1408: The Digital Pickpocket part 2

Speaker: Mhm. Previously on Pretend, we met James Friedman, a master pickpocket. James Friedman is a British entertainer and professional pickpocket who uses his skills to catch bad guys. Instead of being one himself the time and you can decide what I take What would you like me to steal the phone the business cards or the brush brush? It's already gone And that's another thing you have to be aware of thank you He follows in a long line of famous pickpockets like Fagin and the artful Dodger the fictional characters from Charles Dickens Oliver Twist You'd like to make pocket handkerchiefs as easily as the Artful Dodger, wouldn't you, my dear? Yes, if you teach me, sir. We will, my dear, we will. Cut to Fagin was a criminal mastermind who trained young boys to become pickpockets and thieves. As a master pickpocket, James Friedman can easily lift, boost, and pick any wallet. But today we rarely carry around cash. And some of us don't even use physical credit cards anymore. One could say that pickpocketing is a dying art form. But, that would be foolish, because a pickpocket doesn't give up, they learn to adapt. And today, James Friedman is going to show us how to tap, dip, and swipe your digital wallet right from underneath your nose. Yes, he's going to teach you how to commit fraud so that you too can outsmart a digital pickpocket. I'm Javier Leyva, and this is Pretend, stories about real people pretending to be someone else. The evolution of fraud, you know, 30 something years ago, people would get a phone book, ring you, just work their way through. Hello, Mr. Johnson. Yep. Pleased to tell you you've won a holiday. That's terrific. And you've also won a set of our luggage to go on this holiday. That's amazing. And are you still at 74 Beswick Street? Yes, I am. And is your phone number still? Obviously, you just rang it. And check some details. We just need you to pay the shipping charge on the luggage. But the luggage is worth 300 and we're going to charge you 5 shipping. Sure. What's your credit card number? And that's how they got what's called the full set, right? The guy's details. What's your Are you over 18? What's your date of birth? Just hope you won this competition. And that's how they did it. Tricking people to divulge confidential information. Then we all got home computers and they realized they could just email you and tell you'd won the Nigerian lottery. At this point everyone should know not to give money to Nigerian royalty, right? Well at least most of us do. But things aren't just that simple anymore. Now there are phishing text messages, phishing messages. Spoof emails, countless other techniques designed to part us with our wallets. I can send a text message from here that has any number I want as the number you see when it arrives. And I don't even need to know the number. If I send it to you with the word sent from the word mum, and you have mum in your phone, it will join the conversation in your phone that you've been having with your mother. Yeah, in fact, the first thing I did when I got that software was to send my brother a text message from my mom telling him he was adopted. He's not, and she didn't send it, but it's the sort of thing that brothers do. And now there are all kinds of ways that people can pick your pocket from far away. James Friedman had an identity theft show where he was able to show his digital pickpocketing prowess. We cloned a card for a member of the audience and then went to an ATM near the theater to prove it. So it was a terrifying show and I had all the equipment so I thought I'll try it. If you want to know how to make a dodgy credit card go to YouTube. Cloning credit cards is easy. I mean, even disgraced U. S. representative George Santos is accused of doing it. Oh yeah, that's according to testimony from George Santos, former roommate. Look it up. James Friedman also told me how to use someone else's credit card without knowing their pin number. And it's really not that hard. Like you said, you could buy those magnetic stripe readers and writers on Amazon, very cheap. You need some sellotape. Scotch tape, and you put the tape over the chip, just cover it up. You could use clear nail varnish, but that can't be removed. I was taken out for tea by a journalist, a journalist from the Sunday Times. And at the end of the tea, he said, Thank you, but you didn't really do anything. I said, Oh, I paid using your bank card. And I had picked his pocket, added sellotape to the card, gone round to the bar and said to the staff there, I don't want my guests paying, I'd like to pay for tea. with his card. I didn't add that, but and I put the card into the machine and of course it didn't work. I said, Oh, this happened this morning and I pulled it out. So that's strike one. And I rubbed the thing on my arm. That's going to do it. Maybe it's dirty. Try it again. That's strike two. It's really annoying. James inserted the altered card in the chip reading machine three different times. It never worked. So it prompted him to swipe. Perhaps I'm going to need a new card. She took it out the second time. I commented on her shoes and I nailed on it's just something to change this a bit. Third time it says verified by signature. Remember James altered the card, rendering the security chip useless. And then when you put this in a machine, pretending to be whoever the card belongs