Why Smart People Fall for Scams (And Why No One Is Unscammable)

Vicky Baker: Hello and welcome to What The Fraud?, a podcast by Sumsub where digital fraudsters meet their match. I'm Vicky Baker, an investigative journalist specializing in reporting on fraudsters and con artists. Fraud fascinates me because it's about so much more than the money. It's about trust, human behavior, and the way people can manipulate others into believing something that isn't true. What keeps drawing me back is understanding how the psychology and the trickery work together. And that's why this season, we're doing something a bit different. We're looking at the personal side of fraud – not just the technology, financial fraud prevention, and the headline numbers, but the human moments underneath them. Why do we trust someone who's trying to steal from us? What makes any of us vulnerable? And what would it take to stop the act before money moves?

Meet the Fraud Prevention Experts

Joining me for our first episode are two people whose entire job is stopping fraud before it reaches you. Nick Harris is head of financial crime at Capitec Bank in South Africa, and Iain Orpen is Capitec's head of fraud prevention. Capitec is South Africa's largest retail bank, with over 26 million customers. Nick, Iain, welcome to What The Fraud?

Nick Harris: Thank you.

Iain Orpen: Thank you very much.

Vicky Baker: Okay, episode one, and we're going to start where we start every episode of this season, with a case study. And this is one from your own home country, Iain and Nick, so I think this is going to be familiar to you. To give our listeners a quick overview, this year, South African journalist and cybersecurity researcher Joel Cedras deliberately entered into a job scam. He knew it was fraudulent, but he wanted to see how it played out in real time and test his own instincts.

How Online Job Scams Build Trust

Joel saw an advert on TikTok. It was offering a job at Amazon. It looked legit: there was a whole community of workers behind it, there was a platform, there was a mentor who was encouraging him along the way when he started to make a profit. But to access this profit and to access his earnings, he was asked to pay in as well. And that's when this becomes problematic. When he first started paying in, they paid him back, so it all seemed legit again. He made more deposits. The amount that he could earn increased, but so too did the amount that he was expected to pay in to unlock those earnings. Joel, by the time this finished, and remember that Joel knew this was a scam from the beginning, he'd paid in 4,000 rand, which is about £180 or $250.

Nick, Iain, you know Joel, and you're aware of this experiment. What did you make of it?

Nick Harris: We know Joel very well. He's part of our team and a great fraud mind. I really love working with him. It teaches us a few things – it's a scam recipe, right? Number one, pull your victim in: what do they want? South Africans need income. They're looking for jobs, and this is an easy way to earn income – no qualification required, easy processing, an easy job, and a promise of a lot of money, easy profits.

And then, of course, there's the second part of the recipe, which is building trust. Amazon is a brand we all know globally. It's not a brand we know very well in South Africa, but it's coming to South Africa, and everybody knows that. So immediately you're going, "Yeah, this is all seeming like it's legit, it's trustworthy." And that's it – you've got your trust, you've got your promises of income, then you're in. And the final thing is making that small payment and actually getting that money – feeling it in your bank account makes it feel real. But that's only the beginning – it's the hook.

Vicky Baker: And what interests me about this case is that Joel ended up – he obviously had some form of budget to do this scam, he knew what he was getting into – but he also ended up using some of his own money, which seems to be like he wanted to see where it would go. You get kind of hooked in, and is that indicative of how these scams work?

Iain Orpen: Absolutely. I think our own impulsivity as humans is one of the characteristics that fraudsters definitely love to play on. And I think our natural curiosity, once you've bought into the scam or scheme, makes us particularly vulnerable to these types. So you've already got this sort of, "Well, I've already invested into this thing, what's another couple of pounds or Rands that may give me these riches that I've been promised by these fraudsters and scammers?"

