WEBVTT

00:00:00.443 --> 00:00:01.185
JACK: I think that when I

00:00:01.185 --> 00:00:03.789
was a kid I was a good liar.

00:00:04.114 --> 00:00:05.832
Don't ask me where it stemmed from;

00:00:05.833 --> 00:00:07.520
probably because I was always getting

00:00:07.521 --> 00:00:10.476
in trouble, and that — I learned that

00:00:10.489 --> 00:00:12.608
if I was a good enough liar that I could

00:00:12.612 --> 00:00:15.499
sometimes lie my way out of trouble.

00:00:16.161 --> 00:00:18.023
But I was reading this post on

00:00:18.025 --> 00:00:20.168
Reddit the other day, and so

00:00:20.168 --> 00:00:21.761
many memories came back to me.

00:00:22.125 --> 00:00:23.643
[Music] There was this post.

00:00:24.354 --> 00:00:26.889
Some dad was complaining about

00:00:26.890 --> 00:00:28.367
his son being a ding-dong.

00:00:28.647 --> 00:00:32.113
He’s like, my son, who’s fifteen, wanted

00:00:32.113 --> 00:00:33.969
to get some ice cream, so we gave him

00:00:33.970 --> 00:00:35.665
a few bucks and sent him to the store.

00:00:36.058 --> 00:00:38.147
It happened to be a buy-one-get-one-free

00:00:38.150 --> 00:00:39.725
sale, and we all knew that, too.

00:00:40.006 --> 00:00:41.442
So, he went, he bought some ice

00:00:41.443 --> 00:00:43.006
cream on his own, and he came back

00:00:43.426 --> 00:00:45.541
with just one tub of ice cream.

00:00:45.984 --> 00:00:47.655
The knucklehead didn't get the free one.

00:00:47.658 --> 00:00:48.911
He just paid full price for

00:00:48.912 --> 00:00:50.239
a single tub of ice cream.

00:00:50.683 --> 00:00:51.934
The store clerk even told

00:00:51.934 --> 00:00:53.253
him, hey, there’s a sale.

00:00:53.254 --> 00:00:54.571
You know you can get a second one free.

00:00:54.885 --> 00:00:57.160
But my boy just said, well, I only

00:00:57.161 --> 00:01:00.137
want one, and refused the second one.

00:01:01.525 --> 00:01:03.803
His dad on Reddit was all miffed

00:01:03.804 --> 00:01:05.177
about how his son could be so

00:01:05.178 --> 00:01:07.308
daft and ignore free ice cream.

00:01:07.567 --> 00:01:10.125
He even said, I know that as soon as the

00:01:10.125 --> 00:01:11.791
boy finishes his ice cream he’s gonna want

00:01:11.792 --> 00:01:13.686
another, so why didn't he just get two?

00:01:13.857 --> 00:01:15.089
He knows that we all love ice

00:01:15.089 --> 00:01:15.919
cream, so why didn't he get

00:01:15.919 --> 00:01:17.304
one for his mom or his dad?

00:01:17.466 --> 00:01:19.012
Why did he get just one ice cream

00:01:19.012 --> 00:01:20.359
and not the second free one?

00:01:20.389 --> 00:01:21.704
It was free ice cream.

00:01:22.687 --> 00:01:24.371
This Reddit post blew up.

00:01:24.926 --> 00:01:27.274
Everyone was piling on about how dumb this

00:01:27.298 --> 00:01:30.470
kid was, saying stuff like, in my state

00:01:30.491 --> 00:01:32.344
you could disown your child for far less.

00:01:33.356 --> 00:01:34.945
Someone else said this is probably

00:01:34.946 --> 00:01:37.246
because the kid doesn't go buy things

00:01:37.247 --> 00:01:38.538
very often and doesn't know how to

00:01:38.545 --> 00:01:40.170
handle money very well or deals.

00:01:40.832 --> 00:01:42.091
The dad wrote in the post that he

00:01:42.091 --> 00:01:43.502
was starting to feel worried because

00:01:43.759 --> 00:01:44.921
people were saying some real mean

00:01:44.927 --> 00:01:47.527
things about his son, but nobody

00:01:47.527 --> 00:01:50.043
was saying what I was thinking.

00:01:50.433 --> 00:01:52.314
I feel like I know exactly what happened

00:01:52.314 --> 00:01:53.696
here, because I was in the exact

00:01:53.698 --> 00:01:55.679
same situation when I was a teenager.

00:01:55.839 --> 00:01:56.916
If you would have talked to my

00:01:56.917 --> 00:01:58.336
mom then, she would have been

00:01:58.359 --> 00:01:59.666
just like this worried dad.

00:01:59.667 --> 00:02:00.729
She would have told you that I’m

00:02:00.729 --> 00:02:02.261
the worst shopper in the world.

00:02:03.195 --> 00:02:06.066
Because I’m almost certain that what

00:02:06.079 --> 00:02:08.572
happened is he ate a full tub of

00:02:08.572 --> 00:02:10.412
ice cream on his way home and then

00:02:10.413 --> 00:02:12.531
lied and said he only bought one.

00:02:12.950 --> 00:02:13.906
I mean, it all adds up.

00:02:13.918 --> 00:02:15.345
The boy was hungry for ice cream

00:02:15.345 --> 00:02:16.719
before even leaving the house.

00:02:16.933 --> 00:02:18.405
There’s no way he’s gonna wait until

00:02:18.405 --> 00:02:19.993
he gets home to have his first bite.

00:02:20.459 --> 00:02:21.851
Grab a spoon at the store

00:02:21.851 --> 00:02:23.233
and start on your way home.

00:02:23.792 --> 00:02:26.102
Also imagine the look on his face

00:02:26.424 --> 00:02:28.167
when the clerk told him, you know you

00:02:28.167 --> 00:02:29.847
can get a second one for free, right?

00:02:30.268 --> 00:02:31.391
No way.

00:02:31.553 --> 00:02:33.253
Dang, this is my lucky day.

00:02:33.884 --> 00:02:36.089
So, he must have gotten two, and on his

00:02:36.089 --> 00:02:37.919
way home he started thinking, shoot,

00:02:37.962 --> 00:02:40.675
mom and dad don't know I got two.

00:02:40.677 --> 00:02:42.370
They only gave me enough money to get one.

00:02:42.761 --> 00:02:44.651
So, if I come back with one, they

00:02:44.652 --> 00:02:46.351
won't even know there was a second.

00:02:46.806 --> 00:02:47.905
So, if I could scarf this

00:02:47.911 --> 00:02:49.387
second tub down before I even

00:02:49.387 --> 00:02:51.909
get home, it would be glorious.

00:02:52.111 --> 00:02:53.024
No rules.

00:02:53.024 --> 00:02:54.058
No regulations.

00:02:54.071 --> 00:02:55.001
No speed bumps.

00:02:55.001 --> 00:02:56.365
Just eat a whole tub of

00:02:56.367 --> 00:02:57.996
ice cream as fast as I can.

00:02:58.383 --> 00:02:59.749
Challenge accepted.

00:03:00.570 --> 00:03:02.799
I’ll tell you, teenage boys can crush

00:03:02.799 --> 00:03:05.034
a whole tub of ice cream real easy.

00:03:05.317 --> 00:03:06.219
They can make a dozen

00:03:06.220 --> 00:03:07.519
cookies vanish instantly.

00:03:07.520 --> 00:03:08.731
They have the power to inhale

00:03:08.732 --> 00:03:10.408
desserts like no one else can.

00:03:11.028 --> 00:03:12.919
The real tell here is that the dad on

00:03:12.919 --> 00:03:15.030
the Reddit post even said, we would never

00:03:15.030 --> 00:03:16.774
let him eat a whole tub in one sitting.

