Full Transcript for 181: Ricky

things 00:01:37.247 --> 00:01:38.538 very often and doesn't know how to 00:01:38.545 --> 00:01:40.170 handle money very well or deals. 00:01:40.832 --> 00:01:42.091 The dad wrote in the post that he 00:01:42.091 --> 00:01:43.502 was starting to feel worried because 00:01:43.759 --> 00:01:44.921 people were saying some real mean 00:01:44.927 --> 00:01:47.527 things about his son, but nobody 00:01:47.527 --> 00:01:50.043 was saying what I was thinking. 00:01:50.433 --> 00:01:52.314 I feel like I know exactly what happened 00:01:52.314 --> 00:01:53.696 here, because I was in the exact 00:01:53.698 --> 00:01:55.679 same situation when I was a teenager. 00:01:55.839 --> 00:01:56.916 If you would have talked to my 00:01:56.917 --> 00:01:58.336 mom then, she would have been 00:01:58.359 --> 00:01:59.666 just like this worried dad. 00:01:59.667 --> 00:02:00.729 She would have told you that I’m 00:02:00.729 --> 00:02:02.261 the worst shopper in the world. 00:02:03.195 --> 00:02:06.066 Because I’m almost certain that what 00:02:06.079 --> 00:02:08.572 happened is he ate a full tub of 00:02:08.572 --> 00:02:10.412 ice cream on his way home and then 00:02:10.413 --> 00:02:12.531 lied and said he only bought one. 00:02:12.950 --> 00:02:13.906 I mean, it all adds up. 00:02:13.918 --> 00:02:15.345 The boy was hungry for ice cream 00:02:15.345 --> 00:02:16.719 before even leaving the house. 00:02:16.933 --> 00:02:18.405 There’s no way he’s gonna wait until 00:02:18.405 --> 00:02:19.993 he gets home to have his first bite. 00:02:20.459 --> 00:02:21.851 Grab a spoon at the store 00:02:21.851 --> 00:02:23.233 and start on your way home. 00:02:23.792 --> 00:02:26.102 Also imagine the look on his face 00:02:26.424 --> 00:02:28.167 when the clerk told him, you know you 00:02:28.167 --> 00:02:29.847 can get a second one for free, right? 00:02:30.268 --> 00:02:31.391 No way. 00:02:31.553 --> 00:02:33.253 Dang, this is my lucky day. 00:02:33.884 --> 00:02:36.089 So, he must have gotten two, and on his 00:02:36.089 --> 00:02:37.919 way home he started thinking, shoot, 00:02:37.962 --> 00:02:40.675 mom and dad don't know I got two. 00:02:40.677 --> 00:02:42.370 They only gave me enough money to get one. 00:02:42.761 --> 00:02:44.651 So, if I come back with one, they 00:02:44.652 --> 00:02:46.351 won't even know there was a second. 00:02:46.806 --> 00:02:47.905 So, if I could scarf this 00:02:47.911 --> 00:02:49.387 second tub down before I even 00:02:49.387 --> 00:02:51.909 get home, it would be glorious. 00:02:52.111 --> 00:02:53.024 No rules. 00:02:53.024 --> 00:02:54.058 No regulations. 00:02:54.071 --> 00:02:55.001 No speed bumps. 00:02:55.001 --> 00:02:56.365 Just eat a whole tub of 00:02:56.367 --> 00:02:57.996 ice cream as fast as I can. 00:02:58.383 --> 00:02:59.749 Challenge accepted. 00:03:00.570 --> 00:03:02.799 I’ll tell you, teenage boys can crush 00:03:02.799 --> 00:03:05.034 a whole tub of ice cream real easy. 00:03:05.317 --> 00:03:06.219 They can make a dozen 00:03:06.220 --> 00:03:07.519 cookies vanish instantly. 00:03:07.520 --> 00:03:08.731 They have the power to inhale 00:03:08.732 --> 00:03:10.408 desserts like no one else can. 00:03:11.028 --> 00:03:12.919 The real tell here is that the dad on 00:03:12.919 --> 00:03:15.030 the Reddit post even said, we would never 00:03:15.030 --> 00:03:16.774 let him eat a whole tub in one sitting. 00:03:17.457 --> 00:03:19.770 That’s the thing; the boy had an 00:03:19.809 --> 00:03:22.302 unregulated container of ice cream, 00:03:22.854 --> 00:03:24.930 and he thought no one is gonna know. 00:03:25.201 --> 00:03:26.725 No one is gonna stop him from 00:03:26.729 --> 00:03:28.457 eating all this in one sitting. 00:03:29.053 --> 00:03:29.955 Let’s do it. 00:03:30.575 --> 00:03:32.839 So, he saw this as his big stroke of luck 00:03:32.840 --> 00:03:35.156 and secretly slurped it down, and then 00:03:35.308 --> 00:03:37.096 tried to lie about it when he got home by 00:03:37.097 --> 00:03:39.335 saying, no, no, I only got one, I swear. 00:03:40.288 --> 00:03:41.861 But little did he know the entirety 00:03:41.863 --> 00:03:43.660 of Reddit was gonna believe that lie. 00:03:44.303 --> 00:03:45.426 He’s probably okay with them 00:03:45.476 --> 00:03:46.982 calling him names and stuff, because 00:03:47.287 --> 00:03:50.091 being misunderstood isn't as bad 00:03:50.132 --> 00:03:52.152 as being caught in your lies. 00:03:52.430 --> 00:03:54.513 But I see you, kid. 00:03:54.865 --> 00:03:56.601 I’ve been in that same situation before. 00:03:56.609 --> 00:03:59.681 I’ve been in that situation many times. 00:03:59.930 --> 00:04:01.590 Two cupcakes I bought at 00:04:01.590 --> 00:04:03.829 the bake sale became one. 00:04:04.094 --> 00:04:05.415 Two chocolate bars from 00:04:05.416 --> 00:04:07.500 the fundraiser became one. 00:04:07.941 --> 00:04:09.690 Yeah, of course two ice creams from 00:04:09.691 --> 00:04:11.964 the ice cream truck became one, too. 00:04:12.575 --> 00:04:15.674 My mom could never understand why I would 00:04:15.676 --> 00:04:18.817 sometimes pay extra for a single cupcake. 00:04:18.978 --> 00:04:23.647 Intro: [Intro music] These 00:04:23.648 --> 00:04:24.794 are true stories from the 00:04:24.795 --> 00:04:26.314 dark side of the internet. 00:04:30.081 --> 00:04:31.538 I’m Jack Rhysider. 00:04:32.661 --> 00:04:34.403 This is Darknet Diaries. 00:04:34.403 --> 00:04:34.423 JACK: Imagine going 00:04:51.386 --> 00:04:53.771 to a high school baseball game in New 00:04:54.101 --> 00:04:54.405 Port Richey, which is near Tampa, Florida. 00:04:54.405 --> 00:04:54.444 You see one kid, 00:04:57.284 --> 00:04:58.486 a center-fielder, who’s absolutely 00:04:58.486 --> 00:05:02.024 tearing it up out there. 00:05:02.040 --> 00:05:04.264 He’s catching anything that comes his way. 00:05:04.264 --> 00:05:05.288 He’s got an arm like a rocket. 00:05:05.376 --> 00:05:07.361 He could hit anything thrown at him. 00:05:07.361 --> 00:05:08.899 He’s built like a tank but

runs like the 00:05:08.899 --> 00:05:10.834 wind, and it just looks like he’s in a 00:05:10.854 --> 00:05:12.358 different league than the rest of those 00:05:12.360 --> 00:05:13.968 high school players on the baseball field. 00:05:14.176 --> 00:05:15.551 He’s eating them up. 00:05:15.786 --> 00:05:16.843 It’s like all the other kids 00:05:16.843 --> 00:05:18.100 are in a lower league than him, 00:05:18.424 --> 00:05:19.439 and they're just all playing 00:05:19.439 --> 00:05:20.871 in slow motion compared to him. 00:05:21.363 --> 00:05:24.186 You can tell this kid is the star. 00:05:24.832 --> 00:05:27.340 That is Ricky Handschumacher. 00:05:27.371 --> 00:05:28.596 RICKY: So, I played center field, 00:05:28.609 --> 00:05:31.299 but initially I was really known 00:05:31.301 --> 00:05:33.176 for getting on base, getting 00:05:33.179 --> 00:05:35.328 hits, and then stealing bases. 00:05:36.212 --> 00:05:37.515 JACK: Stealing bases. 00:05:38.015 --> 00:05:38.174 RICKY: Yeah. 00:05:38.174 --> 00:05:39.472 JACK: Is this where all this starts? 00:05:39.722 --> 00:05:40.352 This is where all of it 00:05:40.354 --> 00:05:41.984 starts, stealing bases. 00:05:42.426 --> 00:05:43.679 RICKY: Coincidentally, yeah. 00:05:44.061 --> 00:05:45.044 JACK: But were computers 00:05:45.044 --> 00:05:46.513 interesting to you or not at all? 00:05:47.117 --> 00:05:48.609 RICKY: No, I was your gamer, you know? 00:05:48.609 --> 00:05:51.982 Like I said, I wasn't your average nerdy 00:05:52.010 --> 00:05:54.180 kinda guy who’s antisocial or anything. 00:05:54.644 --> 00:05:55.926 I was always out with my friends. 00:05:55.926 --> 00:05:57.433 I was always out on the streets playing 00:05:57.433 --> 00:05:59.400 sports; you know, football, baseball, 00:05:59.413 --> 00:06:01.524 basketball with all my friends. 00:06:01.793 --> 00:06:03.090 Like, Friday night and Saturday 00:06:03.090 --> 00:06:04.632 night I would go roller skating. 00:06:04.899 --> 00:06:07.104 So, I was never like, home, but I 00:06:07.104 --> 00:06:09.500 did have a passion for actual gaming. 00:06:10.170 --> 00:06:10.490 JACK: Alright. 00:06:10.508 --> 00:06:11.656 So, let’s talk about gaming. 00:06:12.096 --> 00:06:13.223 What was your game of choice? 00:06:13.953 --> 00:06:16.990 RICKY: Halo 3 was my primary game. 00:06:21.671 --> 00:06:22.339 JACK: [Halo sound effects] In 00:06:22.339 --> 00:06:24.396 2010, fifteen-year-old Ricky 00:06:24.529 --> 00:06:26.485 is up late on a school night. 00:06:26.762 --> 00:06:29.139 His headphones are tuned in as he plays 00:06:29.147 --> 00:06:32.022 Halo 3 on his Xbox that’s humming away. 00:06:32.580 --> 00:06:33.818 Ricky doesn't want to disturb his 00:06:33.818 --> 00:06:35.337 mom, who’s sleeping in the other room. 00:06:35.834 --> 00:06:37.790 On his glowing TV screen he’s trying 00:06:37.791 --> 00:06:40.023 to escape what looks like a war zone. 00:06:43.024 --> 00:06:44.406 He’s destroying all the 00:06:44.406 --> 00:06:45.647 other players in the game. 00:06:45.894 --> 00:06:46.467 RICKY: I was good. 00:06:46.711 --> 00:06:49.500 So, I was always playing MLG and Team 00:06:49.502 --> 00:06:51.184 Slayer and all the ranked playlists 00:06:51.362 --> 00:06:52.818 against the pros and everything like that. 00:06:53.255 --> 00:06:55.514 Then, of course, naturally once you 00:06:55.514 --> 00:06:56.718 get to that level, there’s people 00:06:56.718 --> 00:06:57.898 who cheat on there and stuff. 00:06:58.402 --> 00:07:00.188 I was a high rank, but cheaters 00:07:00.194 --> 00:07:01.533 get high ranks, too, naturally 00:07:01.533 --> 00:07:02.378 because they're just cheating. 00:07:02.723 --> 00:07:04.300 So, it kept happening to me. 00:07:04.724 --> 00:07:06.328 JACK: People would go up against 00:07:06.328 --> 00:07:08.034 Ricky and see that they can't beat 00:07:08.034 --> 00:07:11.498 him, so they decided to cheat to win. 00:07:11.837 --> 00:07:12.753 He didn't know what 00:07:12.753 --> 00:07:13.811 was happening at first. 00:07:13.811 --> 00:07:16.756 RICKY: [Music] My screen would just 00:07:16.758 --> 00:07:19.308 go blank and then they would stop 00:07:19.310 --> 00:07:20.782 the attack when the game was over, 00:07:20.784 --> 00:07:22.868 which means they’d just win by default 00:07:22.875 --> 00:07:24.320 pretty much, 'cause we can't even move. 00:07:24.587 --> 00:07:25.472 Or if they hit you hard 00:07:25.472 --> 00:07:27.152 enough, we actually — our whole 00:07:27.152 --> 00:07:28.046 internet would just go out. 00:07:28.318 --> 00:07:29.216 I was with my mom. 00:07:29.219 --> 00:07:30.634 She’s like, why is the internet out? 00:07:31.159 --> 00:07:32.042 So, I had to play stupid. 00:07:32.044 --> 00:07:32.972 Like, I have no idea. 00:07:33.501 --> 00:07:34.423 I don't know what's happening. 00:07:34.803 --> 00:07:36.355 JACK: I’ve been in a similar situation. 00:07:36.367 --> 00:07:38.528 I remember the days when we had a family 00:07:38.529 --> 00:07:40.480 computer, and I downloaded a lot of 00:07:40.480 --> 00:07:42.088 random stuff and installed it on there. 00:07:42.745 --> 00:07:43.756 Time and time again I 00:07:43.757 --> 00:07:44.829 would break our computer. 00:07:45.257 --> 00:07:46.551 I didn't want to get in trouble, 00:07:46.553 --> 00:07:47.814 so I would try real hard to 00:07:47.814 --> 00:07:49.474 fix it before anyone noticed. 00:07:49.837 --> 00:07:51.197 Because of that, I got really good 00:07:51.197 --> 00:07:53.196 at detecting viruses and malware 00:07:53.196 --> 00:07:54.888 and fixing it on the family PC. 00:07:55.385 --> 00:07:57.287 But for Ricky, he was on an Xbox, and 00:07:57.287 --> 00:07:59.247 when he’d play, the internet would go 00:07:59.248 --> 00:08:00.979 down in the whole house, and it was 00:08:00.980 --> 00:08:02.311 just him and his mom living there. 00:08:02.473 --> 00:08:04.284 His dad left the picture a long time ago. 00:08:04.662 --> 00:08:05.933 But strangely, this 00:08:05.950 --> 00:08:07.384 pattern kept happening. 00:08:07.427 -->

00:08:09.902 When he would play Halo 3 against other 00:08:09.902 --> 00:08:12.574 players, the internet would go out. 00:08:12.936 --> 00:08:15.176 The game would disconnect, and then 00:08:15.178 --> 00:08:16.638 when he would finally get back on, 00:08:16.904 --> 00:08:18.784 he would see that he lost the match. 00:08:19.027 --> 00:08:20.030 RICKY: It happened to me again 00:08:20.030 --> 00:08:20.996 and again, and I’m like, alright. 00:08:21.670 --> 00:08:23.734 Then through the — through word 00:08:23.736 --> 00:08:25.140 of mouth I was like, oh, if 00:08:25.140 --> 00:08:26.748 they're DDoSing us, like, okay. 00:08:27.058 --> 00:08:28.236 So, I’m like, what the hell is that? 00:08:28.478 --> 00:08:29.647 I was getting DDoSed attacked 00:08:29.849 --> 00:08:30.756 over and over and over. 00:08:31.108 --> 00:08:32.536 JACK: Alright, so they somehow 00:08:32.538 --> 00:08:33.913 discovered your IP and then they 00:08:33.913 --> 00:08:36.126 attacked your IP, and that was enough 00:08:36.137 --> 00:08:38.111 to knock you offline and lose the game. 00:08:39.158 --> 00:08:39.731 RICKY: Yeah, and that’s 00:08:39.732 --> 00:08:40.900 kinda where it all started. 00:08:40.900 --> 00:08:43.669 Then curiosity — I was like, 00:08:44.000 --> 00:08:45.140 okay, how are they doing this? 00:08:45.473 --> 00:08:46.723 JACK: Remember, outside of gaming 00:08:46.754 --> 00:08:48.384 Ricky is not a computer guy. 00:08:48.682 --> 00:08:50.425 He doesn't know what's going on at all. 00:08:50.439 --> 00:08:52.053 So, he just turns his Xbox off 00:08:52.321 --> 00:08:54.235 and jumps on the family PC and 00:08:54.290 --> 00:08:55.887 starts trying to look for answers. 00:08:56.341 --> 00:08:57.117 RICKY: I started browsing some 00:08:57.117 --> 00:08:58.675 forums, and I was like, okay, 00:08:58.675 --> 00:08:59.790 it’s called DDoSing attacks. 00:08:59.790 --> 00:09:00.778 So, I started looking that up. 00:09:00.803 --> 00:09:02.838 I’m like, hm, okay, seems pretty simple. 00:09:03.444 --> 00:09:04.215 There’s a bunch of different 00:09:04.215 --> 00:09:05.764 kind of booters, like an IRC 00:09:05.765 --> 00:09:07.377 booter or a putty booter. 00:09:07.678 --> 00:09:08.607 You could just — or you could just 00:09:08.607 --> 00:09:10.790 go online to a website and use that 00:09:10.790 --> 00:09:12.987 booter, which was less powerful, 00:09:13.390 --> 00:09:15.357 but it would get the job done. 00:09:15.449 --> 00:09:16.712 I browsed the forums, found out what 00:09:16.713 --> 00:09:18.895 it was, downloaded the programs myself. 00:09:18.895 --> 00:09:19.875 So, I was like, okay, well, if they do 00:09:19.875 --> 00:09:21.060 it to me, I’m gonna do it back to them. 00:09:21.443 --> 00:09:22.630 JACK: Eventually he gets 00:09:22.632 --> 00:09:23.461 to the bottom of it. 00:09:23.619 --> 00:09:26.840 He discovers a whole world of ddossers 00:09:26.851 --> 00:09:29.312 and booters and punters and griefers who 00:09:29.313 --> 00:09:31.801 use malware to attack other

players in 00:09:31.801 --> 00:09:35.089 the game to make them lose so you can win. 00:09:35.920 --> 00:09:37.367 Ricky decided, well, 00:09:37.378 --> 00:09:39.293 hey, I want to win, too. 00:09:39.598 --> 00:09:40.503 I want to try. 00:09:40.512 --> 00:09:42.512 [Music] So, he downloads a tool. 00:09:42.752 --> 00:09:44.659 He says it was Cain & Abel, and decides 00:09:44.659 --> 00:09:46.529 to try to use it to attack other players. 00:09:46.801 --> 00:09:48.947 He started a match, ran the tool to 00:09:48.971 --> 00:09:51.672 disconnect another player, then bingo; 00:09:51.749 --> 00:09:54.206 he sees they just freeze in the game 00:09:54.540 --> 00:09:56.425 and he can easily kill them, and he 00:09:56.427 --> 00:09:59.244 wins the match with almost zero effort. 00:09:59.686 --> 00:10:01.341 This was way easier than 00:10:01.350 --> 00:10:02.624 actually playing by the rules. 00:10:02.772 --> 00:10:03.573 RICKY: That’s kinda where I 00:10:03.710 --> 00:10:04.999 got introduced to that world. 00:10:05.045 --> 00:10:06.279 JACK: Yeah, so, at that point you 00:10:06.280 --> 00:10:08.614 were really competitive in baseball, 00:10:08.627 --> 00:10:10.325 you were really competitive at Halo. 00:10:10.677 --> 00:10:12.104 I just wonder, 'cause you had a sense 00:10:12.105 --> 00:10:14.139 of pride, of ranking up on your own and 00:10:14.366 --> 00:10:16.114 being competitive in sports — and where’d 00:10:16.125 --> 00:10:17.749 that sense of pride go with cheating? 00:10:18.796 --> 00:10:19.194 RICKY: I don't know. 00:10:19.194 --> 00:10:20.510 I just let it take over, pretty much. 00:10:20.511 --> 00:10:21.374 I was like, well, this is 00:10:21.375 --> 00:10:22.683 easier than actually trying. 00:10:23.224 --> 00:10:24.770 JACK: Yeah, but that’s 00:10:24.781 --> 00:10:26.785 not the sportsmanlike way. 00:10:26.840 --> 00:10:27.237 RICKY: Yeah. 00:10:28.774 --> 00:10:29.222 I don't know. 00:10:29.595 --> 00:10:30.642 I just took the easy way 00:10:30.642 --> 00:10:31.638 out and got the advantage. 00:10:31.638 --> 00:10:32.333 JACK: Were you cheating in sports at all? 00:10:34.419 --> 00:10:35.951 RICKY: No, that I was not cheating in. 00:10:37.553 --> 00:10:39.008 JACK: Alright. 00:10:39.008 --> 00:10:40.455 RICKY: No, I was naturally good. 00:10:41.430 --> 00:10:41.907 JACK: Yeah, well, you were 00:10:41.907 --> 00:10:42.998 naturally good at Halo, too. 00:10:43.016 --> 00:10:44.877 You were in MLG and all that stuff. 00:10:45.212 --> 00:10:46.792 RICKY: Yeah, I don't know. 00:10:46.836 --> 00:10:50.196 JACK: [Music] Who would have 00:10:50.219 --> 00:10:51.891 thought that this innocent little 00:10:51.892 --> 00:10:53.895 victory in Halo was going to lead 00:10:53.895 --> 00:10:56.219 Ricky down a long, dark path? 00:10:56.569 --> 00:10:58.655 From here he tried more Halo 00:10:58.656 --> 00:11:00.318 cheats like wall glitches, fast 00:11:00.329 --> 00:11:01.992 travel, reduced hitbox, and more. 00:11:02.183 --> 00:11:02.948 It was fun. 00:11:03.019 --> 00:11:05.400 This was the new game, not to compete 00:11:05.404 --> 00:11:07.698 competitively in Halo but to get around 00:11:07.699 --> 00:11:10.002 the game rules, to do things you weren’t 00:11:10.007 --> 00:11:13.026 supposed to, to be a god in the game. 00:11:13.300 --> 00:11:14.959 It gave him a sense of power. 00:11:14.964 --> 00:11:16.365 He saw the game differently now. 00:11:16.368 --> 00:11:17.805 He stopped seeing things on the screen 00:11:17.808 --> 00:11:20.087 like Covenant and Banshees and Needlers. 00:11:20.343 --> 00:11:22.868 Now he was seeing bytes and ones and 00:11:22.868 --> 00:11:25.182 zeros and the data behind the game, 00:11:25.360 --> 00:11:28.114 which gave him an incredible win streak. 00:11:28.458 --> 00:11:30.234 You know, the type of win streaks that 00:11:30.235 --> 00:11:32.297 you just have to take a screenshot of 00:11:32.297 --> 00:11:34.086 so that you can look back at from time 00:11:34.087 --> 00:11:36.483 to time and remember those matches. 00:11:37.154 --> 00:11:39.413 But even being a god can get boring 00:11:39.416 --> 00:11:41.186 after a while, and even though he was 00:11:41.187 --> 00:11:43.056 the winner in those screenshots of his, 00:11:43.204 --> 00:11:45.507 he would notice that some people seemed 00:11:45.507 --> 00:11:47.579 to be even cooler than him somehow. 00:11:48.050 --> 00:11:50.065 Everyone looks the same in Halo 3. 00:11:50.066 --> 00:11:51.633 You're all the same player, Master Chief. 00:11:51.865 --> 00:11:52.850 It’s just, everyone has a 00:11:52.851 --> 00:11:53.833 slightly different color. 00:11:54.322 --> 00:11:56.021 But there’s one thing that sets 00:11:56.021 --> 00:11:58.113 you apart from everyone else; your 00:11:58.114 --> 00:12:00.760 name, specifically your gamer tag. 00:12:01.189 --> 00:12:02.646 These are special, actually. 00:12:02.656 --> 00:12:03.423 They're unique. 00:12:03.531 --> 00:12:04.589 There’s only one person in 00:12:04.589 --> 00:12:06.293 the world with your gamer tag. 00:12:06.791 --> 00:12:08.514 Some people call themselves cool 00:12:08.514 --> 00:12:09.786 things like Shadow Strike or 00:12:09.786 --> 00:12:11.445 Nebula Storm or Blade of Odin. 00:12:11.825 --> 00:12:13.603 Fine, but what about that 00:12:13.604 --> 00:12:16.136 guy that’s just called Wolf? 00:12:16.575 --> 00:12:18.393 How did he get that name, Wolf? 00:12:18.604 --> 00:12:20.759 Now that is fricking cool. 00:12:21.355 --> 00:12:22.464 Well, it’s a first-come, 00:12:22.470 --> 00:12:23.389 first-serve kinda thing. 00:12:23.389 --> 00:12:25.301 So, Wolf must have made that gamer tag 00:12:25.685 --> 00:12:27.905 a long time ago when Xbox Live was first 00:12:27.908 --> 00:12:30.358 created, when gamer tags first came out. 00:12:30.499 --> 00:12:31.852 They probably made the name in the 00:12:31.853 --> 00:12:33.319 first week or maybe even the first 00:12:33.333 --> 00:12:36.063 day, which makes them OG, right? 00:12:36.460 --> 00:12:37.996 But instead of

