Latest / The MedTech Wealth Advisor Podcast / AI Scams Are Getting Scary: How to Protect Your Money | Robert Siciliano

Transcript

AI Scams Are Getting Scary: How to Protect Your Money | Robert Siciliano · The MedTech Wealth Advisor Podcast

• Robert: But it's easy to hack the human that has the phone. It's easy to hack the human sitting in front of the computer that has access to the bank account, you know. So that human is the ultimate vulnerability. Matt: Now talk about what's happening with these some AI deep fakes on voices and images. Is that add to Robert: that we don't get breached because we lack intelligence. We get breached because we're human. Matt: never happen to me because I'm not that stupid. Robert: Mom, mom, I'm in a situation. I'm so sorry. I'm I like I you know I I I need your help. I need your help. I'm so sorry this happened. And it was her her daughter's voice. And two seconds later a man gets on the phone, right, and says, I have your daughter. Matt: On today's show, we're going talk about security risks to your financial and personal life that come with the amazing technology that makes our life easier. But it's also got security experts genuinely concerned. My guest today is Robert Siciliano. Robert's a security analyst, best-selling author, architect of the strategic human firewall. And you may have seen him on CNN, Fox News, CNBC, Anderson Cooper 360. And he's had insights on the Wall Street Journal, New York Times, and more. And he's served on a board of the Identity Theft Resource Center. And he once bought, get this, an ATM on Craigslist, just to so show how easily our secure systems could be cracked. So welcome to the show, Robert. Is there anything that you want listeners to know that I left out in my introduction? Robert: other than I'm from Boston, Massachusetts, which also means that I've never ever parked a car in Harvard Yard ever. Matt: Thank God. Robert: And I'm a girl dad to two 17-year-old and 20-year-old, married 25 years, and I'm a pup parent to Minx. Minx is a Belgian malanoir. They call them dogs, but they're more like hyenas. Matt: Fantastic. I love that background. It's very good. I, you know, before we move on, that's kind of a a hanging chad there. I I on on this ATM. I gotta hear a little bit more about this. Just give us the quick the quick background in this. Robert: So I think I was on Craigslist to buy a bike for my kid, And I see ATM for sale. I'm like, I didn't know you could buy an ATM off of Craigslist. Like I thought that was like a regulated thing. And so I called a guy and he's like, yeah, my bar is going out of business. Come up and take a look. I'm like, all right. So I he was asking a thousand bucks. So I put 700 bucks in my pocket and I call my hacker because I got a hacker and I think everybody should. And I was like, hey, I'm gonna go check out an ATM. He's like, what? I'm like, the guy's selling it. He's like, I'm coming. So we checked it out. He showed us how it worked. I offered him 700. He took it. I brought it home. And my hacker's like, hey, can I take the manual home? Because that's what they do, right? They love that stuff. And so he calls me. The hacker takes the manual home. I guess he read through it all night long, calls me at five o'clock the next morning. He's like, hey man, this thing's awesome. Can I come over and play with it? I'm like, dude, it's five click. He just showed up 20 minutes later. And he immediately plugged it in and started to punch a bunch of codes into the keypad. And so he starts giggling as the receipt starts to print. And this particular receipt was like 30 feet long. What he did was he cleared the ATM's logs. Essentially, he printed out about six months worth of credit card and debit card transactions. And I had All the raw data in front of me, which meant I bought a data breach, which is cool for somebody like me. What I do next, I call Fox. Fox sends down a producer, a guy with a a camera, and a fuzzy mic. And we equipped the ATM with a skimming device, because you know, I have skimming devices, and we deployed it in downtown Boston. And immediately people started to use the ATM. And as we recorded them, We showed them how we, skimmed their card, got their PIN code. They freaked out a little bit. We, let them watch the video and then delete the video. And that made for some pretty compelling TV. I got like six or eight TV shows out of that one. Wow. Matt: That is a that's an amazing story. And very scary, too. Robert: The ATM industry is relatively unregulated and truly like the people who the companies that deploy cigarette machines and soda machines and candy machines, they're also in the ATM business. And since that time, I'll never use an independent ATM ever again. Matt: Man, that yeah, me, me neither now hearing that. So, you know, to back up a second, when when we first connected, what really interested me was, you know, obviously how to help help clients. And you've had a lot of experience working with wealth management firms and wealthy clients and so forth. And so I want to protect our clients, you know, financially, personally, but you know, I've got my own digital life that's sprawling out there as well. So we're I'm really interested to hear as we get into you some of your experience about. how to protect ourselves, what works, what doesn't. and so maybe to just tee this up, you know, take us back a little bit. What's what's changed from let's say six, 12 months ago? you know, we had, we've always had security risk concerns, cybersecurity risk, but what in your view has changed in the in the sort of recent history? Robert: I'm gonna reframe that question if you don't mind. Sure. So it's not like this past six to twelve months, it's really like what's happened over the past 30 years, right? Because check technology evolves so fast. To talk about what changed over the past six to twelve months versus like over the past 30 years. What's changed in the past 30 years is that criminals look at fraud and cybercrime as a business. Okay. Humans look at security as something that's not their responsibility. And for 30 years, that hasn't changed. What has changed again is that the criminals look at fraud as a business and they are engaged in this 24-7-365, meaning that they're making billions of dollars every single year because they look at you and I as very simple creatures that don't look at security as Their responsibility and basically do almost nothing. And that problem persists and it will continue to persist because most of us treat security as, again, somebody else's problem, somebody else's responsibility. And why would they attack me, anyways? And as a result, the bad actors they continue to make a tremendous amount of money as we continue to do almost nothing to protect ourselves. And Their technologies, you talk six to twelve months, say AI has evolved and continues to evolve so fast that they're developing dozens to hundreds of new