AI Has Changed Identity Theft. Are We Ready? with James Lee and Eva Velasquez of the Identity Theft Resource Center: täielik transkriptsioon

complex. 00:04:32.800 --> 00:04:36.240 So we do those other things beyond helping individuals. 00:04:36.319 --> 00:04:41.519 So we do a lot of research into trends because we talk to victims every day. 00:04:41.600 --> 00:04:43.279 We are the canary in the coal mine. 00:04:43.839 --> 00:04:50.240 We see the trends before they ever develop into a nationwide institutional kind of trend. 00:04:50.720 --> 00:05:02.399 So the best example recently would be think about the pandemic when unemployment benefits started to be stolen as part of an organized crime effort, organized identity theft. 00:05:02.800 --> 00:05:08.240 We saw that immediately and watched it grow from Seattle to across the country. 00:05:08.720 --> 00:05:11.439 We also, you know, published information about data breaches. 00:05:11.519 --> 00:05:18.720 We've been tracking data breaches since the California law was passed when the first data breach notice is starting to be filed. 00:05:19.040 --> 00:05:23.120 So we've got 20 plus years now of data breach information. 00:05:23.439 --> 00:05:38.879 And then we also research uh and survey individuals as well as victims about what actually happened to them and how long did it take them to recover and what were the the non-obvious impacts, the financial impacts, obvious stuff. 00:05:39.040 --> 00:05:53.040 It's the non-obvious impacts that really make these kind of crimes, whether it's traditional identity theft, whether now it's a scam or it's a fraud, that's what makes this so insidious, is it's all the other things that happen. 00:05:53.360 --> 00:06:03.759 And now we're layering in new kinds of technologies that just make these kind of crimes explode, make it so much easier to commit and so much harder to recover. 00:06:04.079 --> 00:06:05.600 Oh, and you didn't he didn't say it. 00:06:05.680 --> 00:06:07.920 He didn't say AI, but that's what he meant. 00:06:08.160 --> 00:06:10.079 And is it a podcast? 00:06:10.399 --> 00:06:14.079 Is it a podcast between the two of us if we don't talk about AI? 00:06:14.480 --> 00:06:17.120 I'm I am contractually obligated to mention it. 00:06:17.279 --> 00:06:18.639 So I was gonna get there. 00:06:18.879 --> 00:06:20.480 I mean, we'll definitely get there for sure. 00:06:20.560 --> 00:06:25.920 But I mean for me, what's interesting is we hear a lot more about scams that really don't even feel like scams anymore. 00:06:26.160 --> 00:06:29.439 Can you talk a little bit how sophisticated these attacks are really becoming? 00:06:29.680 --> 00:06:33.519 What has changed the most about identity theft and fraud over the last few years? 00:06:34.240 --> 00:06:35.279 Oh gosh. 00:06:35.600 --> 00:06:40.160 It's the breadth, the scope, it and just how pervasive it is. 00:06:40.399 --> 00:06:51.040 You know, when when I look back at when even when I started 14 years ago, the misuse of your identity credentials, your identity credentials were this small like core piece of the puzzle that is you. 00:06:51.199 --> 00:06:54.319 And it has just been expanding and expanding and expanding. 00:06:54.399 --> 00:06:59.839 And it's your behavior, it's your biometrics, it's all of these usernames and passwords. 00:06:59.920 --> 00:07:05.120 It's so much more than your social security number, date of birth, driver's license number, passport number. 00:07:05.519 --> 00:07:21.519 And I think for your average person understanding that their identity is an asset, and all the things that comprise their identity are assets, pieces of that asset that they have to protect, it's become impossible. 00:07:21.839 --> 00:07:35.519 So as they're getting all of these regions, I'm your bank, I'm your cable provider, I'm the federal government, I'm law enforcement, I'm your romantic partner, I'm your financial advisor, I'm the the company, the escrow company. 00:07:35.600 --> 00:07:38.160 So wire the money for your damn payment to your house. 00:07:38.639 --> 00:07:41.920 We can no longer tell fact from fiction. 00:07:42.160 --> 00:07:46.399 And it isn't because people are careless or they're not savvy or sophisticated. 00:07:46.720 --> 00:07:56.639 It's because the level of deception that is out there in our everyday lives is so high and so polished and professional that no one can tell the difference. 00:07:56.800 --> 00:07:59.040 It's not about detection anymore. 00:07:59.199 --> 00:08:00.160 It's about understanding. 00:08:00.240 --> 00:08:04.720 And we have to change our our behavior with with that incoming communication. 00:08:04.959 --> 00:08:06.800 And that's just gonna be a hard shift for people. 00:08:06.959 --> 00:08:13.839 So that's we can get into more of the details about how scams have become more sophisticated and what they look like. 00:08:13.920 --> 00:08:24.480 But that's the to me, that's the high level piece of it is it we just have to operate differently because the bad guys know now, oh, I can just keep pinging ya and pinging ya and pinging ya, and I'll get something. 00:08:24.720 --> 00:08:25.920 I'll get something valuable. 00:08:26.319 --> 00:08:37.759 I was I was thinking about how like in the early 90s it was like the good days of scamming, you know, you'd get a phone call from Bob and he'd be like, quick, run to your computer right now. 00:08:38.159 --> 00:08:46.639 Quick, you have a virus, and like n and then you'd get like the emails that was like, Hi, I am Prince, whatever, and I need this. 00:08:46.799 --> 00:08:51.039 Like, I miss those because now it's your package can't be delivered. 00:08:51.200 --> 00:08:51.759 Click here. 00:08:51.919 --> 00:08:53.600 I'm like, did I order something? 00:08:53.759 --> 00:08:56.720 You know, and they're really toll on this toll road. 00:08:56.799 --> 00:08:57.919 Well, did I drive the toll? 00:08:58.159 --> 00:08:59.759 I live in a place with toll roads. 00:08:59.840 --> 00:09:00.399 Did I drive it? 00:09:00.720 --> 00:09:06.240 My problem is sometimes my kids will buy stuff on my Amazon, and then I'm like, oh,