00:03:17.457 --> 00:03:19.770
That’s the thing; the boy had an

00:03:19.809 --> 00:03:22.302
unregulated container of ice cream,

00:03:22.854 --> 00:03:24.930
and he thought no one is gonna know.

00:03:25.201 --> 00:03:26.725
No one is gonna stop him from

00:03:26.729 --> 00:03:28.457
eating all this in one sitting.

00:03:29.053 --> 00:03:29.955
Let’s do it.

00:03:30.575 --> 00:03:32.839
So, he saw this as his big stroke of luck

00:03:32.840 --> 00:03:35.156
and secretly slurped it down, and then

00:03:35.308 --> 00:03:37.096
tried to lie about it when he got home by

00:03:37.097 --> 00:03:39.335
saying, no, no, I only got one, I swear.

00:03:40.288 --> 00:03:41.861
But little did he know the entirety

00:03:41.863 --> 00:03:43.660
of Reddit was gonna believe that lie.

00:03:44.303 --> 00:03:45.426
He’s probably okay with them

00:03:45.476 --> 00:03:46.982
calling him names and stuff, because

00:03:47.287 --> 00:03:50.091
being misunderstood isn't as bad

00:03:50.132 --> 00:03:52.152
as being caught in your lies.

00:03:52.430 --> 00:03:54.513
But I see you, kid.

00:03:54.865 --> 00:03:56.601
I’ve been in that same situation before.

00:03:56.609 --> 00:03:59.681
I’ve been in that situation many times.

00:03:59.930 --> 00:04:01.590
Two cupcakes I bought at

00:04:01.590 --> 00:04:03.829
the bake sale became one.

00:04:04.094 --> 00:04:05.415
Two chocolate bars from

00:04:05.416 --> 00:04:07.500
the fundraiser became one.

00:04:07.941 --> 00:04:09.690
Yeah, of course two ice creams from

00:04:09.691 --> 00:04:11.964
the ice cream truck became one, too.

00:04:12.575 --> 00:04:15.674
My mom could never understand why I would

00:04:15.676 --> 00:04:18.817
sometimes pay extra for a single cupcake.

00:04:18.978 --> 00:04:23.647
Intro: [Intro music] These

00:04:23.648 --> 00:04:24.794
are true stories from the

00:04:24.795 --> 00:04:26.314
dark side of the internet.

00:04:30.081 --> 00:04:31.538
I’m Jack Rhysider.

00:04:32.661 --> 00:04:34.403
This is Darknet Diaries.

00:04:34.403 --> 00:04:34.423
JACK: Imagine going

00:04:51.386 --> 00:04:53.771
to a high school baseball game in New

00:04:54.101 --> 00:04:54.405
Port Richey, which is near Tampa, Florida.

00:04:54.405 --> 00:04:54.444
You see one kid,

00:04:57.284 --> 00:04:58.486
a center-fielder, who’s absolutely

00:04:58.486 --> 00:05:02.024
tearing it up out there.

00:05:02.040 --> 00:05:04.264
He’s catching anything that comes his way.

00:05:04.264 --> 00:05:05.288
He’s got an arm like a rocket.

00:05:05.376 --> 00:05:07.361
He could hit anything thrown at him.

00:05:07.361 --> 00:05:08.899
He’s built like a tank but runs like the

00:05:08.899 --> 00:05:10.834
wind, and it just looks like he’s in a

00:05:10.854 --> 00:05:12.358
different league than the rest of those

00:05:12.360 --> 00:05:13.968
high school players on the baseball field.

00:05:14.176 --> 00:05:15.551
He’s eating them up.

00:05:15.786 --> 00:05:16.843
It’s like all the other kids

00:05:16.843 --> 00:05:18.100
are in a lower league than him,

00:05:18.424 --> 00:05:19.439
and they're just all playing

00:05:19.439 --> 00:05:20.871
in slow motion compared to him.

00:05:21.363 --> 00:05:24.186
You can tell this kid is the star.

00:05:24.832 --> 00:05:27.340
That is Ricky Handschumacher.

00:05:27.371 --> 00:05:28.596
RICKY: So, I played center field,

00:05:28.609 --> 00:05:31.299
but initially I was really known

00:05:31.301 --> 00:05:33.176
for getting on base, getting

00:05:33.179 --> 00:05:35.328
hits, and then stealing bases.

00:05:36.212 --> 00:05:37.515
JACK: Stealing bases.

00:05:38.015 --> 00:05:38.174
RICKY: Yeah.

00:05:38.174 --> 00:05:39.472
JACK: Is this where all this starts?

00:05:39.722 --> 00:05:40.352
This is where all of it

00:05:40.354 --> 00:05:41.984
starts, stealing bases.

00:05:42.426 --> 00:05:43.679
RICKY: Coincidentally, yeah.

00:05:44.061 --> 00:05:45.044
JACK: But were computers

00:05:45.044 --> 00:05:46.513
interesting to you or not at all?

00:05:47.117 --> 00:05:48.609
RICKY: No, I was your gamer, you know?

00:05:48.609 --> 00:05:51.982
Like I said, I wasn't your average nerdy

00:05:52.010 --> 00:05:54.180
kinda guy who’s antisocial or anything.

00:05:54.644 --> 00:05:55.926
I was always out with my friends.

00:05:55.926 --> 00:05:57.433
I was always out on the streets playing

00:05:57.433 --> 00:05:59.400
sports; you know, football, baseball,

00:05:59.413 --> 00:06:01.524
basketball with all my friends.

00:06:01.793 --> 00:06:03.090
Like, Friday night and Saturday

00:06:03.090 --> 00:06:04.632
night I would go roller skating.

00:06:04.899 --> 00:06:07.104
So, I was never like, home, but I

00:06:07.104 --> 00:06:09.500
did have a passion for actual gaming.

00:06:10.170 --> 00:06:10.490
JACK: Alright.

00:06:10.508 --> 00:06:11.656
So, let’s talk about gaming.

00:06:12.096 --> 00:06:13.223
What was your game of choice?

00:06:13.953 --> 00:06:16.990
RICKY: Halo 3 was my primary game.

00:06:21.671 --> 00:06:22.339
JACK: [Halo sound effects] In

00:06:22.339 --> 00:06:24.396
2010, fifteen-year-old Ricky

00:06:24.529 --> 00:06:26.485
is up late on a school night.

00:06:26.762 --> 00:06:29.139
His headphones are tuned in as he plays

00:06:29.147 --> 00:06:32.022
Halo 3 on his Xbox that’s humming away.

00:06:32.580 --> 00:06:33.818
Ricky doesn't want to disturb his

00:06:33.818 --> 00:06:35.337
mom, who’s sleeping in the other room.

00:06:35.834 --> 00:06:37.790
On his glowing TV screen he’s trying

00:06:37.791 --> 00:06:40.023
to escape what looks like a war zone.

00:06:43.024 --> 00:06:44.406
He’s destroying all the

00:06:44.406 --> 00:06:45.647
other players in the game.

00:06:45.894 --> 00:06:46.467
RICKY: I was good.

00:06:46.711 --> 00:06:49.500
So, I was always playing MLG and Team

00:06:49.502 --> 00:06:51.184
Slayer and all the ranked playlists

00:06:51.362 --> 00:06:52.818
against the pros and everything like that.

00:06:53.255 --> 00:06:55.514
Then, of course, naturally once you

00:06:55.514 --> 00:06:56.718
get to that level, there’s people

00:06:56.718 --> 00:06:57.898
who cheat on there and stuff.