to. It won't be able to read it because it can't make contact with the chip. So it will say, can't read it. If you take it out and try it two more times, it gives up and says, okay, just verify by signature. So you have to be able to socially engineer slightly the Person who's holding the time machine. Social engineering is a form of psychological manipulation. It's used to trick people into giving up sensitive information. If you could deceive someone, you could gain access to secure systems such as their banks and their company's sensitive data. James Friedman tells me of another way digital pickpockets can cash in by using the ATMs at your local bodega or corner store. Check it out. It's usually a private ATM that charges you money to take money from your bank and it's meant to draw people into the shop. You can withdraw money here. Those machines are obviously connected to the internet, but you can disconnect them from the internet very simply. The simplest way is to unplug the phone line that's plugged into the back or the modem. Often the. Why after these things goes all the way around the shop to another part of the shop and you just unplug it at that end. So you don't even have to be near the machine. You then put a card into the machine. And in some of the machines, do your own tests with your own cards, please. People in some of those machines, it asks for the pin number. And if you get the Pin number wrong, it still lets you take out money because it can't verify it. This is called an ATM jackpotting attack. I'm not sure disconnecting the ATM will work a hundred percent of the time. Like James said, some newer machines might have a wireless connection, but ATM jackpotting is a real thing. Thieves quietly empty out an ATM's cash by plugging in a USB drive with malware. Or installing a little black box that plugs into the machine's network and tricks the machine into dispensing all of its cash either all at once or a few transactions at a time. So that's how you can pickpocket an ATM. But what about our cell phones? We call it a phone, but come on, it's much more than that. You're basically walking around town with your life savings in your pocket. But Javier, there's these biometric logins on my phone and passcodes. Ha, you know what they say, when there's a will, there's a way. James Friedman told me that he was able to hack the iPhone's face ID. It came out on the iPhone 10, which was iPhone X, as it's written. And you couldn't see that phone until launch day. But you could buy a dummy phone that was exactly the same dimensions and shape and stuff. And so what I fashioned, in fact, I've got it here, wait one second, I'll show you. James pulled out a paperback book, but it wasn't what it appeared. There was a little tiny hole in the back of the book. And it's hollow so that my Current phone and case will go inside. And what I use it for is if I'm on a tube or I'm somewhere public, I can film these guys and get the footage for me and not be very obvious that I'm pointing a phone at someone. So I had one of these for years. In fact, this one, I keep cutting the hole bigger as the phones get bigger. He took it to the Apple store on launch day. I said to the genius, cause that's what they're called. Have I pickpocketed the phone from her pocket, slipped it into my pocket straight into a book like this, and then said, have you read this book? And she looked at the book and unlocked the phone. That's not hacking in the formal sense, I'm not a hacker, but it's socially engineering someone to, Give you the bit you need. Listen, most thieves can't slip someone's phone out of their pocket, insert it into a hollow book, and scan the victim's face. That's a trick suited for skilled performers like James Friedman. But, some researchers claim that they've been able to bypass face ID. And log into a victim's phone simply by putting a pair of modified glasses on a person's face. But don't worry, the attack itself is really difficult, okay? Given that the fraudster would need to figure out how to put these glasses on an unconscious victim's face without waking them up. For the most part, Face ID technology is pretty solid. For now, at least. I'll give you a more biometric example, which is not my research. It was actually a company called Vacanzi showed this at the mobile world Congress in 2016. And that is how to hack touch ID, not face ID, touch ID using Play Doh, the child's toy. I'm much more a fan of touch ID. I've never had a phone with face ID because you don't know when you've glanced at something, but you are more likely to know when you've put your thumb on something. And again, James pulls out some putty and presses his thumb to make an imprint. Now, you have to cure this stuff. You can leave it out in sunlight or you can use a ultraviolet torch. It actually sets this stuff. James and I chatted a little bit while the putty dried. And so do you have an assistant doing this at, during the show? I do this during the show. And in fact, I get One person to loan us their phone and I teach another person in the audience how to hack the phone of the stranger So what I have now is this dental party, but if I take it out now, you can see it's it's hard now, right? and This is a negative of the thumbprint And now if I get this, uh, unlocked phone and Play Doh, um There you go. You unlocked it. That's amazing. And that only took, really, less than a minute. And