maybe there is a package that I'm not sure. 00:09:06.559 --> 00:09:09.039 I might not have ordered it, but maybe my daughter did or what have you. 00:09:09.120 --> 00:09:13.519 And so I'm like, I have to go and check with somebody like, are we expecting a package before I click on things? 00:09:14.159 --> 00:09:14.639 Yeah. 00:09:14.879 --> 00:09:21.840 And it is like I got an email literally yesterday, and it was from a friend of mine, and it was like an invite. 00:09:22.000 --> 00:09:28.320 It was like you're invited, and she was the person who sends all of those invites for events. 00:09:28.639 --> 00:09:30.399 And I thought nothing of it. 00:09:30.559 --> 00:09:41.200 It looked like all of the ones, and immediately I clicked it, and thankfully for technology, it immediately was like, Are you sure this looks like and I'm like, nope, I'm not, I am not messing with this. 00:09:41.279 --> 00:09:44.879 And I sent her a message and she was like, Oh my god, I was hacked. 00:09:45.039 --> 00:09:45.679 Don't click it. 00:09:45.759 --> 00:09:47.200 But didn't think it would be. 00:09:47.600 --> 00:09:52.879 Yeah, I was like, Thanks, but she always sends this, so it seems so normal. 00:09:53.120 --> 00:09:59.360 And the and it was weird because I had originally looked at it from my phone and it didn't give me that heads up. 00:09:59.519 --> 00:10:03.519 But on my phone, it was like, we need to confirm your identity. 00:10:03.600 --> 00:10:05.360 And I was like, they've never done that. 00:10:05.600 --> 00:10:06.559 This is weird. 00:10:06.799 --> 00:10:10.399 And I went to my computer because I was like, maybe it's my phone. 00:10:10.639 --> 00:10:12.399 The moment I clicked, it was like, are you sure? 00:10:12.480 --> 00:10:16.000 And I was like, actually, this is definitely a spam and I'm not doing this. 00:10:16.320 --> 00:10:19.039 But to someone else, who knows? 00:10:19.200 --> 00:10:28.879 It's so easy these days to be like, Well, this is one of those things, you know, click on the all of the buses and you're just identifying yourself and you think nothing of it. 00:10:29.120 --> 00:10:31.120 Surprise it's it's a scam. 00:10:31.440 --> 00:10:36.720 So I'm just kind of wondering from your perspective, and this one is for either one to like fight for it. 00:10:36.879 --> 00:10:40.399 How would you say AI is changing the fraud landscape? 00:10:40.559 --> 00:10:47.200 Like, what can scammers do today that would have been difficult or impossible five years ago? 00:10:47.519 --> 00:10:49.279 Oh, hang on, buckle up. 00:10:49.440 --> 00:10:50.480 It's gonna take a while. 00:10:50.720 --> 00:10:52.960 We have to actually go, we have to predate AI. 00:10:53.120 --> 00:10:56.080 Let's go back, let's just think about it. 00:10:56.240 --> 00:11:19.200 In the golden age of uh before AI, three years ago, we were already seeing significant advances in the ability of professional threat actors or even amateurs to be really, really good at their craft because we had developed tools that were low cost and no skill. 00:11:19.440 --> 00:11:33.519 So 10 years ago, you had to know how to code, you had to know Java, you had to know Python, you had to know all the languages, and you had to have some significant computer skills to be able to execute a really good scam. 00:11:33.679 --> 00:11:35.039 Today you need a smartphone. 00:11:35.279 --> 00:11:37.200 Today you don't even have to know English. 00:11:37.440 --> 00:11:40.159 No, yeah, you don't have to, you don't have to know anything. 00:11:40.320 --> 00:11:54.080 So even before AI came along, we had these low-cost toolkits that you could buy off of the web, not the dark web, just the web, for 15 or 20 bucks, and you too could be a professional identity thief. 00:11:54.399 --> 00:11:57.200 That accelerated, and then here comes AI. 00:11:57.360 --> 00:12:04.960 So we have a whole generation of people who have no skills or low skills now becoming professional identity criminals. 00:12:05.200 --> 00:12:08.000 Then we supercharge it with AI. 00:12:08.240 --> 00:12:11.840 So AI gives us both volume and velocity. 00:12:12.080 --> 00:12:17.440 We can do mass amounts of scams in a short period of time. 00:12:17.519 --> 00:12:24.000 And if we get caught, we can dump what we just did and recreate it someplace else in a matter of minutes. 00:12:24.240 --> 00:12:26.320 And everything can be automated. 00:12:26.480 --> 00:12:34.480 So I can automate a video of me looking like Brad Pitt because nobody's ever going to confuse me with Brad Pitt. 00:12:34.639 --> 00:12:55.679 And I can throw that up into an automated email that I bought a list off of some identity marketplace that gives me the tens of thousands or hundreds of thousands of emails to people that fit the zip code, the age demographic, the income demographic, the whatever other kind of parameters I want to set, and I can just pump it out. 00:12:55.919 --> 00:13:03.039 Hi, I'm Brad Pitt, and I I love dogs, and I know you love dogs too, but dogs need your help. 00:13:03.360 --> 00:13:06.960 And the pocketbooks open up, the credit cards start flying. 00:13:07.039 --> 00:13:11.120 So not only are they collecting the money, they're collecting all the information around that. 00:13:11.279 --> 00:13:17.840 That can all be done in less than an hour with letter perfect accuracy, that we've never had that before. 00:13:17.919 --> 00:13:24.480 And there's nothing on the horizon to say it's not going to get even more efficient and more accurate. 00:13:24.720 --> 00:13:52.879 So it really is changing fundamentally the way crime occurs, and it has the effect of it will fundamentally change business processes because we have to anticipate these things now in order to make sure that commerce continues and just a lot of basic societal functions continue without being completely downgraded and disrupted by AI with all the good things AI can do too. 00:13:53.120 --> 00:13:54.320 I can think of one or two. 00:13:54.399 -->