00:06:58.402 --> 00:07:00.188
I was a high rank, but cheaters

00:07:00.194 --> 00:07:01.533
get high ranks, too, naturally

00:07:01.533 --> 00:07:02.378
because they're just cheating.

00:07:02.723 --> 00:07:04.300
So, it kept happening to me.

00:07:04.724 --> 00:07:06.328
JACK: People would go up against

00:07:06.328 --> 00:07:08.034
Ricky and see that they can't beat

00:07:08.034 --> 00:07:11.498
him, so they decided to cheat to win.

00:07:11.837 --> 00:07:12.753
He didn't know what

00:07:12.753 --> 00:07:13.811
was happening at first.

00:07:13.811 --> 00:07:16.756
RICKY: [Music] My screen would just

00:07:16.758 --> 00:07:19.308
go blank and then they would stop

00:07:19.310 --> 00:07:20.782
the attack when the game was over,

00:07:20.784 --> 00:07:22.868
which means they’d just win by default

00:07:22.875 --> 00:07:24.320
pretty much, 'cause we can't even move.

00:07:24.587 --> 00:07:25.472
Or if they hit you hard

00:07:25.472 --> 00:07:27.152
enough, we actually — our whole

00:07:27.152 --> 00:07:28.046
internet would just go out.

00:07:28.318 --> 00:07:29.216
I was with my mom.

00:07:29.219 --> 00:07:30.634
She’s like, why is the internet out?

00:07:31.159 --> 00:07:32.042
So, I had to play stupid.

00:07:32.044 --> 00:07:32.972
Like, I have no idea.

00:07:33.501 --> 00:07:34.423
I don't know what's happening.

00:07:34.803 --> 00:07:36.355
JACK: I’ve been in a similar situation.

00:07:36.367 --> 00:07:38.528
I remember the days when we had a family

00:07:38.529 --> 00:07:40.480
computer, and I downloaded a lot of

00:07:40.480 --> 00:07:42.088
random stuff and installed it on there.

00:07:42.745 --> 00:07:43.756
Time and time again I

00:07:43.757 --> 00:07:44.829
would break our computer.

00:07:45.257 --> 00:07:46.551
I didn't want to get in trouble,

00:07:46.553 --> 00:07:47.814
so I would try real hard to

00:07:47.814 --> 00:07:49.474
fix it before anyone noticed.

00:07:49.837 --> 00:07:51.197
Because of that, I got really good

00:07:51.197 --> 00:07:53.196
at detecting viruses and malware

00:07:53.196 --> 00:07:54.888
and fixing it on the family PC.

00:07:55.385 --> 00:07:57.287
But for Ricky, he was on an Xbox, and

00:07:57.287 --> 00:07:59.247
when he’d play, the internet would go

00:07:59.248 --> 00:08:00.979
down in the whole house, and it was

00:08:00.980 --> 00:08:02.311
just him and his mom living there.

00:08:02.473 --> 00:08:04.284
His dad left the picture a long time ago.

00:08:04.662 --> 00:08:05.933
But strangely, this

00:08:05.950 --> 00:08:07.384
pattern kept happening.

00:08:07.427 --> 00:08:09.902
When he would play Halo 3 against other

00:08:09.902 --> 00:08:12.574
players, the internet would go out.

00:08:12.936 --> 00:08:15.176
The game would disconnect, and then

00:08:15.178 --> 00:08:16.638
when he would finally get back on,

00:08:16.904 --> 00:08:18.784
he would see that he lost the match.

00:08:19.027 --> 00:08:20.030
RICKY: It happened to me again

00:08:20.030 --> 00:08:20.996
and again, and I’m like, alright.

00:08:21.670 --> 00:08:23.734
Then through the — through word

00:08:23.736 --> 00:08:25.140
of mouth I was like, oh, if

00:08:25.140 --> 00:08:26.748
they're DDoSing us, like, okay.

00:08:27.058 --> 00:08:28.236
So, I’m like, what the hell is that?

00:08:28.478 --> 00:08:29.647
I was getting DDoSed attacked

00:08:29.849 --> 00:08:30.756
over and over and over.

00:08:31.108 --> 00:08:32.536
JACK: Alright, so they somehow

00:08:32.538 --> 00:08:33.913
discovered your IP and then they

00:08:33.913 --> 00:08:36.126
attacked your IP, and that was enough

00:08:36.137 --> 00:08:38.111
to knock you offline and lose the game.

00:08:39.158 --> 00:08:39.731
RICKY: Yeah, and that’s

00:08:39.732 --> 00:08:40.900
kinda where it all started.

00:08:40.900 --> 00:08:43.669
Then curiosity — I was like,

00:08:44.000 --> 00:08:45.140
okay, how are they doing this?

00:08:45.473 --> 00:08:46.723
JACK: Remember, outside of gaming

00:08:46.754 --> 00:08:48.384
Ricky is not a computer guy.

00:08:48.682 --> 00:08:50.425
He doesn't know what's going on at all.

00:08:50.439 --> 00:08:52.053
So, he just turns his Xbox off

00:08:52.321 --> 00:08:54.235
and jumps on the family PC and

00:08:54.290 --> 00:08:55.887
starts trying to look for answers.

00:08:56.341 --> 00:08:57.117
RICKY: I started browsing some

00:08:57.117 --> 00:08:58.675
forums, and I was like, okay,

00:08:58.675 --> 00:08:59.790
it’s called DDoSing attacks.

00:08:59.790 --> 00:09:00.778
So, I started looking that up.

00:09:00.803 --> 00:09:02.838
I’m like, hm, okay, seems pretty simple.

00:09:03.444 --> 00:09:04.215
There’s a bunch of different

00:09:04.215 --> 00:09:05.764
kind of booters, like an IRC

00:09:05.765 --> 00:09:07.377
booter or a putty booter.

00:09:07.678 --> 00:09:08.607
You could just — or you could just

00:09:08.607 --> 00:09:10.790
go online to a website and use that

00:09:10.790 --> 00:09:12.987
booter, which was less powerful,

00:09:13.390 --> 00:09:15.357
but it would get the job done.

00:09:15.449 --> 00:09:16.712
I browsed the forums, found out what

00:09:16.713 --> 00:09:18.895
it was, downloaded the programs myself.

00:09:18.895 --> 00:09:19.875
So, I was like, okay, well, if they do

00:09:19.875 --> 00:09:21.060
it to me, I’m gonna do it back to them.

00:09:21.443 --> 00:09:22.630
JACK: Eventually he gets

00:09:22.632 --> 00:09:23.461
to the bottom of it.

00:09:23.619 --> 00:09:26.840
He discovers a whole world of ddossers

00:09:26.851 --> 00:09:29.312
and booters and punters and griefers who

00:09:29.313 --> 00:09:31.801
use malware to attack other players in

00:09:31.801 --> 00:09:35.089
the game to make them lose so you can win.

00:09:35.920 --> 00:09:37.367
Ricky decided, well,

00:09:37.378 --> 00:09:39.293
hey, I want to win, too.

00:09:39.598 --> 00:09:40.503
I want to try.

00:09:40.512 --> 00:09:42.512
[Music] So, he downloads a tool.

00:09:42.752 --> 00:09:44.659
He says it was Cain & Abel, and decides

00:09:44.659 --> 00:09:46.529
to try to use it to attack other players.

00:09:46.801 --> 00:09:48.947
He started a match, ran the tool to

00:09:48.971 --> 00:09:51.672
disconnect another player, then bingo;

00:09:51.749 --> 00:09:54.206
he sees they just freeze in the game

00:09:54.540 --> 00:09:56.425
and he can easily kill them, and he

00:09:56.427 --> 00:09:59.244
wins the match with almost zero effort.