Original Gangster, 00:12:38.124 --> 00:12:39.262 they're the Original Gamer. 00:12:39.789 --> 00:12:41.032 Ricky wanted one of these 00:12:41.032 --> 00:12:43.218 short, cool gamer tags. 00:12:43.673 --> 00:12:45.700 That would really set him apart from the 00:12:45.713 --> 00:12:47.758 other normies playing in the game by the 00:12:47.758 --> 00:12:50.290 rules, but all the good names were taken. 00:12:50.904 --> 00:12:52.241 So, he goes back online into the 00:12:52.241 --> 00:12:53.569 hack forums and starts looking to 00:12:53.569 --> 00:12:55.323 see, how do you get one of these? 00:12:55.521 --> 00:12:57.026 It turns out there’s a whole 00:12:57.050 --> 00:12:58.633 underground marketplace of people 00:12:58.647 --> 00:13:01.255 buying and selling Xbox gamer tags, 00:13:01.464 --> 00:13:02.709 but not in the way you might think. 00:13:03.351 --> 00:13:05.169 See, a typical online market, you'll 00:13:05.170 --> 00:13:07.186 see people selling things that they've 00:13:07.193 --> 00:13:08.742 had for a long time or something 00:13:08.742 --> 00:13:09.837 that they've bought from someone 00:13:09.837 --> 00:13:11.238 else or something they made, right? 00:13:11.589 --> 00:13:13.371 But this was an underground 00:13:13.383 --> 00:13:14.905 hack forums marketplace. 00:13:15.010 --> 00:13:16.248 It operates differently. 00:13:16.449 --> 00:13:18.332 These gamer tags weren't ones that 00:13:18.332 --> 00:13:20.016 sellers were sitting on for a while. 00:13:20.290 --> 00:13:23.358 No, all these gamer tags were stolen. 00:13:23.983 --> 00:13:25.098 When Ricky found that 00:13:25.118 --> 00:13:27.015 out, he leaned in closer. 00:13:27.245 --> 00:13:30.015 How do you steal a gamer tag? 00:13:30.400 --> 00:13:31.867 Well, there are a few ways, but the 00:13:31.870 --> 00:13:33.183 easiest is just to get someone’s 00:13:33.200 --> 00:13:34.690 password and username and take over 00:13:34.690 --> 00:13:35.911 their account, change their password, 00:13:35.911 --> 00:13:37.998 and now that gamer tag is yours. 00:13:38.548 --> 00:13:40.863 But getting someone’s password is tricky. 00:13:41.110 --> 00:13:43.249 Maybe an easier way to get it is 00:13:43.251 --> 00:13:45.233 to trick Microsoft that you're 00:13:45.236 --> 00:13:47.042 the actual owner of the account 00:13:47.372 --> 00:13:49.165 and you just lost the password. 00:13:49.651 --> 00:13:51.343 Ricky saw some people were doing 00:13:51.343 --> 00:13:53.318 that and decided to try it himself. 00:13:53.693 --> 00:13:55.137 RICKY: There was a company called Zune, 00:13:55.162 --> 00:13:57.367 which is like Microsoft’s music app. 00:13:58.810 --> 00:14:00.434 Come to find out what you could do is 00:14:00.434 --> 00:14:03.156 you could call up Zune, and then halfway 00:14:03.156 --> 00:14:04.531 through the call you just tell them your 00:14:04.535 --> 00:14:06.353 gamer tag that you're targeting, and you 00:14:06.353 --> 00:14:10.127 say, okay, hey, my gamer tag is Jack. 00:14:11.574 --> 00:14:12.755 Then you just stop the conversation 00:14:12.756 --> 00:14:14.525 and be like, I have to go real fast. 00:14:14.525 --> 00:14:15.437 I’ll call back. 00:14:15.771 --> 00:14:16.903 JACK: Before hanging up, though, 00:14:17.165 --> 00:14:18.643 Zune support would give Ricky 00:14:18.678 --> 00:14:20.014 a reference number for the 00:14:20.015 --> 00:14:21.358 case that they were working on. 00:14:21.752 --> 00:14:23.701 Then he’d hang up and call a different 00:14:23.707 --> 00:14:26.108 number, Xbox Support this time, 00:14:26.506 --> 00:14:28.160 and they'd say, how can I help you? 00:14:28.188 --> 00:14:29.295 He’d say, oh, well, I was 00:14:29.295 --> 00:14:30.305 on a call but it dropped. 00:14:30.472 --> 00:14:31.740 I have a reference number if you 00:14:31.740 --> 00:14:33.095 want to pull the case details up. 00:14:33.540 --> 00:14:34.391 RICKY: Correct, yeah. 00:14:34.489 --> 00:14:35.674 You'd just simply say, yo, 00:14:35.675 --> 00:14:36.572 I have a reference number. 00:14:36.949 --> 00:14:37.997 Can you pull up my case? 00:14:38.317 --> 00:14:39.454 Then they would just give you the 00:14:39.454 --> 00:14:41.361 information right then and there. 00:14:41.457 --> 00:14:42.528 There was no questions asked. 00:14:42.586 --> 00:14:43.345 JACK: Ah, interesting. 00:14:43.346 --> 00:14:45.327 So, it’s almost like a bypass 00:14:45.327 --> 00:14:47.290 of a verbal authentication. 00:14:47.303 --> 00:14:50.065 So, then when you call Xbox and say, 00:14:50.096 --> 00:14:51.300 I have this reference number, then 00:14:51.301 --> 00:14:52.789 they give you the e-mail address. 00:14:53.242 --> 00:14:53.277 RICKY: Yep. 00:14:53.442 --> 00:14:53.987 JACK: Then you say, can 00:14:53.990 --> 00:14:55.175 you reset the password? 00:14:55.832 --> 00:14:56.043 RICKY: You would just be like, 00:14:56.044 --> 00:14:57.270 hey, yeah, here's my reference 00:14:57.270 --> 00:14:59.084 number — validate the account. 00:14:59.410 --> 00:15:00.622 Then just — you could just 00:15:00.622 --> 00:15:01.714 literally ask them, hey, what's 00:15:01.714 --> 00:15:03.606 the e-mail that I have on file? 00:15:03.622 --> 00:15:04.469 They'd read it off to you. 00:15:05.353 --> 00:15:06.274 JACK: How do you get the password? 00:15:06.872 --> 00:15:08.538 RICKY: Okay, so, back in the day AOL and 00:15:08.539 --> 00:15:10.491 Yahoo were your most popular domains. 00:15:10.752 --> 00:15:14.084 What's their proof of ownership of an 00:15:14.084 --> 00:15:16.161 account of an e-mail, was literally — AOL 00:15:16.164 --> 00:15:17.771 was like, your billing zip code would 00:15:17.772 --> 00:15:19.351 verify the account, and then they would 00:15:19.361 --> 00:15:20.623 be able to reset the password for you. 00:15:21.060 --> 00:15:21.830 Same with Yahoo. 00:15:22.391 --> 00:15:23.991 I think Yahoo was security questions, 00:15:24.241 --> 00:15:28.090 which back in the day was terrible because 00:15:28.107 --> 00:15:30.138 people would — a lot of the time chicken

00:15:30.141 --> 00:15:31.464 or pizza would be your favorite food that 00:15:31.464 --> 00:15:33.784 people would put, and stuff like that. 00:15:34.125 --> 00:15:36.845 So, they were pretty much takeable. 00:15:37.225 --> 00:15:38.023 JACK: See, that’s the thing that 00:15:38.024 --> 00:15:40.465 amazes me about these teenage hackers. 00:15:40.712 --> 00:15:41.859 They see the world differently 00:15:41.859 --> 00:15:44.358 than us, kinda like when you 00:15:44.358 --> 00:15:46.201 see motorcycles lane-splitting. 00:15:46.201 --> 00:15:47.550 You ever get stuck on a highway and 00:15:47.550 --> 00:15:48.721 there’s bumper-to-bumper traffic and 00:15:48.724 --> 00:15:50.015 you're standing still in your car 00:15:50.479 --> 00:15:52.598 and a motorcycle comes zooming past 00:15:52.598 --> 00:15:54.228 you right in-between the two lanes? 00:15:54.665 --> 00:15:56.320 You're like, come on. 00:15:56.540 --> 00:15:57.952 The motorcycle rider just looks back 00:15:57.952 --> 00:15:59.628 at you like you're a chump waiting 00:15:59.628 --> 00:16:01.140 in traffic like everyone else. 00:16:01.611 --> 00:16:03.123 They just whiz by like there’s 00:16:03.136 --> 00:16:04.613 no cars on the highway at all. 00:16:05.092 --> 00:16:07.483 These teenage hackers find ways through 00:16:07.487 --> 00:16:09.857 roadblocks that we just don't see. 00:16:10.135 --> 00:16:11.353 Like, you don't need someone’s 00:16:11.396 --> 00:16:13.300 password when the password reset 00:16:13.302 --> 00:16:14.848 question is ‘What's your favorite 00:16:14.848 --> 00:16:16.900 food?’ and you put ‘pizza’ up there. 00:16:17.317 --> 00:16:18.300 Now anyone can just write 00:16:18.303 --> 00:16:19.319 ‘pizza’ on there, and they could 00:16:19.321 --> 00:16:20.708 reset your password for you. 00:16:20.997 --> 00:16:22.218 It’s like, come on, what's 00:16:22.218 --> 00:16:23.425 the point of passwords if they 00:16:23.425 --> 00:16:24.997 could just be bypassed so easy? 00:16:25.632 --> 00:16:27.379 Sometimes it would try to validate it’s 00:16:27.382 --> 00:16:29.657 really you by asking for your zip code. 00:16:30.019 --> 00:16:31.947 Well, if you have their e-mail address, 00:16:31.950 --> 00:16:33.644 it’s not too hard to use some kind 00:16:33.645 --> 00:16:35.958 of people search tool online to look 00:16:35.989 --> 00:16:37.490 to see what someone’s zip code is. 00:16:37.826 --> 00:16:38.994 You and I don't think like 00:16:38.995 --> 00:16:40.255 that, though, but Ricky does. 00:16:40.266 --> 00:16:41.700 He’s the kind of guy that looks at 00:16:41.700 --> 00:16:43.348 us like we’re chumps for choosing 00:16:43.349 --> 00:16:45.099 an easy password recovery question. 00:16:45.558 --> 00:16:47.247 This was all happening in 2012, 00:16:47.462 --> 00:16:49.356 and Ricky was sixteen years old 00:16:49.448 --> 00:16:51.718 when he stole his first gamer tag. 00:16:53.207 --> 00:16:54.462 [Music] He found the one 00:16:54.496 --> 00:16:56.295 he wanted, Wolverine. 00:16:56.589 --> 00:16:58.194 Yeah, that sounds cool. 00:16:58.479 --> 00:16:59.891 He wasn't an X-Men fan; he 00:16:59.891 --> 00:17:01.068 just liked the sound of it. 00:17:01.488 --> 00:17:03.141 So, he called up Zune support, which 00:17:03.142 --> 00:17:05.172 is a Microsoft product, and is like, 00:17:05.308 --> 00:17:06.609 I have a problem with my account. 00:17:06.884 --> 00:17:08.395 They ask him for his e-mail address 00:17:08.395 --> 00:17:09.433 associated with the account. 00:17:09.719 --> 00:17:11.230 He says, well, I don't know. 00:17:11.914 --> 00:17:13.940 Can you just look up my Xbox gamer tag? 00:17:14.096 --> 00:17:14.954 They said, you know what? 00:17:14.959 --> 00:17:15.344 That works. 00:17:15.345 --> 00:17:16.204 What's your gamer tag? 00:17:16.482 --> 00:17:17.802 Ricky says, Wolverine. 00:17:18.271 --> 00:17:20.385 Zune support says, ah, yes, I see your 00:17:20.385 --> 00:17:21.835 account, sir. What can I help you with? 00:17:22.259 --> 00:17:24.269 Ricky says, okay, well, the problem 00:17:24.270 --> 00:17:25.902 is that when — you know what? 00:17:25.915 --> 00:17:27.630 Actually hold on; something just came up. 00:17:27.630 --> 00:17:28.515 Can I call you right back? 00:17:29.113 --> 00:17:30.713 Zune support says, yeah, sure. 00:17:30.757 --> 00:17:31.533 Do you want a reference 00:17:31.534 --> 00:17:32.464 number for when you call back? 00:17:32.467 --> 00:17:33.170 It’ll be easier for us 00:17:33.170 --> 00:17:33.996 to find your details. 00:17:34.410 --> 00:17:37.928 Ricky says, yes, yes, I do want that. 00:17:38.670 --> 00:17:40.823 He hangs up, and then he calls Xbox 00:17:40.831 --> 00:17:43.582 Support this time, and tells them, I was 00:17:43.583 --> 00:17:45.160 on with support but I got disconnected. 00:17:45.160 --> 00:17:46.197 Can you look up my case if I 00:17:46.197 --> 00:17:47.237 give you a reference number? 00:17:47.629 --> 00:17:48.855 They said, yeah, go ahead. 00:17:49.386 --> 00:17:50.505 He reads the number to them, 00:17:50.698 --> 00:17:51.962 and they see his details. 00:17:52.457 --> 00:17:55.164 Xbox Support’s mode of operation then 00:17:55.408 --> 00:17:57.051 was that if someone had a reference 00:17:57.052 --> 00:17:58.882 number, they must have already 00:17:58.905 --> 00:18:01.206 verified they are the account holder. 00:18:01.521 --> 00:18:03.403 So, they ask him, what's the problem? 00:18:03.458 --> 00:18:04.311 How can I help you? 00:18:04.520 --> 00:18:06.617 Ricky says, I just forgot what e-mail 00:18:06.617 --> 00:18:08.024 address I used for this account. 00:18:08.399 --> 00:18:09.342 He makes up some story 00:18:09.342 --> 00:18:10.542 about why he can't remember. 00:18:10.688 --> 00:18:12.094 He happened to be a good liar. 00:18:12.557 --> 00:18:13.591 Maybe it was that he got a 00:18:13.591 --> 00:18:14.763 new computer and didn't have 00:18:14.764 --> 00:18:15.943 those details on his new one. 00:18:16.389 --> 00:18:18.017 Xbox Support thinks, you know what? 00:18:18.017 -->

00:18:19.102 This is a harmless request. 00:18:19.106 --> 00:18:19.588 Sure. 00:18:19.619 --> 00:18:20.891 Your e-mail address is 00:18:21.195 --> 00:18:23.051 blahblahblah@aol.com. 00:18:23.439 --> 00:18:24.445 Great, he says. 00:18:24.610 --> 00:18:26.073 That’s all I wanted, and he hangs up. 00:18:27.569 --> 00:18:29.313 Now he has an e-mail address 00:18:29.369 --> 00:18:31.474 associated with that gamer tag. 00:18:31.939 --> 00:18:33.605 All he needs now is the password. 00:18:33.911 --> 00:18:35.426 Trying to get the password for an 00:18:35.438 --> 00:18:37.148 Xbox account is tricky, though. 00:18:37.684 --> 00:18:40.180 So, he has a better solution; try to reset 00:18:40.182 --> 00:18:43.493 the password on aol.com’s e-mail address. 00:18:44.068 --> 00:18:46.043 Once in there, he can reset the Xbox 00:18:46.051 --> 00:18:48.468 account and get control of that gamer tag. 00:18:48.872 --> 00:18:50.771 This is where he uses different tricks 00:18:50.781 --> 00:18:53.367 to get into an AOL account, by telling 00:18:53.368 --> 00:18:55.641 the website, I forgot my password, 00:18:55.717 --> 00:18:57.869 and it asking for his favorite food 00:18:57.936 --> 00:18:59.966 or zip code to verify it’s him. 00:19:00.747 --> 00:19:01.986 From there, bingo. 00:19:02.357 --> 00:19:04.282 He can now access the e-mail account 00:19:04.539 --> 00:19:06.022 and reset the password for that 00:19:06.034 --> 00:19:08.751 Microsoft gamer tag and get into it. 00:19:09.232 --> 00:19:12.380 This is how he became Wolverine. 00:19:13.789 --> 00:19:14.868 RICKY: Yeah, I thought it was cool, 00:19:14.914 --> 00:19:16.355 like a cool alias to have, and 00:19:16.356 --> 00:19:17.895 that was the first one I ever took. 00:19:17.896 --> 00:19:18.975 So, I was like, you know what? 00:19:19.070 --> 00:19:19.830 That’s what it is. 00:19:20.138 --> 00:19:21.403 JACK: So, Wolverine. 00:19:22.290 --> 00:19:22.693 RICKY: Yeah. 00:19:23.014 --> 00:19:24.087 So, that’s my alias. 00:19:24.562 --> 00:19:25.868 JACK: Ricky didn't have steel 00:19:25.868 --> 00:19:27.086 claws like Wolverine did. 00:19:27.086 --> 00:19:28.078 His weapons were his 00:19:28.080 --> 00:19:29.532 keyboard and telephone. 00:19:29.948 --> 00:19:31.441 Once Ricky got his first taste of 00:19:31.441 --> 00:19:33.763 stealing a gamer tag, he wanted more. 00:19:34.032 --> 00:19:35.368 He went back to that marketplace 00:19:35.370 --> 00:19:36.314 on hack forums where people 00:19:36.314 --> 00:19:37.475 were selling gamer tags. 00:19:37.815 --> 00:19:38.805 People were selling things like 00:19:38.815 --> 00:19:41.371 Gang or Spirit or Booty or Boss 00:19:41.683 --> 00:19:43.373 for a few hundred bucks each. 00:19:43.856 --> 00:19:46.517 Ricky started stealing gamer tags 00:19:46.562 --> 00:19:48.695 and then selling them for money on 00:19:48.698 --> 00:19:50.952 the site, for Bitcoin specifically. 00:19:51.116 --> 00:19:52.439 He started making some money 00:19:52.439 --> 00:19:53.827 off this, not bad money,