00:13:57.759 I'm not sure I get to three or four, but I you know, there are some good things. 00:13:58.080 --> 00:14:04.799 But gosh, the bad guys are there's so many more of them, and they are not bound by the rules that we are. 00:14:05.600 --> 00:14:14.639 And so they're going to continue to do things that are disruptive and harmful at a scale that we've never seen before. 00:14:15.200 --> 00:14:22.000 So, how much of identity theft these days starts with something that seems relatively harmless, like a random post or a quiz or some online purchase? 00:14:22.159 --> 00:14:25.039 What are people inadvertently giving away that can be used against them? 00:14:25.440 --> 00:14:33.679 I don't think we have good numbers on it it's really hard to determine the root cause because so much of this just happens out of the blue. 00:14:33.919 --> 00:14:41.679 Yeah, sometimes people go, I did click on a link, I did talk to someone and give my information when they were misrepresenting themselves. 00:14:41.759 --> 00:14:43.759 Yes, my purse or wallet was stolen. 00:14:44.159 --> 00:14:56.080 But a lot of times people are just minding their own business and they go, I have no idea where people got my credentials and how I didn't know I had warrants out in another state. 00:14:56.480 --> 00:14:58.480 It's not just the money, Lebowski, right? 00:14:58.720 --> 00:15:00.000 I mean that's a big part of it. 00:15:00.480 --> 00:15:09.440 But there are just think about all of the different ways that you use your identity on a regular basis, and then think about all of the ways it could be misused. 00:15:09.679 --> 00:15:19.440 I think a bad acter with that information can do all of those same things unless you put some guardrails in place to to safeguard the misuse of your credentials. 00:15:19.679 --> 00:15:24.799 So I don't think we can get great numbers on those root causes. 00:15:25.120 --> 00:15:26.559 I think James agrees with me. 00:15:27.519 --> 00:15:28.720 I'm gonna split the hair. 00:15:29.039 --> 00:15:29.360 Okay. 00:15:30.080 --> 00:15:33.679 And that is data breaches are the fuel for most identity crimes. 00:15:34.000 --> 00:15:43.200 And what happens with with um a lot of other kinds of particularly impersonation crimes is we fill in around the edges with exactly what you're talking about. 00:15:43.519 --> 00:15:52.720 Where it may seem like a perfectly innocuous thing to fill out a quiz on your favorite social media platform or to share information someplace else. 00:15:53.039 --> 00:15:54.799 What's your spirit animal, James? 00:15:55.039 --> 00:15:56.799 Yeah, I'm not telling you. 00:15:57.039 --> 00:15:59.840 That's that that's that's it's highly personal information. 00:16:00.240 --> 00:16:01.039 We'll guess it. 00:16:01.200 --> 00:16:02.960 We'll be thinking about it and we'll guess it. 00:16:03.200 --> 00:16:05.679 Yeah, you'll you I bet you'll get there. 00:16:05.840 --> 00:16:37.279 Uh and and and so with massive amounts of information over the over the decades that we've been tracking data breaches, you know, we know that at this point with AI, they can they can analyze, slice, and dice the information and pick your data breach, that information and put it to immediate use and targeting and developing some new kind of pitch, because the the using AI, the pitch can be very persuasive. 00:16:37.440 --> 00:16:39.600 And then add all the other AI tools on it. 00:16:39.919 --> 00:16:44.240 It's not a matter of, well, then collect all the data maybe a year or two down the road to do something with it. 00:16:44.320 --> 00:16:45.519 Now it's minutes. 00:16:45.840 --> 00:16:52.320 So it starts with data breaches and they fill in around the edges with other data that is publicly available. 00:16:52.559 --> 00:16:55.360 It's already in some other identity marketplace. 00:16:55.679 --> 00:16:59.360 And uh frankly, we're our own worst enemies in many respects. 00:16:59.519 --> 00:17:17.440 We'll post anything and everything on social media without any view to the fact that somebody who doesn't have good intentions can look at that and go, that's the piece I need to defeat that ID verification process that I'm gonna be asked when I go to the bank or when I go apply for this. 00:17:17.680 --> 00:17:22.240 And I need to know not your mother's maiden name, but what kind of car do you drive? 00:17:22.400 --> 00:17:23.839 Well, I got pictures of it. 00:17:24.160 --> 00:17:24.960 Where's your house? 00:17:25.119 --> 00:17:26.160 Well, I got pictures of it. 00:17:26.319 --> 00:17:27.839 I know exactly where your house is. 00:17:28.079 --> 00:17:32.559 So all those kinds of things that we don't really think about, we have to start thinking about. 00:17:32.720 --> 00:17:34.240 And this is not paranoia. 00:17:34.319 --> 00:17:36.240 This is not saying that you can't do that. 00:17:36.559 --> 00:17:39.200 You have to think about who's looking at that data. 00:17:39.440 --> 00:17:48.400 Do you want everybody in the world to know where your house is, or do you only want the people who are your friends and relatives who are going to come to your house to know where it is? 00:17:50.640 --> 00:17:51.680 I don't even want them to know. 00:17:51.839 --> 00:17:53.839 I don't like don't tell anyone. 00:17:54.400 --> 00:17:55.119 Don't go over. 00:17:56.559 --> 00:17:57.119 Yeah. 00:17:57.920 --> 00:17:58.160 Nope. 00:17:58.240 --> 00:18:00.160 I'm not nope, I'm not nope, I'm not gonna do it. 00:18:00.480 --> 00:18:01.680 Not gonna comment on that one. 00:18:01.920 --> 00:18:13.440 Well, I'll also I'll also say one, you know, add one more piece to that, and that is remember when James was talking about okay, we're gonna do this Brad Pitt saving the animals charity scam? 00:18:13.920 --> 00:18:24.319 A lot of the data that you post on social media is also cluing in the bad guys onto what kind of social engineering, what kind of hook is going to be the most effective for you? 00:18:24.400 --> 00:18:26.559 And that's