00:09:59.686 --> 00:10:01.341
This was way easier than

00:10:01.350 --> 00:10:02.624
actually playing by the rules.

00:10:02.772 --> 00:10:03.573
RICKY: That’s kinda where I

00:10:03.710 --> 00:10:04.999
got introduced to that world.

00:10:05.045 --> 00:10:06.279
JACK: Yeah, so, at that point you

00:10:06.280 --> 00:10:08.614
were really competitive in baseball,

00:10:08.627 --> 00:10:10.325
you were really competitive at Halo.

00:10:10.677 --> 00:10:12.104
I just wonder, 'cause you had a sense

00:10:12.105 --> 00:10:14.139
of pride, of ranking up on your own and

00:10:14.366 --> 00:10:16.114
being competitive in sports — and where’d

00:10:16.125 --> 00:10:17.749
that sense of pride go with cheating?

00:10:18.796 --> 00:10:19.194
RICKY: I don't know.

00:10:19.194 --> 00:10:20.510
I just let it take over, pretty much.

00:10:20.511 --> 00:10:21.374
I was like, well, this is

00:10:21.375 --> 00:10:22.683
easier than actually trying.

00:10:23.224 --> 00:10:24.770
JACK: Yeah, but that’s

00:10:24.781 --> 00:10:26.785
not the sportsmanlike way.

00:10:26.840 --> 00:10:27.237
RICKY: Yeah.

00:10:28.774 --> 00:10:29.222
I don't know.

00:10:29.595 --> 00:10:30.642
I just took the easy way

00:10:30.642 --> 00:10:31.638
out and got the advantage.

00:10:31.638 --> 00:10:32.333
JACK: Were you cheating in sports at all?

00:10:34.419 --> 00:10:35.951
RICKY: No, that I was not cheating in.

00:10:37.553 --> 00:10:39.008
JACK: Alright.

00:10:39.008 --> 00:10:40.455
RICKY: No, I was naturally good.

00:10:41.430 --> 00:10:41.907
JACK: Yeah, well, you were

00:10:41.907 --> 00:10:42.998
naturally good at Halo, too.

00:10:43.016 --> 00:10:44.877
You were in MLG and all that stuff.

00:10:45.212 --> 00:10:46.792
RICKY: Yeah, I don't know.

00:10:46.836 --> 00:10:50.196
JACK: [Music] Who would have

00:10:50.219 --> 00:10:51.891
thought that this innocent little

00:10:51.892 --> 00:10:53.895
victory in Halo was going to lead

00:10:53.895 --> 00:10:56.219
Ricky down a long, dark path?

00:10:56.569 --> 00:10:58.655
From here he tried more Halo

00:10:58.656 --> 00:11:00.318
cheats like wall glitches, fast

00:11:00.329 --> 00:11:01.992
travel, reduced hitbox, and more.

00:11:02.183 --> 00:11:02.948
It was fun.

00:11:03.019 --> 00:11:05.400
This was the new game, not to compete

00:11:05.404 --> 00:11:07.698
competitively in Halo but to get around

00:11:07.699 --> 00:11:10.002
the game rules, to do things you weren’t

00:11:10.007 --> 00:11:13.026
supposed to, to be a god in the game.

00:11:13.300 --> 00:11:14.959
It gave him a sense of power.

00:11:14.964 --> 00:11:16.365
He saw the game differently now.

00:11:16.368 --> 00:11:17.805
He stopped seeing things on the screen

00:11:17.808 --> 00:11:20.087
like Covenant and Banshees and Needlers.

00:11:20.343 --> 00:11:22.868
Now he was seeing bytes and ones and

00:11:22.868 --> 00:11:25.182
zeros and the data behind the game,

00:11:25.360 --> 00:11:28.114
which gave him an incredible win streak.

00:11:28.458 --> 00:11:30.234
You know, the type of win streaks that

00:11:30.235 --> 00:11:32.297
you just have to take a screenshot of

00:11:32.297 --> 00:11:34.086
so that you can look back at from time

00:11:34.087 --> 00:11:36.483
to time and remember those matches.

00:11:37.154 --> 00:11:39.413
But even being a god can get boring

00:11:39.416 --> 00:11:41.186
after a while, and even though he was

00:11:41.187 --> 00:11:43.056
the winner in those screenshots of his,

00:11:43.204 --> 00:11:45.507
he would notice that some people seemed

00:11:45.507 --> 00:11:47.579
to be even cooler than him somehow.

00:11:48.050 --> 00:11:50.065
Everyone looks the same in Halo 3.

00:11:50.066 --> 00:11:51.633
You're all the same player, Master Chief.

00:11:51.865 --> 00:11:52.850
It’s just, everyone has a

00:11:52.851 --> 00:11:53.833
slightly different color.

00:11:54.322 --> 00:11:56.021
But there’s one thing that sets

00:11:56.021 --> 00:11:58.113
you apart from everyone else; your

00:11:58.114 --> 00:12:00.760
name, specifically your gamer tag.

00:12:01.189 --> 00:12:02.646
These are special, actually.

00:12:02.656 --> 00:12:03.423
They're unique.

00:12:03.531 --> 00:12:04.589
There’s only one person in

00:12:04.589 --> 00:12:06.293
the world with your gamer tag.

00:12:06.791 --> 00:12:08.514
Some people call themselves cool

00:12:08.514 --> 00:12:09.786
things like Shadow Strike or

00:12:09.786 --> 00:12:11.445
Nebula Storm or Blade of Odin.

00:12:11.825 --> 00:12:13.603
Fine, but what about that

00:12:13.604 --> 00:12:16.136
guy that’s just called Wolf?

00:12:16.575 --> 00:12:18.393
How did he get that name, Wolf?

00:12:18.604 --> 00:12:20.759
Now that is fricking cool.

00:12:21.355 --> 00:12:22.464
Well, it’s a first-come,

00:12:22.470 --> 00:12:23.389
first-serve kinda thing.

00:12:23.389 --> 00:12:25.301
So, Wolf must have made that gamer tag

00:12:25.685 --> 00:12:27.905
a long time ago when Xbox Live was first

00:12:27.908 --> 00:12:30.358
created, when gamer tags first came out.

00:12:30.499 --> 00:12:31.852
They probably made the name in the

00:12:31.853 --> 00:12:33.319
first week or maybe even the first

00:12:33.333 --> 00:12:36.063
day, which makes them OG, right?

00:12:36.460 --> 00:12:37.996
But instead of Original Gangster,

00:12:38.124 --> 00:12:39.262
they're the Original Gamer.

00:12:39.789 --> 00:12:41.032
Ricky wanted one of these

00:12:41.032 --> 00:12:43.218
short, cool gamer tags.

00:12:43.673 --> 00:12:45.700
That would really set him apart from the

00:12:45.713 --> 00:12:47.758
other normies playing in the game by the

00:12:47.758 --> 00:12:50.290
rules, but all the good names were taken.

00:12:50.904 --> 00:12:52.241
So, he goes back online into the

00:12:52.241 --> 00:12:53.569
hack forums and starts looking to

00:12:53.569 --> 00:12:55.323
see, how do you get one of these?

00:12:55.521 --> 00:12:57.026
It turns out there’s a whole

00:12:57.050 --> 00:12:58.633
underground marketplace of people

00:12:58.647 --> 00:13:01.255
buying and selling Xbox gamer tags,

00:13:01.464 --> 00:13:02.709
but not in the way you might think.