attack vectors every single day. Matt: Yeah, it's amazing. Well, it just speaks to, we we're assuming our bank's firewall is gonna protect us, but you talk about that's not really what the hackers are going for anymore. You talk about something called wetware. Maybe talk about that. Robert: it's hard to hack a bank, right? it's hard to hack Venmo, it's hard to hack PayPal. it's hard to hack, your iPhone, right? But it's easy to hack the human that has the phone. It's easy to hack the human sitting in front of the computer that has access to the bank account, you know. So that human is the ultimate vulnerability. We could we could spend 10 minutes in this call and I could tell you the top five things to do to protect your your data, but the chances are you're probably not gonna do it, right? Because of our human biology. And what that means is as humans, we all possess what I call the human blind spot. And the human blind spot is fundamentally our biological, psychological default to trust. It's our natural hardwiring that cyber criminals hack through things like manufactured urgency, which I'm sure we'll talk about, and emotional manipulation. We don't get breached because we lack intelligence. We get breached because we're human. Think of it like this: like human beings are what is considered an interdependent species. I depend on you to a certain degree. You depend on me to a certain degree. We are a social creature. Fundamentally, man. Depends on woman and woman depends on man ultimately to procreate, right? That's the whole point and purpose of our species is to procreate, right? And that interdependence for procreation relies on trust. Fundamentally, we default biologically to trust to further the species. That's how that works. And that human blind spot, trust, means that we want to. We need to trust each other when we're face to face, when we get a phone call, when we engage in text messages, in emails, in pop-ups for that matter, and Zoom calls. Like we our DNA says, I want to trust you. And even if you're lying to me, my DNA says, I'm going to give you the benefit of the doubt because I just need to trust you because we're humans and we need each other. And the thing about that is most people have never been presented with that understanding, you know. Most people don't truly understand that about themselves and and how that might relate to frauds and scams and technology. But you know who perfectly understands that? Take a guess. Matt: The scammers do, for sure. Robert: Perfectly. Perfectly. Every single fraud and scam that I've seen come through my phone, email, text, pop up, Zoom, every single one relies on the human blind spot and our biological default to trust. Matt: Yeah, and that you you've mentioned it in that there's there's like a false sense of urgency that goes on. I've I've noticed that myself when I've talked to, you know, whoever it may be that you feel like, I they're asking me a question I should know. I I I need to scramble and figure out what that is because I feel dumb that I don't know the answer. just describe that just a little more into why why that's such a blind spot. Robert: Manufactured urgency is what I see in 99 out of 100 scams. It's designed to distract you, to engage in like cognitive tunneling, meaning that your focus narrows and you're paying attention solely to the urgent request at hand because it takes over your psyche in such a way where, say, for example, A parent or a grandparent for that matter gets a call from their grandchild saying, Hey, I'm in a situation here. you know, I'm down in New Orleans at Mardi Gras and my buddy punched some guy in the face. I tried to break up the fight, and we both got arrested. I really didn't do anything wrong, but now I'm in jail and I need you to bail me out because if I call my father, you know how he is, he's gonna get all upset. And so can you help me out? And the grandparents, well, yeah, I love my grandchild. I'm gonna do what's necessary to help him or her. And, you know, like, if they don't want me to call their dad because they're gonna get in trouble, I'm not gonna do that. And that's my focus right now. It's to save my loved one from harm. they know this, they're bad actors know this, and they use that. They use you're not gonna be able to access your Medicaid or Medicare, that your bank account's gonna get liquidated, you're gonna lose access to your funds. Whatever the case is, they they use a thousand different ruses that they know trigger our cognitive tunnel vision using some type of manufactured urgent request that gets our blood pressure going and essentially distracts us from the truth. Yeah. Matt: That that's super interesting. I I didn't I didn't realize we're going start off like this in this interview, but this is and and I I bet listeners too may have expected we're just gonna jump right into some tips about like how to keep your your password safe and stuff. But you you said 99 out of 100 of the the what you see is this human-driven element. This is it's really important to dig into. After you just described that scenario, which is super plausible, grandparent trying to help. Now talk about what's happening with these some AI deep fakes on voices and and and images. Is that is that Robert: To that? Yeah. AI has truly stripped away the clumsy, you know, what would you call it? Like, like, like, like all of the typos, the the the scammer grammar, and it's really created what we would call like neural puppetry. It's designed to essentially distract us in such a way where What we see, we believe, because it looks really human to us. You know, we've never seen our loved one in this format, this way, stressed out like that. But neuropuppetry creates like this, this, this, this, this persona that's actually looks real and feels real because for all given points and purposes, it really is. It stripped away the clumsy red flags of traditional fraud. And the pla in the past, criminals relied on what we would call. This blunder force phishing, which is mass blasting emails, like I said, with the scamagrammar. And what AI allows for is high precision impersonation at scale, truly. Criminals use, I mentioned neural puppetry to create these perfect lies. And they scrape just seconds of audio and video from social media. And what this does is it allows them to recreate these deep fakes, these voice clones. And it weaponizes our default to trust, our human blind spot, making the deception feel a hundred percent human. And what's what's worse or better, if you're coming from the scammer standpoint, is that AI automates what we would call the grooming process. Essentially, it removes all the labor, the manual labor of the social engineering, of like, which is like. the scamming process, getting us to believe them, right? Allowing a single predator to pilot thousands of AI agents or what we might call digital puppets simultaneously, bypassing technical firewalls and