all now automated with AI. 00:18:26.720 --> 00:18:34.079 So maybe I'm not going to hit Eva with an investment scam because she doesn't talk about that a lot. 00:18:34.319 --> 00:18:40.079 Oh, but I will with a charity scam because she talks about doing good and being philanthropic. 00:18:40.240 --> 00:18:44.559 But oh, maybe James, no, he talks a lot about investments in the market and all these. 00:18:44.799 --> 00:18:46.799 I'm gonna hit him with an investment scam. 00:18:47.440 --> 00:19:03.359 That other more subtle data about who you are and what resonates with you and what's important to you is also unfortunately used against you as far as determining what fishing hook is potentially going to resonate best with you. 00:19:03.759 --> 00:19:11.680 And don't get me wrong, a lot of times they're just casting a wide net and it's about your email or your phone number, and that's it, and whatever works, works. 00:19:12.000 --> 00:19:26.880 But as James was talking about, well, hey, I actually want this zip code and this trait, now it can all be automated so they can do more precise targeting of these types of phishing attacks and scams with very little effort. 00:19:27.200 --> 00:19:29.039 I mean, and you just gave them all your ideas. 00:19:29.279 --> 00:19:34.720 Like anyone who's listening was like, I want to scam, they're like, okay, that's how we scam James, that's how we scam Eva. 00:19:35.279 --> 00:19:35.920 Now we know. 00:19:36.079 --> 00:19:38.079 So you really gave them the info to have it. 00:19:38.400 --> 00:19:43.759 Except that we're such skeptical so-and-so's that uh, you know. 00:19:44.559 --> 00:19:49.599 No, it it is that it is a thing where I really hate certain companies. 00:19:49.759 --> 00:19:50.880 And this is a real thing. 00:19:51.039 --> 00:19:56.640 There's so many companies now that take advantage of the fact that you have scammers that are better now, right? 00:19:56.880 --> 00:20:03.039 Because you have all these companies that know you're so sick of getting those texts that are like, hey, dinner tonight. 00:20:03.200 --> 00:20:04.880 And you're like, it's who is this? 00:20:05.039 --> 00:20:06.400 Oh, I'm so sorry. 00:20:06.559 --> 00:20:08.079 I have the wrong number. 00:20:08.319 --> 00:20:09.279 Who is this? 00:20:09.519 --> 00:20:24.319 And you get so tired of those constant texts that there's a lot of these companies that thrive on making money from that and tell you, we're here to help you pay us X amount and we will delete all of your stuff from the dark web. 00:20:24.480 --> 00:20:27.119 And if you really look at it, that's not what they're doing. 00:20:27.359 --> 00:20:31.279 And it's just a whole thing and you don't even know who to trust anymore. 00:20:31.519 --> 00:20:36.880 And that that's an entire episode and of in itself that will get me spiraling for sure. 00:20:37.039 --> 00:20:46.079 But when you think about like an explosion of data breaches, just like massive ones, which again, I I'm all over the place. 00:20:46.319 --> 00:20:52.240 But when you're thinking about that and you're you realize that at that point, your information, it's out there. 00:20:52.319 --> 00:20:53.759 It's all over the world. 00:20:54.000 --> 00:20:59.839 Not even just the typical, I'm getting these texts, but like your data is fully leaked. 00:21:00.079 --> 00:21:03.279 Do you even really have that much control over it? 00:21:03.519 --> 00:21:09.359 Like, what what does that look like once it's been really leaked in like a very real way? 00:21:09.680 --> 00:21:12.240 Well, that's one of the things that makes this so difficult. 00:21:12.400 --> 00:21:17.119 Because you know, you want to particularly want to give individuals the tools they need to protect themselves. 00:21:17.200 --> 00:21:21.119 And the reality is we're at the mercy of the organizations who have our data. 00:21:21.359 --> 00:21:27.839 Most organizations, if not 99.99% of them, don't want to have a data breach. 00:21:28.000 --> 00:21:31.759 There are there are percentage companies that don't care if they have one or not. 00:21:31.920 --> 00:21:36.000 There are companies that, when they have them, they want to do everything they can to keep them secret. 00:21:36.160 --> 00:21:43.839 But the vast majority of organizations don't want it to happen, and they are they are just as much a victim as the individuals whose information has been compromised. 00:21:44.000 --> 00:21:52.720 But there's nothing that the individual can do once they turn that information over to someone, other than make their information less useful. 00:21:52.880 --> 00:21:59.759 They can't prevent it from being breached once they've given control over, but they can do things to help make it a little less useful. 00:22:00.480 --> 00:22:04.079 And frustrate the bad guys to the maximum degree. 00:22:04.240 --> 00:22:07.119 But at the same time, you know, companies have to step up. 00:22:07.200 --> 00:22:08.400 There's no question about that. 00:22:08.640 --> 00:22:10.160 Government has to step up. 00:22:10.319 --> 00:22:12.000 We don't have the infrastructure. 00:22:12.160 --> 00:22:16.079 We don't have the legal framework to address these issues. 00:22:16.319 --> 00:22:17.839 That is not unique to government. 00:22:18.000 --> 00:22:19.359 That is not unique to this time. 00:22:19.759 --> 00:22:31.759 There's always been a lag between the time, whether you go back to the wheel, you go to automobiles, you go to steam locomotives, you go to Atari 64 or the first IBM PCs. 00:22:31.920 --> 00:22:37.039 There's a 20 to 30 year time lag for government to catch up and go, you know, we should really do something about this. 00:22:37.200 --> 00:22:44.240 We don't have 20 or 30 years now, and we don't have the infrastructure today and the legal framework today to address these issues. 00:22:44.319 --> 00:22:50.720 So individuals have to do more, and we have to press companies and we have to press the government to do more. 00:22:50.880 -->

00:22:58.240 Companies have to pay more attention to the quality of their of what they're doing and how they're securing it. 00:22:58.559 --> 00:23:07.839 Oracle, this last 30 days, issued more patches to their software than they did the last two years combined. 00:23:08.079 --> 00:23:18.480 There's no way on God's green earth that security teams can apply 2,300 security patches in the next 30 days when the next patch update will come out. 00:23:19.119 --> 00:23:21.279 I mean, to me, I mean what you said there is really interesting. 00:23:21.440 --> 00:23:34.400 I feel like I'm I'm part of my worries like, are you putting too much of a responsibility on the individual to protect themselves when it seems like so much of the problem is actually the companies who are collecting and more importantly storing all this enormous amounts of our data? 00:23:34.559 --> 00:23:39.119 Like, what should the companies themselves be doing differently besides just simply furiously patching? 00:23:39.359 --> 00:23:40.960 They they've they have to patch. 00:23:42.720 --> 00:23:45.680 They have to have to slow down this AI nonsense. 00:23:46.000 --> 00:23:58.480 AI is great, it makes things faster, but there's already plenty of body of data that tells us that the vast majority of the flaws that AI is finding in software, AI created. 