either. 00:19:54.043 --> 00:19:55.249 A couple good gamer tags 00:19:55.435 --> 00:19:57.267 might sell for around $1,000. 00:19:57.548 --> 00:19:59.223 But many were just a few hundred bucks. 00:19:59.405 --> 00:20:00.459 He’d play with them, too, 00:20:00.486 --> 00:20:01.585 just to dunk on people. 00:20:01.703 --> 00:20:03.414 He’d log in with a stolen gamer tag, 00:20:03.453 --> 00:20:05.364 totally pwn some other players in Halo 3 00:20:05.364 --> 00:20:07.169 by knocking them offline with some DDoS 00:20:07.201 --> 00:20:08.794 attack, and then just laugh at it all. 00:20:09.450 --> 00:20:11.353 But sometimes people would report 00:20:11.354 --> 00:20:13.601 him for abuse, and this would bring 00:20:13.603 --> 00:20:15.342 the party to a screeching halt. 00:20:16.136 --> 00:20:17.279 RICKY: I thought it was funny just to 00:20:17.305 --> 00:20:19.187 hit them offline and stuff like that. 00:20:20.142 --> 00:20:22.346 But eventually you just get banned. 00:20:22.365 --> 00:20:24.452 Like, back then Xbox was big 00:20:24.452 --> 00:20:26.449 on just banning your accounts 00:20:26.450 --> 00:20:27.724 and stuff for DDoS attacks. 00:20:28.065 --> 00:20:29.311 So, I would just get banned 00:20:29.311 --> 00:20:31.541 over and over, which then led 00:20:31.543 --> 00:20:33.370 to my consoles being banned. 00:20:33.779 --> 00:20:36.190 So, I was always at GameStop and 00:20:36.190 --> 00:20:37.952 whatnot just trading in consoles 00:20:38.052 --> 00:20:39.556 for new consoles and selling my 00:20:39.567 --> 00:20:41.073 banned consoles and stuff like that. 00:20:41.137 --> 00:20:42.370 JACK: He told me this happened over 00:20:42.371 --> 00:20:43.963 a dozen times, and he would just 00:20:43.963 --> 00:20:45.776 keep selling banned Xboxes at the 00:20:45.776 --> 00:20:47.964 same GameStop, and then go to another 00:20:47.964 --> 00:20:49.497 one across town and buy another. 00:20:50.100 --> 00:20:51.207 I just can't believe that they 00:20:51.208 --> 00:20:53.914 didn't catch on to him for constantly 00:20:53.916 --> 00:20:55.501 selling them banned Xboxes. 00:20:55.788 --> 00:20:57.323 RICKY: They would plug it in to make sure 00:20:57.324 --> 00:21:00.466 it turned on, which was fine with me, 00:21:00.877 --> 00:21:02.344 but they never checked like — connected 00:21:02.346 --> 00:21:03.793 to Xbox Live and stuff like that. 00:21:03.994 --> 00:21:06.084 JACK: He would do this again and again. 00:21:06.243 --> 00:21:08.380 RICKY: So, I would typically trade it in 00:21:08.380 --> 00:21:10.264 at one store and then go to a different 00:21:10.275 --> 00:21:12.549 GameStop and then buy the new console. 00:21:12.756 --> 00:21:16.028 I’ve probably went through at 00:21:16.042 --> 00:21:18.078 least ten, maybe closer to twenty. 00:21:18.475 --> 00:21:19.514 JACK: You would think after a while 00:21:19.516 --> 00:21:20.745 that Ricky would be like, alright, 00:21:20.745 --> 00:21:22.219 alright, enough of this getting banned. 00:21:22.222 --> 00:21:23.911 I’ll stop attacking people. 00:21:24.212 --> 00:21:25.753 But for some reason he was just 00:21:25.754 --> 00:21:27.592 so addicted to it that he would 00:21:27.592 --> 00:21:29.545 not stop attacking people and 00:21:29.546 --> 00:21:30.917 just kept getting reported for 00:21:30.918 --> 00:21:32.738 abuse again and again and again. 00:21:33.118 --> 00:21:34.951 You would think after five times, 00:21:34.953 --> 00:21:36.310 it’s like, okay, I’m tired of going 00:21:36.312 --> 00:21:38.035 down to get a new Xbox, but not Ricky. 00:21:38.273 --> 00:21:39.435 He would just keep doing it. 00:21:40.328 --> 00:21:42.784 Now, eventually he graduated to 00:21:42.784 --> 00:21:45.579 stealing something even more malleable. 00:21:46.046 --> 00:21:48.071 It wasn't just gamer tags anymore. 00:21:48.136 --> 00:21:48.916 [Music] His attention 00:21:48.920 --> 00:21:51.455 turned to Instagram handles. 00:21:53.419 --> 00:21:55.346 RICKY: I was always the old-school 00:21:55.350 --> 00:21:56.689 Halo guy, like Xbox guy. 00:21:56.695 --> 00:21:57.360 Like, I didn't want to 00:21:57.384 --> 00:21:58.613 transition into Instagram. 00:21:58.619 --> 00:21:59.726 I just stuck to what I know. 00:22:00.159 --> 00:22:02.460 Then just one day, a couple of 00:22:02.467 --> 00:22:04.260 my people were like, yo, why 00:22:04.260 --> 00:22:05.284 are you not doing Instagram? 00:22:05.444 --> 00:22:06.377 It’s a new wave. 00:22:06.576 --> 00:22:07.814 So, they kinda persuaded me. 00:22:08.340 --> 00:22:09.316 They were like, listen, 00:22:09.325 --> 00:22:11.429 here's an AOL e-mail address. 00:22:11.975 --> 00:22:12.942 It’s for the Instagram 00:22:12.974 --> 00:22:14.815 @bro, just like B-R-O. 00:22:15.412 --> 00:22:16.495 Nobody can take it. 00:22:16.508 --> 00:22:17.541 I’m like, dude, it’s an AOL. 00:22:17.576 --> 00:22:18.694 What do you mean nobody can take it? 00:22:18.992 --> 00:22:20.118 JACK: At the time, Ricky felt like he 00:22:20.119 --> 00:22:22.981 could steal any Xbox gamer tag he wanted. 00:22:23.394 --> 00:22:24.911 So, what do you mean you can't 00:22:24.915 --> 00:22:27.483 steal this Instagram name @bro? 00:22:28.046 --> 00:22:29.952 It’s tied to an AOL address account. 00:22:29.966 --> 00:22:31.300 Those are easy to get into. 00:22:31.911 --> 00:22:34.312 But this idea sparked something in Ricky. 00:22:34.776 --> 00:22:36.213 If he could get any gamer tag he 00:22:36.213 --> 00:22:38.165 wanted, then how different would 00:22:38.166 --> 00:22:39.707 it be to get Instagram names? 00:22:39.855 --> 00:22:41.300 It’s the same social engineering 00:22:41.300 --> 00:22:42.499 techniques that he figured out how 00:22:42.500 --> 00:22:44.798 to recover someone’s password, but 00:22:44.798 --> 00:22:46.291 there’s just way more money in it. 00:22:46.400 --> 00:22:48.266 RICKY: With the Instagram @bro, how nobody 00:22:48.266 --> 00:22:51.144 could get it that was trying to get it, 00:22:51.519 --> 00:22:54.120 it’s because it was linked — it was an

00:22:54.121 --> 00:22:58.699 adult account on AOL, but it had — it 00:22:58.701 --> 00:23:01.427 was like the parent account, and under 00:23:01.428 --> 00:23:02.870 the parent account it had other accounts. 00:23:02.899 --> 00:23:04.278 It was one of those e-mails 00:23:04.379 --> 00:23:05.533 under the parent account. 00:23:05.629 --> 00:23:06.670 That’s why nobody could get it. 00:23:07.665 --> 00:23:09.141 I was able to realize that. 00:23:09.141 --> 00:23:09.924 I realized it. 00:23:10.472 --> 00:23:12.301 Once I reset the main e-mail, and I was 00:23:12.301 --> 00:23:14.369 like, yo, this isn't my e-mail — like, 00:23:15.790 --> 00:23:17.942 you have other accounts under that e-mail. 00:23:18.148 --> 00:23:19.568 So, once I was able to match 00:23:19.569 --> 00:23:20.235 everything up, I was like, 00:23:20.235 --> 00:23:21.610 yo, it’s that specific one. 00:23:21.664 --> 00:23:23.159 I don't remember the exact e-mail. 00:23:23.553 --> 00:23:24.726 But I was like, it’s that one. 00:23:24.995 --> 00:23:25.877 I reset it, and the 00:23:25.878 --> 00:23:26.780 Instagram was right there. 00:23:27.363 --> 00:23:29.971 Funny story, though; the security question 00:23:29.974 --> 00:23:31.431 on it — I remember this conversation. 00:23:32.375 --> 00:23:33.848 Probably forever I’ll remember this. 00:23:34.302 --> 00:23:36.665 The lady was like, the security question 00:23:36.705 --> 00:23:38.539 is your favorite mythical creature. 00:23:39.710 --> 00:23:40.538 I was like, you know, 00:23:40.568 --> 00:23:41.915 I put something random. 00:23:41.947 --> 00:23:42.607 I apologize. 00:23:42.608 --> 00:23:43.696 I don't remember what it was. 00:23:43.957 --> 00:23:45.264 She’s like, okay, well, 00:23:45.264 --> 00:23:46.288 it’s big and hairy. 00:23:47.803 --> 00:23:49.630 As you can guess, I guessed Bigfoot. 00:23:50.120 --> 00:23:52.168 She started laughing and she goes, 00:23:52.178 --> 00:23:53.837 no, it’s another word for Bigfoot. 00:23:54.452 --> 00:23:55.803 I said, sasquatch. 00:23:55.857 --> 00:23:56.826 She goes, yeah, that’s right. 00:23:57.323 --> 00:23:58.306 Gave me the password reset. 00:23:59.504 --> 00:24:01.328 JACK: Man, I absolutely hate 00:24:01.342 --> 00:24:03.229 how easy this is for him. 00:24:03.518 --> 00:24:05.938 That customer service person really 00:24:06.158 --> 00:24:08.886 failed at keeping our accounts safe. 00:24:09.193 --> 00:24:10.950 I hope they got fired for giving 00:24:10.967 --> 00:24:12.473 Ricky this Instagram account 00:24:12.487 --> 00:24:14.904 @bro, because that’s ridiculous, 00:24:15.593 --> 00:24:16.696 and that’s how he got it. 00:24:17.276 --> 00:24:18.784 The way he’d steal an Instagram account 00:24:18.898 --> 00:24:21.359 is that he would get access to it, and he 00:24:21.359 --> 00:24:23.237 would log into it, and then he would have 00:24:23.237 --> 00:24:25.316 a second browser open with a brand-new, 00:24:25.322 --> 00:24:27.300 fresh Instagram account that he just made. 00:24:28.021 --> 00:24:29.538 He would change the username of 00:24:29.538 --> 00:24:31.473 the stolen one to something else, 00:24:31.928 --> 00:24:33.409 and then he would quickly switch 00:24:33.411 --> 00:24:35.397 to his fresh account and change its 00:24:35.402 --> 00:24:37.396 username to the stolen username. 00:24:37.899 --> 00:24:39.243 That way the person, when they 00:24:39.243 --> 00:24:40.442 figure out that their Instagram 00:24:40.444 --> 00:24:42.152 account got stolen and they recover 00:24:42.152 --> 00:24:44.142 it, they still have all their DMs 00:24:44.147 --> 00:24:45.456 and their followers and all that. 00:24:45.671 --> 00:24:46.948 It’s just that their name was 00:24:46.948 --> 00:24:48.764 changed 'cause Ricky stole it. 00:24:48.914 --> 00:24:50.758 RICKY: I would genuinely let 00:24:50.758 --> 00:24:51.782 them just keep their account. 00:24:51.863 --> 00:24:52.779 Like, I don't want to mess with their 00:24:52.782 --> 00:24:55.682 pictures and take down their Instagram 00:24:55.687 --> 00:24:56.915 and close the account or anything. 00:24:57.172 --> 00:24:58.124 Like, they can keep that. 00:24:58.606 --> 00:25:00.499 I got what I wanted and that was it. 00:25:00.915 --> 00:25:02.722 JACK: A stolen Xbox handle might 00:25:02.722 --> 00:25:04.141 get you a few hundred dollars, but 00:25:04.142 --> 00:25:05.963 a good verified Instagram handle 00:25:06.350 --> 00:25:07.945 can go for a few thousand dollars. 00:25:08.363 --> 00:25:10.120 When Ricky stole the Instagram account 00:25:10.142 --> 00:25:13.615 @bro, he says he sold it for $8,000. 00:25:14.058 --> 00:25:16.386 People were paying him in crypto, Bitcoin, 00:25:16.468 --> 00:25:18.493 Ethereum, and Ricky was liking this. 00:25:18.510 --> 00:25:19.683 In an afternoon he could steal 00:25:19.683 --> 00:25:20.466 a few accounts that would 00:25:20.485 --> 00:25:22.041 earn him maybe ten grand. 00:25:22.286 --> 00:25:24.359 This would become his main focus, 00:25:24.580 --> 00:25:25.987 all the ins and outs of how to 00:25:25.992 --> 00:25:27.995 steal accounts and how to sell them. 00:25:28.114 --> 00:25:29.380 He learned verified accounts 00:25:29.381 --> 00:25:30.713 sold more than non-verified. 00:25:30.788 --> 00:25:32.725 He was stealing usernames left and right. 00:25:33.062 --> 00:25:34.306 Of course, Ricky wasn't 00:25:34.309 --> 00:25:35.302 the only guy doing this. 00:25:35.303 --> 00:25:37.006 In fact, he wasn't even discovering 00:25:37.011 --> 00:25:38.236 how any of this stuff worked. 00:25:38.507 --> 00:25:40.166 He was just learning from others 00:25:40.167 --> 00:25:41.537 who were doing the same thing. 00:25:42.453 --> 00:25:44.107 There was this one SIM-swapper that 00:25:44.109 --> 00:25:46.096 Ricky met online named Joseph Harris, 00:25:46.357 --> 00:25:47.490 who I interviewed a while back. 00:25:47.491 --> 00:25:48.774 If you want to hear Joseph’s story, 00:25:49.023 --> 00:25:50.421 you can listen to that episode. 00:25:50.423 --> 00:25:52.336 It’s Episode 118,

called Hot Swaps. 00:25:52.604 --> 00:25:54.267 RICKY: So, me and Joseph were kind of 00:25:54.268 --> 00:25:56.281 in the same world, you know, taking 00:25:56.281 --> 00:25:57.825 usernames and whatnot like that. 00:25:58.503 --> 00:25:59.940 We never really talked or anything. 00:25:59.947 --> 00:26:00.683 Like, I knew him, he 00:26:00.685 --> 00:26:01.546 knew me, type of thing. 00:26:01.585 --> 00:26:04.327 But then I ended up stealing a couple 00:26:04.327 --> 00:26:06.022 of his PlayStation names that he had. 00:26:07.028 --> 00:26:08.289 He asked for them back and I was 00:26:08.289 --> 00:26:10.256 just like, fuck off, pretty much. 00:26:11.232 --> 00:26:13.165 Then he was like, okay. 00:26:13.715 --> 00:26:15.270 Then I felt bad, and we talked, 00:26:15.406 --> 00:26:16.544 but I never gave them back. 00:26:16.894 --> 00:26:19.019 But we talked and we became friends. 00:26:20.564 --> 00:26:21.374 JACK: Even though you never gave 00:26:21.374 --> 00:26:22.467 them back, you became friends. 00:26:23.355 --> 00:26:23.818 RICKY: Yeah. 00:26:24.294 --> 00:26:26.009 JACK: This is a strange world 00:26:26.250 --> 00:26:27.926 that he’s in, where you earn 00:26:27.926 --> 00:26:29.901 respect for being a great liar. 00:26:30.121 --> 00:26:32.447 You earn respect for stealing things. 00:26:32.770 --> 00:26:34.460 Even if you steal things from other 00:26:34.461 --> 00:26:36.498 forum members, their reaction is 00:26:36.500 --> 00:26:38.232 like, oh man, he caught me out. 00:26:38.233 --> 00:26:39.768 I should have secured my username better. 00:26:39.809 --> 00:26:40.686 Man, he’s good. 00:26:41.275 --> 00:26:43.135 Him and Joseph became friends, 00:26:43.283 --> 00:26:44.755 and they would swap strategies 00:26:44.765 --> 00:26:46.002 for stealing usernames, and 00:26:46.004 --> 00:26:47.024 they would help each other out. 00:26:47.464 --> 00:26:49.140 But what makes all this so scary to 00:26:49.142 --> 00:26:50.909 me is that I don't even think Ricky 00:26:51.129 --> 00:26:53.496 was particularly good at computers. 00:26:53.832 --> 00:26:55.239 You have someone with very little 00:26:55.241 --> 00:26:56.735 computer skills that can just come 00:26:56.736 --> 00:26:59.378 at us and steal our stuff so easily. 00:27:00.096 --> 00:27:01.051 It was really hard for 00:27:01.052 --> 00:27:02.291 victims to do anything. 00:27:02.316 --> 00:27:04.096 Instagram customer support is always 00:27:04.105 --> 00:27:06.329 overwhelmed, and I bet so is Microsoft, 00:27:06.521 --> 00:27:08.678 and they often side with the thief by 00:27:08.678 --> 00:27:09.842 telling them, yeah, there’s nothing 00:27:09.844 --> 00:27:11.128 we could do to help you get it back. 00:27:11.426 --> 00:27:13.184 It takes a lot of effort to 00:27:13.184 --> 00:27:14.733 recover a stolen username. 00:27:14.952 --> 00:27:16.116 So, victims often would just 00:27:16.138 --> 00:27:17.908 give up and stop trying, and 00:27:17.908 --> 00:27:19.879 they'd feel helpless in all this. 00:27:20.310 --> 00:27:22.507 It just makes me wonder, how can I even 00:27:22.509 --> 00:27:24.113 protect myself when the company who 00:27:24.115 --> 00:27:26.504 keeps my stuff safe has these flaws? 00:27:26.994 --> 00:27:27.970 I mean, think about it like this. 00:27:27.980 --> 00:27:29.569 Suppose I go and stay at a hotel 00:27:29.728 --> 00:27:31.074 and I leave my valuables in the 00:27:31.074 --> 00:27:32.343 room and I leave for the day. 00:27:32.740 --> 00:27:34.244 I’m assuming my stuff is nice 00:27:34.244 --> 00:27:35.712 and safe behind a locked door. 00:27:36.188 --> 00:27:37.870 But we’ve seen stories where criminals 00:27:37.872 --> 00:27:39.603 will target a guest in a hotel, 00:27:39.616 --> 00:27:40.717 and they’ll go to the front desk 00:27:40.717 --> 00:27:42.466 and say, oh, sorry, I’m staying in 00:27:42.695 --> 00:27:44.878 Room 1020 and I locked myself out. 00:27:45.189 --> 00:27:46.556 Can I get a new key to get in? 00:27:47.108 --> 00:27:49.014 The front desk sees these situations 00:27:49.014 --> 00:27:50.689 happen every day where a guest 00:27:50.700 --> 00:27:51.896 gets locked out of the room, 00:27:52.191 --> 00:27:53.880 and they want to help the guest. 00:27:54.243 --> 00:27:56.183 So, if a criminal is posing as 00:27:56.184 --> 00:27:57.877 a guest and they're convincing 00:27:57.877 --> 00:27:59.853 enough, they’ll likely get the key. 00:28:00.254 --> 00:28:01.566 It might play out like this; the front 00:28:01.567 --> 00:28:03.506 desk will ask for a photo ID, of course, 00:28:03.506 --> 00:28:05.178 but if you say, oh yeah, you know what? 00:28:05.684 --> 00:28:06.668 I left it in the room. 00:28:06.875 --> 00:28:08.174 I was going to the pool and I didn't 00:28:08.174 --> 00:28:09.567 bring anything, and that’s the problem. 00:28:09.567 --> 00:28:10.590 I left everything in the room. 00:28:11.139 --> 00:28:12.264 That’s a real scenario 00:28:12.265 --> 00:28:13.306 that happens all the time. 00:28:13.717 --> 00:28:15.618 So, the hotel is used to this kinda thing. 00:28:16.069 --> 00:28:17.642 So, the hotel front desk might 00:28:17.642 --> 00:28:19.282 say, well, can you give me some 00:28:19.282 --> 00:28:20.446 more details about yourself? 00:28:20.446 --> 00:28:21.592 Like, what's your phone number, 00:28:21.610 --> 00:28:23.263 e-mail address, full name. 00:28:23.852 --> 00:28:25.934 If you can verify those things, you are 00:28:25.974 --> 00:28:27.993 absolutely getting the key to that room. 00:28:28.737 --> 00:28:29.854 And who would be good 00:28:29.855 --> 00:28:30.877 at doing such a crime? 00:28:31.147 --> 00:28:33.823 Liars would be, someone who can lie to 00:28:33.823 --> 00:28:35.942 the front desk person’s face to get the 00:28:35.942 --> 00:28:38.252 room key, which it sounds like Ricky 00:28:38.329 --> 00:28:39.911 must have been a really good liar to 00:28:39.919 --> 00:28:42.861 convince so many customer support reps 00:28:43.098 --> 00:28:45.254 to give him the information he wants

00:28:45.402 --> 00:28:47.130 so that he can get into an account. 00:28:47.797 --> 00:28:49.842 It just makes me wonder, how do you 00:28:49.867 --> 00:28:52.625 protect yourself when a company that has 00:28:52.626 --> 00:28:54.243 your stuff doesn't have good security 00:28:54.244 --> 00:28:55.842 controls to protect their customers? 00:28:56.376 --> 00:28:58.158 So, Ricky’s progressing through this 00:28:58.167 --> 00:28:59.955 scene, making a few hundred dollars 00:28:59.956 --> 00:29:02.093 with each Xbox gamer tag he steals, and 00:29:02.093 --> 00:29:03.639 then moving up to a few thousand dollars 00:29:03.641 --> 00:29:05.163 for each Instagram name he steals. 00:29:05.708 --> 00:29:06.728 But he started having trouble 00:29:06.729 --> 00:29:08.513 getting into some e-mail accounts. 00:29:08.564 --> 00:29:10.532 Like, some he just could not get into 00:29:10.533 --> 00:29:12.112 because his social engineering skills 00:29:12.113 --> 00:29:13.752 just didn't work there or his password 00:29:13.753 --> 00:29:15.148 recovery tricks just didn't work, 00:29:15.438 --> 00:29:17.231 especially when two-factor authentication 00:29:17.263 --> 00:29:18.638 was on for some e-mail accounts. 00:29:18.869 --> 00:29:20.557 So, he told a friend, do you know 00:29:20.566 --> 00:29:23.004 more ways to get into e-mail accounts? 00:29:23.426 --> 00:29:24.524 That’s when his friend told 00:29:24.524 --> 00:29:26.625 him about SIM-swapping. 00:29:26.726 --> 00:29:26.765 RICKY: [Music] 00:29:29.393 --> 00:29:31.563 Then as security and stuff 00:29:31.885 --> 00:29:33.843 escalated, that’s when simming, 00:29:34.095 --> 00:29:35.446 like SIM-swapping, became a thing. 00:29:36.354 --> 00:29:37.752 So, if we couldn't get it through 00:29:38.421 --> 00:29:39.568 the password reset or anything, 00:29:39.568 --> 00:29:40.641 through a security question, 00:29:40.990 --> 00:29:41.853 we could just SIM-swap them. 00:29:42.966 --> 00:29:44.079 JACK: You’ve probably legally 00:29:44.089 --> 00:29:45.959 SIM-swapped yourself a few times. 00:29:46.141 --> 00:29:47.814 Any time you get a new phone and you 00:29:47.816 --> 00:29:49.806 have to move your number to the new 00:29:49.811 --> 00:29:51.790 phone you get, well, that’s a SIM-swap. 00:29:51.801 --> 00:29:53.023 That’s all it is, moving a 00:29:53.023 --> 00:29:54.399 mobile number to a new device. 00:29:54.787 --> 00:29:57.405 But what Ricky wanted to do was pose as 00:29:57.409 --> 00:29:59.341 the customer and convince the carrier 00:29:59.341 --> 00:30:01.096 that he just got a new phone and he wants 00:30:01.097 --> 00:30:02.884 to move his number to this new phone. 00:30:03.586 --> 00:30:05.254 I went into SIM-swapping more in depth 00:30:05.286 --> 00:30:07.263 with Episode 112, called Dirty Coms, 00:30:07.470 --> 00:30:09.033 which by the way just took the lead for 00:30:09.033 --> 00:30:10.418 the most downloaded episode of mine. 00:30:10.614 --> 00:30:13.023 It has now achieved 1.2 million downloads, 00:30:13.025 --> 00:30:14.399 and if you haven't listened to Episode 00:30:14.399 --> 00:30:15.943 112, you should absolutely go do it. 00:30:17.007 --> 00:30:18.442 But basically what Ricky learned is 00:30:18.442 --> 00:30:20.103 that he can call the mobile provider and 00:30:20.108 --> 00:30:22.213 trick them into moving someone else’s 00:30:22.218 --> 00:30:24.455 phone number to his phone, and if he 00:30:24.455 --> 00:30:26.538 can get that, then he can get into their 00:30:26.553 --> 00:30:28.303 e-mail account, say something like, oh, 00:30:28.303 --> 00:30:30.476 I forgot my password, and it’ll text 00:30:30.479 --> 00:30:32.512 them a code to generate a new password. 00:30:33.120 --> 00:30:34.628 He can read those texts now. 00:30:35.120 --> 00:30:36.750 From there, he can reset the password 00:30:36.750 --> 00:30:39.069 to the inbox and look at it and start 00:30:39.084 --> 00:30:40.408 rummaging through it looking for 00:30:40.417 --> 00:30:42.495 usernames and gamer tags to steal. 00:30:43.279 --> 00:30:45.291 RICKY: Once I had the target that I 00:30:45.291 --> 00:30:46.340 was going for — like, usually I had 00:30:46.341 --> 00:30:47.735 their name or something or their e-mail 00:30:48.058 --> 00:30:50.061 and I needed the number or address 00:30:50.062 --> 00:30:51.171 or something — I would just usually 00:30:51.175 --> 00:30:54.959 typically call up Amazon, PayPal, or eBay. 00:30:55.977 --> 00:30:57.572 Those were like — I was gonna get their 00:30:57.572 --> 00:30:58.620 information from one of those three 00:30:58.620 --> 00:31:00.043 companies as long as they had that on 00:31:00.044 --> 00:31:02.454 file or that person used one of the three. 00:31:03.917 --> 00:31:05.173 Social engineering — I would just be 00:31:05.173 --> 00:31:06.684 able to get the pertinent information. 00:31:07.168 --> 00:31:10.516 JACK: Okay, so, you called Amazon, 00:31:10.520 --> 00:31:13.005 and what information do you have, 00:31:13.006 --> 00:31:14.305 what information are you looking for? 00:31:15.613 --> 00:31:16.315 RICKY: I’m specifically 00:31:16.517 --> 00:31:18.145 probably targeting the number. 00:31:18.738 --> 00:31:19.714 JACK: You want the phone number. 00:31:20.396 --> 00:31:20.895 RICKY: Yeah. 00:31:21.148 --> 00:31:22.928 JACK: Associated with an e-mail address? 00:31:23.430 --> 00:31:26.313 RICKY: Yeah, so if I knew you had 00:31:26.313 --> 00:31:28.442 @Jack on Instagram and I had your name, 00:31:28.778 --> 00:31:30.862 I would be able to call up as you. 00:31:31.616 --> 00:31:33.383 I’ll probably — at this point I’m probably 00:31:33.383 --> 00:31:35.157 gonna have a little bit about you, 00:31:35.489 --> 00:31:37.008 maybe the e-mail address or something. 00:31:38.147 --> 00:31:39.925 I would just see if you had any three 00:31:39.926 --> 00:31:41.903 of those accounts; PayPal, Amazon, eBay. 00:31:42.125 --> 00:31:43.015 If you had one of them, I was 00:31:43.015 --> 00:31:44.602 gonna call them up as you. 00:31:44.940 -->

