounding kiosk is legitimate. The fake site reportedly looked official, making the visual context part of the deception. The hosts also connect the story to the episode title: finding a parking spot may be difficult, but paying for it through an unverified code can cost much more than the posted fee.

Joe then describes an alleged scheme involving Pennsylvania’s spotted lanternfly quarantine and permit program. Businesses whose vehicles travel within the quarantine zone must complete training and carry a permit, because lanternflies, eggs, nymphs, and juveniles can be transported on trucks, firewood, logs, and other materials. The training and permits are free and are provided through the Pennsylvania Department of Agriculture and Penn State. The hosts joke that the quarantine zone covers nearly the entire state, apart from a few northern counties, and that anyone transporting materials or operating a vehicle in the zone may need to participate. According to the report, Kevin Wardell, owner of Diversified Solutions, LLC, allegedly impersonated the Pennsylvania Department of Agriculture and sold Pennsylvania businesses permits and training. The attorney general said an official permit can only be obtained by completing the department’s free training. Joe says Wardell may have copied or replayed legitimate training while charging for it, but clearly labels that as speculation and notes the allegations have not been proven. The hosts are particularly frustrated that someone found a way to charge for a government service that costs nothing. The discussion expands into invasive species. Maria says she hates the tree of heaven and Japanese knotweed, while the spotted lanternfly favors the tree of heaven. Joe and Maria discuss Maryland’s emerald ash borer, which has killed many ash trees, and the damage to businesses that depended on ash for products such as baskets and baseball bats. They warn that simply cutting or mowing some invasive plants can make them spread more aggressively. Bradford pears and Norway maples are also criticized as problematic plantings, with Bradford pears described as fast-growing trees that eventually split and damage property.

Dave discusses a Malwarebytes report about a fake preorder page for Apple’s new foldable iPhone Duo. The real device is not yet available for preorder, but the fraudulent page imitates Apple’s typography and layout and promises a $500 voucher toward the purchase. The hosts point out several warning signs, including nonexistent iPhone models and colors and a countdown timer that resets whenever the page reloads. Dave says artificial countdowns immediately make him distrust a site, especially because he doubts Apple would use such a garish pressure tactic. The preorder form is reportedly a distraction: information entered into it is not actually transmitted. Instead, the page attempts to exploit the visitor’s device through the DarkSword exploit chain, malware associated with Safari on iOS. The page checks the iOS version and selects attack code accordingly. If it bypasses the phone’s protections, a second payload contacts a command-and-control server and searches for cryptocurrency wallets, including MetaMask, Phantom, and Trust Wallet. It also attempts to steal saved credentials from the iPhone keychain, wallet files, photo thumbnails, messages, call history, contacts, and voicemail, while deleting diagnostic reports to conceal activity. Google previously reported and Apple patched the vulnerabilities associated with DarkSword, although Malwarebytes had not confirmed the full range of iOS versions targeted by this particular page. Malwarebytes recommends keeping iOS fully updated and avoiding unfamiliar preorder links. Anyone who opened the malicious page should update and restart the phone; the malware did not appear to persist after a restart, although restarting cannot undo information that was already stolen. The hosts conclude that excitement about being first to own an expensive new device can short-circuit critical thinking.

Maria reviews the fifth annual Consumer Cyber Readiness Report from Consumer Reports, Aspen Digital, and the Global Cyber Alliance. The report aggregates several surveys conducted among thousands of U.S. adults in early or mid-2026. It found that 91% of American consumers had encountered at least one digital scam or attempted cyberattack. Seventeen percent said they had lost money to a scam: 10% permanently and 7% temporarily, with some recovering their funds. Among people who successfully recovered money, 61% had paid by credit card, 45% by debit card, 15% through peer-to-peer platforms such as Venmo or Zelle, and 5% with cryptocurrency. The hosts are surprised that any crypto users recovered their money. Twenty percent of respondents said they had encountered a personalized scam in the previous year, meaning the attacker used accurate personal details. Phone calls accounted for 32% of those personalized scams. Dave illustrates the power of this technique with a call from someone impersonating the Carroll County Sheriff’s Office and claiming he had missed jury duty. The caller used a stern, authoritative tone and became irritated when Dave asked him repeatedly to spell his name. Dave forced himself to say he would call the sheriff’s office independently, recognizing that inbound caller ID could not be trusted. The scammer eventually became angry, admitted it was a scam, and hung up. Maria adds that a confident or deep voice can make people seem more authoritative than they have earned. Confidence in data privacy has dropped sharply. Only 32% of respondents felt at least somewhat confident that their personal data remained private, down from 48% the previous year, while those who were not at all confident rose from 16% to 29%. The hosts attribute this partly to constant breach notifications and alert fatigue. On the positive side, 60% reported using multifactor authentication, 48% had enabled automatic software updates, and 69% said they inspect links in texts and emails before clicking. They regard these numbers as meaningful progress, while still saying the work is unfinished. Respondents were divided over who should be responsible for stopping scams: 29% chose platform owners such as social-media, messaging, and sales platforms; 18% chose the federal government; 16% chose individual consumers; and 14% chose financial companies. The hosts argue that responsibility must be shared, including by phone carriers, which were absent from the listed choices. Maria quotes Global Cyber Alliance CEO Brian Cute’s conclusion that personal precautions cannot solve abuse originating upstream from insecure routing and maliciously registered domains; industry, government, and philanthropy must cooperate.

The Catch of the Day comes from the r/phishing subreddit and consists of a series of spam messages apparently directed at someone named Juan. The messages offer a “Fix-It Now” loan, claim Juan overpaid for auto insurance in 2025, warn that 2,532 photos were deleted, say his home-policy information was updated, offer bathroom-remodeling estimates in Anaheim, and advertise utility assistance. After the recipient replies, “This is not Juan. There is no Juan that I know of. Please stop contacting this number,” the spammer follows up with, “Hey, Juan, just making sure my last message came through.” The hosts joke that the phone must have excellent battery life and that there is “no Juan, only Zul.” They speculate that the number may previously have belonged to someone named Juan. Dave and Joe compare this with their own experiences receiving messages intended for former users of their phone numbers or email addresses. Dave recalls creating a fictional employee named Juan as a honeypot for sales callers, complete with business cards and responsibilities for toner cartridges, long-distance plans, and office supplies. Maria says she received political fundraising emails addressed to her deceased father and repeatedly asked the sender to stop. Listeners are invited to submit their own examples to hackinghumans@n2k.com.