just like that, with a little misdirection and some Play Doh, James can hack into anyone's phone. When you were Describing wasn't some white hack computer scientists trick. It was good old fashioned social engineering, right? Yeah. And there's huge amounts of. I think social engineering, you don't even have to be present to socially engineer someone. He's right. You could be miles away and still fool someone. The next digital pickpocketing trick is one to really watch out for. QR codes. You know, those little black and white square barcodes that you use to order food at restaurants or pay for parking? Well, prior to the pandemic, QR codes struggled to take off, but today QR codes are everywhere. There are bikes now you can hire in London and scooters, actually e scooters, and to hire them, you scan a QR code. So you scan a QR code and then it takes you to a site and you put in some payment details and you can unlock the bike. And what the scammers are doing is putting another QR code over that so that you're going to a fake site. You're still unlocking the bike. You're still paying. You just don't know. They can see where you are now because you're on the bike. That's one way around it. So here's a QR code. You have an iPhone with you. I scanned the QR code James showed me through the screen and it took me to his website. So open your camera. And what does it say on that? I can't believe you did that. Yeah. And then below that never scan a QR code unless you can preview the results unless you can preview the results. Everyone knows it's been, we've been told for years. Someone sends you a text message or an email with a link in it, don't click on the link. And yet, these things, people scan from billboards and out in public and restaurants. And the pandemic has made QR codes far more ubiquitous because of the contactless app. From there, James told me to click on the photograph on his site, which led me back to Google. And then he asked me to Google something. It turns out that he could see what I was Googling on my phone because my phone had been compromised. I'm getting a live feed now because I'm an honest guy. I released you. Oh, okay. I mean, releasing you, actually, I cleaned up the evidence on your phone, which a bad guy wouldn't do. Well, he might clean up, but are our phones safe? You know, are you happy now to go to your banking app on that phone? No. And now you have access to my phone. I mean, I don't. And you have my word as a thief. Scammers can easily create a QR code and stick them over real QR codes. Scanning these phony QR codes can trigger automatic downloads of malware into your device without you even knowing it. A malicious QR code can also lead you to a realistic looking website. You think you're paying for your scooter rental, but instead you're handing over your credit card information to a digital pickpocket. When I was preparing to interview James Friedman, I knew that he could pickpocket anyone. I've even seen him pickpocket King Charles himself. I thought I would be safe because there's a whole ocean between us. There's no way James Friedman could pickpocket me. Turns out, you can still do a lot, even from afar. I used to say that distance was one's best defense. When the pandemic hit and the UK government said stay two meters away from everyone else. I thought that's my career as a pickpocket on pause. I soon realized actually you can socially engineer over a distance. The pandemic didn't just end James Friedman's career as a professional pickpocket, it just strengthened his skills. He adapted. You're a pickpocket, but the fact that somebody could digitally pickpocket you, the idea that you could just walk by somebody and tap their pocket and steal their digital wallet, is that possible? No, it's possible. It's possible, but it's not something you need to do. necessarily to worry about with your bank card being skimmed in that way. A consumer group based out of the UK was able to go on an internet shopping spree with credit card data snatched by a contactless card reader. They were even able to gain enough information to complete an online order. It's important to note that their card reader was able to obtain crucial data with the exception of the volunteer card holder's name and CBB code found on the back of the cart. Most online retailers require this information in order to complete a purchase. There are also no statistics to show the scale of contactless payment fraud. So this doesn't appear to be a real problem. Plus, if you walked by a random person, you would need to get fairly close in order to make a scan. Or you have to have a very large reader to do it from a distance. Let's say someone walks by you and scans your credit card information and successfully makes a purchase with your card. Your credit card company should not hold you liable for any of those losses. If you're really paranoid about this though, they make special Faraday wallets that block the electromagnetic signals between your card's chip and the reader. But seriously, don't worry. Fraud on contactless cards are in fact extremely rare. For now. There are easier ways. They're just easier ways. If the card is contactless, they're going to steal the card and just do a contactless transaction. If they see you entering a pin number, they're going to steal the card because they now have unlimited access. If they can get hold of just the card details. So