00:31:47.071 I would say, hey, my name is Jack. 00:31:49.475 --> 00:31:50.405 I need help verifying my 00:31:50.405 --> 00:31:51.371 account or something like that. 00:31:51.549 --> 00:31:53.267 Or if it was eBay, I think I would 00:31:53.267 --> 00:31:54.237 say I need help with an order. 00:31:55.024 --> 00:31:56.620 Then they'd be like, okay, what order? 00:31:57.021 --> 00:32:00.274 Once I verified them, the name and the 00:32:00.278 --> 00:32:02.411 e-mail on file, what I would do is be 00:32:02.411 --> 00:32:04.024 like, oh — like make conversation; be 00:32:04.024 --> 00:32:05.889 like, oh, by the way, what's my number 00:32:05.896 --> 00:32:08.337 ending in whatever your number ended in? 00:32:08.340 --> 00:32:09.536 Because they would be able to see 00:32:09.725 --> 00:32:10.995 the last two digits or something. 00:32:12.319 --> 00:32:13.428 They would just read off the number. 00:32:14.421 --> 00:32:15.489 I’m not gonna say there wasn't 00:32:15.499 --> 00:32:18.266 people who haven't gotten away, like 00:32:18.267 --> 00:32:19.247 I couldn't find them or something 00:32:19.249 --> 00:32:20.101 or I just gave up because it 00:32:20.101 --> 00:32:21.461 was too hard and on to the next. 00:32:21.788 --> 00:32:24.137 But 90-something percent of 00:32:24.137 --> 00:32:26.092 the time it was successful. 00:32:26.614 --> 00:32:27.776 JACK: That’s such a hard number 00:32:27.776 --> 00:32:29.220 to believe, because nobody’s 00:32:29.221 --> 00:32:32.660 taken my Instagram yet, and I know 00:32:32.714 --> 00:32:34.063 people would love to have that 00:32:34.063 --> 00:32:35.785 feather in their hat, to hack Jack. 00:32:37.405 --> 00:32:39.730 RICKY: Yeah, I mean, from personal 00:32:39.730 --> 00:32:42.203 experience, I like what you guys do, 00:32:42.320 --> 00:32:45.639 but this was also back in 2015 or so, 00:32:45.948 --> 00:32:49.279 and if you had the username @Jack and 00:32:49.279 --> 00:32:53.719 somebody came and asked me for that 00:32:53.721 --> 00:32:55.963 handle, I was probably gonna get it. 00:32:56.534 --> 00:32:58.092 JACK: It’s real interesting to me how 00:32:58.095 --> 00:33:00.380 Ricky pieces all this together, isn't it? 00:33:00.592 --> 00:33:02.007 I mean, he’s grabbing at a 00:33:02.029 --> 00:33:04.189 single digit of a phone number 00:33:04.394 --> 00:33:06.179 from this place or that place. 00:33:06.305 --> 00:33:08.378 He’s grabbing at just a few digits 00:33:08.380 --> 00:33:10.254 of a social security number from here 00:33:10.256 --> 00:33:12.473 or there, and then he’s connecting 00:33:12.474 --> 00:33:14.107 it all together to get a more 00:33:14.108 --> 00:33:17.081 complete detail view of his victims. 00:33:17.218 --> 00:33:18.333 Like, for instance, he might go to 00:33:18.334 --> 00:33:20.540 Amazon not knowing if this target of 00:33:20.543 --> 00:33:23.092 his has an Amazon account or not, and 00:33:23.093 --> 00:33:26.436 he would say, hey, I forgot my password. 00:33:26.881 --> 00:33:27.834 The website

would say, okay, 00:33:27.834 --> 00:33:28.837 what's your e-mail address? 00:33:28.868 --> 00:33:30.587 He would put in the e-mail address, 00:33:30.855 --> 00:33:32.088 and then it would say, alright, well, 00:33:32.088 --> 00:33:34.862 we just texted you a code which ends 00:33:34.863 --> 00:33:37.372 in these two digits, 34 or whatever. 00:33:37.538 --> 00:33:38.484 He’s just like, great. 00:33:38.495 --> 00:33:39.658 That’s all I wanted to know, 00:33:39.672 --> 00:33:41.352 the last two digits of the phone 00:33:41.361 --> 00:33:43.160 number associated to this account. 00:33:43.503 --> 00:33:44.815 You might think, what's the big deal 00:33:44.816 --> 00:33:46.386 if someone knows one of my social 00:33:46.386 --> 00:33:47.497 security numbers, right, or the 00:33:47.497 --> 00:33:48.901 last two digits of my phone number? 00:33:49.106 --> 00:33:49.896 This is why. 00:33:49.902 --> 00:33:52.101 This is why right here, because people 00:33:52.103 --> 00:33:54.050 like Ricky are grabbing at every little 00:33:54.050 --> 00:33:56.034 detail to steal things from you so 00:33:56.034 --> 00:33:57.846 that it’s just enough information that 00:33:58.093 --> 00:33:59.639 they could social engineer someone to 00:33:59.646 --> 00:34:01.040 give them the rest of the information. 00:34:01.399 --> 00:34:02.976 They are persistent and 00:34:02.976 --> 00:34:04.959 clever and incentivized. 00:34:05.370 --> 00:34:06.670 I mean, how many times have you 00:34:06.672 --> 00:34:08.346 been asked to provide only the last 00:34:08.356 --> 00:34:09.993 four digits of your social security 00:34:09.995 --> 00:34:11.751 number to get something done? 00:34:12.395 --> 00:34:14.204 So, the goal here was that Ricky 00:34:14.205 --> 00:34:15.509 needed to convince the mobile 00:34:15.510 --> 00:34:17.851 provider he’s actually the customer. 00:34:18.101 --> 00:34:19.514 They would ask him to prove it by 00:34:19.514 --> 00:34:21.435 providing things like a social security 00:34:21.437 --> 00:34:23.811 number or personal details, and Ricky 00:34:23.811 --> 00:34:24.849 would be able to get this kind of 00:34:24.849 --> 00:34:27.274 information off you because he had access 00:34:27.275 --> 00:34:29.035 to a people search database that for 00:34:29.037 --> 00:34:31.137 three bucks he could enter in whatever 00:34:31.332 --> 00:34:33.495 little info he had on you, and it would 00:34:33.495 --> 00:34:35.711 give him back a ton of details, which 00:34:35.714 --> 00:34:38.067 drives me nuts that we're so relaxed 00:34:38.069 --> 00:34:39.804 about our personal data and just give 00:34:39.806 --> 00:34:42.181 it to anyone who asks nicely, because 00:34:42.201 --> 00:34:44.295 our lack of care about our own personal 00:34:44.301 --> 00:34:47.072 data translates to a lack of care for 00:34:47.125 --> 00:34:48.614 other companies to keep our personal 00:34:48.616 --> 00:34:50.746 data private, and that translates to 00:34:50.748 --> 00:34:52.500 criminals like Ricky who are exploiting 00:34:52.513 --> 00:34:55.353 our lack of care for his personal gain. 00:34:55.880 --> 00:34:58.410 We should be way more protective of who 00:34:58.412 --> 00:35:00.235 we're giving our private information to. 00:35:00.608 --> 00:35:01.397 RICKY: All you had to do was put 00:35:01.620 --> 00:35:05.396 your name in the search, and it would 00:35:05.398 --> 00:35:07.085 show me all your addresses and stuff. 00:35:07.423 --> 00:35:08.395 That’s how I would be able to 00:35:08.395 --> 00:35:10.612 buy the correct social, because 00:35:10.784 --> 00:35:12.528 let’s say your name is like a 00:35:12.532 --> 00:35:13.931 very common name or something. 00:35:14.269 --> 00:35:16.105 But I can match up your dox, like 00:35:16.105 --> 00:35:17.287 your address and stuff, on the page. 00:35:17.303 --> 00:35:19.213 That’s how I know what social to buy. 00:35:21.422 --> 00:35:22.774 So, I’m not just blowing through 00:35:23.096 --> 00:35:25.337 everybody named John Doe, and 00:35:25.637 --> 00:35:26.449 there’s a hundred of them. 00:35:27.751 --> 00:35:29.724 I would just specifically target the one 00:35:29.731 --> 00:35:32.144 that had the correct dox and buy their 00:35:32.145 --> 00:35:34.712 social for $3, call up AT&T, Verizon, 00:35:34.712 --> 00:35:37.195 or T-Mobile or Sprint, and give them 00:35:37.196 --> 00:35:38.497 the last four of the social to verify 00:35:38.499 --> 00:35:39.767 the account, and just SIM-swap them. 00:35:41.476 --> 00:35:43.231 JACK: Okay, is it that simple? 00:35:43.254 --> 00:35:44.675 You could call up this place and 00:35:44.681 --> 00:35:46.029 say, hey, I got a new phone number? 00:35:46.170 --> 00:35:46.789 RICKY: Back then, yeah. 00:35:47.534 --> 00:35:48.186 JACK: Okay. 00:35:49.238 --> 00:35:50.417 Then can we verify 00:35:50.432 --> 00:35:51.616 who — that it’s actually you? 00:35:51.616 --> 00:35:53.191 Okay, what information do you need? 00:35:53.268 --> 00:35:54.350 Well, let’s have your social. 00:35:54.374 --> 00:35:55.200 Okay, here it is. 00:35:55.390 --> 00:35:56.196 Do you have your phone number? 00:35:56.198 --> 00:35:56.788 Okay, here it is. 00:35:56.790 --> 00:35:57.758 That’s all we need, sir. 00:35:59.196 --> 00:35:59.960 RICKY: Yeah, that was it. 00:36:00.156 --> 00:36:01.662 Then they would ask for the new 00:36:01.769 --> 00:36:03.547 IMEI and the new SIM card number. 00:36:05.122 --> 00:36:06.709 I had a burner phone, and that was it. 00:36:06.962 --> 00:36:09.115 I’d get the text and I’d be in and out. 00:36:11.606 --> 00:36:13.450 JACK: [Music] When Ricky started 00:36:13.453 --> 00:36:15.636 SIM-swapping in 2015, he was 00:36:15.636 --> 00:36:16.917 going after video game accounts 00:36:16.938 --> 00:36:18.283 and social media usernames. 00:36:18.798 --> 00:36:20.587 This is when his efforts 00:36:20.587 --> 00:36:21.699 really kicked into gear. 00:36:21.710 --> 00:36:23.354 He was taking over dozens of phone 00:36:23.360 --> 00:36:25.328 numbers and stealing lots of usernames.

00:36:25.897 --> 00:36:27.717 But after a while he started to connect 00:36:27.718 --> 00:36:29.441 some dots, and his friends did, too. 00:36:30.064 --> 00:36:31.191 All these usernames he was 00:36:31.191 --> 00:36:33.377 selling made his Bitcoin wallet 00:36:33.490 --> 00:36:35.347 keep getting bigger and bigger. 00:36:35.675 --> 00:36:38.112 At the time, in 2016, Bitcoin was on 00:36:38.112 --> 00:36:40.241 this massive bull run, rising steadily 00:36:40.257 --> 00:36:42.371 and quickly, which meant a lot of 00:36:42.374 --> 00:36:44.169 people were getting into Bitcoin. 00:36:44.952 --> 00:36:46.879 If you went anywhere online back 00:36:46.880 --> 00:36:48.780 then, you would definitely hear 00:36:48.781 --> 00:36:50.785 someone talking about Bitcoin. 00:36:51.260 --> 00:36:52.049 SPEAKER 1: It’s called Bitcoin, 00:36:52.070 --> 00:36:53.687 but it isn't really a coin, okay? 00:36:53.689 --> 00:36:55.021 It’s an intangible thing. 00:36:55.030 --> 00:36:56.531 It’s a logarithmic number. 00:36:56.768 --> 00:36:58.343 SPEAKER 2: Bitcoin has outperformed 00:36:58.746 --> 00:37:01.471 every other investment around. 00:37:01.550 --> 00:37:02.770 SPEAKER 3: Trading never ceases. 00:37:02.992 --> 00:37:04.997 Every ten minutes Bitcoin’s 00:37:05.009 --> 00:37:07.114 heart beats [snaps fingers] 00:37:07.114 --> 00:37:09.149 and transactions are processed. 00:37:09.585 --> 00:37:11.029 The exchanges never close. 00:37:11.536 --> 00:37:13.370 JACK: Social media and YouTube was 00:37:13.372 --> 00:37:15.420 going nuts about cryptocurrencies. 00:37:15.448 --> 00:37:17.212 If you were holding Bitcoin then, in six 00:37:17.212 --> 00:37:18.490 months your money would have doubled, 00:37:18.531 --> 00:37:19.977 and it was rising exponentially. 00:37:19.999 --> 00:37:21.189 It would have doubled again four 00:37:21.191 --> 00:37:22.337 months after that and then doubled 00:37:22.337 --> 00:37:23.464 again three months after that. 00:37:23.694 --> 00:37:25.255 A lot of people were jumping in 00:37:25.265 --> 00:37:27.245 fast, investing, holding, and 00:37:27.247 --> 00:37:29.372 surprisingly telling everyone 00:37:29.373 --> 00:37:30.384 else what they're holding. 00:37:30.680 --> 00:37:31.562 SPEAKER 4: I personally — I 00:37:31.563 --> 00:37:32.962 own Bitcoin in my hedge fund. 00:37:32.986 --> 00:37:34.223 I own Bitcoin in my fund. 00:37:34.237 --> 00:37:36.333 I own Bitcoin in my private account. 00:37:37.836 --> 00:37:40.105 It is a huge deal. 00:37:40.536 --> 00:37:41.837 SPEAKER 5: I will show you my 00:37:41.903 --> 00:37:44.510 trend trading strategy for crypto. 00:37:44.770 --> 00:37:47.380 JACK: Ricky had Bitcoin and Ethereum 00:37:47.384 --> 00:37:49.421 himself, so he was watching videos 00:37:49.423 --> 00:37:51.085 like this, and he was seeing this new 00:37:51.087 --> 00:37:52.927 surge of holders come onto the scene. 00:37:53.418 --> 00:37:55.513 He understood crypto enough to be familiar 00:37:55.514 --> 00:37:58.104 with how it all worked, how it’s stored, 00:37:58.217 --> 00:38:00.354 how to transfer it, how to secure it. 00:38:01.094 --> 00:38:03.062 See, Bitcoin is electronic money. 00:38:03.164 --> 00:38:04.744 To transfer it, it’s really no 00:38:04.745 --> 00:38:06.235 harder than just sending an e-mail. 00:38:06.806 --> 00:38:09.436 When it’s sent, there’s no way to undo it. 00:38:10.005 --> 00:38:11.935 So, Ricky and his online friends got 00:38:11.937 --> 00:38:14.321 the idea that instead of hacking into 00:38:14.322 --> 00:38:16.720 people’s stuff to steal something to 00:38:16.722 --> 00:38:18.785 then sell it to turn it into Bitcoin, 00:38:19.232 --> 00:38:21.312 why not just hack into their crypto 00:38:21.312 --> 00:38:24.036 wallets directly and just steal it? 00:38:24.825 --> 00:38:26.298 Because after a while, social 00:38:26.299 --> 00:38:27.324 media handles and gamer 00:38:27.325 --> 00:38:28.536 tags just weren't enough. 00:38:28.681 --> 00:38:30.952 It was time to go bigger, something with 00:38:30.955 --> 00:38:33.653 greater payouts and an even greater risk. 00:38:34.022 --> 00:38:35.535 It was time to target 00:38:35.585 --> 00:38:37.067 people’s crypto wallets. 00:38:37.120 --> 00:38:37.908 [To Ricky] Well, you would SIM-swap 00:38:37.924 --> 00:38:39.491 them to get what, a username? 00:38:40.290 --> 00:38:40.658 RICKY: Yeah. 00:38:40.705 --> 00:38:42.058 Like I said, if we couldn't take 00:38:42.058 --> 00:38:44.682 the e-mail or something but we had 00:38:44.682 --> 00:38:45.813 the number on file, we would just 00:38:45.813 --> 00:38:47.524 SIM-swap it and then reset the e-mail. 00:38:47.960 --> 00:38:49.145 JACK: [Music] That was the whole point 00:38:49.235 --> 00:38:51.581 to the SIM-swap, to access their e-mail 00:38:51.582 --> 00:38:54.219 account, by saying I forgot my password, 00:38:54.231 --> 00:38:55.848 and it would text them a code to reset it. 00:38:55.956 --> 00:38:57.382 Once he got into the e-mail account, 00:38:57.395 --> 00:38:59.439 it was suddenly a high-stakes, 00:38:59.518 --> 00:39:01.136 mad dash kind of moment. 00:39:01.622 --> 00:39:03.787 Typically it was a group effort. 00:39:03.909 --> 00:39:04.942 A few of his close friends 00:39:04.971 --> 00:39:06.203 would also be part of this. 00:39:06.397 --> 00:39:07.404 Once the phone number was 00:39:07.406 --> 00:39:08.714 moved over to his new phone, 00:39:08.924 --> 00:39:10.828 suddenly everyone was engaged. 00:39:11.029 --> 00:39:12.201 First they'd crack into the e-mail 00:39:12.201 --> 00:39:14.113 address, then that username and password 00:39:14.113 --> 00:39:15.732 would get shared to the group, and his 00:39:15.732 --> 00:39:17.968 crew would start looting the inbox, 00:39:17.982 --> 00:39:20.560 looking for anything crypto-related to 00:39:20.560 --> 00:39:23.591 try to see where their Bitcoin was stored. 00:39:23.797 --> 00:39:24.834 RICKY: If we're in your Gmail, 00:39:24.856 --> 00:39:25.680 we're searching the inbox. 00:39:25.685 --> 00:39:26.589 If we're

in your iCloud, we’re 00:39:26.593 --> 00:39:28.977 searching pictures, text pads, 00:39:29.804 --> 00:39:31.263 drafts and stuff like that. 00:39:32.066 --> 00:39:34.153 For Gmail specifically, a lot of 00:39:34.153 --> 00:39:35.868 people will save passwords on Gmail. 00:39:35.871 --> 00:39:38.134 So, we're gonna check all those 00:39:38.142 --> 00:39:39.314 passwords and then see if they work. 00:39:40.729 --> 00:39:42.391 I will say there was one time 00:39:43.191 --> 00:39:45.402 that me and a couple friends, we 00:39:45.403 --> 00:39:47.950 were able to get into an account. 00:39:48.027 --> 00:39:49.827 So, he had a blockchain account. 00:39:50.511 --> 00:39:51.435 We were like, okay, let’s go. 00:39:51.471 --> 00:39:52.119 So, we went into the 00:39:52.122 --> 00:39:53.174 blockchain, reset the password. 00:39:53.174 --> 00:39:53.617 We're in. 00:39:53.902 --> 00:39:56.685 It had mid seven figures in it. 00:39:59.077 --> 00:40:02.104 He had a password to send the money out, 00:40:02.984 --> 00:40:04.364 and we could never find that password. 00:40:07.002 --> 00:40:09.521 So, we never took anything. 00:40:10.178 --> 00:40:11.009 We’re sitting there looking 00:40:11.062 --> 00:40:12.257 at — we're looking at that much 00:40:12.261 --> 00:40:15.897 money, and we never got it. 00:40:16.897 --> 00:40:18.310 JACK: People will typically store their 00:40:18.315 --> 00:40:19.879 crypto in one of two places, either on an 00:40:19.879 --> 00:40:22.118 exchange or in their own private wallet. 00:40:22.404 --> 00:40:24.138 If it’s on an exchange, well, 00:40:24.140 --> 00:40:25.466 that would quickly be discovered, 00:40:25.468 --> 00:40:26.993 because he’s in their inbox. 00:40:26.999 --> 00:40:28.140 So, he’s just searching for every 00:40:28.140 --> 00:40:30.047 major exchange to see if that 00:40:30.049 --> 00:40:31.196 person has an account there. 00:40:31.819 --> 00:40:33.361 If they found an e-mail like Welcome 00:40:33.361 --> 00:40:35.423 to Coinbase, then they'd know this 00:40:35.423 --> 00:40:37.151 e-mail address has a Coinbase account, 00:40:37.566 --> 00:40:38.826 and they'd just go into Coinbase 00:40:38.827 --> 00:40:40.051 and say, I forgot my password. 00:40:40.308 --> 00:40:41.561 They'd say, no problem. 00:40:41.561 --> 00:40:44.366 We’ll e-mail you a recovery link, 00:40:44.367 --> 00:40:46.076 and they would recover the password. 00:40:46.680 --> 00:40:49.101 Boom, he would get into Coinbase and then 00:40:49.440 --> 00:40:51.686 have full control of someone else’s money. 00:40:52.348 --> 00:40:54.355 If the person is storing it in a private 00:40:54.356 --> 00:40:56.008 wallet, then to get access to that 00:40:56.010 --> 00:40:57.202 you would need the private key for 00:40:57.202 --> 00:40:59.092 that wallet or a seed phrase, which is 00:40:59.093 --> 00:41:00.649 what’s used to generate the private key. 00:41:01.008 --> 00:41:02.599 Ricky and his team understood what 00:41:02.600 --> 00:41:04.431 these keys and phrases looked