hacking that human brain, their biology, their emotion to get them to react and respond to their manufactured urgency. Matt: Yeah, that's incredible. It is are the the AI voices recreations good enough to bypass systems like you know, Schwab used to have you know, at Schwab, your your voice is your password. That used to be the message when you would call. I don't hear them having that anymore. I think they maybe have removed it. I could be wrong, but speak to that. I'm sure it I'm sure there's some validity there. Robert: So a couple things. The AI voice clones, taking, say, my voice and running it through AI and replicating it with every word in the English dictionary and you know breaking it down into sentences and then paragraphs and entire dialogues in real time is entirely possible. And the human air cannot determine real from fake. It is perfect. There's no differentiating it. You and I are incapable of making that distinction. Okay. Now, as far as voice being used as a biometric technology, like a fingerprint, that's still being done. And AI can, in some cases, defeat that, the technology to determine whether or not that's an AI-generated deep fake or voice clone versus that's the actual voice. There is certain, I guess, technologies in the background that can determine that that's a voice clone versus it's being real and so forth. So companies are still using voice biometrics, but if they don't have the right systems in place to detect a fake, then that would be problematic. Matt: Sure. Well you you I saw in your in the in the pre show notes you teach something called a a triple A protocol. so maybe walk us through that at this point. Robert: Yeah, so The triple A protocol essentially is your break the fake playbook, right? When you get a phone call, a text message or an email, or even if you're on like, a pop-up that says, Hey, this is, Microsoft and you've got a problem with your computer. And if you don't call this phone number, then your entire system is gonna be compromised and you're gonna your identity is gonna get stolen and manufactured urgency is kicking in, which means your biology is going, Whoa, I gotta do something about this. And I I trust Microsoft. I trust Apple. So I gotta call that phone number. It's like, whoa, whoa, whoa, whoa. Wait a minute. The triple A protocol is your break the fake playbook, so to speak, right? And basically triple A is analyze, authenticate, and then act. And really what you're truly doing is you're acting as far as analyzing, you're acting in regards to authenticating. You're acting in regards to, you know, act in regards to execute the out-of-band verification. But what this truly means is. Number one is analyze, which means recognize the manufactured urgency. stop what you're doing. before you get all emotional, before you react and respond, before you get cognitive tunnel vision, the moment a request demands urgency or secrecy, immediate action, stop because your brain is moved into that emotional reaction. It's it's you know, you're trusting and biology is saying, I gotta do this. Take a breath, you know, move back into. Analytical thinking, right? force a conscious pause. What's really happening here? Recognize that your gut reaction or emotional panic is a psychological trigger that is designed to cloud your judgment. I mean, that's its whole point. That's what it does. It's it's it's perfect at that. That's the whole motivation. If an interaction sparks sudden fear or urgency, Your emotional drive is being exploited and weaponized against you. It's kind of brilliant what they do. I mean, it's awful what they do. It's awesome. What they do is truly awesome. It's awesome. It's awful, but it's awesome. Right. Okay. And second is authenticate. You know, identify the digital mask, so to speak, right? Engage your intellectual filter immediately. Step back, scrutinize the communication channel. phone call, email, text message pop-up, Zoom call. Strip away the emotional narrative, the manufactured urgency, your biology kicking in, and look objectively at what's happening. what are they trying to accomplish? Is this a deep fake video? Is it a deep fake voice clone? Is it a link that I'm supposed to click on because my account's compromised or I'm gonna lose my driver's license? Or my loved one is being kidnapped. really? Right. And then, you know, essentially like hang up or bypass whatever's happening right now and do your own digging, do your own research. That means now you act. Now you determine is this real or is this fake by acting, by executing what we would call out of band. Verification. What does that mean? Out-of-band verification. It means truly never using the contact information in the phone call, email, pop-up. call the person back at a phone number or heck, knock on their door in the office, a few doors down. Call them back at a pre-validated number that you know is legit, whether that means doing a quick Google search or going into your contact manager. don't just believe it. Let me give you a quick example. Not too long ago in Southern California, a woman, you know, probably in I'm guessing in her like late fifties, gets a phone call from her daughter. Okay. And the phone call is, Mom, mom, I I'm in a situation. I'm so sorry. I'm I like I you know, I I I need your help. I need your help. I'm so sorry this happened. And it was her her daughter's voice. And two seconds later, a man gets on the phone. Right. And says, I have your daughter. And and the the woman's like, who is this? And she's like, if the guy's like, I have your daughter. I've kidnapped her. She we're in Mexico right now, and I'm right over the border. And in and the mother starts freaking out because she hears her daughter's voice in the background. And a man gets on the phone. So immediately cognitive tunneling kicks right in. Manufactured urgency takes over. Mama Bear is wants to save her daughter. And the guy, long story short, says, You'll get your daughter back if you wire $5,400 to me. It was actually several thousand, but all she had was $5,400. And so for the next five hours, the woman ran around town wiring money. Five hours. True, true horror show. Google it. just happened. And when it was all said and done, she was supposed to meet her daughter. The kidnappers were supposed to release her daughter at the supermarket, like right over the border. And so she goes to the supermarket. She couldn't find her daughter. Daughter wasn't there. So what does the mother do? She picks up the phone, calls her daughter. Where are you? Where are you? Daughter picks, answers the phone. She's like, Mom, I'm at work. Why? What's going on? Yeah. After five hours of pure, pure terror, right? Matt: Maybe a phone call first would have been good. Robert: But here's deal, and I get that, and I agree, of course. Yes, and we all look at that and go, hey, lady, like duh, but she heard her daughter's voice over the phone. Right. it was her