00:13:03.351 --> 00:13:05.169
See, a typical online market, you'll

00:13:05.170 --> 00:13:07.186
see people selling things that they've

00:13:07.193 --> 00:13:08.742
had for a long time or something

00:13:08.742 --> 00:13:09.837
that they've bought from someone

00:13:09.837 --> 00:13:11.238
else or something they made, right?

00:13:11.589 --> 00:13:13.371
But this was an underground

00:13:13.383 --> 00:13:14.905
hack forums marketplace.

00:13:15.010 --> 00:13:16.248
It operates differently.

00:13:16.449 --> 00:13:18.332
These gamer tags weren't ones that

00:13:18.332 --> 00:13:20.016
sellers were sitting on for a while.

00:13:20.290 --> 00:13:23.358
No, all these gamer tags were stolen.

00:13:23.983 --> 00:13:25.098
When Ricky found that

00:13:25.118 --> 00:13:27.015
out, he leaned in closer.

00:13:27.245 --> 00:13:30.015
How do you steal a gamer tag?

00:13:30.400 --> 00:13:31.867
Well, there are a few ways, but the

00:13:31.870 --> 00:13:33.183
easiest is just to get someone’s

00:13:33.200 --> 00:13:34.690
password and username and take over

00:13:34.690 --> 00:13:35.911
their account, change their password,

00:13:35.911 --> 00:13:37.998
and now that gamer tag is yours.

00:13:38.548 --> 00:13:40.863
But getting someone’s password is tricky.

00:13:41.110 --> 00:13:43.249
Maybe an easier way to get it is

00:13:43.251 --> 00:13:45.233
to trick Microsoft that you're

00:13:45.236 --> 00:13:47.042
the actual owner of the account

00:13:47.372 --> 00:13:49.165
and you just lost the password.

00:13:49.651 --> 00:13:51.343
Ricky saw some people were doing

00:13:51.343 --> 00:13:53.318
that and decided to try it himself.

00:13:53.693 --> 00:13:55.137
RICKY: There was a company called Zune,

00:13:55.162 --> 00:13:57.367
which is like Microsoft’s music app.

00:13:58.810 --> 00:14:00.434
Come to find out what you could do is

00:14:00.434 --> 00:14:03.156
you could call up Zune, and then halfway

00:14:03.156 --> 00:14:04.531
through the call you just tell them your

00:14:04.535 --> 00:14:06.353
gamer tag that you're targeting, and you

00:14:06.353 --> 00:14:10.127
say, okay, hey, my gamer tag is Jack.

00:14:11.574 --> 00:14:12.755
Then you just stop the conversation

00:14:12.756 --> 00:14:14.525
and be like, I have to go real fast.

00:14:14.525 --> 00:14:15.437
I’ll call back.

00:14:15.771 --> 00:14:16.903
JACK: Before hanging up, though,

00:14:17.165 --> 00:14:18.643
Zune support would give Ricky

00:14:18.678 --> 00:14:20.014
a reference number for the

00:14:20.015 --> 00:14:21.358
case that they were working on.

00:14:21.752 --> 00:14:23.701
Then he’d hang up and call a different

00:14:23.707 --> 00:14:26.108
number, Xbox Support this time,

00:14:26.506 --> 00:14:28.160
and they'd say, how can I help you?

00:14:28.188 --> 00:14:29.295
He’d say, oh, well, I was

00:14:29.295 --> 00:14:30.305
on a call but it dropped.

00:14:30.472 --> 00:14:31.740
I have a reference number if you

00:14:31.740 --> 00:14:33.095
want to pull the case details up.

00:14:33.540 --> 00:14:34.391
RICKY: Correct, yeah.

00:14:34.489 --> 00:14:35.674
You'd just simply say, yo,

00:14:35.675 --> 00:14:36.572
I have a reference number.

00:14:36.949 --> 00:14:37.997
Can you pull up my case?

00:14:38.317 --> 00:14:39.454
Then they would just give you the

00:14:39.454 --> 00:14:41.361
information right then and there.

00:14:41.457 --> 00:14:42.528
There was no questions asked.

00:14:42.586 --> 00:14:43.345
JACK: Ah, interesting.

00:14:43.346 --> 00:14:45.327
So, it’s almost like a bypass

00:14:45.327 --> 00:14:47.290
of a verbal authentication.

00:14:47.303 --> 00:14:50.065
So, then when you call Xbox and say,

00:14:50.096 --> 00:14:51.300
I have this reference number, then

00:14:51.301 --> 00:14:52.789
they give you the e-mail address.

00:14:53.242 --> 00:14:53.277
RICKY: Yep.

00:14:53.442 --> 00:14:53.987
JACK: Then you say, can

00:14:53.990 --> 00:14:55.175
you reset the password?

00:14:55.832 --> 00:14:56.043
RICKY: You would just be like,

00:14:56.044 --> 00:14:57.270
hey, yeah, here's my reference

00:14:57.270 --> 00:14:59.084
number — validate the account.

00:14:59.410 --> 00:15:00.622
Then just — you could just

00:15:00.622 --> 00:15:01.714
literally ask them, hey, what's

00:15:01.714 --> 00:15:03.606
the e-mail that I have on file?

00:15:03.622 --> 00:15:04.469
They'd read it off to you.

00:15:05.353 --> 00:15:06.274
JACK: How do you get the password?

00:15:06.872 --> 00:15:08.538
RICKY: Okay, so, back in the day AOL and

00:15:08.539 --> 00:15:10.491
Yahoo were your most popular domains.

00:15:10.752 --> 00:15:14.084
What's their proof of ownership of an

00:15:14.084 --> 00:15:16.161
account of an e-mail, was literally — AOL

00:15:16.164 --> 00:15:17.771
was like, your billing zip code would

00:15:17.772 --> 00:15:19.351
verify the account, and then they would

00:15:19.361 --> 00:15:20.623
be able to reset the password for you.

00:15:21.060 --> 00:15:21.830
Same with Yahoo.

00:15:22.391 --> 00:15:23.991
I think Yahoo was security questions,

00:15:24.241 --> 00:15:28.090
which back in the day was terrible because

00:15:28.107 --> 00:15:30.138
people would — a lot of the time chicken

00:15:30.141 --> 00:15:31.464
or pizza would be your favorite food that

00:15:31.464 --> 00:15:33.784
people would put, and stuff like that.

00:15:34.125 --> 00:15:36.845
So, they were pretty much takeable.

00:15:37.225 --> 00:15:38.023
JACK: See, that’s the thing that

00:15:38.024 --> 00:15:40.465
amazes me about these teenage hackers.

00:15:40.712 --> 00:15:41.859
They see the world differently

00:15:41.859 --> 00:15:44.358
than us, kinda like when you

00:15:44.358 --> 00:15:46.201
see motorcycles lane-splitting.

00:15:46.201 --> 00:15:47.550
You ever get stuck on a highway and

00:15:47.550 --> 00:15:48.721
there’s bumper-to-bumper traffic and

00:15:48.724 --> 00:15:50.015
you're standing still in your car

00:15:50.479 --> 00:15:52.598
and a motorcycle comes zooming past

00:15:52.598 --> 00:15:54.228
you right in-between the two lanes?

00:15:54.665 --> 00:15:56.320
You're like, come on.

00:15:56.540 --> 00:15:57.952
The motorcycle rider just looks back

00:15:57.952 --> 00:15:59.628
at you like you're a chump waiting

00:15:59.628 --> 00:16:01.140
in traffic like everyone else.

00:16:01.611 --> 00:16:03.123
They just whiz by like there’s

00:16:03.136 --> 00:16:04.613
no cars on the highway at all.

00:16:05.092 --> 00:16:07.483
These teenage hackers find ways through

00:16:07.487 --> 00:16:09.857
roadblocks that we just don't see.