like. 00:41:04.565 --> 00:41:06.846 So, he would look for them in the inbox. 00:41:07.366 --> 00:41:09.132 Because these are things that you never 00:41:09.133 --> 00:41:10.772 want to lose if you're holding crypto. 00:41:11.080 --> 00:41:12.814 A lot of people will just e-mail 00:41:12.815 --> 00:41:14.234 themselves the private keys. 00:41:14.526 --> 00:41:15.950 So, surprisingly, searching for 00:41:15.964 --> 00:41:17.636 ‘private key’ or ‘seed phrase’ 00:41:17.656 --> 00:41:20.145 resulted in finding crypto wallets. 00:41:20.868 --> 00:41:22.281 But sometimes people would take 00:41:22.285 --> 00:41:24.136 screenshots of these things and store them 00:41:24.136 --> 00:41:25.906 on their iCloud or Google Photos account. 00:41:25.942 --> 00:41:27.790 You know, for safe keeping. 00:41:28.183 --> 00:41:29.690 Surely no one has access 00:41:29.690 --> 00:41:31.357 to your photos, right? 00:41:31.936 --> 00:41:33.243 Well, this crew would rummage through 00:41:33.244 --> 00:41:35.323 those photos, looking for anything that 00:41:35.344 --> 00:41:38.118 looked like a photo of a password or a key 00:41:38.118 --> 00:41:40.620 or a wallet, anything sensitive like that. 00:41:41.171 --> 00:41:43.497 Eventually they would find a 00:41:43.502 --> 00:41:45.492 crypto wallet and drain it. 00:41:45.757 --> 00:41:46.925 RICKY: The people that would — that 00:41:46.926 --> 00:41:48.126 were in the e-mail would do that, and 00:41:48.127 --> 00:41:49.230 then they would send it out to one 00:41:49.230 --> 00:41:50.836 of our fresh wallets that we all had. 00:41:51.985 --> 00:41:52.531 JACK: And then from there 00:41:52.534 --> 00:41:53.798 split it however many ways. 00:41:53.801 --> 00:41:54.223 RICKY: Yeah. 00:41:54.423 --> 00:41:56.502 From there, then you split it separately. 00:41:56.828 --> 00:41:57.586 We're a group, so we 00:41:57.587 --> 00:41:58.442 always split everything. 00:41:58.825 --> 00:42:00.434 But like, I’m busy, I’m working. 00:42:00.758 --> 00:42:03.261 They have to just wait for me to be ready, 00:42:04.118 --> 00:42:06.146 'cause I typically had the burner phone. 00:42:06.517 --> 00:42:07.319 JACK: Ricky doesn't remember 00:42:07.319 --> 00:42:08.734 the first crypto heist he did. 00:42:08.740 --> 00:42:09.785 He says it was probably something 00:42:09.785 --> 00:42:11.718 low, like probably under $20,000. 00:42:12.082 --> 00:42:12.881 If you split that four 00:42:12.883 --> 00:42:14.493 ways, it’s way less, right? 00:42:14.877 --> 00:42:16.464 Because he was in this crew, 00:42:16.515 --> 00:42:17.814 and Ricky had a certain skill 00:42:17.816 --> 00:42:19.502 set that complimented his crew. 00:42:19.736 --> 00:42:21.051 RICKY: Mine was probably doxxing 00:42:21.060 --> 00:42:22.705 the person, finding the information. 00:42:22.707 --> 00:42:24.020 I had the burner phones. 00:42:24.144 --> 00:42:25.587 JACK: This was the beginning 00:42:25.819 --> 00:42:28.352 of Ricky’s crypto heist spree. 00:42:28.997 --> 00:42:30.305 We're gonna take a quick ad break 00:42:30.305 --> 00:42:31.432 here, but stay with us, because 00:42:31.437 --> 00:42:33.077 when we come back, I’m gonna 00:42:33.089 --> 00:42:34.310 introduce you to his mother. 00:42:36.990 --> 00:42:38.095 While researching this episode, 00:42:38.095 --> 00:42:39.598 I met this guy named Mark. 00:42:39.827 --> 00:42:41.668 MARK: My name is Mark Kreitzman, and 00:42:41.671 --> 00:42:44.460 I’m pretty much a lifelong tech guy. 00:42:44.644 --> 00:42:45.756 JACK: When I sat down with him to listen 00:42:45.756 --> 00:42:47.838 to his story, his story takes place at the 00:42:47.839 --> 00:42:50.196 same time Ricky was doing all this stuff. 00:42:50.259 --> 00:42:51.430 MARK: At the time I was working 00:42:51.430 --> 00:42:53.232 on something in the crypto space. 00:42:53.854 --> 00:42:56.312 I had been interviewed a couple 00:42:56.312 --> 00:42:57.767 times, so I was interviewed 00:42:57.768 --> 00:42:59.236 on a couple YouTube channels. 00:42:59.285 --> 00:43:03.631 I had my name and persona on the website 00:43:03.645 --> 00:43:05.214 that I was developing at the time. 00:43:06.102 --> 00:43:06.542 JACK: [Music] There was this 00:43:06.544 --> 00:43:08.797 night in 2018 that permanently 00:43:08.801 --> 00:43:10.263 burned into Mark’s memory. 00:43:10.591 --> 00:43:12.502 He remembers driving through the Arizona 00:43:12.502 --> 00:43:14.629 desert on his way to visit his dad. 00:43:15.872 --> 00:43:17.417 MARK: I was actually talking to my father, 00:43:17.433 --> 00:43:18.890 and then all of a sudden the line is dead. 00:43:19.997 --> 00:43:20.993 JACK: But Mark doesn't freak out. 00:43:21.006 --> 00:43:22.135 He’s driving through the Arizona 00:43:22.135 --> 00:43:23.809 desert, far from civilization. 00:43:24.040 --> 00:43:25.299 The reception isn't great out there, 00:43:25.300 --> 00:43:26.294 so he’s thinking, you know what? 00:43:26.295 --> 00:43:28.000 Maybe I’m just out of range of the towers. 00:43:28.195 --> 00:43:28.939 MARK: I was sitting there on 00:43:28.939 --> 00:43:30.268 my — on the dashboard, so I 00:43:30.268 --> 00:43:32.396 could see the front of the phone. 00:43:32.396 --> 00:43:34.840 It said — it was like a network 00:43:34.843 --> 00:43:38.422 disconnect error, and an SOS at the top. 00:43:39.033 --> 00:43:40.099 JACK: How strange. 00:43:40.386 --> 00:43:41.721 But he can't do anything now. 00:43:41.721 --> 00:43:44.361 There’s no cell service to call customer 00:43:44.361 --> 00:43:45.797 support even if he wanted, and he’s 00:43:45.798 --> 00:43:47.326 still driving to his dad’s house. 00:43:47.765 --> 00:43:48.819 Maybe it’ll start working 00:43:48.819 --> 00:43:49.470 when he gets there. 00:43:49.913 --> 00:43:51.051 Mark concentrates on the 00:43:51.053 --> 00:43:51.877 road in front of him. 00:43:52.301 --> 00:43:53.718 His headlights carve out a small 00:43:53.718 --> 00:43:54.971 bubble of light on the road. 00:43:55.989 --> 00:43:58.109 About ten minutes go by, and still 00:43:58.174

--> 00:44:00.114 his phone isn't connected to anything. 00:44:00.799 --> 00:44:02.285 Panic starts to sink in. 00:44:03.000 --> 00:44:04.599 He knew about SIM-swapping 00:44:04.605 --> 00:44:06.410 attacks, and now his thoughts 00:44:06.524 --> 00:44:07.611 were starting to eat him up. 00:44:08.105 --> 00:44:09.622 What if someone targeted him? 00:44:10.181 --> 00:44:11.440 His heart started racing. 00:44:12.199 --> 00:44:14.227 But this can't happen to Mark. 00:44:14.227 --> 00:44:15.292 He was smart about this. 00:44:15.294 --> 00:44:16.685 He put safeguards in place 00:44:16.903 --> 00:44:18.377 for this exact attack. 00:44:18.583 --> 00:44:20.944 It is not possible to SIM-swap him. 00:44:21.024 --> 00:44:23.035 He thought about this and he was ready. 00:44:23.590 --> 00:44:24.767 MARK: I knew that it could happen, 00:44:25.052 --> 00:44:27.187 and — but I thought — I had set up 00:44:27.187 --> 00:44:29.480 my account profile with the carrier 00:44:29.524 --> 00:44:33.326 to where if I wanted to make a change 00:44:33.326 --> 00:44:35.182 on my account, I would have to go 00:44:35.182 --> 00:44:37.252 into a store physically and have my 00:44:37.252 --> 00:44:39.345 driver’s license and my passport. 00:44:39.696 --> 00:44:41.404 JACK: Yeah, so, he set up his account to 00:44:41.404 --> 00:44:43.700 require two forms of ID, and he had to 00:44:43.707 --> 00:44:45.861 be present in the store for it to happen. 00:44:46.118 --> 00:44:48.064 There was no way to change 00:44:48.066 --> 00:44:49.482 his number over the phone. 00:44:50.270 --> 00:44:51.423 But despite putting those 00:44:51.423 --> 00:44:53.361 safeguards in place, his thoughts 00:44:53.361 --> 00:44:55.743 were still racing about what if? 00:44:55.957 --> 00:44:57.397 What if it did happen? 00:44:57.982 --> 00:44:59.386 There was no one around to help, 00:44:59.826 --> 00:45:01.322 and he had no working cell phone. 00:45:01.868 --> 00:45:03.078 He was all alone on the 00:45:03.078 --> 00:45:04.299 road with his thoughts. 00:45:04.863 --> 00:45:05.745 Maybe it’s just a 00:45:05.745 --> 00:45:06.942 network connection issue. 00:45:07.246 --> 00:45:08.659 Maybe the bill didn't get paid. 00:45:09.077 --> 00:45:10.020 Maybe the credit card 00:45:10.020 --> 00:45:11.034 got marked as stolen. 00:45:11.545 --> 00:45:12.471 What is it? 00:45:12.480 --> 00:45:13.268 What's wrong? 00:45:13.855 --> 00:45:15.773 A little over an hour goes by 00:45:15.827 --> 00:45:18.353 with no connection, and he finally 00:45:18.437 --> 00:45:19.915 arrives at his dad’s house. 00:45:20.209 --> 00:45:22.386 MARK: As soon as I got close to my 00:45:22.387 --> 00:45:24.598 parents’ house, the Wi-Fi kicks in and six 00:45:24.609 --> 00:45:26.646 password resets went right at my phone. 00:45:27.694 --> 00:45:29.221 So, that’s when I knew that 00:45:29.248 --> 00:45:30.942 it was an actual nightmare. 00:45:31.399 --> 00:45:33.040 My dad’s — opens the door. 00:45:33.631 --> 00:45:35.507 He wants to greet me, give me

a hug, 00:45:35.507 --> 00:45:36.765 and I’m like, I got an emergency. 00:45:36.765 --> 00:45:38.468 I hadn't seen him in two years. 00:45:40.311 --> 00:45:40.974 It was panic. 00:45:40.976 --> 00:45:42.299 So, as soon as I got my mobile phone 00:45:42.304 --> 00:45:44.627 working, now I have to go deal with all 00:45:44.635 --> 00:45:47.620 the accounts, like the e-mail they got 00:45:47.621 --> 00:45:49.422 into to make sure they didn't set up some 00:45:49.428 --> 00:45:51.877 CC where it’s like, every e-mail I send 00:45:51.879 --> 00:45:54.623 out they get a copy without me knowing. 00:45:55.199 --> 00:45:56.630 JACK: So, when you see that, now 00:45:56.630 --> 00:45:58.650 you — now your suspicion is confirmed. 00:45:59.160 --> 00:46:01.617 So, I imagine your heart sank. 00:46:01.710 --> 00:46:03.524 MARK: [Music] Oh yeah, it was — I 00:46:03.524 --> 00:46:06.024 mean, I still have PTSD over it today. 00:46:08.015 --> 00:46:10.622 JACK: Six accounts, one attack. 00:46:10.988 --> 00:46:13.408 It all happened so fast, all 00:46:13.410 --> 00:46:14.807 while Mark was stuck behind the 00:46:14.808 --> 00:46:16.060 wheel in the middle of the desert, 00:46:16.095 --> 00:46:17.910 unable to do a thing about it. 00:46:18.174 --> 00:46:19.337 By the time he made it to his 00:46:19.337 --> 00:46:20.835 dad’s house, he called the carrier 00:46:20.837 --> 00:46:22.191 to try to find out what happened. 00:46:22.578 --> 00:46:23.763 MARK: Hey, I think something’s wrong. 00:46:23.763 --> 00:46:25.647 I think my mobile account got stolen away. 00:46:26.006 --> 00:46:27.285 JACK: The person on the line 00:46:27.307 --> 00:46:28.810 jumps into liability mode and 00:46:28.810 --> 00:46:30.751 wonders if Mark is the one lying. 00:46:31.084 --> 00:46:32.098 MARK: Well, how am I —? I 00:46:32.099 --> 00:46:33.410 called you on my phone. 00:46:33.757 --> 00:46:36.043 I was in such a panic that I rushed inside 00:46:36.044 --> 00:46:37.407 the house and called you from my cell 00:46:37.408 --> 00:46:39.098 phone, so how am I even able to call you? 00:46:39.551 --> 00:46:40.765 JACK: Good point, says the carrier. 00:46:40.991 --> 00:46:42.472 Mark quickly starts trying 00:46:42.473 --> 00:46:43.626 to recover his account. 00:46:43.687 --> 00:46:45.542 He knew he had been SIM-swapped. 00:46:45.605 --> 00:46:46.693 He knew his accounts were 00:46:46.694 --> 00:46:47.712 taken over by someone else. 00:46:47.712 --> 00:46:48.926 He knew people were trying to 00:46:48.926 --> 00:46:50.467 steal money from him right now. 00:46:50.485 --> 00:46:52.236 There was no time to say hi to dad. 00:46:52.406 --> 00:46:53.515 He rolls up his sleeves 00:46:53.532 --> 00:46:54.632 and gets busy trying to get 00:46:54.634 --> 00:46:55.892 control of his accounts again. 00:46:56.169 --> 00:46:57.888 Lucky for him, he was able to get his 00:46:57.890 --> 00:46:59.997 phone reconnected rather quickly, but 00:46:59.998 --> 00:47:02.338 the hackers had an hour head start. 00:47:02.743 -->

00:47:04.822 So, he’s racing to do damage control. 00:47:04.938 --> 00:47:06.605 He did a password reset on his e-mail. 00:47:06.641 --> 00:47:07.393 He got back in. 00:47:07.503 --> 00:47:09.457 He looked to see what e-mails came in that 00:47:09.457 --> 00:47:11.315 were password resets for a few accounts. 00:47:11.504 --> 00:47:12.640 MARK: It was a bank account, it 00:47:12.642 --> 00:47:14.869 was two crypto accounts, two cloud 00:47:14.869 --> 00:47:16.301 accounts, and an e-mail account. 00:47:16.648 --> 00:47:17.830 So, I have to reset them 00:47:17.830 --> 00:47:19.140 and check the details. 00:47:19.245 --> 00:47:20.950 JACK: One was his Coinbase account. 00:47:20.960 --> 00:47:22.883 Someone changed the password on it. 00:47:23.949 --> 00:47:25.590 That’s where he kept his Bitcoin. 00:47:25.830 --> 00:47:28.151 It’s not good to see that someone 00:47:28.341 --> 00:47:30.339 got access to his Coinbase wallet. 00:47:30.855 --> 00:47:32.442 He resets the password there and 00:47:32.442 --> 00:47:33.812 gets into it to see what happened. 00:47:34.062 --> 00:47:34.794 MARK: The only thing I had 00:47:34.794 --> 00:47:36.966 at that point was Bitcoin. 00:47:37.578 --> 00:47:38.930 It’s the only thing I cared about. 00:47:38.932 --> 00:47:40.183 I wasn't doing anything else. 00:47:40.185 --> 00:47:42.145 It was pure Bitcoin. 00:47:42.149 --> 00:47:45.408 So, they just took the 2.2 Bitcoin away. 00:47:46.111 --> 00:47:47.482 JACK: Dang, they stole all of it. 00:47:47.817 --> 00:47:49.044 It was everything he had. 00:47:49.567 --> 00:47:50.961 That wasn't worth a lot of money at 00:47:50.962 --> 00:47:53.335 the time, but still, they got him for 00:47:53.335 --> 00:47:55.748 everything, and it all happened so fast. 00:47:55.748 --> 00:47:56.836 Mark was mortified. 00:47:57.082 --> 00:47:57.767 It’s like coming to your 00:47:57.767 --> 00:47:59.106 house just to see the place 00:47:59.317 --> 00:48:01.122 ransacked, your valuables stolen. 00:48:01.465 --> 00:48:03.306 Suddenly you feel so vulnerable. 00:48:03.308 --> 00:48:04.352 You feel defenceless. 00:48:04.374 --> 00:48:05.544 You don't know if they're 00:48:05.544 --> 00:48:06.970 coming back or what's next. 00:48:07.128 --> 00:48:08.496 MARK: At that point my mobile service 00:48:08.501 --> 00:48:10.575 is working, but then every time I 00:48:10.575 --> 00:48:12.917 went to sleep, I’m thinking, well, are 00:48:12.917 --> 00:48:15.466 they gonna SIM-swap me an hour later 00:48:15.482 --> 00:48:18.084 and then port it back at 4:00 a.m.? 00:48:19.189 --> 00:48:21.133 So, for about sixty to ninety 00:48:21.133 --> 00:48:23.767 days, every day I woke up, whether 00:48:23.767 --> 00:48:25.437 it was 3:00 in the morning, 6:00, 00:48:25.437 --> 00:48:28.203 7:00 in the morning, I would look 00:48:28.205 --> 00:48:30.064 at my phone and see if it had LTE. 00:48:30.933 --> 00:48:33.526 I didn't use Wi-Fi for about ninety 00:48:33.526 --> 00:48:35.297 days because I was afraid that would 00:48:35.299