And I think what Joel also picked up really on is the advancement, right? I call it the great illusion, because when we deal with clients, often we go like, "How did this happen? How did you go through?" But I think once you're in the moment, this illusion and the realism that's being created by the look and feel of these things, the slickness, the professionalism, and, to Nick's point, around the believability – this is a brand, why would Amazon not create this website and lure us to this phenomenal path to riches? If I were in Joel's position, I probably would have put a few of my Rands in there as well. And I think we've done that before, both Iain and myself, where we've tried to see what else we can get if we attempt to be scammed, just to see what plays out, because you start seeing their playbook, right? You'll start seeing the other tactics being played out as you get further down the line.

Why Anyone Can Become a Scam Victim

Vicky Baker: Nick, we often imagine vulnerability as belonging to a certain type of person, maybe someone who is not as technically savvy or perhaps older, but vulnerability is a lot more situational than that. Is that right?

Nick Harris: Yes, absolutely. I think everybody is vulnerable in their own right, and I've got a particular pet hate to say, "Oh, you were stupid," right? You know, we often say in South Africa we call it a braai, barbecue maybe in the UK, and you stand around, "Oh, I can't believe such and such was romance scammed," right? But what you've got to realize is that, based on some of the work I've actually been researching myself by Martina Dove, you know, everybody's got vulnerability factors that, at any given point, may make you vulnerable, right? And it could be situation-specific.

Suggested read: Fraud Is in the Air: The Growing Threat of Online Romance Scams

It could be that you're from an older generation, and there's this belief in authority, you know? Somebody says they're from the fraud department; you're going to believe them, and you're going to act accordingly. It could be younger generations' impulsivity. You want things here and now, it looks like a great deal, you're in a marketplace environment, those sneakers you wanted are suddenly going for next to nothing, and that risk-reward sort of trigger gets fired off. It could be this belief in justice. "This won't happen to me, I'm too clever for this." And unfortunately, I think in the careers that we are in, we've seen it from all demographics, all ages, all professions, educational levels, and the like. And so, yeah, everybody's got a playbook, unfortunately.

Vicky Baker: And what are the red flags that you're seeing? What are fraudsters trying to hide?

Iain Orpen: I'll get to the red flags, and maybe just to expand on Nick's previous point about vulnerabilities. I do believe every single person has a vulnerability, and this is in the context of red flags and what to look out for. It's just about finding that vulnerability.

A very smart, successful person is probably quite vulnerable, just in terms of their own sort of self-awareness and vanity. You know, tell a person like that, "We're making incredible money with this deal, my clients are making a lot of money, but you're smarter than them, you're way smarter than them. You can make even more money than them; you're 10 times smarter." And people go, "Yeah, of course, that's true, I am 10 times smarter, I can make 10 times more money." Well, that's your vulnerability.

And if you think about the need to protect your family, everybody's got that. Most scams right now, to your earlier point, are online, so you haven't physically seen a product or a person. You won't have touched the salesperson, you won't have touched the goods. They will be synthetic. So that is really, really important. Watch out for being pushed; watch out for promises that are too good to be true; and ask, Have you touched or seen this thing? Those are your common things to look out for.

Romance Scams and the Shame of Reporting Fraud

Vicky Baker: Do you think we judge people too readily, Nick? You mentioned telling stories at a braai or a barbecue, and almost all the red flags are there when you're telling the story, because we don't tell people anecdotal stories about bank transactions and mysterious strangers and these kinds of job offers that, as you begin to tell someone, they recognize that something's about to go wrong, but when it's actually happening to someone, they can be unaware.

Nick Harris: I think that touching a little bit around, "It's not going to happen to me," kind of thing. Now, one of my pet hates really in the industry is that we tend to – and I say we as collectively as banks and public interest groups and government – tend to put out really cool warnings like "Watch out for scams," right? "There are scammers out there." And they're not tailored to the context or the situation.

