The Crying Call

Speaker 1: A software engineer named Richard Mendelstein walks into a bank in New Jersey, approaches the teller, and Richard has his phone out as he walks up. He's got someone on the line with him as he goes into this bank. And Richard, the software engineer says something to the effect of, I need to withdraw $4,000 cash right now. Bank teller goes to get him the money. And when the bank teller comes back with the cash, Richard has like while they were gone, he's found a piece of paper and he scrolled something on it with the little pen off the counter. Mhmm. And he's holding this note that he's written and he's got his phone in the other hand and he hasn't given the note over and he's staring at the phone and he's starting to panic because the call that he was on when he walked into the bank had hung up, the line had gone dead. And Richard, phoning one hand, note in the other, starts to to freak out in the middle of this bank. And he looks at the teller, and he doesn't give over the note, and he just takes the money, looks at the phone, and he bolts. The teller watches as he leaves with the money, the phone, and the note that she never got to see. Which we now know reads as follows. My daughter has been kidnapped. Here's the kidnapper's number. Here's my wife's name and number. But Richard is long gone.

Speaker 2: A little

Speaker 1: bit of a trigger warning, the following audio is a little bit distressful.

Speaker 2: Who is this?

Speaker 3: I don't

Speaker 2: know why you hang up.

Speaker 3: Who is this?

Speaker 2: It's me, dad. Who else? It's me and your daughter.

Speaker 1: Richard Mendelstein got a call that sounded like that.

Speaker 4: Please, whatever you do, please just don't hurt my mom.

Speaker 1: Or this one.

Speaker 4: I will do anything you want. All my money you can have. I'm I'm helping you, man. I'm giving you all I can. I'll give you anything you want, man.

Speaker 1: Neither of those two exact recordings, but one pretty similar to it. And there are a lot of recordings kind of like this. The FBI has a name for what was happening here. They don't actually handle them anymore. It was happening too much. They call them virtual kidnappings, which is, a pretty bad name for them, which we'll get to why. But what they are is a story about people using technology at their disposal in unintended ways to unintended effects. So we're gonna talk about this just very fascinating piece of social engineering on this episode of Hacked. Scott, how you doing?

Speaker 3: I'm doing great, Jordan. How are you?

Speaker 1: I'm doing good. You staying warm over there?

Speaker 3: I was very warm yesterday. Not so warm today.

Speaker 1: Question for you. What is the best way to support this show?

Speaker 3: Well, if you wanna drop ship mattress company, we'd love to have you as a sponsor and, advertiser. But I think for the average listener, the easiest way is definitely Patreon.

Speaker 1: Patreon.com/hackedpodcast. Best way to support the show, according to Scott.

Speaker 3: Accord according to me. Yeah. And I'm I'm rarely wrong.

Speaker 1: You heard it here first. Patreon.com/hackedpodcast if you wanna support the show. Big thanks to all of our patrons on Patreon because this month, this episode, we are gonna be hitting a pretty big milestone. This one, if all goes according to plan, is gonna be our millionth download.

Speaker 3: Let's go. Congratulations, Scott. Congratulations to you too, Jordan.

Speaker 1: Appreciate that, buddy. Big, big milestone for us. Thank you to everyone who's been kinda just listening from day one a bajillion years ago, everyone who stayed subscribed when we stopped producing it for, for a hot second there. Thank you.

Speaker 3: Yeah. There was a whole a whole TV venture that spun up and spun down. You know, we've we've been our story has multiple arcs.

Speaker 1: A lot.

Speaker 3: Our story has multiple arcs. So

Speaker 1: That name, virtual kidnapping. Mhmm. It's not the best name. It's kind of a misleading name. Name. What it does do is get you really good headlines. Of course. Criminals are staging a devious new kind of kidnapping and the FBI is stumped. Great headline. Right? It's a new kind of kidnapping.

Speaker 3: Well, the you know, the word kidnap is, like, I don't know. I'm not a I'm not a parent, but I can only imagine it to be the most, like, powerful term, you know, to just 100%. Have somebody take your child and make you, like, essentially powerless in that situation is probably the most frightening thing in the world.

