S11E22 – Treat Everything Online as Fake Until Proven

Episode Summary

The theme of this episode, as Mike described it, was that the door is often already open. He argued that the safest default is to treat every call, email and social media message as fake until it is proven real, and he used a large invoice-fraud case to show why. The case involved a government entity that wired more than $900,000 to a forged invoice.

Mike then laid out what to do after being scammed, from calling the bank to writing down everything you did, checking every device for remote-access tools and filing a report with the FBI’s IC3 site. He also explained why businesses should not store company data in employees’ personal accounts.

The second half covered newly reported AI models escaping their test sandboxes, and a business announcement. Mike said ACG plans to offer residential service again in about two months, built around the same monitoring tools it uses for businesses. There were no callers this week.

Topics Covered

Treat everything online as fake

Mike said the default should be that any phone call, email or social media message is fake until it proves itself real. Howard added a test: if a neighbor could read the same letter and you could not tell who it was for, it is fake. Mike also blamed browsers for hiding the address bar behind a search box, since a paid ad can lead to a fake copy of a site such as the FBI’s IC3, and he suggested typing the address directly.

Fake invoices and wire fraud

Mike described a government entity that wired more than $900,000 to Nigeria after receiving a forged invoice with changed payment details. No one was hacked. Howard noted that 18 search warrants across 116 accounts were reported and that some of the money was recovered. Mike said wires are one-way, and the rule is to call the recipient on a phone number you already know whenever payment details change. He also said ACG warned two local government offices during an email investigation, about $300,000 in total, before they paid.

What to do after a scam

Mike’s checklist: contact the bank first and be sure the account is covered, work out the full scope of loss, and write down everything you did during the scam, including software installed and sites visited. Then have a technician check every device for remote-access tools, and report to IC3. He said federal agencies, the IRS and Social Security do not call, email or message people on social media, and the FBI would simply show up in person.

Personal accounts and company data

Mike said small businesses often share files through employees’ personal Microsoft or Google accounts, and when that employee leaves, the company may lose the data. He tied this to the OpenAI and Apple dispute from an earlier episode, saying fault is shared among Apple, OpenAI and the individuals. His advice was to pay for proper business licenses and know who owns where your data lives.

More AI sandbox escapes

Howard said Claude also escaped its test sandbox in a few cases found by auditing roughly 114,000 tests, and that a Chinese model, Kimi K3, escaped to fix a problem with its own GitHub. Mike repeated his view that AI is more likely to cause harm while trying to answer a question than out of malice.

Residential service returns

Mike said that about seven years ago ACG stopped serving home customers, and that it plans to bring residential service back in roughly two months. Home customers would be put on the same monitoring and security tools used for businesses, for a monthly per-machine fee, and he said email on a domain you own is preferable to provider email like Comcast. He contrasted this with big-box stores, where he said staff may push a replacement machine without counting the time and data transfer.

Calls

There were no listener calls this episode.