Now, I recently had a personal experience with a close family member who was romance-scammed. And I never in my life thought I should even have a conversation with this individual, you know, in her late 70s, widowed. I'm supposed to be this expert in the field. I should be making sure my family is protected and safe, and close colleagues and stuff. And what I realized is that what latched on to – and can you believe where that hooked her – was Words with Friends, you know, playing online Scrabble with strangers. Who would have thought that would be where your hunting ground would be? But when you understand the scam, you think that's making complete sense. So if I'm a romance scammer, where I'm going to go find my elderly people is Words with Friends, where they may be having a chat with a casual stranger.

And then suddenly, as she was in a relationship with a handsome Australian engineer who's working in Angola, speaking with a very suspicious West African French accent, and they were in this online relationship for almost six months, I think, before there was even a request for money. So now, think of the vulnerability there. Think of you being – to Iain's point – you might have built a bit of trust. You aren't going to give money to a complete stranger, but someone who now knows your family, knows the names of your dogs, understands that you love dogs, and has spent six months talking about your amazing dogs, sending dog photos and all kinds of things. I mean, this is a long haul before the money started being requested.

And so now, going through this my own experience, realizing: did I actually have those critical chats? Did I tell the stories? Did I say to people, "This is how it makes it real. Do you understand how long this could take that could break up that cycle?" That prompted a lot of introspection for me, firstly, but secondly, we rush too quickly to judgment. So you can look at the end and go, "Ah, it's a silly old lady, you should have known you shouldn't have sent money to a handsome stranger that you've never met on the internet." But when you understand the context, you realize this is why these things are so successful and why, particularly for this kind of scam, right, why it can be so devastating. Because suddenly you've got an individual who's not just lost money, but they've lost potentially the love of their life, who was giving them affection and lots of love and care, more than potentially even their own family was.

So now this person's lost that and they're going through, and then you don't realize that they get revictimized. So she reached out to me recently and said, "They came back, and it's another person." And so you get drawn in, because this is actually how it works.

Vicky Baker: It sort of echoes back to the case study at the beginning as well: you already feel that you've put money in and you've lost, and that's when you're even more vulnerable. You think you can beat the system, potentially.

Nick Harris: Yes. I'll tell you how they did the last part. So they said, "No, we've got all your money, right. Your money's coming back, we'll give it back to you all." And they sent her, and it was an HSBC card with her online boyfriend's name on it, and said, "All you have to do is pay another," I think it was let's say $5,000, "to unlock the million dollars that's on this account," whatever it was, right? And so sitting there with this physical card was so tempting, I literally had to go and say, "Let's just cut this thing up," because I can see what's going to happen. You're just going to look at this every day and say, "Maybe this was real, maybe I can get my money back." How good is that hook?

Vicky Baker: Yes, we talked about sort of judging other people, but people who are caught up in a scam judge themselves, right, Iain? They're also beating themselves up for a long time afterward, and do you find that there's sometimes a gap in the scam being reported because there's so much shame associated with it?

Iain Orpen: Absolutely. I think investment scams and romance scams – often referred to in this context as pig-butchering scams – probably have the lowest reporting rates. And you say, "Well, why?" Number one is the majority of them just don't ever believe that they were scammed. They may take that to their graves, to actually never believe – they're so convinced that this person is real that they'll believe it till the day they die. And you've seen lots of the high-profile cases of multi-million dollar schemes where the victim still refuses to admit that it was a scam. So number one, there's the fact of just really struggling to come to terms with the fact that it was a scam. It's against your self-worth, it's your own ego that stands in the way.

The second is embarrassment, if you have realized that you've been scammed. It's again that stigma, and that's a stigma we need to break. This can happen to anyone. And with the "Slam the Scam" campaigns that we currently are doing, it's really about saying, "Actually, this can happen to anyone, this could have happened to me. I'm a fraud professional, and this could happen to me. I can promise you there are scams that I would fall for." So breaking that stigma is really important.

And then, of course, what Nick talks about is repeat scams. So especially if you have not reported the scam, you will get targeted again – absolutely will get targeted. And we often think and talk about scams as businesses, so we have the protection factor on our side, but we also think about how does the money flow? How do these scammers make money? And if you do start to think about them as businesses, it actually does impact the way we try to break them down.