Speaker 1: Yeah. You hear that a new kind of kidnapping, a virtual kidnapping, and it gets your your heart rate up a little bit. Absolutely. The trouble with all of them is that they imply a kidnapping of some kind. Sure. And this term does not apply to a kidnapping of any sort. It's a social engineering people hack. Virtual kidnapping would imply that, like, oh, the thing being kidnapped is virtual. Right? Like, when you hold something digital ransom that we have another name for that. It's ransomware. We talk about it all the time. Mhmm. Calling this a virtual kidnapping is using virtual in a very traditional sense of the word, where you would use it to mean, like, practically as described, but technically not quite. The way you might say there's virtually no way that could happen, or there's virtually no way to control that.

Speaker 3: Mhmm.

Speaker 1: Basically, for all intents and purposes, but not technically quite for, you know, a small exception. And the exception in this case is the kidnapping part.

Speaker 3: So virtual kidnap actually just means not kidnapped.

Speaker 1: It means like a fake kidnapping, like a theater like a Yeah. Kidnapping ruse, which brings us back to Richard Mendelstein, not his real name, the morning all of this kicked off. Richard, 56 years old, software engineer at Google, who according to the coverage of this by David Kushner, is the kind of guy to, like, watch out for phishing schemes and not click on funny links and store his password in, like, a little encrypted folder, knows what's up when it comes to cybersecurity.

Speaker 3: Sure. He's passed the corporate cybersecurity checklist exam every year. You know, he challenges the test. He gets through it. No problem.

Speaker 1: He knows what's up. He's got it figured out.

Speaker 3: He he knows what the term fishing means, and he tells his friends about it. I gotcha. I know I know who we're talking about.

Speaker 1: In July 29 at 11:00 in the morning, Richard gets this call. Richard's daughter has been attending Northwestern University as a junior, and Richard gets this call, and his call, like all of these calls that happen all over the world, goes basically the same way. Richard hears

Speaker 2: Give me your daughter.

Speaker 1: At which point, someone grabs the phone away and says Listen very carefully. We have your daughter. If you do exactly as I say, nothing will happen. I just want money. Don't hang up. Don't talk to anyone. Don't take any calls. Don't text. At which point, the other big character in this whole story, Richard's wife, walks into the room. She asks, are you okay? The kidnapper is still on the line with Richard and just told him not to talk to anybody Mhmm.

Speaker 3: And

Speaker 1: told him, you know, I can hear everything. So Richard doesn't say anything because he doesn't want to get his daughter hurt.

Speaker 3: Mhmm.

Speaker 1: And in what I'm sure was, like, a really awkward moment in their kitchen, you know, staring at his wife, holding his phone, he just gets up, walks out of the room, walks outside, gets into his car, and drives off. Leaving his wife just like standing there in her kitchen with no clue what is going on. Yeah. Confused. Richard, at this point, is now following the kidnapper's instructions and is driving to the bank from the opening story. And on the way, the kidnapper is, like, making him rattle off all the street names as they rush by to prove that he's actually heading to this bank. And Richard's phone is lighting up with, hey, husband, like, where did you go? That was scary and weird text messages and calls from his wife. Like, he can't take them because the kidnapper is on the line with him listening the entire time, keeping him on this call. He's always being kept on this call, which is a big part of this, and we'll talk about that later. Sure. He gets to the bank, he goes inside, he writes the note, doesn't give it over, and he walks out with $4,000 in cash. While he was in there, the call for whatever reason got cut off. So there's this little lull, this little patch where he isn't being surveyed by these scammers, where the kidnapper can't hear him. So he calls his wife, and he gets in his car, and he starts to drive to the police station. She picks up the phone. He says, our daughter's been kidnapped. And she says, how do you know? And he says, because I spoke to her. Mhmm. Like, he heard her, right, on that phone call. That was her. Right? Right. Right? Right? And right as he's ripping into the parking lot right in front of the Montgomery Township Police Department, the kidnapper calls him back. Richard hangs up on his wife, and he he answers the call. So typically in these scams and really the the social engineering phase of a lot of the hacks we talk about here, there are, like, stages to it, almost like an act structure. And the closer you can keep it tuned to that act structure, the better it's gonna go.

Speaker 3: Of course. Yeah.