daughter's voice. And when that happens, cognitive tunneling, manufactured urgency, just like you're not thinking, call your daughter back, this is a scam. You're thinking, my god, I gotta save my daughter. Yeah. And and I I would tell you, I would suggest to you that 99.9% of Everybody in your social circle would do the exact same thing. They would just freak out and do what they could to get the loved one back because it's perfect. Matt: Yeah, this is a this is a great point. I just was I just was thinking the same thing. There's there's a lot of smart people that could hear a story like that on its surface and think that'll never happen to me because I'm not that stupid. When I I would I would know, but just as we went through, there's there's so many plausible reasons I could see a very smart person just jump into action. Yeah, when I when I get you know the dozens of messages you you seem to get. Potentially daily, even, Google, Google has a security alert, we're just checking in on your account. I started to just treat those as nice to know notifications. And if I want to know about it, I'm gonna go to my Google account directly and see if anything's actually going on. Most of the time I ignore it, but yeah, start to start to just like you're saying, you know, separate the emotion from what's actually happening there. I I want to follow up with with another piece that this this can be annoying to some people, maybe a lot of people actually. It's just it seems like every time you get go to try to do to do something, you've got passwords and two-factor authentications and security certificates. And it just sometimes it seems like those things need attention right when you need to log in or right needed when you need to do something else. But just speak to us about how maybe we should change our thinking around what. What those security tools are. Robert: Yeah. Okay. Good. And what I'd like to do to answer that is to kind of jump off of what you just said in regards to like you're kind of looking at like every phone call and email and text message that comes in is like, yeah, you know, like, is this really Google? And like you're already like scrutinizing everything. You're already like, you know, your guard's already up, right? And that's kind of how I want everybody to be. And in that, like, mindset is what is actually like Part of what I've developed over the past 30 years. And I would say that you already possess what I call the strategic human firewall. Okay. So, like in your computer, traditional firewalls filter like internet traffic, right? Human firewalls filter intent and block deception. Okay. So when you're engaged in inbound communications that you deem fraudulent, right? Your strategic human firewall is up. Your radar is like, on high alert, right? And at this point, I would imagine it's just a habit. It's like you're not even like high alert. You're like, yeah, no, that's just not real, right? So the idea behind becoming a strategic human firewall is that you look at Every single phone call, email, text message pop-up, zoom call, with this firewall as a proactive governance, as a mindset that turns us from being what I would consider passive targets, which that's due to the human blind spot, I trust everything, versus I verify everything, you know, like I'm really paying attention, right? And You develop these habits like where you can see it, right? And it. you're not even messing with it because you're like delete, market spam, block, it's just like your natural reaction at this point, right? And what happens is as you become this strategic human firewall, you actually begin to appreciate security at a much higher level, which means you appreciate the security tools. That are at your fingertips, that are at your disposal, that are there for you to use regularly, right? And so what happens is as you begin to appreciate security in the security tools that are at your disposal, you shift from like basic awareness, like, I understand about these things, to appreciation, right? And that appreciation basically is what changes our behavior. It's what allows us to act. More effectively when we react and respond to the obvious scams and to the manufactured urgency that can kind of get us all riled up, right? And ultimately, like I call this the security appreciation gap. It's that chasm between our intellectual understanding of risk and our emotional commitment to act on that. risk or that knowledge, which is truly appreciation. I appreciate the value security has in my life, which results in what I call the kitchen table effect, which is a multiplier effect where you take what you've learned, say, from this podcast home and you teach it to your loved ones around the kitchen table. And like now everybody is a part of the solution. And so as a result of that, like everybody, you know, kind of has a higher level of Appreciation for security beyond just awareness that these things happen. It's like now we do something about it because it means something and it matters to us. That's appreciation, right? And so I use all the basic tools like everybody else does: password managers, two-factor authentication, or that they should be using. And I love all this stuff. And look, we should talk about all that because, you do these basic things. Now I tell everybody, you do these basic things, you are in the top. 10% of secure Americans. Because the re reason why I say that is because 90% of us aren't doing the basic things. Matt: Yeah, agree. Agree. I still know people who will go unnamed, but you know who you are that still is using a spreadsheet to keep all of the passwords, and it's stored on their desktop because that is so annoying to track all their passwords. So that's the place to go look for them. So stop doing that if that's you. is there, I just thought of something while you're describing that. You you for those of us that that are using a lot of these tools and we start to let let's say, can we get into a false sense of security that I know all this stuff, I'm using two factor, I've got security passwords, et cetera. I'm not gonna be fooled, and you almost start to get a little complacent potentially. Robert: Yeah. So I'm going to answer that in a couple of different ways. Number one, I'm 58. Okay. And I've been on this planet long enough that I learned, thankfully, I learned this lesson in my 20s, that the moment that I think that I know everything, I know nothing. Yeah. So truly. Like so as I grow, as I evolve, as my family grows, as they evolve, as they as their little problems be become big problems as I age and my health truly deteriorates. I mean it just deteriorates after a certain age, right? No matter what, right? Because we age. It's we're we're deteriorating. I need to change up this and that. Like I can't be lifting like, you know, 70 pound dumbbells. I got to go down to like 30s because the 70s are going to tear my shoulders. I can