Number one is to make it financially difficult for them, and number two is to make sure that the victims are not retargeted. It's not a one-phone-call recovery journey; it can be a very long and complex emotional process, as a global financial industry, as that client, as that victim, is going through those emotional phases of trying to admit and accept that it was a scam, going through the anger and the grief. That doesn't take a day. It is a long process, and it's something that I think we as a global financial industry need to come to terms with.

How Banks Identify and Prevent Fraud

Vicky Baker: So how are these conversations happening? How are you communicating with the customer? Are these phone calls, you're alerting someone and phoning them out of the blue? How do you also get their trust in that conversation?

Iain Orpen: A big challenge. Really, you're starting on the back foot. You have a person who's trusted, and you're coming in as a bank, an outsider, the first time you're speaking to them, perhaps from a fraud perspective, and you're now trying to persuade them that the person they trust is not trustworthy and you are.

So, number one, it's about building trust. It doesn't always mean a phone call; sometimes you actually have to have a physical visit with the person. We have a big branch network in South Africa, I think it's one of our advantages, where all of our branches are accessible, and there's a large level of trust in our branches. And I think that creates, for certain people, a safe haven to be able to come in and say, "Okay, I'm in an environment that I trust; I'm safe here. There's a physical person that I'm speaking to, and what they say may be heard easier."

The second thing, if it is in a call center environment, is to give context, and that's a data strategy. Often, if you create the larger network of these scams, you'll find multiple victims. And the victims that have reported it can tell you what happened. And then it's about making sure we utilize that data to tell the story to the other victim. And then you can say, "Listen, there are other victims that have said, 'I met this person, the same name, I met him on the same channel, and he said the same thing. We created a bond about children, and then he said he had a business in the oil industry, but there were problems, and, and, and.'" And suddenly you're saying, "Well, actually, other people have told us that, and then what happened is they were cut off." Now that person is associating themselves more with the reality of the situation.

Vicky Baker: So, Iain, how do you tell the difference between a genuine customer who's making a transaction they wouldn't normally make that is legitimate, but someone who is maybe carrying out a scammer's instructions? What sort of patterns and data are you looking at?

Iain Orpen: A couple of things. Number one is the profile of the payer, again looking at their age, their vulnerability, their technical savviness. Number two is the channel. How are they making payments? Is this a payment channel that they don't often use? Certainly, if you're looking at things like, "Oh, this person is doing a real-time clearing payment, or a forex payment, or a Send Cash payment," they've never done that before, that would again show you high abnormality.

And then finally, and I think the strongest point, would be the destination. The destination account will give you strong, strong signals: Who am I paying? Who else has paid this account? How recent is that account? What level of activity is going to that account? And what does that account look like in terms of ins and outs, what you call mule activity?

And if you take sort of those three things together, even though by themselves they're not going to be strong enough to say "this is fraud" or "this is not," if you put them together, you get very strong signals that say, "Okay, this is a vulnerable client, they may even have had fraud incidents before, they're doing a transaction that is abnormal for them, and the account that they're sending it to doesn't look like a normal account – it looks like a suspicious account, it shows mule activity, it's relatively new, it's not a trustworthy organization, or it could be a crypto wallet, or a gambling wallet, or anything like that." That combination of these three should give a very strong signal that this is highly improbable to be a legitimate transaction, I would say.

Can Anyone Be Scam-Proof? Deepfake Scams and Personalized Fraud

Vicky Baker: And so, Iain, I want to look at the victims again here, and a lot of people suggesting that they would never fall for something like a scam. And I have a friend who insists she is unscammable. What do you make of that? Is there such thing as an unscammable person?

Iain Orpen: There may be one or two, and it's probably not your friend. I don't know your friend well enough, but look, I think there are people who are more vulnerable, and there are people who are less vulnerable, certainly. There are certain vulnerabilities that are easier to exploit, like your trust that we talked about, and compliance – it's just a wider range of people.