Speaker 1: And it's at this point that that order gets shuffled just enough as to start to unravel. The whole point of, like, a a people hack like this is that the line never goes dead. There's never a moment where you're not, like, adrenaline pumping on the line with the kidnapper.

Speaker 3: Sure. Yeah. Yeah. Yeah. You're fighting anxiety.

Speaker 1: You're constantly just trying to solve this situation. You're in panic mode. Oh god. I gotta fix this. And for Richard, that's basically what happens. Aside from this little blip as he's walking out of the bank and he calls his wife, aside from that, he is on the line the entire time. And as soon as he gets the police, the kidnapper calls him back, and he's back in it. He's back on that that roller coaster ride. Because the call got cut off and he was able to ring up his wife, who Richard just hung up on, she is now sitting there in her house going, like, oh my god. What is going on? Who are these people? Do they have my daughter? What is happening to me right now?

Speaker 3: I can pick up my phone, and I can call the daughter, and I can do all where the husband can't.

Speaker 1: She's not on the roller coaster ride driving around like Liam Neeson taking yeah. She's she's free to have the very rational thought that you just did. I should probably try calling my daughter. Mhmm. And her daughter picks up and says, presumably, like, hi, mom. What's what's going on? What's good? What's new in your world?

Speaker 3: Yeah. What's good? How's dad?

Speaker 1: How's dad doing? And she says, dad says you've been kidnapped. And the daughter goes like, no, I'm good. I'm fine. But the mom, the first thing the mom thinks is like, oh, maybe this is all part of the ruse. Mhmm. So she makes her daughter FaceTime her to prove she's not, like, at gunpoint. And her daughter shows up on the camera, and she's fine. So the mother says, like, where are you? And she says, with a friend. The mom says, let me see the friend. And the friend, like, leans into the FaceTime frame, this little wave. And once the mom is convinced that her daughter's okay, and the adrenaline starts to kinda wear off, and the sharpness starts to get a little bit fuzzier, she's gotten off the ride, you know, like the engineering has failed, the act structure has been broken.

Speaker 3: Yeah. Exactly. You've been pulled you've been removed from the play. Now, they they broke the third wall.

Speaker 1: They they turned the lights on in the theater, and you can see that the the floor is a little sticky. Yeah. And the mom says, okay. My daughter's at school. She hasn't been kidnapped. She's okay. And the next question that pops into her head is where the fuck is my husband going with $4,000 cash? And who is gonna be there to meet him? We're gonna get to that right after the break. Starting some new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's gonna work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US. From household names like, well, hacked podcasts merch, to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button that's used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, sort of getting abandoned in the parking lot, and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/act.

Speaker 5: You have one new message. Translating. Disney and Pixar's Hoppers is now available on Disney plus

Speaker 3: You could say that again. Critics are

Speaker 5: calling it Pixar's funniest movie ever and a wildly entertaining ride. Blizzard

Speaker 2: entertaining ride.

Speaker 5: Blizzard potato is certified fresh and verified hot.

Speaker 3: Now, we party.

Speaker 2: This is incredible. Wow.

Speaker 1: I am clearing

Speaker 3: the rest of the day.

Speaker 5: Disney and Pixar's Hoppers, now available on Disney plus Rated PG.

Speaker 6: You thought this was your run club era. Turns out, it was more of a thinking about run club era. The good news? Someone's marathon training is about to start. Sell your workout gear on Depop. Just snap a few photos, and we'll take care of the rest. They get their race day fit and you get a payout for trying. Someone on Depop wants what you've got. Start selling now. Depop, where taste recognizes taste.

Speaker 7: I No one goes to Hank's for his spreadsheets. They go for a darn good pizza. Lately though, the shop's been quiet, so Hank decides to bring back the $1 slice. He asks Copilot in Microsoft Excel to look at his sales and costs and help him see if he can afford it. Copilot shows Hank where the money's going and which little extras make the dollar slice work. Now Hanks has a line out the door. Hank makes the pizza. Copilot handles the spreadsheets. Learn more at m365copilot.com/work.

Speaker 3: I just like I I feel like you could just do this better, you know?

Speaker 1: Yeah. How would you improve on this?

Speaker 3: I think the the first thing I would do is, you know, I would make sure that I was in control like, you know, let's lean into the virtual side of this and the digital side of this.