00:16:10.135 --> 00:16:11.353
Like, you don't need someone’s

00:16:11.396 --> 00:16:13.300
password when the password reset

00:16:13.302 --> 00:16:14.848
question is ‘What's your favorite

00:16:14.848 --> 00:16:16.900
food?’ and you put ‘pizza’ up there.

00:16:17.317 --> 00:16:18.300
Now anyone can just write

00:16:18.303 --> 00:16:19.319
‘pizza’ on there, and they could

00:16:19.321 --> 00:16:20.708
reset your password for you.

00:16:20.997 --> 00:16:22.218
It’s like, come on, what's

00:16:22.218 --> 00:16:23.425
the point of passwords if they

00:16:23.425 --> 00:16:24.997
could just be bypassed so easy?

00:16:25.632 --> 00:16:27.379
Sometimes it would try to validate it’s

00:16:27.382 --> 00:16:29.657
really you by asking for your zip code.

00:16:30.019 --> 00:16:31.947
Well, if you have their e-mail address,

00:16:31.950 --> 00:16:33.644
it’s not too hard to use some kind

00:16:33.645 --> 00:16:35.958
of people search tool online to look

00:16:35.989 --> 00:16:37.490
to see what someone’s zip code is.

00:16:37.826 --> 00:16:38.994
You and I don't think like

00:16:38.995 --> 00:16:40.255
that, though, but Ricky does.

00:16:40.266 --> 00:16:41.700
He’s the kind of guy that looks at

00:16:41.700 --> 00:16:43.348
us like we’re chumps for choosing

00:16:43.349 --> 00:16:45.099
an easy password recovery question.

00:16:45.558 --> 00:16:47.247
This was all happening in 2012,

00:16:47.462 --> 00:16:49.356
and Ricky was sixteen years old

00:16:49.448 --> 00:16:51.718
when he stole his first gamer tag.

00:16:53.207 --> 00:16:54.462
[Music] He found the one

00:16:54.496 --> 00:16:56.295
he wanted, Wolverine.

00:16:56.589 --> 00:16:58.194
Yeah, that sounds cool.

00:16:58.479 --> 00:16:59.891
He wasn't an X-Men fan; he

00:16:59.891 --> 00:17:01.068
just liked the sound of it.

00:17:01.488 --> 00:17:03.141
So, he called up Zune support, which

00:17:03.142 --> 00:17:05.172
is a Microsoft product, and is like,

00:17:05.308 --> 00:17:06.609
I have a problem with my account.

00:17:06.884 --> 00:17:08.395
They ask him for his e-mail address

00:17:08.395 --> 00:17:09.433
associated with the account.

00:17:09.719 --> 00:17:11.230
He says, well, I don't know.

00:17:11.914 --> 00:17:13.940
Can you just look up my Xbox gamer tag?

00:17:14.096 --> 00:17:14.954
They said, you know what?

00:17:14.959 --> 00:17:15.344
That works.

00:17:15.345 --> 00:17:16.204
What's your gamer tag?

00:17:16.482 --> 00:17:17.802
Ricky says, Wolverine.

00:17:18.271 --> 00:17:20.385
Zune support says, ah, yes, I see your

00:17:20.385 --> 00:17:21.835
account, sir. What can I help you with?

00:17:22.259 --> 00:17:24.269
Ricky says, okay, well, the problem

00:17:24.270 --> 00:17:25.902
is that when — you know what?

00:17:25.915 --> 00:17:27.630
Actually hold on; something just came up.

00:17:27.630 --> 00:17:28.515
Can I call you right back?

00:17:29.113 --> 00:17:30.713
Zune support says, yeah, sure.

00:17:30.757 --> 00:17:31.533
Do you want a reference

00:17:31.534 --> 00:17:32.464
number for when you call back?

00:17:32.467 --> 00:17:33.170
It’ll be easier for us

00:17:33.170 --> 00:17:33.996
to find your details.

00:17:34.410 --> 00:17:37.928
Ricky says, yes, yes, I do want that.

00:17:38.670 --> 00:17:40.823
He hangs up, and then he calls Xbox

00:17:40.831 --> 00:17:43.582
Support this time, and tells them, I was

00:17:43.583 --> 00:17:45.160
on with support but I got disconnected.

00:17:45.160 --> 00:17:46.197
Can you look up my case if I

00:17:46.197 --> 00:17:47.237
give you a reference number?

00:17:47.629 --> 00:17:48.855
They said, yeah, go ahead.

00:17:49.386 --> 00:17:50.505
He reads the number to them,

00:17:50.698 --> 00:17:51.962
and they see his details.

00:17:52.457 --> 00:17:55.164
Xbox Support’s mode of operation then

00:17:55.408 --> 00:17:57.051
was that if someone had a reference

00:17:57.052 --> 00:17:58.882
number, they must have already

00:17:58.905 --> 00:18:01.206
verified they are the account holder.

00:18:01.521 --> 00:18:03.403
So, they ask him, what's the problem?

00:18:03.458 --> 00:18:04.311
How can I help you?

00:18:04.520 --> 00:18:06.617
Ricky says, I just forgot what e-mail

00:18:06.617 --> 00:18:08.024
address I used for this account.

00:18:08.399 --> 00:18:09.342
He makes up some story

00:18:09.342 --> 00:18:10.542
about why he can't remember.

00:18:10.688 --> 00:18:12.094
He happened to be a good liar.

00:18:12.557 --> 00:18:13.591
Maybe it was that he got a

00:18:13.591 --> 00:18:14.763
new computer and didn't have

00:18:14.764 --> 00:18:15.943
those details on his new one.

00:18:16.389 --> 00:18:18.017
Xbox Support thinks, you know what?

00:18:18.017 --> 00:18:19.102
This is a harmless request.

00:18:19.106 --> 00:18:19.588
Sure.

00:18:19.619 --> 00:18:20.891
Your e-mail address is

00:18:21.195 --> 00:18:23.051
blahblahblah@aol.com.

00:18:23.439 --> 00:18:24.445
Great, he says.

00:18:24.610 --> 00:18:26.073
That’s all I wanted, and he hangs up.

00:18:27.569 --> 00:18:29.313
Now he has an e-mail address

00:18:29.369 --> 00:18:31.474
associated with that gamer tag.

00:18:31.939 --> 00:18:33.605
All he needs now is the password.

00:18:33.911 --> 00:18:35.426
Trying to get the password for an

00:18:35.438 --> 00:18:37.148
Xbox account is tricky, though.

00:18:37.684 --> 00:18:40.180
So, he has a better solution; try to reset

00:18:40.182 --> 00:18:43.493
the password on aol.com’s e-mail address.

00:18:44.068 --> 00:18:46.043
Once in there, he can reset the Xbox

00:18:46.051 --> 00:18:48.468
account and get control of that gamer tag.

00:18:48.872 --> 00:18:50.771
This is where he uses different tricks

00:18:50.781 --> 00:18:53.367
to get into an AOL account, by telling

00:18:53.368 --> 00:18:55.641
the website, I forgot my password,

00:18:55.717 --> 00:18:57.869
and it asking for his favorite food

00:18:57.936 --> 00:18:59.966
or zip code to verify it’s him.

00:19:00.747 --> 00:19:01.986
From there, bingo.

00:19:02.357 --> 00:19:04.282
He can now access the e-mail account

00:19:04.539 --> 00:19:06.022
and reset the password for that

00:19:06.034 --> 00:19:08.751
Microsoft gamer tag and get into it.

00:19:09.232 --> 00:19:12.380
This is how he became Wolverine.