00:23:58.559 --> 00:24:01.039 And when they write the patch, it usually fails. 00:24:01.119 --> 00:24:03.920 And the patches that do work break the application. 00:24:04.240 --> 00:24:05.759 So slow down. 00:24:06.079 --> 00:24:20.960 But go ahead and make sure you're doing everything you can to patch and patch faster and don't be afraid of newer technologies, which are more effective than the old find and remediate, the old find and fix model that we've used for the last 30 years. 00:24:21.039 --> 00:24:22.319 That doesn't work anymore. 00:24:22.480 --> 00:24:24.720 Automation can work, but you got to be smart about it. 00:24:24.880 --> 00:24:25.839 So they've got to do that. 00:24:25.920 --> 00:24:28.799 They also have to get themselves off the crack of data. 00:24:29.359 --> 00:24:31.920 And that, and look, I'm a former marketer. 00:24:32.079 --> 00:24:40.799 I ran the marketing for publicly traded companies, and I know what it is to a company to say, I'm not going to collect your data. 00:24:40.880 --> 00:24:43.680 There's there are people who would pass out when you say do that. 00:24:43.839 --> 00:24:46.559 But that's what it comes down to data minimization. 00:24:46.720 --> 00:24:48.640 If you don't need it, don't collect it. 00:24:48.880 --> 00:24:52.960 If you do collect it, once you're through using it for that transaction, get rid of it. 00:24:53.119 --> 00:24:53.839 And you know why? 00:24:54.000 --> 00:24:56.160 Because if you don't have it, it can't be stolen. 00:24:56.319 --> 00:24:59.759 It can't be breached, and you can't put your customers or anybody else at risk. 00:25:00.000 --> 00:25:05.119 Companies have to look at that kind of process to though there's less data collected. 00:25:05.200 --> 00:25:09.279 And when it is collected, it's gone once the use is over. 00:25:09.759 --> 00:25:17.359 And government has to then have its role is to set those guardrails and set enforcement that is meaningful. 00:25:17.599 --> 00:25:21.599 Actually follow up on are you living up to these requirements? 00:25:21.839 --> 00:25:24.640 And if you don't, make it hurt. 00:25:25.440 --> 00:25:28.720 Not a slap on the hand, make it painful. 00:25:29.039 --> 00:25:30.880 We have data breach laws. 00:25:31.039 --> 00:25:33.680 All 50 states, the territories, and District of Columbia. 00:25:33.839 --> 00:25:36.319 We've had them for now, yeah, two decades. 00:25:36.480 --> 00:25:38.319 What's happened to data breaches because of those? 00:25:38.400 --> 00:25:40.960 Because those laws were designed to make sure we didn't have data breaches. 00:25:41.039 --> 00:25:43.920 It was going to be so painful if somebody had to report a data breach. 00:25:44.079 --> 00:25:46.640 They'd do whatever it took to prevent that from happening. 00:25:46.880 --> 00:25:47.759 Hadn't happened. 00:25:48.000 --> 00:25:55.359 Last three years, more than 3,000 data breaches reported in the U.S., and that's just a drop in the bucket to the ones that actually happen. 00:25:55.680 --> 00:25:57.440 And it gets higher every year. 00:25:57.599 --> 00:26:00.799 We're going to break another record probably this year. 00:26:00.960 --> 00:26:10.559 And the number of individuals who are impacted get less and less information because the law and the legal frameworks don't require them to actually share any meaningful information. 00:26:10.720 --> 00:26:13.119 And even if they ignore the law, there's no penalty. 00:26:13.359 --> 00:26:18.640 That kind of process cannot continue if we want to fix the problem. 00:26:18.799 --> 00:26:21.200 If we don't want to fix the problem, keep doing what we're doing. 00:26:21.359 --> 00:26:33.599 But if you want to fix it, and it's not to make the that won't happen, it's to manage it and make it better for the organizations who want to follow the rules and want to help people, and better for the people whose information is actually impacted. 00:26:33.839 --> 00:26:35.200 We can fix those things. 00:26:35.359 --> 00:26:36.319 We can make it better. 00:26:36.480 --> 00:26:41.920 We can manage the problem because it's always going to be there, but we can manage it better than we do today. 00:26:42.160 --> 00:26:46.079 But it's going to require everybody participating. 00:26:46.319 --> 00:26:48.880 Individuals, government, and companies. 00:26:49.359 --> 00:26:52.000 Individuals do have a role here. 00:26:52.240 --> 00:26:57.680 You know, Laura, you were saying, oh, my data's already out there, and why bother? 00:26:57.759 --> 00:27:03.759 I talked to somebody the other day with it, was like, I should just put my social security number on a t-shirt because it doesn't matter. 00:27:03.920

--> 00:27:06.400 It's already been compromised a million times. 00:27:06.880 --> 00:27:15.839 Well, I understand the cynicism, and I think there's a balance between I acknowledge that I'm at risk and my data is already out there, so I'll do nothing. 00:27:16.319 --> 00:27:20.960 And I can't acknowledge that it's out there and I have to, you know, protect all of these things. 00:27:21.039 --> 00:27:22.160 There's a middle of the road. 00:27:22.240 --> 00:27:27.119 And I would say to the person asking me, the individual, yes, you have a role. 00:27:27.200 --> 00:27:28.480 Yes, there are things you do. 00:27:28.720 --> 00:27:32.079 Not every bad guy has every piece of your data. 00:27:32.400 --> 00:27:43.440 So adopt a mindset that it says this is an asset and I want to protect it, but acknowledge that other entities, like what James was saying, government and industry, have a role as well. 00:27:43.759 --> 00:27:49.759 And my role is to do things to protect the data that I know has already been compromised. 00:27:49.839 --> 00:27:51.200 So I'm going to freeze my credit. 00:27:51.680 --> 00:28:02.960 I'm going to freeze my credit so that my social security number that can be purchased on both the dark web and the on the public web on YouTube of all places, that it's less valuable. 00:28:03.039 --> 00:28:10.880 So I'm going to freeze my credit, which we can we at the ITRC, we have all kinds of information that walks people through how they can do it. 00:28:10.960 --> 00:28:15.599 It's free to you, free to your kids, free to dependent adults that you're taking care of. 00:28:15.680 --> 00:28:19.200 So it's a great thing that you can do to reduce your risk. 00:28:19.599 --> 00:28:23.839 And then, you know, Kevin, you said, isn't the onus too much on individual people? 