Speaker 1: Sure.

Speaker 3: Like, if you digitally kidnap somebody, I. E. You were to take control of their mobile phone or have control of their their social, you know, social networking, Instagram, etcetera, you could make it much more convincing. Like, imagine the phone call came from the daughter's cell phone rather than just some, you know Clever. Random number. Like, I feel like I feel like they could they could be better at this, you know. And that's probably not a great thing to say, but it's like just, you know, like, I get that it works and you, like, it's essentially like a a hard ruse where you pull somebody into an emotional window and, like, you feed them full of adrenaline and you force them to do something. You're also, you know, under the guise of a serious threat to their, like Mhmm. Close family. But I feel like, you know, from the hacks perspective, from the digital's perspective, I feel like they could really tighten up their game. You know?

Speaker 1: For sure. If you were taking a targeted approach of doing this, you could probably keep someone on throughout a bunch of, no. I think this isn't quite right or something seems off. Like, you could probably get over a lot of those hurdles if you could prepare for it, if you could target it.

Speaker 3: Well, I just think about, like, like, we've talked about some pretty amazing digital heists on this show where it comes to, like, you know, getting people access to people's cell phones to bypass, two factor authentications to get another Bitcoin. Like, you know, we've we've seen and talked and discussed about people going farther, doing more. And, you know, this just seems like a lazy ransomware method where it's like we just we just call people until somebody bites.

Speaker 1: Yeah.

Speaker 3: And it's like, you know, it's the same thing as the I get a 100 phone calls a day saying that I'm being arrested for not paying taxes or border security stuff or whatever.

Speaker 1: Yeah.

Speaker 3: And I just ignore them all. Like, there's actually Apple I don't know if you knew this, but has introduced a new setting where you can just ignore all phone calls from people that you don't know, which is, like, in a business perspective is, like, a scary thing to do to just click on unknown number to send it to voice mail. Yeah.

Speaker 1: It's gonna hurt.

Speaker 3: But it's like, I literally there's certain days that go by that I get, like, ninety five

Speaker 1: Totally.

Speaker 3: Of these, like, spam phone calls. It's like, I haven't bitten on the first 2,000 of them. Why do you think the two thousand and first one's gonna work on me now?

Speaker 1: Yeah. The, you know, we make a show called hacked, so I kinda think about what constitutes a hack a lot of the time. And I I like the it's using technology in unintended ways. Like, if there's there's a use outside of what has been designed, that that's when you're getting into it. And I think that it's really interesting you bring that up because where these calls are coming from and who is doing them changes the nature of what this is in a really cool way.

Speaker 3: Mhmm. Mhmm.

Speaker 1: I also get a lot of those calls. I've never gotten one of these calls before. The calls I get are, I think, the same one you just mentioned. I get the CRA call, which is the Canadian version of the IRA, like, the you've been flagged or your name IRS. IRS. Thank you. I get the sense I don't know what to do with this thought, but I get the sense these are really common up here in Canada. And I presume over time, like, the most effective tactics for those calls become common until their commonness reduces their effectiveness, if that makes sense.

Speaker 3: Yeah. 100%.

Speaker 1: And I find it really interesting that here in Canada, the most common, like, emotion they're trying to get at is, like, oh, you broke a rule. Like, that's the thing that getting the incident revealed themselves to be susceptible to is, like, oh, you didn't chuck a box? I'm sure you didn't mean to do that, and then we clamor to make the thing okay.

Speaker 3: We're gonna put you in jail. No. That that is I never thought about it like that, but that is true. Canadians, we just have, like, the softest form of this. You know? In America, they're kidnapping children or pretending to. And in Canada, we're like, you didn't fill out your paperwork at the border correctly. And you're like, oh my god. Take my visa number. I'm so sorry.

Speaker 1: I remember that one time I did this in 2004. Speaking of this in The United States Mhmm. Explosions of virtual kidnappings, like, pop off in the summer of about 2015 or so When, the FBI started to get calls, they got a they got a call about a run of fake kidnappings in Southern California, specifically in area code 310, which is all of West LA, and it's like a famous area code.

Speaker 3: Mhmm. Mhmm.