00:19:13.789 --> 00:19:14.868
RICKY: Yeah, I thought it was cool,

00:19:14.914 --> 00:19:16.355
like a cool alias to have, and

00:19:16.356 --> 00:19:17.895
that was the first one I ever took.

00:19:17.896 --> 00:19:18.975
So, I was like, you know what?

00:19:19.070 --> 00:19:19.830
That’s what it is.

00:19:20.138 --> 00:19:21.403
JACK: So, Wolverine.

00:19:22.290 --> 00:19:22.693
RICKY: Yeah.

00:19:23.014 --> 00:19:24.087
So, that’s my alias.

00:19:24.562 --> 00:19:25.868
JACK: Ricky didn't have steel

00:19:25.868 --> 00:19:27.086
claws like Wolverine did.

00:19:27.086 --> 00:19:28.078
His weapons were his

00:19:28.080 --> 00:19:29.532
keyboard and telephone.

00:19:29.948 --> 00:19:31.441
Once Ricky got his first taste of

00:19:31.441 --> 00:19:33.763
stealing a gamer tag, he wanted more.

00:19:34.032 --> 00:19:35.368
He went back to that marketplace

00:19:35.370 --> 00:19:36.314
on hack forums where people

00:19:36.314 --> 00:19:37.475
were selling gamer tags.

00:19:37.815 --> 00:19:38.805
People were selling things like

00:19:38.815 --> 00:19:41.371
Gang or Spirit or Booty or Boss

00:19:41.683 --> 00:19:43.373
for a few hundred bucks each.

00:19:43.856 --> 00:19:46.517
Ricky started stealing gamer tags

00:19:46.562 --> 00:19:48.695
and then selling them for money on

00:19:48.698 --> 00:19:50.952
the site, for Bitcoin specifically.

00:19:51.116 --> 00:19:52.439
He started making some money

00:19:52.439 --> 00:19:53.827
off this, not bad money, either.

00:19:54.043 --> 00:19:55.249
A couple good gamer tags

00:19:55.435 --> 00:19:57.267
might sell for around $1,000.

00:19:57.548 --> 00:19:59.223
But many were just a few hundred bucks.

00:19:59.405 --> 00:20:00.459
He’d play with them, too,

00:20:00.486 --> 00:20:01.585
just to dunk on people.

00:20:01.703 --> 00:20:03.414
He’d log in with a stolen gamer tag,

00:20:03.453 --> 00:20:05.364
totally pwn some other players in Halo 3

00:20:05.364 --> 00:20:07.169
by knocking them offline with some DDoS

00:20:07.201 --> 00:20:08.794
attack, and then just laugh at it all.

00:20:09.450 --> 00:20:11.353
But sometimes people would report

00:20:11.354 --> 00:20:13.601
him for abuse, and this would bring

00:20:13.603 --> 00:20:15.342
the party to a screeching halt.

00:20:16.136 --> 00:20:17.279
RICKY: I thought it was funny just to

00:20:17.305 --> 00:20:19.187
hit them offline and stuff like that.

00:20:20.142 --> 00:20:22.346
But eventually you just get banned.

00:20:22.365 --> 00:20:24.452
Like, back then Xbox was big

00:20:24.452 --> 00:20:26.449
on just banning your accounts

00:20:26.450 --> 00:20:27.724
and stuff for DDoS attacks.

00:20:28.065 --> 00:20:29.311
So, I would just get banned

00:20:29.311 --> 00:20:31.541
over and over, which then led

00:20:31.543 --> 00:20:33.370
to my consoles being banned.

00:20:33.779 --> 00:20:36.190
So, I was always at GameStop and

00:20:36.190 --> 00:20:37.952
whatnot just trading in consoles

00:20:38.052 --> 00:20:39.556
for new consoles and selling my

00:20:39.567 --> 00:20:41.073
banned consoles and stuff like that.

00:20:41.137 --> 00:20:42.370
JACK: He told me this happened over

00:20:42.371 --> 00:20:43.963
a dozen times, and he would just

00:20:43.963 --> 00:20:45.776
keep selling banned Xboxes at the

00:20:45.776 --> 00:20:47.964
same GameStop, and then go to another

00:20:47.964 --> 00:20:49.497
one across town and buy another.

00:20:50.100 --> 00:20:51.207
I just can't believe that they

00:20:51.208 --> 00:20:53.914
didn't catch on to him for constantly

00:20:53.916 --> 00:20:55.501
selling them banned Xboxes.

00:20:55.788 --> 00:20:57.323
RICKY: They would plug it in to make sure

00:20:57.324 --> 00:21:00.466
it turned on, which was fine with me,

00:21:00.877 --> 00:21:02.344
but they never checked like — connected

00:21:02.346 --> 00:21:03.793
to Xbox Live and stuff like that.

00:21:03.994 --> 00:21:06.084
JACK: He would do this again and again.

00:21:06.243 --> 00:21:08.380
RICKY: So, I would typically trade it in

00:21:08.380 --> 00:21:10.264
at one store and then go to a different

00:21:10.275 --> 00:21:12.549
GameStop and then buy the new console.

00:21:12.756 --> 00:21:16.028
I’ve probably went through at

00:21:16.042 --> 00:21:18.078
least ten, maybe closer to twenty.

00:21:18.475 --> 00:21:19.514
JACK: You would think after a while

00:21:19.516 --> 00:21:20.745
that Ricky would be like, alright,

00:21:20.745 --> 00:21:22.219
alright, enough of this getting banned.

00:21:22.222 --> 00:21:23.911
I’ll stop attacking people.

00:21:24.212 --> 00:21:25.753
But for some reason he was just

00:21:25.754 --> 00:21:27.592
so addicted to it that he would

00:21:27.592 --> 00:21:29.545
not stop attacking people and

00:21:29.546 --> 00:21:30.917
just kept getting reported for

00:21:30.918 --> 00:21:32.738
abuse again and again and again.

00:21:33.118 --> 00:21:34.951
You would think after five times,

00:21:34.953 --> 00:21:36.310
it’s like, okay, I’m tired of going

00:21:36.312 --> 00:21:38.035
down to get a new Xbox, but not Ricky.

00:21:38.273 --> 00:21:39.435
He would just keep doing it.

00:21:40.328 --> 00:21:42.784
Now, eventually he graduated to

00:21:42.784 --> 00:21:45.579
stealing something even more malleable.

00:21:46.046 --> 00:21:48.071
It wasn't just gamer tags anymore.

00:21:48.136 --> 00:21:48.916
[Music] His attention

00:21:48.920 --> 00:21:51.455
turned to Instagram handles.

00:21:53.419 --> 00:21:55.346
RICKY: I was always the old-school

00:21:55.350 --> 00:21:56.689
Halo guy, like Xbox guy.

00:21:56.695 --> 00:21:57.360
Like, I didn't want to

00:21:57.384 --> 00:21:58.613
transition into Instagram.

00:21:58.619 --> 00:21:59.726
I just stuck to what I know.

00:22:00.159 --> 00:22:02.460
Then just one day, a couple of

00:22:02.467 --> 00:22:04.260
my people were like, yo, why

00:22:04.260 --> 00:22:05.284
are you not doing Instagram?

00:22:05.444 --> 00:22:06.377
It’s a new wave.

00:22:06.576 --> 00:22:07.814
So, they kinda persuaded me.

00:22:08.340 --> 00:22:09.316
They were like, listen,

00:22:09.325 --> 00:22:11.429
here's an AOL e-mail address.

00:22:11.975 --> 00:22:12.942
It’s for the Instagram

00:22:12.974 --> 00:22:14.815
@bro, just like B-R-O.