still work out, but I got to like modify and I can't let like, you know, my ego get in the way of like my physical body. Right. Like, you know, it just makes sense, right? All that being said, I got to change up my diet. I can't keep eating sugar because it has a cumulative effect on everything. so you learn these things. The moment you think everything, nothing. So you got to continue to learn and grow. And security is the exact same thing because the ki the criminals, the bad actors, they continue to learn and grow too. And they continue to use various tools to bypass the tools that we have. Right. So we have to keep on top of what is new and ahead of what is next in all things, life and security. Right. And so being complacent is easy. Like, I got the password manager. I'm good. But there's more to it. Like this past keys now. So so like here are the basics, right? I've been using a password manager for 20 plus years. And it is the best piece of software that I possess for both saving me time and protecting my security and my privacy. Okay, so password manager. And the first thing that people say when it comes to a password manager is, yeah, but they can get hacked. It's like, yeah, well, so can you bank, but you put your money in the bank, Right. we use fatalism to justify not using certain technologies, which is just kind of par for the course. It's what we do. But you wouldn't tell like a law enforcement officer, yeah, why bother using a bulletproof vest? I mean, you can still get shot in the head. Mm-hmm. I mean, okay, but that's really not good advice. Right. You should use the road to advice best, right? That's right. Same, same thing of the password manager. Yeah, they could be compromised here and there, but they're really the best thing we have access to today, and they work. And they truly work. And so a password manager, download it, just Google it. And once you find the one you like, pay for it because the ones you could pay for, truly you'll have for the rest of your life. Right. And I've been paying for mine for 20 plus years. And it's 20 bucks a year. really? 20 bucks a year. It's great. And it allows me to have a different secure passcode across every critical account. uppercase, lowercase, numbers, characters, like 20, 30, you know, character passwords that I don't know, but I don't need to know because my password manager knows it for me. And I know that like less than 10% of society uses a password manager. So you want to be more secure? Part of the 10%, you use a password manager. And then changing up your passcodes. 90% of us are using the same passcode across multiple accounts. That is so unbelievably risky. And why? Because most of us don't understand that there are 300 billion with a B of our records on the dark web. 300 billion. About 20 to 25 billion of those 300 billion records are actual passwords. Wow. Yeah. And so Bad actors, they don't necessarily hack us. They just log in because they have our credentials. If you're using the same credentials across multiple accounts, they just log into your accounts. And so if you're changing up your passcodes using a password manager, you're already ahead of the curve. Okay. Right. And then two factor authentication. It's so simple. I mean, it can be like a little tedious. It could take a little getting used to. But I know that less than ten percent of society is actually using two factor authentication across all their critical accounts, including both personal and professional email, you know, less than 10% of us. Matt: That's incredible. That just seems far, far too low. I I can't I can't almost believe that. It's amazing. Which is Robert: Why it keeps getting worse, it's not getting any better. I spoke in front of several hundred people yesterday. I asked the entire audience of professionals. In this case, it was real estate agents. And I've been in front of doctors, I've been in front of law in front of law enforcement, I've been in front of police officers, I've been in front of healthcare professionals, you know, I've been in front of you know retirees. And I asked the same question: how many of you are using a different passcode across all critical accounts? If I get ten percent to raise their hand, that's a lot across all professions, including t retirees. Matt: Man, that's incredible. That makes me think of the the old joke about you don't have to run faster than the bear, you just gotta run faster than the guy next to you. Because I mean, if only ten percent of people are using password bolts, just just start there and you're you're a a harder tack a harder harder victim, if you will. Robert: Hard to target, hard to target. You become a tougher target. And that analogy, the joke, is not even a joke. It's true. Yeah. You just gotta run, you just gotta be a tougher target than your next door neighbor. And like another example would be if if if a if a bad actor, if you know, burglar goes into a neighborhood and he sees, you know, 10 houses and one of them has beware of dog, this house protected by ADT. you know, forget the dog, worry about the Smith and Wesson, right? Like the bad actor has nine other houses to choose from. Right. You know. Matt: so much time. So they're just they're just gonna do the easy target. Robert: Easy target. it's all about becoming a tougher target. So password manager, change up your passcodes, two factor authentication. Heck, lock your doors, put signage out, basic stuff. We do these basic things. Generally, you're pretty good. Matt: Yeah, that's that's that's good. I wanna come back to that lock of doors in a second. before we move on, password managers, speak to why someone may want to use a manager that they pay for versus just just storing everything in their Google Chrome browser. Robert: So I'll give you I'll give you me as an example, right? I got an iPhone, I got an iPad, I got a Mac. So that's my Mac environment. I also have a Windows machine and I have an Android phone as a backup, you know? And so right there, I've got two different or three different operating systems, right? Between iOS, which is your iPhone. Mac, which is whatever, and Windows, which is Windows, right? That's three different OSs. A Google password manager really isn't effective on through on two different OSs, three different OSs, and th and and then and then like you got Edge as it as a Microsoft browser. You've got Chrome as a Google browser. You've got Safari as a Mac browser. It's like you you're like Your your your different browsers, different operating systems, different operating system like you're all over the place. Google doesn't really talk well to all of that. And your the app's on your phone. You know? A password manager's job is to make sure when you're on your iPhone or your Android or your iOS tablet or your Windows browser via Edge or Chrome or DuckDuck. Go or whatever, right? The password manager's job is to talk to all of that. It's ubiquitously