00:28:24.000 --> 00:28:25.359 Yes, yes, it is. 00:28:25.599 --> 00:28:30.480 We do put too much onus on individual people to protect themselves and to recover from it. 00:28:30.799 --> 00:28:38.880 But at the same time, you as an individual cannot abdicate all responsibility because you are engaging in the a lot of these digital transactions. 00:28:39.119 --> 00:28:41.200 You are engaging in using social media. 00:28:41.359 --> 00:28:46.880 There is some level of responsibility that you have to understand it. 00:28:47.039 --> 00:28:49.039 Yeah, everybody just blame Kevin. 00:28:49.519 --> 00:28:51.039 You don't have to take any steps. 00:28:51.119 --> 00:28:51.839 Just blame Kevin. 00:28:52.240 --> 00:28:53.920 No, it makes sense to me. 00:28:54.160 --> 00:28:55.440 So two things here. 00:28:55.759 --> 00:28:59.680 One to what James had said about getting rid of the data. 00:28:59.839 --> 00:29:02.720 When you don't need it, get rid of it, can't be used against you. 00:29:02.960 --> 00:29:05.039 That is something I just think is so true. 00:29:05.119 --> 00:29:07.039 I mean, think about murders, right? 00:29:07.119 --> 00:29:09.680 Like obviously let's tie it to that naturally. 00:29:10.000 --> 00:29:14.240 But without the gun, without the murder ref weapon, they can't tie it. 00:29:14.400 --> 00:29:15.519 Same thing with data. 00:29:15.759 --> 00:29:19.920 Data is what is gonna get you in trouble unless it is on your side. 00:29:20.079 --> 00:29:24.640 But I think that is so important of sometimes you just get rid of it. 00:29:24.720 --> 00:29:25.839 You don't need this. 00:29:26.000 --> 00:29:27.200 Why are you doing that? 00:29:27.359 --> 00:29:32.960 And then Eva, you literally took my question that I was gonna ask you and you started to answer it. 00:29:33.119 --> 00:29:40.319 So I was gonna talk about how you mentioned earlier that you were skeptical and asked, you know, what is something that you would do different? 00:29:40.559 --> 00:29:43.839 Because, you know, you're you're something that you would assume that the rest of us wouldn't be doing. 00:29:43.920 --> 00:29:46.480 And you kind of started to answer that with like freezing your credit. 00:29:46.640 --> 00:29:52.079 That is not something that I think a person would think, oh, I can just freeze my credit. 00:29:52.319 --> 00:29:57.519 So can you, and you were you were literally saying this, and so I want to expand on that more. 00:29:57.680 --> 00:30:05.920 If I am just a normal person and I'm I got one of those letters in the mail that was like, you've been breached, but don't worry, we have it under control. 00:30:06.079 --> 00:30:09.519 And I think, okay, well, I have a a year of it's under control. 00:30:10.000 --> 00:30:11.279 Well, okay, is it? 00:30:11.440 --> 00:30:13.119 And after that period, what happens? 00:30:13.279 --> 00:30:17.039 So I call you, I say, Eva, well, what does this mean? 00:30:17.279 --> 00:30:19.279 Would you be like, quick, freeze your credit? 00:30:19.440 --> 00:30:20.880 Like, what would your response be? 00:30:21.039 --> 00:30:22.000 How would you handle that? 00:30:22.480 --> 00:30:27.599 Well, I'm I'm actually gonna back up one step before you get the data breach notification. 00:30:27.759 --> 00:30:30.960 And because that's incoming communication, right? 00:30:31.200 --> 00:30:40.319 And with the state of how things are now, I really want people to think differently when they receive communication that they didn't initiate. 00:30:40.880 --> 00:30:55.119 If you didn't initiate the contact, whether it's an email, a phone call, even a physical letter in the mail, a text message, a DM on social media, if you didn't initiate it, go to the source and verify. 00:30:55.599 --> 00:31:02.400 We cannot just assume on the face of it that that communication is legitimate from the party that it says it's from. 00:31:02.720 --> 00:31:04.480 We just can't anymore. 00:31:04.799 --> 00:31:11.359 So that first layer of skepticism I I do think is is very, very important. 00:31:11.920 --> 00:31:17.680 Now, when it comes to a data breach notification, and it doesn't always come in the form of physical letter, it can come by email.

00:31:17.839 --> 00:31:21.839 Sometimes it's just a blast on the media, it's on the company's website. 00:31:22.240 --> 00:31:31.039 I'll let James dig into the details on the rest of the breach part, but the first thing I want people to realize is that they're not created the same. 00:31:31.359 --> 00:31:38.640 So I can't say if you receive a breach notification letter, your first step is X because the data is different. 00:31:39.119 --> 00:31:50.000 You need to understand specifically what data are we talking about in this notification because that is what informs my first step. 00:31:50.319 --> 00:31:55.279 If my social security number was compromised and you haven't already done it, yes, I want you to freeze your credit. 00:31:55.359 --> 00:31:56.079 That's the first thing. 00:31:56.400 --> 00:32:02.720 If it was a username and password, then I want your first step to be to change that password immediately. 00:32:03.119 --> 00:32:07.759 Now, there's a lot more detail in that, so I will give James a a chance to talk on that. 00:32:07.920 --> 00:32:19.759 But I I would be remiss if I didn't say the easiest thing for people to do when they get a data breach notification letter and they're confused about what is my first step, where do I turn, is to please contact the ITRC. 00:32:19.920 --> 00:32:24.400 Call us on the toll-free number, live chat with us, and we will walk you through that. 00:32:24.720 --> 00:32:30.559 We will walk you through the process of understanding, hey, where is my risk actually, and what are my next steps? 00:32:30.720 --> 00:32:34.799 And that's something we do frequently and and it's of course at no cost. 00:32:35.279 --> 00:32:38.480 I guess the other thing I would add is don't wait for the data breach letter. 00:32:38.799 --> 00:32:40.079 Go ahead and freeze your credit. 00:32:40.240 --> 00:32:40.480 Yes. 00:32:40.799 --> 00:32:45.279 Because you know, that credit monitoring you're going to get for free is great. 