I don't think anybody is completely unscammable. I gave the example the other day when I was talking to a large group of nurses, it was a nursing conference, and we'd been talking about scams for half an hour, and we talked about why people call you and talk to you for 10 seconds and hang up. And we were going, "Oh, they're probably recording your voice and they could be extorting you." And eventually we said, "Listen, let's do an exercise. Close your eyes, and picture your parent. You have a son or a daughter, 22 years old, traveling in Dubai, and you get a call at 1:30 in the morning. And it's a video call, and it is your child, your daughter, who is visibly upset, crying, and your immediate reaction is to be shocked. And what has happened is she says she's been arrested, she and her boyfriend, and a large amount of drugs were found in their possession. And they put you on to the officer who says, 'Listen, this is a very serious crime in that area, and you need to immediately pay $5,000 to at least get bail and allow them to get a lawyer.'"

Now, and then I said to the crowd, "Okay, guys, what would you do?" And nobody in the crowd said they wouldn't pay that money as a parent. And I said, "But hold on, guys, that wasn't your daughter; your daughter was asleep in bed, she was safe. That was a deepfake."

Vicky Baker: People in that situation, they don't want to take a risk.

Iain Orpen: Oh, you don't want to take a risk. It depends.

You'll be super worked up, you'll be on the back foot because it's 1:00 in the morning, you're surprised, you're not expecting it. You've heard about deepfakes, but not deepfakes of your daughter. You've heard of deepfakes of Elon Musk or your president – that stuff happens, but not your own daughter. You're not used to this.

Nick Harris: This is my fear, and I think we are going down this route, is that scams are being tailored to you. So, given the data breaches and the availability of information about you, particularly, young people who seem to live their lives through TikTok, and the availability – I mean, it only takes about five minutes of voice recordings to clone your voice, and I've seen that in action.

I do think we're going to hit a world where the puppetry that will be displayed in front of you is going to be tailored exactly to you. So if I was trying to scam Iain, I'd definitely go for cheap mountain bike parts, right? That the seller is offering to sell you those things, and you're going to pay away, and it's just going to be just below market price, right, and you're going to be like, "This is going to be a great deal."

I do think in this new world with generative AI, data breaches, and we've seen that already, the guys being able to tailor that very quickly. We had a recent one with an ex-colleague, and his daughter, a student in her first job, also claimed she was unscammable, and her boss reached out on WhatsApp on his WhatsApp number and said, "Please, I'm meeting some big clients," and he was dealing with some big clients, "and I need to get them gift cards as a present. You can't go meet a big client without cards, and I need gift cards." And she complied. She went and drew all her cash, and asked her mom for more money, and bought a whole bunch of gift cards and sent it to her boss, who it turned out his WhatsApp had been hacked because he had given away his one-time PIN on another scam, and so it went on.

I think everybody, to Iain's point, has got their vulnerability or trigger, and I think the tailoring of this and the customization, as you've seen everywhere else in the world, they're going to pick one that's going to be right for you.

Scam Awareness and Fraud Prevention Education

Vicky Baker: Wow. So how can you get one step ahead of this, Nick, in terms of education and getting through to people?

Nick Harris: I'll break it into two components. I think foundational layer and getting into the schools and creating skepticism, just like be aware of what's going on, and an ongoing curriculum almost, I think needs to play its part, and I don't think it's done well enough yet, to be honest. I think we're starting to see it coming through some of the school curricula. So the foundational phase, but it goes throughout society, and so we need to first of all look at the way we deliver content. It needs to be fresh; it needs to be available; you need to look at the way you're delivering the message so that it's relatable to the actual situation.

The last one is really around how we empower people to ask questions without feeling stupid? And that sounds funny to say, but people are going onto GPTs and all those kinds of things and asking questions, saying, "Is this a scam?" What if we could build into our own app environments that capability? So quite a few financial institutions, including our own, are looking at how do we actually build that, allow the client to enter free text or upload a screenshot, or something similar to say, "Hey, can I ask this expert who, instead of being at the barbecue, you could have the Iain-bot in the Capitec banking app answering, 'This is a scam, do not pay.'"