connected to all of that and can speak to all of that. That's what a password manager does. Yeah, that's what you want. You want to be on any device and be able to access your password manager and be good, you know? And like I've tried the Google Password Manager, it doesn't really talk well to all my devices. I've tried, I've I've tried to use the Apple password manager. It doesn't talk to Microsoft at all. It doesn't talk to Chrome at all. So it's like, unless I'm only using Apple, I'm only using Apple, then the Apple password manager might work good, but still it's not even a good password manager. And Apple does great with everything, but not the password manager. Matt: Yeah, I know that that's a great point. It's it's so essentially we start to cross over between we've got to pay attention to these security issues. We also have a practical, practicalness to life that we have to run. We've got spouses probably we need to share certain passwords with. We have friends, your your mom that you end up being the IT manager for because, well, that's just typically how that works. And so, what I've found is having a good password manager, you can actually have some secure sharing with family. Frankly, even maybe put put that that family member that wouldn't otherwise be using one on one because you helped to to manage it for them. And it just can't happen. I I'll give you another anecdote. it traveling is a big one. I have been traveling before when it was critical that I was able to access a certain set of passwords. And if I didn't have, you know, if I had everything stored on my laptop's edge browser and I didn't have my laptop with me. in a problem. So so just some practicalness to it. I want to move on to just a a a different subject, which I think it's an interesting one. I I see I see a lot of people, you know, putting putting tape over their their cameras on their laptops. And you know, there's there's just listening devices everywhere in the house these days. I mean you could have for current lot, I think now the smart TVs are coming with built in mics that seem to be you can't turn them off. Just talk to what the reality is of of that, how much we really need to be concerned, and and how much we you know, just don't need to waste our time thinking about it and and and and where the real risks are, I guess. Robert: Yeah. So two things. I'll answer that right now, but I also want a quick statement on the password manager. Sure. Right. So one major benefit of the password manager that people don't even think you didn't necessarily mention it, but you kind of alluded to it, is that when I die, because it's coming, hopefully not for 20 years, but you know, I went to my fortieth class reunion last weekend. There was a table full. Of the deceased, full, unfortunately, right? Yep. We're going. That said, that password manager provides continuity in your afterlife. Matt: Very good point. Robert: So your loved ones, my wife, my kids, they have access to everything. When I'm gone, because I'm going at some point, they have access to everything, every single account, all my investments, all of my everything, right? And I told them. Specifically, my wife hates when I talk about this stuff, but it's uncomfortable, but it's true. I I said, make sure you pay for my mobile phone after I'm gone. Don't, don't turn it off. Like you're gonna need my phone for what? Matt: Very good point. For access to everything. Sure. Robert: Two-factor authentication. Sure. Yeah. So the password manager, continuity in your afterlife and two-factor authentication, pay for the phone for a year. And then, you know, yeah, you're good. Okay. So smart devices. you know, Alexa, Google Pod, all these listening devices. You know, listen, I'm not worried about any of that stuff. Zero. I'm not worried about. Google or Apple, recording my voice and using that for ill will. I'm not worried about any of that stuff. do I like, flock cameras and they're, you know, getting every single license plate and they know where we are all day, every day? Not really, but you know, it does a pretty good job of actually getting the bad actors too. and I'm all about security first and privacy second. That's just my nature. truly what the bad actor can do with the data to cause harm, whether financially or physically, is my concern. so you know, I'm not worried about the smart devices recording us. I don't really see it as being an issue. hasn't affected my life. I don't use a lot of the the smart devices, frankly. I mean, a lot of my stuff is still kind of analog. My TV's a little bit older. I'm not using an Alexa or a Google Pod. But like there's probably enough going on in my house with my 20 plus cameras that are like being recorded in the cloud that if any of these companies wanted to kind of peek in, they could. but you know, like I'm not worried about any of this stuff. Look. If security is not easy, or at least accessible, we're not gonna do it. We're not gonna do it. Right. If it's overwhelming, if it's too much, if it's if it makes us nuts, we're not gonna do it. And when I'm speaking in front of a few hundred people, like I've got to make it easy for them to consume and adopt. It's gotta be convenient. It's gotta make their lives somewhat easier, in addition to being more secure, right? And so When it gets into all of this surveillance and all of this monitoring, hey, some people aren't gonna like this. It is what it is, you know. But how is it negatively impacting my life? I don't know that it is. Matt: Yeah, it's a very good point. And maybe even hearkening back to earlier about just being a harder target, it's it seems far easier for a bad actor to come into an unlocked house or an easy house to enter, get onto a laptop that doesn't have a password to get on the laptop, then open up a spreadsheet with all the passwords sitting there on the on the laptop. than it does for that individual. Let me just make sure they've closed off all their cameras and they don't want anybody listening to them. So some of these practical things, I think, are just takeaways. Just think about what you're prioritizing with your time and effort. Robert: I got front of a few hundred real estate agents and I asked a question like, How many of you have a home security system? And I got like 10, maybe 15% of the room raised their hand. Okay. And I said, Okay, so why don't you have a home security system? And the hands fly up. we don't have a home security system because we have insurance. As if insurance is gonna protect you at 3 AM. You know? So not well thought out. And then the next dance is, we don't have a home security system because my husband says, listen, if they're gonna break in, they're gonna break in. There's not much we can do to prevent it. And I'm like, yeah. your husband's not really thinking that one through, nor the security of his family. you might want to start thinking about a divorce. And and everybody laughs