Speaker 1: And it's the same thing every time. Person gets the call. There's someone on the other line out of breath crying. You know, help me. Help me. They think, is that my relative? And then a ransom demand. And there's thousands of these things start coming in. One woman, one of the early ones, did what Richard did. She wrote a note to a bank teller, but she actually handed it over. The cops came. But it started happening, like, all the time. I think right now in The States, it is the third most popular kind of phone. Wow. A guy in Missouri whose mom got taken. His air quotes are on all these. A pastor in Memphis whose daughter got taken. A lady who went down to Mexico with her husband, and they got, like, a cartel themed one. It happened to a cop in LA, which speaking of law enforcement, this essentially doubled in 2020. And while most law enforcement now knows about it and can go, oh, this is a fraud when they get one of these calls, in 2022, a bunch of them still haven't heard about this, which creates this domino scenario where you not only have loved ones of the purported victim running around trying to solve this problem doing all of this, like, kind of reckless just trying to solve a problem kind of behavior, you now also have cops running around trying to solve what they think are kidnappings happening in progress.

Speaker 3: Yeah. Sure.

Speaker 1: To quote FBI agent Eric Arbuthnot, quote, jumping fences and breaking down doors. So you have fake kidnappings prompting very real chaos.

Speaker 3: Sure. Real fake fake kidnappings prompting real responses.

Speaker 1: All starting with just that little social engineering glitch moment of someone crying on a telephone.

Speaker 3: It's amazing. You better you better imagine how many people get that call that don't even have kids. You know? Yep. Because you got because you'd like I that would be something of interest is, like, how are they at least filtering their call lists? And, like, are they doing any kind of pre filtering to be, like, these people don't actually have children? Like, let's not call these people. Or are they just kind of wholesale calling? Like, call everybody. You know? For every thousand calls we make, one person, you know, bites, so we just need to make enough calls.

Speaker 1: I bet if they could check, they would. Mhmm. And we'll talk about why they can't check pretty soon.

Speaker 3: Oh, let's go.

Speaker 1: Within an hour, word about what was happening to Richard Mendelstein had started to get out. Presumably, his wife had talked to one person and kind of word had started to spread amongst their friends and family. One cousin had heard a rumor that people had hacked Richard and had his bank account, and that's why he was driving around. There was another rumor, his wife heard that the kidnappers were actually with him and had him at gunpoint, which she didn't really know whether or not that was true. And, you know, when a story like this sort of pops up inside of a social ecosystem, it did as they tend to do, and it revealed other people's stories. In short order, people started saying, oh, this happened to me too. Like, her sister's friend thought her daughter got kidnapped, her brother in law's grandpa got tricked about his grandson. All of them having the same experience of what is real, what is going on, what's happening, none of which, you know, answers that question for his wife who's just sitting there, no clue where her husband is going. Practically speaking, how is this done? My first theory was that they were gonna have, I've been reading a lot about the technology that's being used, to coordinate communications inside of the Ukraine right now.

Speaker 3: Mhmm.

Speaker 1: When Russia destroyed a bunch of the, like, data towers, they created a situation where they couldn't use, like, WhatsApp or any encrypted messaging system because they needed access to the Internet. So all they had access to them was cell phone coverage, so they started having to use essentially very fancy SIM hub auto dialer type machines. And there was a guy who got arrested in the Ukraine, allegedly working for Russia, who had one of these SIM hubs, these, like, little kind of machines that allow you to act as a repository for a bunch of different calls coming and going out. He was essentially acting as, like, a little telephone switching booth, when they found him.

Speaker 3: Crazy.

Speaker 1: So my first theory was that they would have had one of these these SIM hub type machines, which is not how this is being done, which brings us to the reason it started in The States in a famous area code like 31 o in West LA. Like just about any other phone based social engineering scam hack type thing, this is a numbers game. And in this case, it is a pen and paper numbers game. You pick an area code and you start to work your way down a list of all the possible nine digit number combinations. And though 99 might hang up, as long as you get the right one, as long as you get that person for whom hearing that crying on the other end of the line causes that little kind of glitch in their brain where panic starts to eat away all the reason, you can get them. Apparently, a big part of the script, like the sort of engineering turn that lets you get a person is when the interaction goes, help me, help me. Jenny, is that you? And then you jump on and say, we have Jenny. And they go, oh my god, they have Jenny.