00:32:45.440 --> 00:32:48.000 It tells you what happened, it stops nothing. 00:32:48.319 --> 00:32:50.480 Credit freeze stops something. 00:32:50.720 --> 00:32:52.640 And shameless plug. 00:32:53.039 --> 00:32:58.240 We have a website dedicated just to not only credit freezes, but freezing other things. 00:32:58.400 --> 00:33:05.519 Freezing the ability of somebody to open up a bank account in your name, freezing the ability of somebody to open up certain utilities in your name. 00:33:05.680 --> 00:33:08.319 There is a whole host of freezes beyond credit. 00:33:08.480 --> 00:33:15.599 And we have a website, frozenpie.com, frozenpi.com, tells you all about it, helps you do it. 00:33:15.839 --> 00:33:16.720 That's hilarious. 00:33:17.200 --> 00:33:19.039 I'm sorry, can we take a minute, Jake? 00:33:19.680 --> 00:33:20.480 Frozen pie. 00:33:20.960 --> 00:33:23.599 I'm hungry and sold and love the spelling. 00:33:23.759 --> 00:33:29.519 And if you're listening right now and you haven't, go back to our mail out and you will see the link in our mail out. 00:33:29.920 --> 00:33:35.839 So check it out so that we can freeze everything except our eggs, unless you want that through this site. 00:33:36.400 --> 00:33:38.319 I'm I'm walking right by that one too. 00:33:38.640 --> 00:33:40.559 No matter how hard I want to say something. 00:33:40.799 --> 00:33:43.440 So that you know, freeze your credit ahead of time. 00:33:43.519 --> 00:33:44.160 Don't wait for it. 00:33:44.319 --> 00:34:01.920 The other thing is, and we this is this goes to there is a technology tool that can completely eliminate an entire class of attacks, an entire class of data breaches, if we get to the point of mass adoption, and that is passkeep as the replacement to for passwords. 00:34:02.160 --> 00:34:09.440 The biggest data breaches over the last couple of years have all been because of legitimate logins and passwords used at organizations. 00:34:09.599 --> 00:34:19.679 If you didn't have a password to steal, and or you didn't have a password that you use on every single account you have, like what most people do, because we have too many passwords. 00:34:19.840 --> 00:34:23.039 If you could eliminate that password entirely, would you do it? 00:34:23.199 --> 00:34:24.880 Well, that's what pass key is. 00:34:25.039 --> 00:34:30.639 You don't have to remember anything, and it's not stored at the organization where you have the account. 00:34:30.719 --> 00:34:33.599 So if they have a data breach, it can't be stolen. 00:34:33.840 --> 00:34:44.800 But we don't, we'd haven't reached that mass adoption level yet because businesses have to offer it first, and then we, as the people who have accounts there, have to accept it. 00:34:45.039 --> 00:34:52.800 And we haven't really done as good a job as we should be doing on getting people to understand how easy it is and how secure it is. 00:34:53.039 --> 00:34:56.559 And it's like every other security tool, nothing is 100%. 00:34:56.960 --> 00:35:02.880 Of course, there's going to be a very persistent, very dedicated, very evil individual. 00:35:03.039 --> 00:35:11.599 They will find a way around a few of them, but for the most part, this is technology that is rock solid based on encryption, and it's easy. 00:35:11.760 --> 00:35:22.639 If you have a smart device, you have a laptop with a fingerprint reader, you have a desktop keyboard with a fingerprint reader, you have a pen code, you have a tablet with a fingerprint, a camera to read your face. 00:35:22.800 --> 00:35:24.159 That's how you log in. 00:35:24.320 --> 00:35:25.679 And that's all you need again. 00:35:25.840 --> 00:35:31.039 Never remember anything else, can't be stolen, you cannot self-compromise because you know what? 00:35:31.119 --> 00:35:32.559 You'll never see the code. 00:35:32.800 --> 00:35:37.199 So you can't accidentally give it away if somebody's trying to trick you into it. 00:35:37.440 --> 00:35:42.320 So pass keys can eliminate an entire class of attacks. 00:35:42.639

--> 00:35:47.360 So that's one of those things that we can do as individuals and as businesses. 00:35:47.519 --> 00:35:53.760 Businesses offer it, individuals use it, and that makes both sides more secure. 00:35:54.159 --> 00:35:54.719 I like it. 00:35:54.800 --> 00:35:55.760 This has been really interesting. 00:35:56.000 --> 00:36:00.079 As a last question, what do you think identity theft will look like five years from now? 00:36:00.159 --> 00:36:01.679 And do you think we're prepared for it? 00:36:02.239 --> 00:36:09.679 Yeah, that's a tough one because I I don't think I could have predicted the scale and the severity with AI. 00:36:10.320 --> 00:36:23.840 I I mean, I'm hopeful that it looks better and we've got some better processes in place, but I don't think I could posit what is it actually going to look like because I'm always just stunned by the bad guys. 00:36:24.159 --> 00:36:25.679 Do I think we'll have it resolved? 00:36:25.920 --> 00:36:26.480 No, I don't. 00:36:26.800 --> 00:36:28.960 I honestly don't in in five years. 00:36:29.119 --> 00:36:36.239 We've really got to catch up and we have to have a societal shift that maybe we can make some ground in five years. 00:36:36.800 --> 00:36:42.719 We have got to be willing to forego some convenience for the introduction of more friction. 00:36:43.039 --> 00:36:50.639 We really have to stop losing our minds at nine seconds of inconvenience when we have to prove we are who we say we are. 00:36:50.960 --> 00:37:02.880 And that's going to require a change like in our just our nature, our social contract, and we've got to work a little bit more on the behavior piece before we can start tackling the the technology piece, in my opinion. 00:37:03.440 --> 00:37:06.880 Technology is agnostic, users are not. 00:37:07.519 --> 00:37:15.840 So it's going to look different than what it is today, both the technology and the good things and the bad things from it. 00:37:16.159 --> 00:37:20.559 What that's going to look like, anybody's guess, because it's going to move so fast. 00:37:21.440 --> 00:37:24.960 Five years from now is a lifetime. 00:37:25.519 --> 00:37:31.599 But there will be things that are better and there will be things that are worse, and there will be things that are just the same. 00:37:31.840 --> 00:37:34.559 The key is riveting there, James. 