but her, right? The reality of it is that we use fatalism to justify. Why don't we invest in security practices? why bother? If they can hack the credit bureau, why would I get a credit freeze? If they can hack the password manager, why would I bother with that? If they can break in and hack the security system, why would I bother with that? It's like, no, it's all about layers of protection. The more you do, the tougher target you become. And you make it harder for the bad guy. And they just move on to the tougher, the weaker target, the more vulnerable target. So It's a pretty simple, the physics behind it are pretty simple. Matt: Yeah, it makes sense. Well, that makes me think of our digital footprint. it feels like we're s it just got this sprawling, ever growing footprint. I I was looking recently at at I think frankly my password manager just trying to clean up a couple things, had no idea just how many websites I have stored in there. So it and it which is first of all, it's a it's great to free up my brain. I don't have to keep all those passwords in, but it just has gotten enormous. So it's Are there any thoughts people need to think about with that? Should is it worth the time to backtrack and clean up your digital footprint? And it can it even be done? Robert: Yeah. So there's some things you can do. I probably have close to a thousand websites into my password manager at this point over the past 20 plus years. And I would say I might access 10% of them regularly. if I really wanted to do something about that, I would just, you know, adopt a new password manager or or and just abandon the old one and just retrain a password manager and just have like it be much tighter. I could do that. But in the end, how much does that really matter? The digital breadcrumbs, how much does it really matter? look at technology in and of itself can be overwhelming. you see what it's doing to kids in in digital devices, you see what it's doing to adults and their addiction to digital devices. I think that like if we spent more time, you know, you know, shoeless, sockless, walking through grass versus cleaning up our digital lives, I think that'd be better for us. Matt: Sure, more healthy. Yeah. Robert: Yeah, yeah. I I wouldn't worry about any of that stuff. I wouldn't lend too much mind share for it. The one thing that I do do is maybe every six months, I might do a search for my actual mobile phone number on Google and see where it pops up. And if if different information brokers have my mobile phone number connected to my physical address, I'll I'll spend a little time working on removing that. Other than that. Really no, I don't do much of that. Matt: Is it is it worth it to have multiple email addresses? Let's say one that you specifically use for finances and one for personal. And it all sounds good in theory until you start to run life practically with five different addresses. Robert: If you have three to five different addresses and one or two of them you're using full, daily and regularly, and a couple of them are specifically for specific financial accounts, there's nothing wrong with that. As long as you've got a good handle on it and it's specific and it doesn't overwhelm you. The moment it becomes tedious, then you're not gonna do it. Sure. Matt: Sure, sure. Well, how you you've done some work, I believe, with with various, high net worth individuals and family offices and so forth. So maybe describe a little bit of that and and and when someone should call in an expert in the first place. Robert: So there are all kinds of experts out there that that do what I do in regards to security awareness training. But then there's experts that actually like come in and they they they lock down your networks, they lock down your information. as a business person, let's say, that has like, you know, employees and in and digital devices and books and are spread a little wide. Then you need what's called the managed service provider, which is a company that comes in and manages all your hardware and all your software and all your updates. And that managed service provider has a monthly or annual fee. And they also will manage a lot of the security of your network. You could have 10 employees or 10,000 employees, and you need either a managed service provider or depending on how scalable you are, a managed security service provider. Okay. But an MSP for small business is somebody is something that you should consider. Do it yourself when it comes to security and a business level isn't necessarily a good idea. you should have cybersecurity insurance, and your managed service provider should engage in that the application for that cybersecurity insurance, meaning that like they should work with you in filling it out and making sure that you are checking all the necessary boxes, that you have all the necessary systems in place. So if you actually have a claim, a s a cybersecurity vulnerability, a breach, that your managed service provider has checked all those boxes because the systems are actually in place to reduce your liabilities, to prevent those breaches from happening in the first place. But that Matt: Good that is a that is a very good point. I I wanna emphasize. So I I think what you're saying is don't just think it's fine that you have a security provider and then you talk to your your insurance agent and just got a cybersecurity policy and you're good. Basically make sure that if you actually had a claim, those two things actually match up. That that's a that's a a very important point. Robert: You've met the terms of service, you've met the terms and conditions. Right. You've met the baseline plus of their requirements. Because look at I've long believed and I've been affected by, you know, insurance companies don't really care about their customers. Their allegiance is to their shareholders. Sure. And so the moment that you file a claim, they're looking for reasons to deny that claim, whether it's auto, health, life. Right. If you don't meet certain criteria, they're not paying the claim. and cybersecurity insurance is absolutely no different. And they're just loving to deny your claim. So that said, make sure that you have professionals that go over the applications with you that have the systems in place. And annually, like, you know, they're they're running what's called vulnerability scans on your network looking for vulnerabilities and patching them up regularly. Security never sleeps. Security is 247, 365. And as a business person, you need to have, the right businesses managing your network for that in that regard. And those same companies can also manage a family's life too. You can do it yourself when it comes to protecting yourself, just yourself. But that like is basic. It's, you know, password managers, change your passcodes, two factor authentication, pay for antivirus, you know. Have your home properly secured, right? With cameras, home