--> 00:48:37.732 mask it, where I’d wake up and — I’ve 00:48:37.769 --> 00:48:40.388 got Twitter updates, e-mail updates, 00:48:40.388 --> 00:48:43.038 whatever comes in on the phone over data. 00:48:43.057 --> 00:48:45.536 I might get tricked in thinking that 00:48:45.872 --> 00:48:47.774 the voice and the SMS is still working. 00:48:48.369 --> 00:48:50.529 JACK: [Music] Mark became obsessed with 00:48:50.552 --> 00:48:52.540 trying to find out who did this to him. 00:48:52.628 --> 00:48:54.587 He called the mobile provider over 00:48:54.651 --> 00:48:56.732 and over again seeking answers, but 00:48:56.732 --> 00:48:58.818 they refused to tell him anything. 00:48:59.128 --> 00:49:01.540 All he wanted to know was what employee, 00:49:01.575 --> 00:49:03.614 what store authorized this SIM-swap? 00:49:03.633 --> 00:49:04.966 Because he put those protections in 00:49:04.966 --> 00:49:06.548 place, so how did all that get ignored? 00:49:06.900 --> 00:49:07.991 But they were protecting their 00:49:07.991 --> 00:49:10.209 employees by not saying which employee 00:49:10.214 --> 00:49:11.641 did it or how it happened or what 00:49:11.644 --> 00:49:13.175 department did it or what store. 00:49:13.599 --> 00:49:16.045 But after a lot of persistence and a lucky 00:49:16.045 --> 00:49:18.860 break, he traced it back to an employee 00:49:18.907 --> 00:49:21.317 at a third-party phone store in Memphis, 00:49:21.326 --> 00:49:23.235 Tennessee — you know, the ones that say 00:49:23.481 --> 00:49:25.025 they're authorized resellers of a mobile 00:49:25.025 --> 00:49:27.932 provider — nowhere near where Mark lived. 00:49:28.561 --> 00:49:30.454 It happened to be that employee’s 00:49:30.477 --> 00:49:33.389 last day at work, and it looks like 00:49:33.389 --> 00:49:35.570 someone paid them to SIM-swap a 00:49:35.574 --> 00:49:37.407 few phone numbers before leaving. 00:49:37.989 --> 00:49:39.897 So, while it says very clearly in Mark’s 00:49:39.897 --> 00:49:41.973 account ‘Do not SIM-swap this customer 00:49:41.973 --> 00:49:43.861 unless they show two types of photo ID 00:49:43.866 --> 00:49:46.243 and are there in person’, the employee 00:49:46.316 --> 00:49:48.015 had enough privileges in the system to 00:49:48.017 --> 00:49:50.779 simply type, yeah, I saw both IDs and he 00:49:50.779 --> 00:49:53.261 was here in person, and he was able to 00:49:53.269 --> 00:49:54.971 conduct the SIM-swap, because at the end 00:49:54.973 --> 00:49:56.397 of the day, that’s all this really is. 00:49:56.703 --> 00:49:58.238 It’s a confirmation on a computer 00:49:58.240 --> 00:50:00.014 somewhere that you saw both IDs. 00:50:00.556 --> 00:50:02.051 Mark says that’s as far as he 00:50:02.052 --> 00:50:03.239 got with his investigation. 00:50:03.241 --> 00:50:04.861 He doesn't know where his money 00:50:04.862 --> 00:50:06.221 went or who actually stole it. 00:50:06.634 --> 00:50:07.865 Just because the guy in the store 00:50:07.865 --> 00:50:09.380 did the SIM-swap doesn't mean

that 00:50:09.380 --> 00:50:10.663 he’s the one who stole the crypto. 00:50:10.859 --> 00:50:13.149 He just got paid his cut for 00:50:13.168 --> 00:50:15.834 doing the swap, which is known as 00:50:15.835 --> 00:50:17.777 an innie, an insider to help you 00:50:18.034 --> 00:50:19.476 get someone else’s phone number. 00:50:20.225 --> 00:50:22.121 While this absolutely terrified Mark 00:50:22.122 --> 00:50:24.578 and infuriated him, he didn't feel like 00:50:24.578 --> 00:50:25.819 it was a big enough loss for him to 00:50:25.824 --> 00:50:27.881 open an investigation and go to court. 00:50:28.504 --> 00:50:30.391 Even if he somehow recovered his Bitcoin, 00:50:30.395 --> 00:50:31.875 it would cause way more in lawyer 00:50:31.875 --> 00:50:33.388 fees and it just wouldn't be worth it. 00:50:33.865 --> 00:50:35.136 So, he let it go. 00:50:35.435 --> 00:50:36.962 The thieves got away cleanly 00:50:36.964 --> 00:50:38.906 with his 2.2 Bitcoin. 00:50:39.982 --> 00:50:41.509 It’s been over a decade now 00:50:41.514 --> 00:50:42.911 since this attack, and still 00:50:43.007 --> 00:50:44.647 Mark can't fully shake this. 00:50:44.852 --> 00:50:46.404 Like, every time he flies, he gets a 00:50:46.404 --> 00:50:48.491 little worried that his phone service is 00:50:48.493 --> 00:50:50.343 going to be disconnected for a few hours. 00:50:50.547 --> 00:50:51.861 Like, a twenty-hour trip to 00:50:51.870 --> 00:50:54.216 Asia is pure agony for him 00:50:54.600 --> 00:50:56.236 after being a victim like this. 00:50:56.538 --> 00:50:57.727 MARK: I mean, I still 00:50:57.729 --> 00:50:59.741 have PTSD over it today. 00:51:00.388 --> 00:51:02.598 Not to take away from real PTSD, but it’s 00:51:02.598 --> 00:51:07.229 sort of this digital PTSD of not knowing. 00:51:07.410 --> 00:51:08.991 Every time I wake up, it’s like, okay, 00:51:08.991 --> 00:51:10.481 I’m gonna log into my computer, log 00:51:10.483 --> 00:51:13.772 in, open up my phone, and of course 00:51:13.782 --> 00:51:15.665 everything has been safe since then. 00:51:16.740 --> 00:51:18.095 But yeah, it was painful. 00:51:18.096 --> 00:51:19.610 I was very angry for months. 00:51:19.626 --> 00:51:20.876 I couldn't sleep for months. 00:51:21.103 --> 00:51:22.157 JACK: But despite this being a 00:51:22.157 --> 00:51:24.642 traumatizing moment for Mark, he used it 00:51:24.665 --> 00:51:26.682 as sort of an origin story of his own. 00:51:27.042 --> 00:51:28.775 He was so sick of mobile providers 00:51:28.778 --> 00:51:30.578 being pointless at protecting us 00:51:30.578 --> 00:51:32.176 against SIM-swaps that he started his 00:51:32.177 --> 00:51:34.947 own service to stop people who try 00:51:34.948 --> 00:51:36.488 to hijack phone numbers like this. 00:51:36.826 --> 00:51:38.428 His company is called Efani. 00:51:38.700 --> 00:51:40.164 It’s a mobile carrier that resells 00:51:40.167 --> 00:51:42.101 AT&T and Verizon service with one 00:51:42.103 --> 00:51:44.137 big difference; extra protection 00:51:44.194 --> 00:51:45.693 against SIM-swap attacks. 00:51:45.894 --> 00:51:47.928 As we heard from Ricky Handschumacher, 00:51:48.196 --> 00:51:49.863 the social engineering starts long 00:51:49.863 --> 00:51:51.439 before the phone call even starts. 00:51:51.598 --> 00:51:53.182 As he told me, he found many of 00:51:53.182 --> 00:51:54.441 his targets because they were just 00:51:54.469 --> 00:51:56.616 too public about their crypto. 00:51:57.046 --> 00:51:58.772 Someone would post on Twitter, excited 00:51:58.772 --> 00:52:00.838 that their coin is going up, or spoke 00:52:00.838 --> 00:52:03.027 on a panel about investing in certain 00:52:03.028 --> 00:52:05.094 coins and then posting that to YouTube, 00:52:05.367 --> 00:52:07.001 or they would share tips on what to 00:52:07.002 --> 00:52:08.826 invest and how to store your coins. 00:52:09.126 --> 00:52:10.352 It’s all an attacker needs 00:52:10.352 --> 00:52:11.544 to hone in on their targets. 00:52:11.545 --> 00:52:13.214 The more they know about what accounts 00:52:13.215 --> 00:52:14.887 you have or what coins you have or what 00:52:14.888 --> 00:52:16.760 software you use, then the more they can 00:52:16.762 --> 00:52:19.338 use that to craft an attack just for you. 00:52:19.764 --> 00:52:21.200 I always tell people the number-one 00:52:21.200 --> 00:52:22.844 rule about having crypto is don't 00:52:22.908 --> 00:52:25.483 tell anyone you have crypto, because 00:52:25.504 --> 00:52:27.326 even if your digital security is 00:52:27.333 --> 00:52:29.121 tip top, I’ve heard stories about 00:52:29.122 --> 00:52:30.884 people getting drugged or robbed at 00:52:30.885 --> 00:52:32.945 gunpoint to get someone’s crypto. 00:52:33.472 --> 00:52:34.672 It’s brutal out there. 00:52:35.368 --> 00:52:37.709 For Mark, all that became a very 00:52:37.711 --> 00:52:39.406 painful lesson that he still thinks 00:52:39.409 --> 00:52:41.643 about nearly a decade after his attack. 00:52:41.930 --> 00:52:44.613 MARK: With crypto, my wife knows that 00:52:44.613 --> 00:52:46.346 when I’m gonna do anything with crypto, 00:52:46.348 --> 00:52:48.799 it’s like, stay thirty feet away from me. 00:52:49.491 --> 00:52:51.127 I don't want any distractions. 00:52:51.127 --> 00:52:53.194 I don't want anybody asking me a question. 00:52:54.451 --> 00:52:56.913 I’m just really very conscious now about 00:52:57.419 --> 00:52:59.837 the fact that most hacking — a lot of 00:52:59.842 --> 00:53:02.743 people think that hackers are trying 00:53:02.743 --> 00:53:04.592 to hack into your laptop or they're 00:53:04.593 --> 00:53:07.392 trying to hack into the back end of 00:53:07.393 --> 00:53:10.116 your Android phone, your iOS phone. 00:53:10.634 --> 00:53:12.540 But the reality is is that it’s probably 00:53:12.540 --> 00:53:15.560 like 99% of hacking is hacking the 00:53:15.560 --> 00:53:17.986 human mind, and it’s trying to get 00:53:18.051 --> 00:53:21.741 you to make a mistake or a company, 00:53:21.752 --> 00:53:23.507

somebody that works at a company that 00:53:23.509 --> 00:53:25.786 you rely on for them to make a mistake. 00:53:26.534 --> 00:53:27.656 It really just comes 00:53:27.656 --> 00:53:29.151 down to hacking the mind. 00:53:29.540 --> 00:53:30.981 JACK: We have no idea if Ricky 00:53:31.011 --> 00:53:32.252 actually hacked Mark or not. 00:53:32.287 --> 00:53:33.750 He probably didn't, but I wanted 00:53:33.750 --> 00:53:35.952 to talk with Mark because I wanted 00:53:35.952 --> 00:53:36.966 to get a feeling of what that 00:53:36.966 --> 00:53:38.449 scenario is like for the victim. 00:53:38.630 --> 00:53:39.784 What does the SIM-swap look 00:53:39.785 --> 00:53:40.830 like from the other side? 00:53:41.026 --> 00:53:42.035 It sounds awful. 00:53:42.129 --> 00:53:43.101 Nobody should have their 00:53:43.102 --> 00:53:44.221 stuff stolen like that. 00:53:44.664 --> 00:53:46.903 Ricky didn't just stop at one heist. 00:53:47.102 --> 00:53:48.391 Once he got a taste of the money 00:53:48.392 --> 00:53:50.170 that he could steal, he was hooked. 00:53:50.333 --> 00:53:52.805 He wanted to do this again and again, and 00:53:52.805 --> 00:53:54.704 very quickly, the money started adding up. 00:53:54.982 --> 00:53:57.461 In 2018, the year Mark was targeted, 00:53:57.798 --> 00:54:00.616 Ricky Handschumacher and his crew got so 00:54:00.616 --> 00:54:02.131 good at this that they were bringing in 00:54:02.144 --> 00:54:04.133 millions of dollars from their victims. 00:54:04.368 --> 00:54:05.417 RICKY: We found the money, we send 00:54:05.417 --> 00:54:08.430 it out, and — a couple million here, 00:54:08.446 --> 00:54:09.792 a couple hundred thousand there. 00:54:10.581 --> 00:54:11.186 It adds up. 00:54:11.510 --> 00:54:13.518 JACK: These numbers are startling, right? 00:54:14.927 --> 00:54:16.359 You've had to be surprised by your 00:54:16.361 --> 00:54:18.587 first big hundred-thousand-dollar 00:54:18.588 --> 00:54:20.490 or million-dollar lick. 00:54:20.547 --> 00:54:21.105 RICKY: Yeah. 00:54:21.147 --> 00:54:22.856 When I started doing it all, like 00:54:22.863 --> 00:54:24.363 actually SIM-swapping and crypto and 00:54:24.364 --> 00:54:27.672 stuff, like late teenager, maybe twenty 00:54:27.778 --> 00:54:30.219 — and I was like, damn, dude, I’m making 00:54:30.220 --> 00:54:33.959 more than people make in a lifetime, 00:54:34.353 --> 00:54:38.795 or more than their decade of a salary. 00:54:38.890 --> 00:54:40.310 I’m making that in ten minutes. 00:54:45.756 --> 00:54:47.026 JACK: [Music] Ricky said that he would 00:54:47.027 --> 00:54:48.456 sometimes pay an employee at a cell 00:54:48.456 --> 00:54:50.203 phone store a couple hundred bucks to 00:54:50.203 --> 00:54:53.254 help them do a SIM-swap, an insider who 00:54:53.254 --> 00:54:55.374 could bypass the security protections, 00:54:55.674 --> 00:54:57.013 just like what happened to Mark. 00:54:57.924 --> 00:55:00.316 This insider, he says, didn't know exactly 00:55:00.318 --> 00:55:02.132 how much was

being stolen in crypto. 00:55:02.439 --> 00:55:03.474 They were just happy to get a few 00:55:03.474 --> 00:55:04.498 hundred bucks to change someone’s 00:55:04.501 --> 00:55:05.513 phone number in the system. 00:55:05.928 --> 00:55:07.204 But that was nothing compared to 00:55:07.204 --> 00:55:08.699 the lion’s share that Ricky and 00:55:08.712 --> 00:55:10.059 his crew would get from the heist. 00:55:10.336 --> 00:55:11.334 RICKY: So, once I had a couple 00:55:11.334 --> 00:55:12.594 million, I was like, damn, 00:55:14.314 --> 00:55:16.481 my moral compass checked in. 00:55:16.482 --> 00:55:19.033 I’m like, actually 00:55:19.034 --> 00:55:20.320 screwing people’s lives up. 00:55:20.558 --> 00:55:21.680 I have my own kid. 00:55:22.086 --> 00:55:24.167 My kid’s gonna be set for life, 00:55:24.571 --> 00:55:27.527 like just living life now. 00:55:28.347 --> 00:55:29.610 But we just kept going. 00:55:30.143 --> 00:55:31.063 It was like — almost like 00:55:31.063 --> 00:55:32.138 an addiction at this point. 00:55:32.687 --> 00:55:33.939 JACK: While all this was going on, 00:55:33.939 --> 00:55:35.499 Ricky was living a double life. 00:55:35.629 --> 00:55:37.267 He had just turned eighteen. 00:55:37.274 --> 00:55:38.535 He had just finished high school. 00:55:38.538 --> 00:55:39.663 He did not get the baseball 00:55:39.663 --> 00:55:40.725 scholarship for college. 00:55:41.066 --> 00:55:42.977 He did get a girlfriend, and they 00:55:42.977 --> 00:55:44.551 had a kid together, and he was 00:55:44.551 --> 00:55:45.886 still living at home with his mom. 00:55:46.687 --> 00:55:49.009 He had a 9:00 to 5:00 job for the county’s 00:55:49.038 --> 00:55:51.279 park and recreation department, you know, 00:55:51.279 --> 00:55:53.656 to keep up with the ruse that he’s got 00:55:53.656 --> 00:55:55.682 some normal job with a regular income. 00:55:56.091 --> 00:55:57.897 But of course, that job was boring 00:55:57.968 --> 00:55:59.397 compared to his online world, 00:55:59.622 --> 00:56:00.886 where millions of dollars were 00:56:00.886 --> 00:56:02.173 passing through his fingers. 00:56:02.486 --> 00:56:04.154 RICKY: So, I was just changing 00:56:04.154 --> 00:56:05.343 trash bags and stuff like that at 00:56:05.343 --> 00:56:06.937 a park, sitting in a work truck. 00:56:06.937 --> 00:56:08.093 So, I had all the time in the 00:56:08.093 --> 00:56:09.718 world to just be on my phone, like 00:56:09.730 --> 00:56:11.038 talking to everybody on Discord 00:56:11.040 --> 00:56:12.029 or Skype or something like that. 00:56:15.002 --> 00:56:17.296 While I’m at work, we're just 00:56:18.051 --> 00:56:19.176 hitting targets for crypto. 00:56:20.184 --> 00:56:21.754 DEBBIE: I had no idea, a 00:56:21.755 --> 00:56:22.947 boy that works for the city. 00:56:23.375 --> 00:56:25.128 JACK: This is Debbie, Ricky’s mom. 00:56:25.294 --> 00:56:26.679 DEBBIE: He had a county job. 00:56:27.120 --> 00:56:28.236 It wasn't the best money, 00:56:28.236 --> 00:56:29.581 but I was happy he

had it. 00:56:29.585 --> 00:56:31.499 He had good benefits, he had retirement 00:56:31.588 --> 00:56:33.946 with it, and he went to work every day. 00:56:34.259 --> 00:56:35.819 JACK: She had no idea her son was 00:56:35.821 --> 00:56:37.349 living this double life, bringing 00:56:37.349 --> 00:56:39.117 in anywhere from $100,000 to a 00:56:39.124 --> 00:56:40.551 million dollars from victims. 00:56:41.021 --> 00:56:42.247 But having all this Bitcoin was 00:56:42.290 --> 00:56:45.053 pointless unless Ricky could spend it, 00:56:45.286 --> 00:56:47.101 and this is where he had to be careful. 00:56:47.314 --> 00:56:49.714 Crypto exchanges require KYC, which 00:56:49.714 --> 00:56:50.964 stands for ‘know your customer’. 00:56:51.019 --> 00:56:52.790 They want your full name and picture 00:56:52.793 --> 00:56:54.537 of your ID before they will let you 00:56:54.698 --> 00:56:56.694 exchange cryptocurrency for cash. 00:56:57.161 --> 00:56:58.432 So, that wasn't going to work. 00:56:58.432 --> 00:57:00.305 His Bitcoin wallet was likely marked as 00:57:00.308 --> 00:57:03.007 fraudulent, and if he used an exchange 00:57:03.016 --> 00:57:04.747 and gave them his name, then they 00:57:04.748 --> 00:57:05.919 would probably call the cops on him. 00:57:06.357 --> 00:57:08.188 So, he needed a new plan, a way to cash 00:57:08.192 --> 00:57:10.034 out Bitcoin without using an exchange, 00:57:10.226 --> 00:57:12.602 and basically he just found another 00:57:12.602 --> 00:57:14.484 person in the world who would do it. 00:57:14.781 --> 00:57:16.243 Like, he would send them the Bitcoin 00:57:16.243 --> 00:57:17.402 and they would hand him cash. 00:57:17.768 --> 00:57:20.241 He met them through localbitcoins.com. 00:57:20.529 --> 00:57:22.185 RICKY: I had a guy in the Tampa area. 00:57:22.332 --> 00:57:25.194 If I needed $20,000 cash or less, I can 00:57:25.196 --> 00:57:27.639 go to him, or if I needed more, I had 00:57:27.639 --> 00:57:31.439 a guy that was in Miami, and he never 00:57:31.439 --> 00:57:32.790 scammed me, but I would send him the 00:57:32.794 --> 00:57:34.321 crypto and he would mail me the cash. 00:57:35.339 --> 00:57:36.011 JACK: Yeah, let’s talk 00:57:36.020 --> 00:57:37.127 about both of these, right? 00:57:37.129 --> 00:57:38.534 So, when you go to meet someone, 00:57:38.840 --> 00:57:40.047 how does this meet go down? 00:57:41.718 --> 00:57:42.424 RICKY: Typically it was at 00:57:42.578 --> 00:57:43.596 a McDonald’s or something. 00:57:43.596 --> 00:57:44.743 We would just go sit in the booth. 00:57:44.743 --> 00:57:46.051 I would send him the Bitcoin. 00:57:46.127 --> 00:57:47.459 We would wait for the confirmations 00:57:47.459 --> 00:57:48.937 and for him to get it in his account, 00:57:49.673 --> 00:57:51.586 and he would give me the cash. 00:57:51.991 --> 00:57:53.462 Prior to that, though, we had the 00:57:53.464 --> 00:57:56.093 deal locked in at a certain amount, 00:57:56.187 --> 00:57:57.607 'cause Bitcoin would go up and down. 00:57:58.346 --> 00:57:59.388 But I would typically just 00:57:59.406 --> 00:58:01.707 lock in the deal, and I’d 00:58:01.716 --> 00:58:03.212 be — okay, we’ll meet at 7:00. 00:58:03.218 --> 00:58:04.209 This is where we’re going. 00:58:04.221 --> 00:58:05.221 He would send me an address, 00:58:05.223 --> 00:58:06.201 and I would just go there. 00:58:06.520 --> 00:58:07.211 JACK: And then he’d just 00:58:07.239 --> 00:58:08.256 hand you an envelope? 00:58:08.716 --> 00:58:09.886 RICKY: Yeah, or just straight 00:58:09.888 --> 00:58:11.216 cash or an envelope and whatnot. 00:58:11.225 --> 00:58:12.926 But it was always a public place. 00:58:12.971 --> 00:58:15.067 It was never in a dark alley 00:58:15.067 --> 00:58:16.131 or anything crazy like that. 00:58:16.471 --> 00:58:17.618 JACK: That’s the classic way 00:58:17.629 --> 00:58:19.312 LocalBitcoins worked; you meet 00:58:19.314 --> 00:58:20.493 someone in person, you send them the 00:58:20.497 --> 00:58:21.973 Bitcoin, and they hand you the cash. 00:58:22.301 --> 00:58:23.470 Of course, they’d take a 00:58:23.471 --> 00:58:24.734 percentage for doing this deal. 00:58:24.736 --> 00:58:27.120 Maybe they'd give Ricky 95% of the money 00:58:27.120 --> 00:58:28.999 and keep 5% for themselves for the trouble 00:58:28.999 --> 00:58:30.600 of having to launder these Bitcoins. 00:58:31.109 --> 00:58:32.339 So, he actually had a lot of people 00:58:32.339 --> 00:58:34.408 making decent money on LocalBitcoins 00:58:34.419 --> 00:58:35.828 just buying crypto off people. 00:58:36.196 --> 00:58:37.697 But eventually Ricky needed to cash 00:58:37.700 --> 00:58:39.834 out bigger and bigger amounts, and this 00:58:39.836 --> 00:58:41.785 person he was working with wasn't able 00:58:41.785 --> 00:58:43.781 to cash out what he needed, so Ricky 00:58:43.788 --> 00:58:46.268 had to find someone new, and this new 00:58:46.286 --> 00:58:48.467 person was like, send me the Bitcoin; 00:58:48.614 --> 00:58:50.302 I’ll send you the cash in the mail. 00:58:50.535 --> 00:58:53.047 RICKY: It typically would just come 00:58:53.105 --> 00:58:59.183 in a vacuum-sealed, clear envelope 00:58:59.464 --> 00:59:01.274 wrapped in another envelope kinda thing. 00:59:02.203 --> 00:59:04.458 Sometimes it would be inside of a book, 00:59:04.494 --> 00:59:06.548 like a big Harry Potter book or something 00:59:06.549 --> 00:59:08.911 like that, and the pages would be cut 00:59:08.911 --> 00:59:10.457 out and the money would be in there. 00:59:11.014 --> 00:59:12.536 What's funny is I lived with my 00:59:12.537 --> 00:59:14.719 mom, so packages are coming to the 00:59:14.721 --> 00:59:17.366 house, but I’m eighteen years old. 00:59:17.528 --> 00:59:18.728 She’s not going through my mail. 00:59:18.751 --> 00:59:19.869 So, she would just take the envelope, 00:59:19.879 --> 00:59:20.898 put it on my bed, and she’d be 00:59:20.898 --> 00:59:22.032 like, hey, the mail came for you. 00:59:22.523 --> 00:59:23.967 She had no idea what was inside of