So definitely there's certainly a few things up our sleeves. I think the last one is, how do we fight fire with fire? And how do we get into those environments, the marketplaces and WhatsApp and the Telegrams where they are doing this, and how do we infiltrate that, how do we get real-time intelligence?

Banking Security: Biometrics, Payment Monitoring, and Fraud Intelligence

Vicky Baker: I want to dig into what you're doing at Capitec to help customers before it gets to the point of no return, and we've talked about that a bit, but the risks in personal banking have changed a lot as the platforms have become a lot stronger themselves. We're using biometrics and things to log in, so bad actors are kind of changing their approach. They're no longer trying to sort of hack or steal directly, but there's a shift from fraudsters attacking systems to attacking customers directly. Is that what you're seeing?

Nick Harris: The days are gone when giving away your secret PIN would let someone get into your banking app. I think you've got to look at layers of defense, which everybody is employing, hopefully. So selfie authentication, biometric authentication, is hugely important, but also not relying on the cell phone or the handset's biometrics itself, but also looking at how you do that independently from the device. So we've invested quite a lot of technology in not only, for example, taking a selfie, right, but actually comparing that to our own golden source on record. So even if the device is taken and somebody else is in front of that legitimate device and has a PIN, they shouldn't be able to take out large portions of your savings.

The second component is around understanding the payment journeys, and Iain's touched upon it, really. It's about understanding the bad endpoints, because that's probably the biggest thing you can scale quickly. So one thing is about victim monitoring and going, "Okay, well, could you be a victim, and would a little old lady pay away savings to a cryptocurrency?" That's a great signal, but if they're paying a one-off bank account that's offered at another bank, and five people reported that for fraud in my own system, I should use it as a good signal. So look at the destination of where the value goes in, and not only the victim and the victim's transactions against themselves. So identifying that and using the scalability, so it's almost like crowdsourcing data within your own environment, and then being able to then block that at scale. So we've been using quite a lot of that successfully.

The other one is just being able to slow down payments, high-risk payments, give the client time to call in, or for one of our agents to actually look at that. You have to have this. In the world of real-time payments, it's critical. You know, I always find it funny that it takes seconds to deploy or send funds across in most jurisdictions or countries nowadays, but to get that money back, you have to phone the fraud department. So we need to work on both of those journeys, but at least slow it down before it leaves the bank as the best opportunity.

And then I think, really looking at what my intelligence is, what my data means, and then these syndicates and bad actors at scale, and using those signals to your own advantage as well. Identifying the network, having a mule-combating strategy, and then going into the fighting fire with fire – it doesn't help if I do this in my bank alone. It has to be at an industry layer, it has to be at a network layer, and it doesn't help my walls – you know, the proverbial "My security's high, my house won't be robbed." Well, guess what, somebody else's house can get robbed, and they're going to take that money to build a taller ladder to get into your house. So it's about the networking component, sharing intelligence, and Iain actually has got some great insights. So I'm not going to steal his thunder on this one, because I think he can talk to you guys probably for the next hour on that, but maybe give us some highlights as well, Iain, because there're some really good things I think we can learn from what they've been doing on the industry side.

Industry Collaboration and Trusted Approver

Vicky Baker: Iain, do you want to pick up on that?

Iain Orpen: Yeah, absolutely. I believe we need to solve it as an industry, not just the banking industry; anyone providing financial services needs to be involved, anyone storing or transacting money needs to be involved, and I think the industry accepts that. We have to all stand together against crime because of the scale of crime and the complexity.

Number one is that you can build a high wall in your ecosystem. If you're just building it in your own ecosystem, you're going to have zero impact on fraud. It's very easy for the money launderers, which is the financial flow of those crimes, to just change patterns, so they just divert the money in a different way. So you have to kind of stand together to make sure that, if you're going to have a meaningful impact, you are able to block off all those bad endpoints at scale.