security systems, a fire retardant safe where a lot of your personal items, including paperwork, are you know stored. And those that same paperwork is digitized as well. It's in the cloud and so on. You do all those basic things, you're doing pretty good in backing up everything redundantly locally and in the cloud. Matt: thinking of the the personal your personal situation, all of us have a lot of us have t these Internet of Things devices, right? So probably if I looked on a man network, I'd probably have at least 60 different devices connected to my network. Just it just it it blows up without you knowing. I mean, you could buy bulbs now, right? Bulb bulbs manufactured in some other country that come over that want you to use an app just to turn on the bulb. So kind of speak to Where you need to be concerned about that, just adding multiple, multiple devices to your network. Robert: Yeah, so I currently have a mesh network. I'm utilizing Netgear and their Orby system. And I don't mind, I don't mind, you know, saying that. and there's an app that comes with that. And that app is constantly scanning my internet of things: printers, DVRs, digital video recorders for my cameras, every phone, every tablet, every laptop, desktop, every everything that connects to my internet, the app that is connected to my router slash modem is scanning for vulnerabilities. It's scanning firmware, it's scanning software, it's scanning the hardware. And it's letting me know if there's any vulnerabilities, if I need to make any updates in regards to firmware andor software. So take advantage of newer technology. If you're running a modem that's five plus years old, you're you're in the dark ages. If you're running a router that's five plus years old, you're in the dark ages. If you're not running a mesh network that you just installed two years ago, then you're in the dark ages. Like as technology evolves, like you know, you've got three, four, five TVs, you've got you know, four, five cell phones, you've got Four, five laptops. You've got bulbs and printers, and it just if it gets nuts, like you said, I probably have 60 to 80 devices myself. I am incapable of manually dealing with all of that technology. But an app on my phone is perfectly capable of that, and it does a perfect job of that. And so as we adopt more technology, we've got to adopt more technology to manage that technology. And it's great. Look, it's hard to hack a home if you've got the right technology in place, which means that updating your modem router, OS devices, hardware, software, apps, generally you should be good. Matt: Yeah. This this is not an area that you should be trying to save money by waiting until it breaks. just just because your router and your mesh network work and you don't want to mess with setting it up again because it's just such a pain in the butt to do it. That's not a good excuse. I that that's great advice about if you're if you're more than a couple of years old on some of these this equipment, think about it as an investment in your security versus, versus a pain in the asses. Robert: And not only not only will waiting too long to save money slow down your internet, your TV doesn't work like it's supposed to, your comp your printer doesn't get the connection, you're gonna fight with your spouse because she's like, Why is the internet so slow? Matt: Yeah, that's a very good point as well. Well, as we're kind of coming to a close here, you know, what maybe with some take some takeaways here, how how should how should someone be thinking about what to do next if they feel like they've had, you know, they've they've been compromised, let's say, and when should they call someone, you know, because it's more serious. Robert: So the moment you've been compromised, I would say the first thing you do is talk to your local police department, depending on the nature of the compromise, whatever that might might be. because they they generally are dealing with this all the time. And in most situations, depending on the level of compromise, especially if there were finances affected, you're gonna need a police report, which essentially is a government document that says, I am a victim. And therefore I am trying to resolve this, potentially what Which might mean restitution, get my funds back. Police reports are generally the first thing when there's money lost. that's one. Number two, there are all kinds of nonprofits out there. And then there's the Federal Trade Commission. If you search Federal Trade Commission in Identity Theft, they're gonna have a checklist that will walk you through all the different things that you're supposed to do, which also include getting a police report. And then there's a nonprofit out there called the Identity Theft Resource Center, which I was on the board for a number of years. I believe it's at idcenter.org. just check it out. And they work with consumers who are victims of various forms of digital fraud. that said, being proactive can prevent you from getting there in many situations. And proactive is what this entire podcast has been all about. So what I would do is number one, I would re-listen to this one and take a bunch of different notes, and then send it to friends and family, you know, because they should. engage in everything that we spoke to. You, frankly, Matt, have done an an amazing job of like covering a lot of ground in this podcast. And you know, this is what I do live for audiences all the time. And we cover a certain a a lot of ground that it's basically everything they need to do. You know, if you do all these things and you put it all into perspective and you look at the whole thing and and I say to everybody when it's all said and done, don't worry about anything. that we've talked about at all. Don't worry about it. But do something about it. Don't worry. But do something about it. If you take action on everything we've said, when I tell you you are good, you become a hard target. Matt: Right. That's right. That's that's a that's a good takeaway. That's the main the main thing I want to accomplish with this for clients and and everybody else listening is just awareness. Just awareness. You you can I I I don't want the fear of the new AI Skynet for those of you old enough to to to know who Skynet is, and and I'm sure you do. that is wow while there's a lot of unknowns with that. You got to live your life in the meantime and and you can't be driven by fear. So just just be proactive, like Robert's suggesting. Get an expert if you need it. how can they contact you if they need to, Robert? Robert: on the Google. Okay. Robert Ciciliano. Yeah. And my website is protectnowlc dot com, protectnowlc dot com, or search Robert Ciceliano on LinkedIn and connect with me there. Investment advisory services offered through Savvy Advisors Inc. Other entities and or marketing names, products or services mentioned here are independent of Savvy Advisors Inc.