00:37:37.519 --> 00:37:38.800 I step out on a limb. 00:37:38.960 --> 00:37:39.679 Let me tell you. 00:37:39.840 --> 00:37:41.920 I I I really I really go out there on a limb. 00:37:42.159 --> 00:37:44.800 There will be black, white, and gray options. 00:37:45.039 --> 00:37:46.239 That's exactly right. 00:37:46.480 --> 00:37:58.800 Um, but here's the part that's different, though, and that is what we do now is what's going to determine is it more black, is it more white, is it more gray? 00:37:58.960 --> 00:38:10.079 We've got the chance in these early days still of AI and whatever technology is coming behind that to put things in place to help everybody, but we gotta want to do it. 00:38:10.480 --> 00:38:12.800 And right now, that's the biggest question. 00:38:13.039 --> 00:38:14.639 Do we have the will to do it? 00:38:15.280 --> 00:38:15.679 Don't know. 00:38:17.440 --> 00:38:17.920 Yeah. 00:38:18.159 --> 00:38:20.159 Well, if you're listening, what do you think? 00:38:20.320 --> 00:38:20.800 Let us know. 00:38:21.039 --> 00:38:22.400 Edge of our seats. 00:38:22.639 --> 00:38:25.360 We might actually know, but we won't tell you on this episode. 00:38:25.440 --> 00:38:28.559 We'll have to bring James and Riva back and and see. 00:38:28.960 --> 00:38:29.440 Yeah. 00:38:29.920 --> 00:38:31.519 In five years, we'll come back. 00:38:31.760 --> 00:38:32.000 Yeah. 00:38:32.880 --> 00:38:33.599 That'll be fun. 00:38:33.679 --> 00:38:34.719 I'll mark the calendar. 00:38:34.880 --> 00:38:37.039 Thank you all so much for being on this episode. 00:38:37.199 --> 00:38:37.920 Very informative. 00:38:38.000 --> 00:38:42.559 And again, to everyone listening, if you didn't see it in the mail out, go back and check it out. 00:38:42.719 --> 00:38:45.119 Click on the link and you know, get some pie. 00:38:54.960 --> 00:39:01.679 So, Kevin, we just spoke with James and Eva, who are both at the Identity Theft Resource Center. 00:39:01.920 --> 00:39:04.800 We've got on, you know, a CEO and president. 00:39:05.039 --> 00:39:08.320 So we're talking to the real, the real people at this. 00:39:08.480 --> 00:39:13.360 And, you know, we love a nonprofit and we hate a nonprofit in a real way. 00:39:13.679 --> 00:39:19.280 Because if you're a good nonprofit, Kevin and I, if you're listening, are just huge fans. 00:39:19.440 --> 00:39:22.800 When I say we don't, we don't like ones that take advantage. 00:39:22.960 --> 00:39:25.760 And we've experienced that before, so that's why we say it. 00:39:25.920 --> 00:39:28.559 And this is one that is a good nonprofit. 00:39:28.960 --> 00:39:29.840 Let me start with that. 00:39:30.000 --> 00:39:41.119 But it's one you should be paying attention to because if you're an everyday person, if you're a company, if you're looking into cyber, and if if you're not, I should say you should be, and you should be opening up to that. 00:39:41.360 --> 00:39:48.639 Knowing where you can get resources and knowing where to go is really hard, especially if you're Googling cybersecurity, right? 00:39:48.719 --> 00:39:49.920 It's such a hot topic. 00:39:50.000 --> 00:39:58.639 You're gonna get Alo Alto, CrowdStrike, all of these like companies are gonna come up and you don't know who is for you, what makes sense, is this a tool, is this gonna protect me? 00:39:58.800 --> 00:39:59.519 What is this? 00:39:59.679 --> 00:40:03.440 And Kevin and I look into all of these companies all of the time. 00:40:03.679 --> 00:40:12.480 And this is something that we're gonna stand by and say the ITRC, I love an acronym, is one that you should look at. 00:40:12.639 --> 00:40:16.079 You should check out, and we feel it's one that we can trust. 00:40:16.159 --> 00:40:19.280 So we want to give that to you all as a non-biased company. 00:40:19.360 --> 00:40:23.920 We are not sponsored, but it's a strong opinion that I have, and I think that they're they're great. 00:40:24.000 --> 00:40:30.559 And I think you have to look at technology, but you also have to look at the people behind it and who's doing what. 00:40:30.719 --> 00:40:34.159 So I I loved this episode, but but Kevin, what were your tech takeaways? 00:40:34.480 --> 00:40:35.119 Yeah, I agree. 00:40:35.199 --> 00:40:39.840 I mean, again, for me, the conversation today was really more about like how much the landscape has changed, right? 00:40:40.000 --> 00:40:44.480 This like the scams have gotten so sophisticated and AI is just making them impossible to spot. 00:40:44.639 --> 00:40:48.480 And honestly, I like the piece where they were talking about how much of our data is just out there. 00:40:48.639 --> 00:40:51.840 Challenge isn't really just protecting ourselves, it's like just being prepared. 00:40:51.920 --> 00:40:55.199 And so I like the practical advice, it's things you don't necessarily think about. 00:40:55.360 --> 00:40:57.679 And so agree, I thought this was a really great episode. 00:40:57.760 --> 00:40:59.119 I'm really glad we had them on. 00:40:59.519 --> 00:41:10.400 If you have any questions for us around cybersecurity, around freezing your credit, around freezing your eggs, or around anything that you just kind of want to talk to us about, even if we can't answer, we'd love to hear from you. 00:41:10.480 --> 00:41:24.400 So feel free to reach out to us at contact at thattechpod.com, head on over to our website, www.thattechpod.com, enter your email to subscribe, get some gear, do some cool things, just scroll around for a while. 00:41:24.639 --> 00:41:27.360 Also, we'd love to be friends with you on social media. 00:41:27.519 --> 00:41:31.360 Head over to LinkedIn.com slash that tech pod, give us a follow. 00:41:31.519 --> 00:41:33.519 Anywhere else we might be on social media. 00:41:33.599 --> 00:41:34.400 I really don't know. 00:41:34.559 --> 00:41:36.239 I am not good at that. 00:41:36.480 --> 00:41:38.719 Kevin, is there anything else our listeners can do? 00:41:39.039 --> 00:41:46.320 Yep, go to review your pod, Apple Podcasts, Spotify, iHeartMedia, or what have you, and leave us a review, leave us a rating, let us know how we are doing. 00:41:46.480 --> 00:41:50.880 All that stuff helps us with the algorithms and gets us out there more, which is much appreciated. 00:41:51.039 --> 00:41:52.079 Thanks everybody. 00:41:52.320 --> 00:41:53.599 Thanks everyone.