That's the one thing around the industry initiatives on fraud. Another initiative that we're working on that I really am very excited about is what we call Trusted Approver, and it speaks to that vulnerable client. Trusted Approver is about nominating a person you trust – it could be a family member – who may have a different perspective, or at least a different level of thinking in terms of financial transactions, a different level of understanding, that can help approve risky transactions.

I always say vulnerable clients, especially elderly clients, you don't want to take away their financial autonomy, their freedom; it is a major part of their lives, and when that happens, you really do tend to see resistance and issues. So allowing a client to retain their financial autonomy as they get older really supports their quality of life. The only way you can do that is if there's someone that they trust that can monitor and double check on those risky transactions. So you can imagine in Nick's case, there's a phone call to say, "Mom, who's this new person you're paying? Is this the same person that you met online, or the same person we discussed last week?" Or probing for that information by a loved one. Again, I think it's really going to add a lot of value to those vulnerable clients.

Vicky Baker: Is that something you've rolled out already, this Trusted Approver?

Iain Orpen: We're in the process of rolling it out.

Mobile Malware and Fraud-as-a-Service

Vicky Baker: I wanted to ask you also, Iain, about malware, and if that's still problematic, and how fraudsters are using that?

Iain Orpen: Nick, you'll come in as well. Malware still absolutely is prevalent, and you know, it's come and gone and changed so much in the last couple of years from relatively simple technology to actually quite highly complicated and rapidly evolving technology that we see now. The current one we see is also very clever in that it's a social network again, and it's scaled for people that are wanting to get free streaming services. In South Africa, well, we've had the World Cup soccer recently, we've had the Olympics, and we've had a massive rugby tournament with all the Blacks and the Springboks, and it's very expensive to watch in South Africa. And a lot of people are saying, "Well, I just can't afford that, but I want to watch the game, and I'm prepared to go and download some app to watch one game. What's the harm? It's one game."

And that's it – you've downloaded that app, you've got malware on your phone, and once it's on your phone, it's very difficult to control. So, malware remains a problem. There are just so many varieties, right? That's the thing: malware is highly advanced, but some of the same things are incredibly simple. But, you know, you'll pick your victim. You don't need – as a fraudster, again, if you're thinking about it from a financial perspective – you don't need every single person to fall victim to your scam. You just need one, and that's it. They will empty you out.

Nick Harris: And maybe to add on, I mean, you've got to understand the psychology, and maybe just tie that back. So, I mean, you're looking for a good deal, you go and you see an advert, a lot of paid media on platforms like Facebook, and you were searching in your history streaming apps for World Cup rugby, because that's what you want to watch, or World Cup soccer for this year, and your Facebook app is picking up those cookies and serving you customized streaming ads for very cheap streaming services, or free. You're not worried too much, you're probably on an Android phone, which is probably where you're most vulnerable at this stage, not to say iPhone is immune. You click on it, it gives you very considered guidance how to download an APK, you store it on your device. Your device is going to give you a whole bunch of red signals, but hopefully you might even be phoned by someone from customer care from the streaming platform, because they are so good at their jobs, and you're very like, "Oh, this is great, no, don't worry, just go through it."

And to Iain's point, the client thinks they're on a rewards program, they love that. We saw a Marks & Spencer equivalent in South Africa, so you can imagine already they're targeting different demographics. People looking for flights, they must have money; people looking for streaming services must have a television, so these guys definitely know what they're doing. So you've really got the hook by the time the person's clicked that thing, so there's not much work to be done. You get the advert, you serve it up, and in the background, to Iain's point, your phone is taken over completely. You don't even know what's going on.