it. 00:59:24.439 --> 00:59:26.986 JACK: Alright, so you're 00:59:27.477 --> 00:59:29.668 loading it up in crypto here. 00:59:29.709 --> 00:59:30.411 Things are coming in, 00:59:30.423 --> 00:59:32.284 $100,000, $1 million at a time. 00:59:33.104 --> 00:59:34.681 So, you're leading a double life here. 00:59:35.608 --> 00:59:36.369 You're living with your mom. 00:59:36.369 --> 00:59:38.983 Does she have any idea that you're doing 00:59:38.984 --> 00:59:40.409 any of this stuff, involved with this? 00:59:41.125 --> 00:59:41.856 RICKY: First of all, she doesn't really 00:59:41.866 --> 00:59:45.765 understand what the hell crypto was, and 00:59:46.152 --> 00:59:48.915 she was like, Ricky, what are you doing? 00:59:49.026 --> 00:59:49.984 How do you have all this money? 00:59:50.495 --> 00:59:54.252 I bought a $100,000 F-250 Ford truck, 00:59:54.582 --> 00:59:56.946 I had jet skis, I had side-by-sides. 00:59:56.946 --> 00:59:58.556 I had a lot of toys and stuff like that. 00:59:59.113 --> 01:00:01.297 DEBBIE: It really got my attention 01:00:01.448 --> 01:00:02.768 when he came home with the truck. 01:00:03.450 --> 01:00:05.006 I said, what is going on? 01:00:05.158 --> 01:00:06.046 RICKY: I would just lie to her. 01:00:06.229 --> 01:00:07.886 Like, yo, I invested back then. 01:00:09.386 --> 01:00:10.589 At the time when I started, Bitcoin 01:00:10.602 --> 01:00:12.163 was a couple hundred dollars, and 01:00:12.163 --> 01:00:14.774 now it’s, let’s say, $3,000, $6,000. 01:00:15.154 --> 01:00:16.908 So, I made a lot just from 01:00:16.908 --> 01:00:18.154 that, that little growth. 01:00:18.986 --> 01:00:20.009 So, I was able — but 01:00:20.312 --> 01:00:21.167 that’s what I told her. 01:00:21.231 --> 01:00:24.285 Meanwhile I’m stealing it, but — so, she 01:00:24.285 --> 01:00:26.383 has really no idea the severity of it. 01:00:28.975 --> 01:00:30.517 So, my mom, she believed me. 01:00:30.522 --> 01:00:32.075 She believed that I was saying there’s 01:00:32.078 --> 01:00:34.100 no reason for her not to believe me. 01:00:34.741 --> 01:00:35.985 DEBBIE: He never gave me a reason 01:00:35.986 --> 01:00:37.699 not to believe what he was doing was 01:00:37.699 --> 01:00:40.860 wrong, 'cause he wasn't that kinda kid. 01:00:41.444 --> 01:00:42.569 JACK: Ricky’s crypto investment 01:00:42.577 --> 01:00:44.569 explanation wasn't a total lie. 01:00:44.581 --> 01:00:46.563 He did have Bitcoin investments, 01:00:46.822 --> 01:00:47.779 and Debbie didn't have 01:00:47.779 --> 01:00:48.953 any reason to question it. 01:00:49.296 --> 01:00:50.837 After all, her own mother, Ricky’s 01:00:50.853 --> 01:00:52.250 grandmother, dabbled in Bitcoin, 01:00:52.269 --> 01:00:54.250 too, so she knew it was real. 01:00:54.587 --> 01:00:56.540 Ricky also had a young kid at home, 01:00:56.884 --> 01:00:58.346 and Debbie thought why would he do 01:00:58.348 --> 01:01:00.084 anything to throw his life away? 01:01:00.409 --> 01:01:01.468 DEBBIE: I was a single mom. 01:01:01.471 --> 01:01:03.046 I did the best I could 01:01:03.047 --> 01:01:03.911 growing up with him. 01:01:03.939 --> 01:01:05.205 He was a very honest child, 01:01:05.205 --> 01:01:06.913 never got in trouble, never 01:01:06.913 --> 01:01:09.096 was in the principal’s office. 01:01:09.098 --> 01:01:10.435 He didn't get in fights. 01:01:11.008 --> 01:01:12.866 So, when he came home with the truck, 01:01:12.866 --> 01:01:14.824 I just said, I don't know what you're 01:01:14.826 --> 01:01:17.459 doing or what's going on, but that’s 01:01:17.459 --> 01:01:20.304 not normal, and all I know is if you get 01:01:20.314 --> 01:01:22.475 in trouble, there’s not much I can do. 01:01:24.225 --> 01:01:26.564 I mean, I — and I said — at that time it 01:01:26.564 --> 01:01:31.506 was just his daughter, and between the 01:01:31.506 --> 01:01:34.122 mom and my son being the parents to this 01:01:34.124 --> 01:01:37.933 child, they were both younger, and I was 01:01:37.937 --> 01:01:39.442 fairly involved with my granddaughter. 01:01:39.988 --> 01:01:41.872 I just said to him, it’s 01:01:41.879 --> 01:01:43.076 just not your life anymore. 01:01:43.077 --> 01:01:44.589 You have a child involved here. 01:01:45.000 --> 01:01:46.437 JACK: Debbie believed her son and 01:01:46.437 --> 01:01:48.156 was proud of him, and had no reason 01:01:48.156 --> 01:01:49.226 to think he would lie to her. 01:01:49.692 --> 01:01:51.441 In fact, she thought Ricky’s crypto 01:01:51.452 --> 01:01:53.750 savviness could actually help others. 01:01:54.191 --> 01:01:56.036 At the time she worked as a nurse 01:01:56.078 --> 01:01:59.133 in the Pasco County Jail, and one 01:01:59.133 --> 01:02:01.045 day she overheard some sheriff’s 01:02:01.045 --> 01:02:03.198 deputies yapping about crypto. 01:02:03.518 --> 01:02:05.302 DEBBIE: I assumed at this point my son 01:02:05.302 --> 01:02:07.440 was doing really good with crypto, 'cause 01:02:07.441 --> 01:02:09.529 that’s what — the vision I was getting. 01:02:10.263 --> 01:02:12.814 I kinda went into work and 01:02:12.814 --> 01:02:14.785 was saying, yeah, my son does 01:02:15.394 --> 01:02:19.250 crypto, Bitcoin, and he’s done 01:02:19.250 --> 01:02:20.530 really well, and they've matured. 01:02:20.630 --> 01:02:21.876 I remember one of the deputies 01:02:22.087 --> 01:02:23.239 was really interested. 01:02:23.246 --> 01:02:24.091 He’s like, really? 01:02:24.337 --> 01:02:25.227 RICKY: They were like, oh, 01:02:25.227 --> 01:02:26.440 we’d love to talk to him. 01:02:26.825 --> 01:02:27.509 DEBBIE: I was like, yeah, he’s 01:02:27.510 --> 01:02:28.591 doing really good with it. 01:02:29.227 --> 01:02:30.224 One of the guys, one of the 01:02:30.225 --> 01:02:31.461 deputies, wanted to get with 01:02:31.461 --> 01:02:32.616 him and speak with my son. 01:02:32.651 --> 01:02:34.573 RICKY: So, next thing you know my 01:02:34.573 --> 01:02:36.271 mom is having me call these police 01:02:36.271 --> 01:02:37.528 officers and they're coming to 01:02:37.529 -->

01:02:39.305 the house to ask me about crypto. 01:02:39.307 --> 01:02:40.519 They're asking me about investing. 01:02:40.521 --> 01:02:42.253 They're asking me like, what do I think? 01:02:42.322 --> 01:02:43.166 I just went along with it. 01:02:43.167 --> 01:02:44.423 Like, yeah, crypto’s great. 01:02:44.596 --> 01:02:45.671 This is what I recommend. 01:02:46.585 --> 01:02:48.522 I recommend Bitcoin or Ethereum. 01:02:48.857 --> 01:02:50.298 I think XRP was actually 01:02:50.318 --> 01:02:51.629 blowing up at that time, too. 01:02:52.365 --> 01:02:53.804 I think I made a lot off XRP, 01:02:53.811 --> 01:02:55.928 actually, which — not legitly, 01:02:56.237 --> 01:02:59.388 but I used my dirty money and 01:02:59.446 --> 01:03:01.235 put it into XRP, and XRP blew up. 01:03:02.711 --> 01:03:03.504 I was telling them about 01:03:03.504 --> 01:03:05.353 that, and they were loving it. 01:03:05.362 --> 01:03:06.306 So, they were just like, okay, 01:03:06.306 --> 01:03:08.167 cool, thanks for chatting. 01:03:08.843 --> 01:03:10.488 They had no idea I was stealing it. 01:03:11.397 --> 01:03:12.632 JACK: And how were you feeling inside? 01:03:13.341 --> 01:03:14.051 RICKY: Oh, I’m nervous. 01:03:14.052 --> 01:03:15.149 I’m like, mom — that’s when I told her. 01:03:15.153 --> 01:03:15.963 Like, yo, never again. 01:03:16.227 --> 01:03:17.699 Don't tell people what I do. 01:03:17.935 --> 01:03:18.762 DEBBIE: [Music] I said to Ricky, 01:03:18.763 --> 01:03:20.412 and you let this deputy come 01:03:20.412 --> 01:03:22.324 to the house and talk to you? 01:03:25.169 --> 01:03:27.189 JACK: By 2018 the walls 01:03:27.198 --> 01:03:28.448 started closing in on Ricky. 01:03:28.808 --> 01:03:30.839 He says he has a hunch of when 01:03:30.839 --> 01:03:32.140 it all started to unravel. 01:03:32.703 --> 01:03:33.519 One night he was doing a 01:03:33.519 --> 01:03:35.283 SIM-swap, a crypto heist with 01:03:35.283 --> 01:03:36.904 some other guys online, his crew. 01:03:37.600 --> 01:03:40.682 One of the guys was a younger kid, and 01:03:40.682 --> 01:03:43.412 this younger kid was posing as an AT&T 01:03:43.412 --> 01:03:45.167 employee trying to social engineer 01:03:45.169 --> 01:03:47.158 someone into doing the SIM-swap for him. 01:03:47.674 --> 01:03:49.290 But little did this kid know, his 01:03:49.290 --> 01:03:50.759 mother was listening through the 01:03:50.759 --> 01:03:52.500 door, and she heard him trying 01:03:52.502 --> 01:03:54.172 to scam someone on the phone. 01:03:54.851 --> 01:03:57.734 That kid’s mom called the cops on her son, 01:03:57.746 --> 01:04:00.025 and that kid got arrested in Michigan. 01:04:00.761 --> 01:04:03.120 Ricky and his crew did not know this. 01:04:03.357 --> 01:04:04.415 All they knew was that 01:04:04.415 --> 01:04:05.428 kid suddenly went missing. 01:04:05.428 --> 01:04:06.269 That’s strange. 01:04:06.664 --> 01:04:08.282 But they had no idea he got arrested. 01:04:08.955 --> 01:04:11.479 But then that kid came back out of the 01:04:11.479 --> 01:04:14.235 blue and really, really, really badly 01:04:14.235 --> 01:04:15.984 wanted to get in on the action again. 01:04:16.417 --> 01:04:18.892 Ricky suspected that’s really weird that 01:04:18.893 --> 01:04:20.518 this kid got a bunch of money from a 01:04:20.531 --> 01:04:22.579 crypto heist and then disappeared for 01:04:22.579 --> 01:04:24.333 a while and now really wants back in. 01:04:25.109 --> 01:04:26.363 They kept that kid at arm’s 01:04:26.363 --> 01:04:28.148 length, but that didn't matter. 01:04:28.148 --> 01:04:29.437 Another one of Ricky’s friends 01:04:29.437 --> 01:04:31.285 was arrested shortly after, who 01:04:31.286 --> 01:04:33.332 was also present on that same call 01:04:33.333 --> 01:04:34.784 where the kid’s mom overheard them. 01:04:35.208 --> 01:04:37.323 Joel Ortiz was arrested for 01:04:37.325 --> 01:04:38.864 SIM-swapping and stealing millions 01:04:38.864 --> 01:04:40.873 of dollars in crypto from victims. 01:04:40.885 --> 01:04:42.999 He pled guilty, and a judge sentenced 01:04:43.000 --> 01:04:45.103 him to a decade behind bars. 01:04:45.913 --> 01:04:47.395 Prosecutors said that he was the 01:04:47.397 --> 01:04:49.568 first SIM-swapper to ever be sentenced 01:04:49.577 --> 01:04:51.821 to prison in the US, and after 01:04:51.822 --> 01:04:54.468 hearing about Joel’s arrest, Ricky 01:04:54.469 --> 01:04:56.577 was worried that he might be next. 01:04:56.877 --> 01:04:57.862 RICKY: I’ve known Joel. 01:04:57.862 --> 01:04:59.171 I’ve talked with him and I’ve done 01:04:59.171 --> 01:05:01.243 stuff with him and stuff where it was 01:05:01.247 --> 01:05:04.466 like, hold on, this is a huge red flag. 01:05:05.488 --> 01:05:06.956 I remember I was eating at Ford’s 01:05:06.966 --> 01:05:08.702 Garage when it happened when I 01:05:08.703 --> 01:05:10.167 found out that Joel got arrested. 01:05:11.616 --> 01:05:13.232 So, that’s what kinda raised my suspicion. 01:05:13.232 --> 01:05:15.922 I’m like, oh shit, Joel got caught. 01:05:17.361 --> 01:05:19.805 JACK: After hearing Joel went down, you 01:05:19.806 --> 01:05:21.553 would think that it would give you a 01:05:21.553 --> 01:05:24.115 spook of some kind and be like, okay, I’m 01:05:24.130 --> 01:05:27.350 gonna lay low for a couple weeks or clear 01:05:27.353 --> 01:05:29.338 some stuff or get rid of some evidence. 01:05:30.903 --> 01:05:31.539 RICKY: Yeah. 01:05:33.048 --> 01:05:33.936 JACK: But you didn't do any of that. 01:05:35.921 --> 01:05:39.921 RICKY: Um…no. 01:05:42.647 --> 01:05:43.893 JACK: Just a day after learning 01:05:43.895 --> 01:05:45.301 about Joel’s arrest, the 01:05:45.312 --> 01:05:46.650 dominoes started to fall. 01:05:46.848 --> 01:05:47.661 There are moments in our 01:05:47.662 --> 01:05:48.956 life that stand out forever. 01:05:48.962 --> 01:05:50.818 Maybe it’s when your first child 01:05:50.818 --> 01:05:52.825 is born or first kiss or playing 01:05:52.829 --> 01:05:54.259 a video game for the first time. 01:05:54.753

--> 01:05:58.073 For Ricky, that day was July 18, 2018. 01:05:59.020 --> 01:06:00.547 On that day, Ricky was still living 01:06:00.547 --> 01:06:01.712 at home with his mom, and he had 01:06:01.729 --> 01:06:02.939 broken up with his girlfriend that 01:06:02.939 --> 01:06:04.116 he had a child with, but he had a 01:06:04.116 --> 01:06:05.578 new woman and a new child with her. 01:06:05.578 --> 01:06:06.605 I think the baby was a few 01:06:06.607 --> 01:06:07.645 months old at that point. 01:06:08.084 --> 01:06:10.031 The day started just like any other day. 01:06:10.290 --> 01:06:11.932 Ricky was getting ready to go to work 01:06:11.937 --> 01:06:13.669 at the parks and recreation department, 01:06:13.727 --> 01:06:15.042 and his girlfriend left the house just 01:06:15.046 --> 01:06:16.667 before him so that she could go to work. 01:06:16.964 --> 01:06:17.997 RICKY: I used to live 01:06:18.013 --> 01:06:19.528 by a cul-de-sac area. 01:06:20.234 --> 01:06:21.232 [Music] When she went to work, 01:06:21.232 --> 01:06:22.017 she’s like, hey, there’s a lot 01:06:22.017 --> 01:06:23.321 of cops in this cul-de-sac. 01:06:24.104 --> 01:06:25.642 I was like, okay, come back. 01:06:25.642 --> 01:06:26.659 Like, that’s weird. 01:06:26.937 --> 01:06:27.679 That’s off to me. 01:06:28.620 --> 01:06:29.740 So, when she went around the 01:06:29.742 --> 01:06:31.164 block the other way, she’s like, 01:06:31.164 --> 01:06:32.201 yo, they're also on this side of 01:06:32.202 --> 01:06:34.199 the house, like on this block. 01:06:34.823 --> 01:06:36.702 I was like, alright, I’m 01:06:36.705 --> 01:06:37.641 pretty sure they're coming. 01:06:39.018 --> 01:06:41.625 I walk outside to go — just 01:06:41.640 --> 01:06:42.613 act like I’m going to work. 01:06:42.620 --> 01:06:44.290 Like, I knew at that point that 01:06:44.291 --> 01:06:45.747 they were probably coming for me. 01:06:45.934 --> 01:06:47.163 I could see them coming down the road. 01:06:47.656 --> 01:06:50.658 I was like, just try to play it off. 01:06:52.126 --> 01:06:53.796 I went to go get up in my truck, and 01:06:53.797 --> 01:06:54.672 they were like, don't go in your truck. 01:06:54.674 --> 01:06:55.713 Don't run, don't run. 01:06:56.214 --> 01:06:58.001 JACK: Ricky stayed still, standing next 01:06:58.004 --> 01:06:59.980 to his truck as officers handcuffed him. 01:07:00.515 --> 01:07:01.305 OFFICER: You wanna lean against 01:07:01.310 --> 01:07:02.343 your truck or something? 01:07:10.388 --> 01:07:10.651 RICKY: Yeah, if — whatever. 01:07:10.651 --> 01:07:10.691 I mean, just whatever. 01:07:10.808 --> 01:07:15.249 [Background talk] 01:07:16.056 --> 01:07:16.703 OFFICER: You have anything 01:07:16.704 --> 01:07:18.306 on you that might hurt us if 01:07:18.308 --> 01:07:19.465 we pat you down or whatever? 01:07:19.546 --> 01:07:19.859 Alright. 01:07:20.246 --> 01:07:20.836 Just hang tight. 01:07:22.535 --> 01:07:23.300 You understand right now 01:07:23.302 --> 01:07:24.333 you're just being detained.

01:07:24.996 --> 01:07:26.267 JACK: This is body cam audio 01:07:26.272 --> 01:07:27.365 from Ricky’s arrest by the 01:07:27.373 --> 01:07:29.023 Pasco County Sheriff’s Office. 01:07:29.090 --> 01:07:30.745 It’s the very same sheriff’s office 01:07:30.745 --> 01:07:32.601 where his mom Debbie worked as a nurse. 01:07:32.879 --> 01:07:35.079 DEBBIE: When they came here that day 01:07:35.079 --> 01:07:37.735 — and, you know, they — I guess it would 01:07:37.745 --> 01:07:39.268 be to raid the house, but they were 01:07:39.268 --> 01:07:41.449 very — doing the search warrant stuff, 01:07:41.455 --> 01:07:43.316 but they did not break down our doors. 01:07:43.328 --> 01:07:44.863 They didn't do anything. 01:07:44.880 --> 01:07:47.046 So, now I kinda get up out of my bed 01:07:47.047 --> 01:07:49.907 and I look into the kitchen area, and 01:07:49.908 --> 01:07:53.351 there’s two cops standing in the doorway. 01:07:53.902 --> 01:07:55.081 They're like, hey, Debbie. 01:07:55.250 --> 01:07:56.647 I need you to come out here. 01:07:56.745 --> 01:07:57.419 JACK: They know you? 01:07:58.804 --> 01:07:59.569 DEBBIE: Yeah, they knew my 01:07:59.571 --> 01:08:00.799 name, they knew everything. 01:08:00.913 --> 01:08:02.296 Now, yeah, I knew some of them 01:08:02.296 --> 01:08:03.570 from coming in and out of work. 01:08:04.835 --> 01:08:06.614 I think I kept saying, what is going on? 01:08:06.615 --> 01:08:07.342 What is going on? 01:08:07.354 --> 01:08:08.260 What is happening? 01:08:08.986 --> 01:08:09.596 JACK: And when they finally tell 01:08:09.596 --> 01:08:11.585 you this is what we think is going 01:08:11.587 --> 01:08:13.232 on, what was your reaction to that? 01:08:13.333 --> 01:08:15.703 DEBBIE: We have — my reaction to that was, 01:08:15.953 --> 01:08:20.011 well, isn't Bitcoin — isn't this legal? 01:08:20.742 --> 01:08:22.043 That was my first reaction; 01:08:22.716 --> 01:08:24.014 but I thought it was legal. 01:08:24.069 --> 01:08:25.991 So, I kinda looked at him and he 01:08:25.991 --> 01:08:28.259 goes, he was not — those coins 01:08:28.261 --> 01:08:29.697 and the money that he was getting, 01:08:29.698 --> 01:08:31.112 Debbie, did not belong to him. 01:08:31.115 --> 01:08:32.193 He was stealing them. 01:08:33.613 --> 01:08:34.617 That’s when I really 01:08:34.750 --> 01:08:38.453 realized like, oh, okay. 01:08:38.456 --> 01:08:39.535 So, now what? 01:08:40.495 --> 01:08:41.397 JACK: Debbie sat outside the 01:08:41.402 --> 01:08:42.615 front of the house with Ricky 01:08:42.622 --> 01:08:44.259 as deputies collected evidence. 01:08:44.344 --> 01:08:45.848 Some of Ricky’s burner phones, his 01:08:45.852 --> 01:08:47.477 iPhone, his crypto wallets, and 01:08:47.487 --> 01:08:48.915 some other SIM cards were taken. 01:08:49.277 --> 01:08:52.356 RICKY: They took my truck, they took 01:08:52.616 --> 01:08:54.919 two side-by-sides, they took a trailer 01:08:54.920 --> 01:08:56.591 I had, the trailer I haul everything. 01:08:57.010 --> 01:08:58.086