Speaker 3: Sure. Of course. Yeah.

Speaker 1: Because you revealed that the person's name was Jenny. And you just keep moving, moving, moving. And they kept Richard moving in his car on the line, having just left the police station upstate to a town, called New Brunswick to this specific location. Like, the kidnapper knew the streets. He knew exactly where he was sending Richard. And Richard is driving, and he doesn't know what's gonna be at this address, but he is taking $4,000 there. It turns out that Richard was being directed to a very dodgy money wiring place where he was told where to send the cash. There is a community outside of Houston called The Woodlands. It's like a rich neighborhood, a lot of oil money.

Speaker 7: Mhmm.

Speaker 1: And a couple years ago, one of these calls unfolded there, exactly as you think it would. Mother gets the call, she hears the crying, they say we want $25,000. She goes to get the money and she takes it to the drop point. The difference in this case is the drop point. Instead of like a money wiring place in a bad part of town, it was an elementary school near Houston. She was told to drop it off in a garbage can and someone's gonna come pick it up. At which point, a woman named Yannette Rodriguez Acosta came and got the money from that garbage can and was spotted by a surveillance camera. And a SWAT team picked her up shortly after. Wow. And it is here that we find out where these calls have been coming from, who has been doing these calls, why they've been doing it in the very analog pen and paper way that they've been doing it. Yanet, who picks up the money, is the girlfriend of a man named Ismael Brito Ramirez, a 38 year old serving time in Mexico City on murder and kidnapping charges, currently in a prison. We're not gonna dip our toes into the world of, like, physical in real life kidnappings in Mexico. It's way too big. It's way beyond the scope of this episode.

Speaker 3: Yeah. Absolutely.

Speaker 1: But starting in about 2006, Vox described it as they essentially became democratized. It went from being something that happened to high value, high profile targets to something that would happen to, like, a teacher, something kind of that affects middle class people. People get more afraid of it happening, which then opened the door to this thing that we're talking about, which is social engineering surrounding that fear. People are so scared of kidnappings because they happen so much that you don't even have to kidnap anybody. You just have to convince someone that you have. Sure. Where, like, fear of one crime becomes the main ingredient in another. Which is all to say that this guy Ramirez, Dinette's boyfriend, finds himself in prison. And he's heard about virtual kidnappings. He knows about this. It's a thing. It's all very profitable. And Ramirez has this little advantage, which is that he speaks English with a super accurate American accent. And it gives them this idea to export this grift to a place where they don't know about it yet, where it's not this, like, super familiar story. It's not like a Nigerian prince email that everyone's heard about it. It's, like, it's a surprise.

Speaker 3: Sure. Yeah. People aren't people aren't desensitized to it yet.

Speaker 1: And who has time seven days a week, twelve hours a day to make call after call after call, horrible success rate be damned until someone bites.

Speaker 3: I feel like you already answered this, but I'm shocked that prisoners, have that have that much phone time. But I guess they probably get cell phones in jail.

Speaker 1: So Ramirez gets a bunch of burner phones. Apparently, that's a that's a big part of it. Smuggling phones into prison, very, very common thing.

Speaker 8: Mhmm.

Speaker 1: Having a phone in prison, relatively common thing. Mhmm. So he cooks up this laundering system where victims like Richard transfer the money down to Mexico, and a mule picks it up on the far side of the border or at a drop outside of a school in the Woodlands near Houston. And suddenly, he's built this little, like, phone crime ring kind of structured around this social engineering hack running from right inside of a prison. At a few thousand dollars at a time, the feds generally don't care about this that much. It kinda starts to fly under the radar pretty quickly. Mhmm. Ramirez does get caught after the, Woodlands bust. He gets charged with conspiracy to commit extortion wire fraud and money laundering. But that kinda just reveals the real problem with this, which is, you know, oh, throw the book at these people. I've already had the book thrown.

Speaker 3: Yeah. Yeah. Yeah.

Speaker 1: You can't threaten them with more jail time. They're in jail.

Speaker 3: I guess I'm not getting out on good behavior. I'm just gonna spend more time making money in in jail.

