Yeah, I'm just curious, like, are medium-sized institutions, let's say a medium-sized bank, more vulnerable than one of the giant banks? Or what's your thought there? And then if they are, like, what's some advice you have? What should they be doing to protect themselves?

I would say all banks are vulnerable in the same ways.

And we work with some of the smaller banks as well because they tend to have their protocols to verify people are who they say they are might be a little bit older than say some of the larger banks or institutions.

So the recommendations that I have across the board are if I pick up the phone and I call your support line and I say that I am John Smith And I ask you, how do you verify that I am really John Smith? And you say, date of birth, address, verify the phone number that's calling, email address.

Those are all KBA, knowledge-based authentication questions.

And the problem with that is if you go to Google and you Google John Smith, well, it'd be hard for John Smith because that's a little bit of security by obscurity because there's so many John Smiths.

But somebody with a regular name, I would probably be able to find the answers to those questions on data brokerage sites.

Well, how about the funniest story you can share with us in terms of social engineering?

Is this thanks to AI? Is AI making scams like this more convincing?

It absolutely is.

And what we see is that the goals of the scammer haven't changed.

They still want your money.

They want your data or access.

But the scalability and the believability of the attack has increased.

So when they're using AI, they don't have to think and actually write out a fantastic email.

So Rachel, to his question, but also for the people who received those fake invitations, what do you say?

Tell me more about how you think companies can, can learn from this.

Yeah, absolutely.

So companies can protect themselves by making some changes to the way that they operate.

So number one, they've got to update their protocols to verify that people are who they say they are before taking another action.

So a sensitive action would be something like typing in your username and password, providing a multi-factor authentication code.

A lot of times we say, "Oh, we just have to train people," and it is good for people to be educated, but if they don't actually have updated protocols to verify people are who they say they are, then people will make choices that aren't in the best interest of the company or the customers that they serve.

Next, we have to make sure they have good multi-factor authentication.

What do you think we people who are just users of software, any kind of software, what can we take away from this?

Is this thanks to AI? Is AI making scams like this more convincing?

It absolutely is.

And what we see is that the, the goals of the scammer haven't changed.

They still want your money.

They want your data or access.

But the scalability and the believability of the attack has increased.

So when they're using AI, they don't have to think and actually write out a fantastic email.

So, Rachel, to his question, but also for the people who received those fake invitations, what do you say?

Why has it changed?

You know, Meta hasn't 100% said why it's changed, but we can speculate.

Um, one thing that we're definitely seeing as a push around the world is, uh, the safety and moderation becoming more important to these large institutions.

So without end-to-end encryption, Meta can do more moderation for things like harassment or child exploitation on their apps.

A- as Instagram users, is there any reason for us to care?

It's interesting because not many people opted in to end-to-end encryption for the, the Meta Ins- the Instagram direct messages.

You had to opt in, so you had to go to your privacy settings and make that change, and very few people did that.

Now, I typically recommend that end-to-end encryption is, uh, something that just is on by default, and that was not the case here, which is probably explaining the low adoption.

Is this thanks to AI? Is AI making scams like this more convincing?

It absolutely is.

And what we see is that the, the goals of the scammer haven't changed.

They still want your money.

They want your data or access.

But the scalability and the believability of the attack has increased.

So when they're using AI, they don't have to think and actually write out a fantastic email.

So Rachel, to his question, but also for the people who received those fake invitations, what do you say?

We've already mentioned the method criminals used to take over Patricia's account, SIM swap, but I wanted Rachel to explain in detail what a SIM swap is.

So a SIM swap is whenever a cyber criminal wants to gain access to your account, your phone number, and the way that they do this is they call up your telco, the carrier that helps you with your phone service, and they might say something like this, "Hey, this is Bob Sullivan.

I dropped my phone in the toilet.

I got a new phone.

I need to make sure that I port over my SIM to this new device.

Can you help me get that set up?" And the telco says, "Oh yeah, absolutely.

We can help you with that.

Okay, so what the heck am I supposed to do about this?

We have gotten into this a little bit on terms of service before, but will you just give us kind of the CliffsNotes definition of what a VPN is?

Yeah, yeah.

So in general...

VPNs are used to obfuscate your location and who you are.

So in layman's terms, they try to add privacy to you online.

And VPNs aren't necessary for most everyday users in their personal life.

So most sites, like I mentioned, that you go to are encrypted.

How should people be thinking about providing their IDs to platforms that are increasingly asking for them? If it's a site that they want to use or they feel like they need to use, how do you sort of think about evaluating that risk? Should you never do it?