The only thing is, whether you got biometrics activated or not, the app is activated, biometrics are passed, and the payments start. Right then, what do they do? They crash your phone. So suddenly your phone is not working, you're not getting the notifications, you don't know what's happened, you've got to reset it, try to get a new phone sometimes. We look at this stuff, we look in the back end, it's coming from a Cambodian IP address, across control centers, and to Iain's point, fraud as a service. There's Telegram groups offering this as a fraud as a service. You click on the phishing link that was provided, within a minute, that thing's been taken down through an AI-assisted approach by the scammers, because they know that one's been burned. They immediately fire up a new front end to lure somebody else. So this stuff is really, really good. If you want to say there's one thing that's keeping me up, is this format, right, malware, because of the danger, because it's already got a hook component.

So again, my only advice for any other fraud fighters from other institutions is what are you looking for from a signal perspective, because our big thing in the beginning of these things, we couldn't see anything wrong, because the client's device didn't change, it used the client's biometrics, their PINs, everything, their pictures, they've authorized those payments. The client said, "I never did; it's not my fault," until you really get to the bottom of what is actually happening. So, it's extremely dangerous, it is definitely the next form of what I've seen in terms of the next attack vector, and they're only going to double down on this because I think it's been highly successful in all the markets that have been launched in this vector.

The Future of Fraud Prevention

Vicky Baker: I mean, you guys are fighting fires on every front, and I feel I need to let you get back to it, there's so much to keep you busy. But one thing before I let you both go is what we're going to do with each episode is ask people, what's the one thing you would change that you think would help to prevent fraud, the one thing you could change tomorrow? Iain, I'm going to ask you that.

Iain Orpen: Yeah, I think we started with that, and I'll end with it: it's a collaboration. We really do need to come together: law enforcement, financial industries, and then don't forget the social networks. This is a problem that we can really only solve between the three of us, and we're not doing enough. And that's a global callout, not just in our community. We can't control it here alone; this has to be an international effort between those three spheres.

Vicky Baker: And Nick, can I ask you what you would change?

Nick Harris: I think for me, anti-fraud and anti-scam needs to be a social movement. We need to drive this the way we do climate change and all the other sort of social movements, and really spend the time educating our own family members and communities, and really sharing the skills and insights. I think it's a life skill now. I think this should be taught, and you can teach it through experiences like this, telling the story, showing the insights, and hopefully providing the opportunity for just one person to just double-click in that moment and go, "Ooh, okay, this doesn't make sense. Let me drop this call and phone a trusted family member or activate this device or activate Trusted Approver," for example. So, I think get this as a social movement and a cause for change.

Is Anyone Unscammable?

Vicky Baker: And based on everything that we've talked about today, I think I know the answer to this, but I want to ask you both: Is anyone too smart to be scammed?

Iain Orpen: Well, you claim your friend is too smart to be scammed; again, maybe you can give me her phone number and we'll set something up. I don't believe there are many people that are too smart to be scammed, and certainly the word "smart" is not the right word. It's about situations. If you find yourself at the wrong place, the wrong time, with the wrong emotion that's being activated, and the context that is going to send you in a direction, you're going to go in that direction. It's almost – I always think of it as street magic. I've seen some incredible street magicians that there is just no ways that anybody's going to look at them and go, "Oh, I saw what you did there." And scammers act in the same way; they use your thought patterns, your preset conditions and ways of thinking, to make you do something. And that is more powerful than intelligence. It is human nature; your brain has been tuned to do this for many, many, many years, and to change that is almost not possible.

Vicky Baker: Echo the same question to you, Nick, if anyone's genuinely too smart to be scammed?

Nick Harris: I think the answer to that is if you believe that, you probably are being scammed at that stage. But yeah, absolutely not. The fact of the matter is that there is a scam for everyone, and it's only a matter of time that you will probably fall for it, whether you like to admit it or not.

There is a scam for everyone, and it's only a matter of time before you fall for it, whether you like to admit it or not.

The question is how quickly you identify it, get yourself out of that situation, and learn from it. And where we're going in terms of the next generation of fraudsters and scammers makes this even more likely. So be vigilant, understand the risk, and certainly do not go into this thinking that you are invulnerable.