I carry these cards and the contactless, as I mentioned. Has been disabled. So I'll tell you in detail how to disable the contact list on a card, which can be used for good and bad reasons doing that. And what you do is you take your smartphone and you turn on the torch. The torch, AKA your phone's flashlight. Keep up with this people. And then you put the card over. The torch and you go into a darkened room, you move the card around and you will see the wire inside. That's the aerial for the induction and you cut that aerial at any point and the contactless won't work. The chip and pin element will still work, pin verification and the mag stripe will still work, but the card won't work contactless. And why do I do that? Because if you lose your contactless card, You ring your bank, you say, I lost it. They say, no problem. We'll cancel it. And they send you a new one, but they cannot stop that card working because contactless payments are not all verified centrally. Some of them have verified offline. And if they're verified offline, the charge will appear on your account until potentially the expiry date of that card anyway. And if you spot it, I'm sure the bank will give you your money back, but I don't want the hassle of checking. Okay. And though personal Apple Pay technology may be relatively safe, it turns out that contactless payment systems can actually be a great tool for fraudsters. I just recently read this Vice magazine article where a fraudster said that Apple Pay is actually, quote, the easiest way to make money. But it's not by hacking the technology. Here's how it works. Bots, yes, non human bots, use social engineering to text hundreds of people, even making phone calls to potential victims, and trick them into revealing their multi factor authentication code. Yeah, you know, the code that's generated anytime you want to log in somewhere? With this code in their tiny, cold, metal hands, These bots then link that code with the stolen credit card information found in the dark web. Oh yeah. I hate to break it to you, but if you've ever shopped at Target or anywhere that has had a major data breach. Well, you most likely have your credit card information out in the dark web. I know, ignorance is bliss. Now that the bot has your code and credit card information, they can add your credit card to their Apple Pay or Google Pay. It's that easy. So what does Apple have to say about all this? Well, they basically said that it's the bank's and credit card company's responsibility to perform verification of these cards that are added to Apple Pay. In other words, it's not our problem. So be on the lookout for phishing messages or phony support calls. More after the break. Call him paranoid, but James Friedman has altered his physical credit card in order to prevent fraud. James pulled out a blank card. It looks blank. I mean, there's almost no information on it. It's got a name just in case I lose it and someone might be able to give it back to me. It hasn't got the whole number on it. It's got just the last few digits of the number. And you can't even tell what institution it is because I made this card with the chip from the card I was sent that had branding all over it. And I used a mag stripe writer reader like this tiny thing that you can buy for 30 on eBay or Amazon. And I made this because I quite like It turns out that there are businesses online where you could buy custom credit cards. All you have to do is mail your plastic card to the company, and then they will mail you back a fully customizable design metal card with your chip and magnetic stripe data on it. Now, you can have a credit card with no name, no Visa or MasterCard logo, no embossed numbers or security codes. It's just a chip and a card. And a picture of your dog, Sparky, on it if you want. James says that he prefers his credit card to have as little information as possible. You know why cards are embossed? No, why is that? Because some cards aren't. No, cards are embossed so that back in the day they could put it in a machine and run the roller over it. Right, and it could roll, the carbon copy. That's right. That's not necessary, but for decades kept them embossed for that reason. What, why are they mag stripe? Because that was quicker than running it through, oh this was the latest technology, but then we went to chip and pin and they left the mag stripe on and they're still in, why all these legacy systems? So what about your debit card PIN? A lot of times it's a number that's pretty easy to remember, like your child's birthday or a series of sequential numbers. The truth is that each card should have its own unique number. But how are we supposed to remember all this? For people who say they can't remember all their PIN numbers because they've got lots of cards, here is a really easy way to remember PIN numbers. And what you shouldn't do is have the same one. I've met people, I just have the same number and everything so I don't forget. So here's a really easy way. You take the last four digits of your card. So this dummy card here is nine, four, eight, one. Okay. And then I have a secret number. My secret number is three. Oh, yeah. Okay. So I add three to that. It's nine, four, eight, four. Great. That'll be my pin number for this card. No one's going to know. Oh, interesting. Yeah. Come up with a system that only, you know, and then that way you have a unique. Pin for