Speaker 1: Yeah. Like, you got a bunch especially when you got a bunch of people in jail that are probably not gonna leave for most of the rest of their life, and you figure out a, like, clever new crime that you're uniquely equipped to do inside of prison in this really low tech way, it makes sense that it's gonna grow pretty quickly.

Speaker 3: And especially, like, the outsourcing. I'm sure there's you can bring other prisoners in from other institutions and just get the build the corporate structure. You know?

Speaker 1: Which it does. It spreads. Other cities in Mexico and then down to Puerto Rico and The Dominican Republic. In Tamaulipas, prison officials tried to install, like, equipment that would prevent inmates from making calls on the cell phones they've smuggled in, but the technology that they used was so powerful that it turned off service throughout most of the city. And when you think about it with just how many people are in prisons, at a certain point, this turns into what a lot of hacking stories do, which is, like, you're going up against the hive mind. Even if you come up with a solution, it's only a matter of time before one of a 100,000 people comes up with a solution for your solution. So Richard transfers the $4,000 down to Mexico, sends the money off, and he exhales. He gets off the call with the kidnapper. He's standing there in the parking lot, and he checks his texts. He sees a bunch of stuff from his wife. So he calls her up to find out what's happened, and he finds out his daughter is okay. He got hacked. He got tricked, but all is well. Richard, the thing I find interesting about this is that Richard is a software engineer at Google. Like, he knows what a phishing scam is. If we knew his real name, it is not unreasonable to think he could probably be a subject matter expert on something on this show.

Speaker 3: Sure. Yeah.

Speaker 1: The idea that he would ever get a scam email or a text or see a pop up or answer almost any other kind of call, like you said, that would result in him and a money wiring place sending a weird amount of cash to Mexico is preposterous. But social engineering is really, really powerful, and it functions almost like a like a joke where it doesn't work as well if you've heard this one before. But if you aren't familiar with the punch line, it can kinda catch you off guard a little bit. Like, it'll it'll it'll sneak up on you. That a guy like him would get got by it, I find that very, very fascinating, and it makes me think that maybe it's not a kidnapping call, but that there's some kind of call or text or message I could get that would make me fall for something like this too.

Speaker 3: Everybody has a trigger. Right? You know, whatever it is.

Speaker 1: Thanks for listening, everybody. Looking based on last episode's downloads that we've got a bunch of new folks who have joined us maybe for the first time. If that's you and you've made it to the end of this episode, thanks. Really appreciate you being here. Happy to have you. Let's cite a couple sources here. First up, the big one in this is We Have Your Daughter by David Kushner, ran an insider. It was a big source for this and it is a interesting, you know, punchy read. There's more to that story than we got into in this, sort of outside of the hack scope. So if you're interested in this, highly recommend you check that out. There's also Vox's piece by Rory Smith on the democratization of kidnappings in Mexico. Also a fascinating interesting story. Again, outside the scope of this episode, but totally worth a read. Thanks again for joining us and we will catch you in the next one.

Speaker 2: One.

Speaker 8: Have no fear. Chosen Foods is here to defend your favorite foods from the forces of seedy oils and sketchy ingredients. With cooking oils, salad dressings, and mayo, all powered by the good fats from 100% pure avocado oil and simple delicious ingredients, chosen foods.

Speaker 9: Athletic Brewing Company crafts award winning nonalcoholic beers for those who wanna be part of every round. With over 185 flavor awards, they're exceptional NA beers that fit your lifestyle and any social occasion. Summer's full of good times and athletic fits right in. Go to athleticbrewing.com to have brews delivered to your door or find them at a bar, restaurant, or store near you. Near beer, athletic brewing company fit for all times.

Speaker 10: Ryan Reynolds here from Mint Mobile with a message for everyone paying big wireless way too much. Please for the love of everything good in this world, stop. With Mint, you can get premium wireless for just $15 a month. Of course, if you enjoy overpaying, no judgments, but that's weird. Okay. One judgment. Anyway, give it a try at mintmobile.com/switch.

Speaker 8: Upfront payment of $45 for three month plan, equivalent to $15 per month required. Intro rate first three months only, then full price plan options available. Taxes and fees extra. See full terms at mintmobile.com.