JACK: Ricky was taken away in 01:08:58.086 --> 01:08:59.846 the back of a squad car to jail. 01:09:01.126 --> 01:09:04.520 … OFFICER: I have one male adult, 1012. 01:09:06.119 --> 01:09:07.577 Nothing else is in your pockets? 01:09:07.808 --> 01:09:08.314 RICKY: No, sir. 01:09:10.284 --> 01:09:11.367 JACK: They drive off to jail. 01:09:11.840 --> 01:09:12.790 The twenty-five minute 01:09:12.792 --> 01:09:14.493 ride is mostly quiet. 01:09:15.085 --> 01:09:17.054 Ricky is alone with his thoughts, 01:09:17.627 --> 01:09:18.819 but he does ask the officer 01:09:18.820 --> 01:09:20.634 behind the wheel what to expect. 01:09:21.195 --> 01:09:22.769 RICKY: Do you know how all this all goes? 01:09:22.799 --> 01:09:25.142 Like, do I see a judge and then…? 01:09:25.787 --> 01:09:27.074 OFFICER: You’ll have advisors. 01:09:27.455 --> 01:09:27.788 RICKY: I will? 01:09:28.276 --> 01:09:28.569 Okay. 01:09:29.641 --> 01:09:32.070 OFFICER: That’ll be done by 01:09:32.078 --> 01:09:35.089 video, on chat or whatever. 01:09:35.531 --> 01:09:36.577 RICKY: That’ll be today, right? 01:09:36.769 --> 01:09:37.216 OFFICER: Should be. 01:09:37.569 --> 01:09:38.123 JACK: I can't get over 01:09:38.124 --> 01:09:39.501 how calm Ricky sounds. 01:09:39.834 --> 01:09:41.106 He had been cooking up these schemes 01:09:41.107 --> 01:09:43.092 for years to steal things from who 01:09:43.092 --> 01:09:44.862 knows how many victims, starting 01:09:44.862 --> 01:09:46.137 with a few hundred dollars in gamer 01:09:46.138 --> 01:09:47.673 tags to millions of dollars in crypto 01:09:47.677 --> 01:09:49.718 wallets, and it all came to an end 01:09:49.720 --> 01:09:51.600 here in the back of the squad car. 01:09:52.358 --> 01:09:54.230 Maybe he was feeling relief, 01:09:54.334 --> 01:09:55.451 like his big secret’s out. 01:09:55.460 --> 01:09:56.659 He doesn't have to lie to his mom 01:09:56.660 --> 01:09:58.502 anymore or try to walk quietly in 01:09:58.503 --> 01:09:59.972 the shadows of his double life. 01:10:01.005 --> 01:10:01.938 But sitting in the back of the 01:10:01.939 --> 01:10:03.729 car, you have to wonder what 01:10:03.729 --> 01:10:04.827 else is going through his head. 01:10:05.315 --> 01:10:06.608 What’s gonna happen to me, 01:10:07.284 --> 01:10:08.388 and what about my family? 01:10:09.158 --> 01:10:10.065 What about my money? 01:10:11.268 --> 01:10:12.470 But he quietly listens as the 01:10:12.472 --> 01:10:14.081 officer driving him to the jail 01:10:14.082 --> 01:10:15.810 spells out the next steps for him. 01:10:16.768 --> 01:10:17.452 OFFICER: I would think it 01:10:17.452 --> 01:10:18.628 would be this afternoon. 01:10:21.282 --> 01:10:23.083 That’s when they’ll basically just 01:10:23.083 --> 01:10:24.841 announce what you're charged with, 01:10:25.827 --> 01:10:29.060 and then whether you're gonna 01:10:29.060 --> 01:10:30.774 retain your own attorney or whether 01:10:30.774 --> 01:10:32.488 you're asking for a public defender. 01:10:32.950 --> 01:10:33.280 RICKY: Okay. 01:10:33.637 --> 01:10:36.277 OFFICER: And then — but that 01:10:36.277 --> 01:10:37.461 is — again, I don't know if 01:10:37.767 --> 01:10:40.424 you're being charged federally. 01:10:41.228 --> 01:10:41.511 RICKY: Okay. 01:10:41.651 --> 01:10:43.778 OFFICER: Which makes it different, so… 01:10:44.112 --> 01:10:45.636 RICKY: Alright, thank you sir. 01:10:46.628 --> 01:10:48.512 JACK: Ricky was booked in the county jail. 01:10:48.796 --> 01:10:50.880 His mom was so distraught, though. 01:10:51.154 --> 01:10:53.132 She didn't want to see her son in jail. 01:10:53.161 --> 01:10:54.005 What mother would? 01:10:54.426 --> 01:10:55.622 So, she went down to jail to 01:10:55.622 --> 01:10:56.658 see if she could bail him out. 01:10:57.035 --> 01:10:58.297 DEBBIE: I just — it had to be done. 01:10:58.334 --> 01:11:00.011 I wasn't leaving him in jail. 01:11:00.028 --> 01:11:00.677 JACK: Did he go to the 01:11:00.677 --> 01:11:01.708 very jail you worked at? 01:11:01.711 --> 01:11:03.210 DEBBIE: Oh yeah, he sure did. 01:11:03.773 --> 01:11:05.673 All my nursing staff, friends, they were 01:11:05.673 --> 01:11:07.742 all like, oh my god, Debbie’s son is here. 01:11:07.743 --> 01:11:08.583 What’s going on? 01:11:08.603 --> 01:11:12.719 Then the sergeant — they all knew once I 01:11:12.777 --> 01:11:17.008 posted bond for him, get him outta here. 01:11:18.046 --> 01:11:19.445 Yeah, they did do a little 01:11:19.445 --> 01:11:20.545 bit of, let’s say, courtesy. 01:11:20.926 --> 01:11:23.021 I shouldn't say courtesy, but they 01:11:23.022 --> 01:11:25.005 treated him knowing that he was my son. 01:11:25.012 --> 01:11:26.342 Like, let’s move him along. 01:11:27.906 --> 01:11:28.577 You know? 01:11:28.815 --> 01:11:29.333 JACK: Yeah, that must 01:11:29.334 --> 01:11:30.203 have been embarrassing. 01:11:30.214 --> 01:11:31.286 DEBBIE: But yeah. 01:11:31.286 --> 01:11:32.615 Yeah, a little bit embarrassing, a 01:11:32.615 --> 01:11:34.779 little bit of shocking, embarrassing. 01:11:35.486 --> 01:11:37.195 The only thing — and I wasn't actually 01:11:37.197 --> 01:11:38.362 physically working there anymore. 01:11:38.362 --> 01:11:40.270 I had just left like six months prior. 01:11:41.773 --> 01:11:43.123 But I mean, it was still fresh. 01:11:43.125 --> 01:11:45.405 I had worked there for almost ten years. 01:11:45.883 --> 01:11:48.715 JACK: They said his bail was $110,000. 01:11:49.277 --> 01:11:50.701 The cost of a bail bond is usually 01:11:50.703 --> 01:11:52.465 10% to 15% of the total amount. 01:11:52.680 --> 01:11:54.044 Debbie ended up paying that to 01:11:54.045 --> 01:11:55.761 a bail bondsman to get him out. 01:11:55.815 --> 01:11:56.849 She didn't even hesitate. 01:11:56.864 --> 01:11:58.641 She just immediately was there for him. 01:11:59.210 --> 01:12:00.861 Prosecutors charged Ricky with 01:12:00.873 --> 01:12:03.049 grand theft and money laundering. 01:12:04.027 --> 01:12:04.869 The case against him 01:12:04.869 --> 01:12:06.938 dragged

on for four years. 01:12:07.301 --> 01:12:08.192 He had to wear an ankle 01:12:08.194 --> 01:12:09.870 monitor during that whole time 01:12:09.887 --> 01:12:11.164 and follow a strict curfew. 01:12:11.515 --> 01:12:13.760 He pled guilty to federal charges 01:12:13.762 --> 01:12:15.101 of computer misconduct and 01:12:15.101 --> 01:12:16.780 conspiracy to commit wire fraud. 01:12:17.400 --> 01:12:18.748 By the time he went before a judge 01:12:18.758 --> 01:12:20.605 for sentencing, Ricky didn't know 01:12:20.605 --> 01:12:22.016 what to expect in the courtroom 01:12:22.072 --> 01:12:23.422 or how it would affect his family. 01:12:24.041 --> 01:12:25.236 His mom and fiancé were 01:12:25.236 --> 01:12:26.342 there during the sentencing. 01:12:26.697 --> 01:12:27.895 DEBBIE: It was horrible. 01:12:27.939 --> 01:12:29.801 It was I think one of the 01:12:29.801 --> 01:12:31.432 saddest days of my life. 01:12:32.893 --> 01:12:33.701 I remember standing in 01:12:33.702 --> 01:12:34.454 front of that judge. 01:12:34.454 --> 01:12:35.838 I just cried and said, look, 01:12:35.980 --> 01:12:37.277 I know my son did wrong. 01:12:37.298 --> 01:12:39.183 I know he did wrong, believe me. 01:12:39.936 --> 01:12:41.347 I can't believe he did all this, 01:12:41.355 --> 01:12:43.691 but he’s — that’s not my — that’s 01:12:43.691 --> 01:12:44.950 not the kind of kid he is. 01:12:45.014 --> 01:12:45.820 It was horrible. 01:12:46.429 --> 01:12:47.454 JACK: What did the judge say to that? 01:12:48.849 --> 01:12:49.974 DEBBIE: She was a woman, and I 01:12:49.977 --> 01:12:51.482 could almost feel her sympathy 01:12:51.485 --> 01:12:54.094 for me and getting it, but the 01:12:54.094 --> 01:12:57.297 law is the law, and I agree. 01:12:57.628 --> 01:12:59.885 The law is the law, and my son broke the 01:12:59.885 --> 01:13:03.445 law, and he had to pay his consequences. 01:13:04.018 --> 01:13:05.808 I let him know you did not 01:13:05.812 --> 01:13:06.965 just do this to yourself. 01:13:06.969 --> 01:13:08.554 You did this to your whole family. 01:13:09.382 --> 01:13:11.357 We're all suffering through this. 01:13:12.572 --> 01:13:13.971 We're suffering more than you are. 01:13:14.501 --> 01:13:16.035 JACK: The judge sentenced Ricky to four 01:13:16.035 --> 01:13:18.132 years in federal prison and ordered him to 01:13:18.132 --> 01:13:21.847 pay $7.6 million in restitution, which is 01:13:21.847 --> 01:13:24.071 what the courts accused him of stealing. 01:13:24.317 --> 01:13:25.612 RICKY: I knew it could have been 01:13:25.614 --> 01:13:26.946 worse and it should have been 01:13:26.946 --> 01:13:28.920 worse, and I was thankful that 01:13:28.955 --> 01:13:30.797 I got the forty-eight months. 01:13:31.088 --> 01:13:32.105 Like, I knew it was coming. 01:13:32.105 --> 01:13:32.991 I knew it had to happen 01:13:32.992 --> 01:13:35.023 because all the havoc I caused. 01:13:35.931 --> 01:13:36.772 I was like, you know, 01:13:38.251 --> 01:13:38.985 I gotta deal with it. 01:13:38.987 --> 01:13:41.223 I did what I did and now I gotta do it. 01:13:44.366 --> 01:13:46.029 I lost — I had to leave 01:13:46.203 --> 01:13:47.859 everybody, my family, my mom, my 01:13:47.861 --> 01:13:50.736 grandparents, my kid, everybody. 01:13:52.108 --> 01:13:53.171 JACK: Okay, so your child was four or 01:13:53.172 --> 01:13:54.999 five months old when you went away. 01:13:56.094 --> 01:13:58.562 RICKY: Correct, and that’s super hard 01:13:58.576 --> 01:14:01.730 because all those — I’ve always said 01:14:02.945 --> 01:14:05.623 the money, whatever, the money can't 01:14:05.623 --> 01:14:07.343 buy back those memories that I missed. 01:14:08.830 --> 01:14:09.857 Like, there’s nothing I could do; 01:14:09.994 --> 01:14:11.979 his first walk, his first talk, stuff 01:14:11.979 --> 01:14:13.168 like that, that money can't buy. 01:14:13.896 --> 01:14:15.352 DEBBIE: It was so hard coming to see 01:14:15.353 --> 01:14:17.769 him in prison and having to leave 01:14:19.090 --> 01:14:21.182 knowing that my kid’s in prison. 01:14:21.833 --> 01:14:24.137 Me and his fiancé, we went 01:14:24.139 --> 01:14:25.736 and saw Ricky at least once 01:14:25.736 --> 01:14:27.465 a month if not twice a month. 01:14:28.438 --> 01:14:29.871 We’d pack up the car, we’d leave 01:14:29.884 --> 01:14:31.699 early one morning, get there. 01:14:31.732 --> 01:14:35.289 We drove six hours, whatever it was, with 01:14:35.301 --> 01:14:37.652 two kids in the car, me and her only. 01:14:37.730 --> 01:14:39.411 No men, nobody to help us. 01:14:43.485 --> 01:14:46.302 We drove down there and had to 01:14:46.952 --> 01:14:49.389 do what we had to do, and then 01:14:50.009 --> 01:14:51.195 spend the night in a hotel. 01:14:51.367 --> 01:14:54.030 It was horrible, embarrassing, 01:14:54.038 --> 01:14:55.874 horrible, a combo of everything. 01:14:56.519 --> 01:14:57.784 JACK: So many criminal hacker 01:14:57.784 --> 01:14:59.248 stories go the same way. 01:14:59.473 --> 01:15:01.675 There’s a video game, a cheat, an 01:15:01.702 --> 01:15:04.210 underground community, an exploit, a 01:15:04.210 --> 01:15:06.634 payday, and then the knock on the door. 01:15:07.102 --> 01:15:08.548 They don't usually have the foresight 01:15:08.561 --> 01:15:10.563 to see how it will inevitably end. 01:15:11.133 --> 01:15:12.228 What do those millions of 01:15:12.228 --> 01:15:14.005 dollars really buy you? 01:15:14.513 --> 01:15:16.420 A couple of years of wealth that 01:15:16.422 --> 01:15:18.347 you can't really show anyone? 01:15:19.245 --> 01:15:21.424 Some screenshots of good old times? 01:15:22.231 --> 01:15:24.409 The skills to find gaps in security 01:15:24.431 --> 01:15:25.556 through social engineering? 01:15:26.764 --> 01:15:28.976 Whatever it is, the windfall was worth a 01:15:28.976 --> 01:15:31.262 lot less when you factor in what you lose. 01:15:31.317 --> 01:15:32.527 That’s the real cost. 01:15:32.870 --> 01:15:35.485 No cryptocurrency can buy back lost 01:15:35.554 -->

01:15:37.907 time or memories with your children. 01:15:38.585 --> 01:15:39.958 That’s what Ricky learned. 01:15:40.416 --> 01:15:41.349 [To Ricky] What was the worst 01:15:41.360 --> 01:15:42.665 part of this whole experience? 01:15:43.013 --> 01:15:45.034 RICKY: The worst part was the victims, 01:15:45.331 --> 01:15:48.365 because they didn't deserve it. 01:15:50.898 --> 01:15:53.682 So, that was the worst part, dealing 01:15:53.682 --> 01:15:56.505 with — I was doing terrible things. 01:15:57.371 --> 01:15:59.565 But I guess you have a chance in prison; 01:15:59.576 --> 01:16:02.269 you're like, dude — looking back on the 01:16:02.269 --> 01:16:05.876 shit that you caused — I can only imagine 01:16:05.877 --> 01:16:07.467 if I was in there and she was with a kid. 01:16:07.592 --> 01:16:10.205 That could have been used for my — their 01:16:10.209 --> 01:16:13.317 kids’ college funds or retirement 01:16:13.317 --> 01:16:14.865 or whatever the case may have been 01:16:14.896 --> 01:16:16.075 that they had that much money for, 01:16:16.475 --> 01:16:18.203 and I just came by and took it all. 01:16:21.766 --> 01:16:23.630 JACK: If it was me, I think I would have 01:16:23.630 --> 01:16:26.853 been — the saddest or the worst part 01:16:26.853 --> 01:16:29.470 of it was just not seeing my child in 01:16:29.471 --> 01:16:31.159 those early day — in those early years. 01:16:32.232 --> 01:16:33.600 Did that have an affect on you? 01:16:35.558 --> 01:16:38.326 RICKY: Yeah, that’s the second part of it. 01:16:38.525 --> 01:16:40.536 The first part was how I 01:16:40.537 --> 01:16:41.994 ruined innocent people’s lives. 01:16:42.395 --> 01:16:45.764 The second part now is I went to prison, 01:16:46.086 --> 01:16:48.294 I affected more people than just myself. 01:16:48.452 --> 01:16:52.103 I lost — I had to leave everybody, 01:16:52.142 --> 01:16:53.303 like my family, my mom, my 01:16:53.304 --> 01:16:56.183 grandparents, my kid, everybody. 01:16:57.036 --> 01:16:57.887 They were devastated. 01:16:58.008 --> 01:17:00.065 I know they were devastated, and it hurt 01:17:00.065 --> 01:17:01.642 me knowing that I hurt them like that. 01:17:01.786 --> 01:17:03.303 Like, my actions caused all that. 01:17:03.913 --> 01:17:05.044 JACK: After serving just a little 01:17:05.045 --> 01:17:06.318 more than two years in prison, 01:17:06.651 --> 01:17:08.646 Ricky got out early in 2024. 01:17:09.076 --> 01:17:10.012 These days he’s thinking a 01:17:10.012 --> 01:17:11.717 lot about the time he has now. 01:17:12.105 --> 01:17:13.672 Since his release he’s tried to turn his 01:17:13.673 --> 01:17:15.585 story into something useful, to reach out 01:17:15.589 --> 01:17:17.911 to the very gamers like him who may follow 01:17:17.914 --> 01:17:19.704 a darker path of social engineering. 01:17:20.330 --> 01:17:21.704 He’s spoken at anti-fraud 01:17:21.704 --> 01:17:23.165 events and security conferences 01:17:23.499 --> 01:17:24.954 like Black Hat and DEF CON. 01:17:25.403 --> 01:17:26.420 SPEAKER 6: Ricky, what would have made a 01:17:26.420 --> 01:17:28.124 difference to you as a teenager that would 01:17:28.124 --> 01:17:29.739 have stopped you going down this pathway? 01:17:31.756 --> 01:17:34.128 RICKY: Probably companies who 01:17:34.133 --> 01:17:36.007 could intervene, like get you 01:17:36.007 --> 01:17:37.417 before you're — it’s too late. 01:17:38.686 --> 01:17:39.812 If you had a chance to use your 01:17:39.812 --> 01:17:41.510 skills for good and after you help 01:17:41.520 --> 01:17:43.233 companies and whatnot, where they 01:17:43.233 --> 01:17:46.059 could be like, hey, we offer you a 01:17:46.059 --> 01:17:48.309 job, said job, into this world where 01:17:48.311 --> 01:17:50.222 you don't have to do what I was doing. 01:17:50.740 --> 01:17:51.382 JACK: I agree with that. 01:17:51.383 --> 01:17:52.842 The people in his bubble at that 01:17:52.842 --> 01:17:54.384 time were all criminals, and 01:17:54.384 --> 01:17:55.797 they used their skills for bad. 01:17:56.341 --> 01:17:58.336 But if he had more exposure to people, 01:17:58.589 --> 01:18:00.628 mentors, for instance, who could show 01:18:00.628 --> 01:18:02.882 him that these hacking tricks he knows, 01:18:03.080 --> 01:18:04.686 the cleverness of his social engineering 01:18:04.687 --> 01:18:06.567 skills and his OSINT skills, can be 01:18:06.567 --> 01:18:09.281 used for good and here's how, I think 01:18:09.295 --> 01:18:11.035 that kind of stuff does influence a 01:18:11.036 --> 01:18:12.572 lot of people to turn away from their 01:18:12.574 --> 01:18:14.902 life of crime and to find a new home, 01:18:15.581 --> 01:18:17.571 to be a productive member of society. 01:18:18.288 --> 01:18:19.756 So, he’s trying to do that now. 01:18:19.769 --> 01:18:21.295 He’s trying to build a pen testing 01:18:21.296 --> 01:18:23.225 company with another former SIM-swapper 01:18:23.225 --> 01:18:24.623 named Joseph Harris, one of the 01:18:24.627 --> 01:18:26.382 people Ricky met in the hacker forums. 01:18:26.759 --> 01:18:27.687 They're hoping to get this 01:18:27.689 --> 01:18:29.123 company up and running next year. 01:18:29.123 --> 01:18:29.133 [Outro]: 01:18:34.366 --> 01:18:34.413 [Outro music] 01:18:41.037 --> 01:18:42.743 A big thank you to Ricky and Debbie 01:18:42.744 --> 01:18:44.266 Handschumacher for sharing this 01:18:44.266 --> 01:18:45.537 story with us, and also thanks to 01:18:45.540 --> 01:18:47.250 Mark Kreitzman for telling us about 01:18:47.417 --> 01:18:48.777 one of the worst days of his life. 01:18:48.807 --> 01:18:49.685 You can learn more about what 01:18:49.686 --> 01:18:51.777 he’s working on at efani.com. 01:18:52.150 --> 01:18:53.598 If you liked this episode, go listen 01:18:53.598 --> 01:18:55.266 to our most popular episode we’ve 01:18:55.271 --> 01:18:57.514 ever made, Episode 112, called Dirty 01:18:57.516 --> 01:18:59.141 Coms, which goes into more details 01:18:59.143 --> 01:19:00.588 about this whole underground world, 01:19:01.080 --> 01:19:02.886 or listen to Joseph Harris’ story, 01:19:02.918 --> 01:19:05.050 which is Episode 118, called Hot Swaps. 01:19:05.858 --> 01:19:06.619 Hey, have you listened to 01:19:06.619 --> 01:19:08.384 my other podcast yet, LOW? 01:19:08.755 --> 01:19:09.686 It is wild. 01:19:09.879 --> 01:19:11.053 A lot of feedback from people are 01:19:11.053 --> 01:19:13.142 saying, pssh, I’ll pass, which is fine. 01:19:13.155 --> 01:19:14.005 It’s not for everyone. 01:19:14.173 --> 01:19:15.942 But I’m getting even more feedback 01:19:15.950 --> 01:19:17.458 from people saying — well, here, 01:19:17.460 --> 01:19:18.445 let me actually pull up one of 01:19:18.445 --> 01:19:19.349 the quotes that came in today. 01:19:19.867 --> 01:19:22.532 "The end of Episode 1 left me speechless." 01:19:23.321 --> 01:19:25.434 Someone else wrote, "it has moved me 01:19:25.438 --> 01:19:27.551 in a way that I did not think a podcast 01:19:27.575 --> 01:19:30.133 could." I mean, when is the last time 01:19:30.136 --> 01:19:32.295 you heard a show that moved you in a 01:19:32.295 --> 01:19:33.950 way that you didn't know was possible? 01:19:34.721 --> 01:19:37.054 If you need that in your life, open your 01:19:37.066 --> 01:19:39.777 podcast player and type in LOW, L-O-W. 01:19:39.811 --> 01:19:41.740 I made it as easy as possible to find. 01:19:42.165 --> 01:19:43.730 Go find it, go listen to it, 01:19:43.732 --> 01:19:44.722 and tell me what you think. 01:19:45.377 --> 01:19:46.949 This show is created by me, the ghost 01:19:46.950 --> 01:19:48.381 in the groceries, Jack Rhysider. 01:19:48.603 --> 01:19:50.007 This episode was written and produced by 01:19:50.008 --> 01:19:52.391 the packet-snacker, Sean Powers, assembled 01:19:52.405 --> 01:19:54.152 by the fridge phreaker, Tristan Ledger, 01:19:54.228 --> 01:19:56.052 mixing by Proximity Sound, theme music 01:19:56.072 --> 01:19:57.694 by the mysterious Breakmaster Cylinder. 01:19:58.528 --> 01:20:00.008 Alright, question; if you dug 01:20:00.011 --> 01:20:02.653 up a tomb that was in a pyramid, 01:20:03.341 --> 01:20:05.252 does it become unencrypted? 01:20:06.501 --> 01:20:07.919 This is Darknet Diaries.