everything, because I guarantee that most people listening here, their pin is something really easy, like 2222 or 1423. Well, it may not be that, but here's a scary thing. I reckon over half the people listening to this have the same four digit code. On their phone as they use it, the bank, Hey, Siri, remind me to change my bank pin number. So like everyone listening to this right now, I was going to go change your pins. But how do you live? Like, do you live a little bit more relaxed? I'm a relaxed, I suppose is the word or as relaxed as you can't fight certain battles. So. A good example would be your credit card is secured with a four digit number. You don't have the option to say to your bank, please can I have a 10 digit number? It's four digits. That's their system. What am I going to allow to be secured by those four digits? If it's used anywhere for any transaction, I get an immediate notification on my phone. So if someone were to fraudulently use it, I get a ping. So relax. Don't stress out about this. Just do simple things to make it harder for digital pickpockets to get to you. Set up an alert with your bank. Another is using two factor authentication whenever possible. Like on PayPal or Venmo. And most importantly, Get a password manager. Yes, a password manager. I can't stress enough how important it is for you to have a unique password for every account. That way, if one account is compromised, The others are safe. Don't use the one on your phone, your Apple key chain or whatever the Android equivalent is, because if I get your pin number, which I can get, or I get my Play Doh and your thumb, I can read all those, right? Get a proper password manager for people listening. It's a really simple way for you to have really complicated passwords. I'll link some password managers in my show notes. And seriously, if you do one thing after listening to this episode, do this, get a password manager. All right, off my soapbox. So the way that mine works in practice is I go to PayPal or I'm logging out of a store using PayPal. I just put my thumb on the phone or the tablet and it pre populates my Paypal, uh, username, which is an email address and the password. And then it says, because I've set up two factor authentication, now you need to enter a one time six digit passcode. I don't even need to know what that is. I just tap on the screen and press paste. And the password manager has already put it ready on my clipboard for me to paste it. The whole point of a password manager is you don't have to remember. You don't need to remember. If a website says your password can be 8 to 15 characters, I set it to 15. If it says it can be 6 to 40, I set it to 40. And James Friedman's last tip is just to really make it hard for the bad guys to win. Think of all the booby traps in Home Alone. If you make it tough enough, they might just give up. The analogy I use in the talks I give is that I once saw a documentary about the world record domino toppling attempt. And it was extraordinary. They set up in an aircraft hangar, a gazillion dominoes that make patterns and swirls and flags and go over assault courses. And it was really amazing. And what I found most interesting was it takes months and months to set it up. So what they do is they lay out 500 dominoes. And then they leave a gap and they lay out the next five and they leave a gap. And the reason they leave gaps is in case. At night, a moth or a bird or just someone careless knocks one, they don't undo six months work before the big day. James says you could do the same thing with your digital wallet or your digital bank. Just leave some gaps. James told me that he rarely gives out his personal number. He'll give food delivery services a burner number. Another gap that you can leave is giving your bank a different email than the one you normally use. If you get a phishing email from someone claiming to be your bank on your main email account, well, you'll know it's fake immediately. So dividing things up and just compartmentalizing, is that a word? Things I think is a good tip. I love that analogy of leaving a gap because I'm an online investigator like a sleuth. I'm constantly looking for people and I'm amazed at how much readily publicly available information there is out there about all of us. And if you leave a gap, you make it harder for me. You make it harder for people, you know, with your skills and you become safer, right? You could protect yourself or make it harder for them. Yeah. If a burglar's gonna burgle a house, the one that he can see's got locked doors and a burglar alarm, he'll go to the next house. So, we're not trying to be Fort Knox, we're just trying to be safer than Just make it harder. So, we've covered a lot of ground. There are infinite amount of ways that someone can have access to your card, your phone, your information, and ultimately, your bank account. But, there are ways to protect yourself. So, double check your wallet. And keep an eye on your bank account. This episode was written, researched, and produced by Audrey Gibbs and myself, Javier Leyva. And it was edited by the talented Poonath Chinoy, with the podcast Pundis. We'll be back next week with a brand new episode of Pretend. This one is a listener request. We're talking about the case of Rudy Farias. The son who was missing for years and then all of a sudden reappeared out of nowhere. That's next time on Pretend.