00:22:15.412 --> 00:22:16.495
Nobody can take it.

00:22:16.508 --> 00:22:17.541
I’m like, dude, it’s an AOL.

00:22:17.576 --> 00:22:18.694
What do you mean nobody can take it?

00:22:18.992 --> 00:22:20.118
JACK: At the time, Ricky felt like he

00:22:20.119 --> 00:22:22.981
could steal any Xbox gamer tag he wanted.

00:22:23.394 --> 00:22:24.911
So, what do you mean you can't

00:22:24.915 --> 00:22:27.483
steal this Instagram name @bro?

00:22:28.046 --> 00:22:29.952
It’s tied to an AOL address account.

00:22:29.966 --> 00:22:31.300
Those are easy to get into.

00:22:31.911 --> 00:22:34.312
But this idea sparked something in Ricky.

00:22:34.776 --> 00:22:36.213
If he could get any gamer tag he

00:22:36.213 --> 00:22:38.165
wanted, then how different would

00:22:38.166 --> 00:22:39.707
it be to get Instagram names?

00:22:39.855 --> 00:22:41.300
It’s the same social engineering

00:22:41.300 --> 00:22:42.499
techniques that he figured out how

00:22:42.500 --> 00:22:44.798
to recover someone’s password, but

00:22:44.798 --> 00:22:46.291
there’s just way more money in it.

00:22:46.400 --> 00:22:48.266
RICKY: With the Instagram @bro, how nobody

00:22:48.266 --> 00:22:51.144
could get it that was trying to get it,

00:22:51.519 --> 00:22:54.120
it’s because it was linked — it was an

00:22:54.121 --> 00:22:58.699
adult account on AOL, but it had — it

00:22:58.701 --> 00:23:01.427
was like the parent account, and under

00:23:01.428 --> 00:23:02.870
the parent account it had other accounts.

00:23:02.899 --> 00:23:04.278
It was one of those e-mails

00:23:04.379 --> 00:23:05.533
under the parent account.

00:23:05.629 --> 00:23:06.670
That’s why nobody could get it.

00:23:07.665 --> 00:23:09.141
I was able to realize that.

00:23:09.141 --> 00:23:09.924
I realized it.

00:23:10.472 --> 00:23:12.301
Once I reset the main e-mail, and I was

00:23:12.301 --> 00:23:14.369
like, yo, this isn't my e-mail — like,

00:23:15.790 --> 00:23:17.942
you have other accounts under that e-mail.

00:23:18.148 --> 00:23:19.568
So, once I was able to match

00:23:19.569 --> 00:23:20.235
everything up, I was like,

00:23:20.235 --> 00:23:21.610
yo, it’s that specific one.

00:23:21.664 --> 00:23:23.159
I don't remember the exact e-mail.

00:23:23.553 --> 00:23:24.726
But I was like, it’s that one.

00:23:24.995 --> 00:23:25.877
I reset it, and the

00:23:25.878 --> 00:23:26.780
Instagram was right there.

00:23:27.363 --> 00:23:29.971
Funny story, though; the security question

00:23:29.974 --> 00:23:31.431
on it — I remember this conversation.

00:23:32.375 --> 00:23:33.848
Probably forever I’ll remember this.

00:23:34.302 --> 00:23:36.665
The lady was like, the security question

00:23:36.705 --> 00:23:38.539
is your favorite mythical creature.

00:23:39.710 --> 00:23:40.538
I was like, you know,

00:23:40.568 --> 00:23:41.915
I put something random.

00:23:41.947 --> 00:23:42.607
I apologize.

00:23:42.608 --> 00:23:43.696
I don't remember what it was.

00:23:43.957 --> 00:23:45.264
She’s like, okay, well,

00:23:45.264 --> 00:23:46.288
it’s big and hairy.

00:23:47.803 --> 00:23:49.630
As you can guess, I guessed Bigfoot.

00:23:50.120 --> 00:23:52.168
She started laughing and she goes,

00:23:52.178 --> 00:23:53.837
no, it’s another word for Bigfoot.

00:23:54.452 --> 00:23:55.803
I said, sasquatch.

00:23:55.857 --> 00:23:56.826
She goes, yeah, that’s right.

00:23:57.323 --> 00:23:58.306
Gave me the password reset.

00:23:59.504 --> 00:24:01.328
JACK: Man, I absolutely hate

00:24:01.342 --> 00:24:03.229
how easy this is for him.

00:24:03.518 --> 00:24:05.938
That customer service person really

00:24:06.158 --> 00:24:08.886
failed at keeping our accounts safe.

00:24:09.193 --> 00:24:10.950
I hope they got fired for giving

00:24:10.967 --> 00:24:12.473
Ricky this Instagram account

00:24:12.487 --> 00:24:14.904
@bro, because that’s ridiculous,

00:24:15.593 --> 00:24:16.696
and that’s how he got it.

00:24:17.276 --> 00:24:18.784
The way he’d steal an Instagram account

00:24:18.898 --> 00:24:21.359
is that he would get access to it, and he

00:24:21.359 --> 00:24:23.237
would log into it, and then he would have

00:24:23.237 --> 00:24:25.316
a second browser open with a brand-new,

00:24:25.322 --> 00:24:27.300
fresh Instagram account that he just made.

00:24:28.021 --> 00:24:29.538
He would change the username of

00:24:29.538 --> 00:24:31.473
the stolen one to something else,

00:24:31.928 --> 00:24:33.409
and then he would quickly switch

00:24:33.411 --> 00:24:35.397
to his fresh account and change its

00:24:35.402 --> 00:24:37.396
username to the stolen username.

00:24:37.899 --> 00:24:39.243
That way the person, when they

00:24:39.243 --> 00:24:40.442
figure out that their Instagram

00:24:40.444 --> 00:24:42.152
account got stolen and they recover

00:24:42.152 --> 00:24:44.142
it, they still have all their DMs

00:24:44.147 --> 00:24:45.456
and their followers and all that.

00:24:45.671 --> 00:24:46.948
It’s just that their name was

00:24:46.948 --> 00:24:48.764
changed 'cause Ricky stole it.

00:24:48.914 --> 00:24:50.758
RICKY: I would genuinely let

00:24:50.758 --> 00:24:51.782
them just keep their account.

00:24:51.863 --> 00:24:52.779
Like, I don't want to mess with their

00:24:52.782 --> 00:24:55.682
pictures and take down their Instagram

00:24:55.687 --> 00:24:56.915
and close the account or anything.

00:24:57.172 --> 00:24:58.124
Like, they can keep that.

00:24:58.606 --> 00:25:00.499
I got what I wanted and that was it.

00:25:00.915 --> 00:25:02.722
JACK: A stolen Xbox handle might

00:25:02.722 --> 00:25:04.141
get you a few hundred dollars, but

00:25:04.142 --> 00:25:05.963
a good verified Instagram handle

00:25:06.350 --> 00:25:07.945
can go for a few thousand dollars.

00:25:08.363 --> 00:25:10.120
When Ricky stole the Instagram account

00:25:10.142 --> 00:25:13.615
@bro, he says he sold it for $8,000.

00:25:14.058 --> 00:25:16.386
People were paying him in crypto, Bitcoin,

00:25:16.468 --> 00:25:18.493
Ethereum, and Ricky was liking this.

00:25:18.510 --> 00:25:19.683
In an afternoon he could steal

00:25:19.683 --> 00:25:20.466
a few accounts that would

00:25:20.485 --> 00:25:22.041
earn him maybe ten grand.

00:25:22.286 --> 00:25:24.359
This would become his main focus,

00:25:24.580 --> 00:25:25.987
all the ins and outs of how to

00:25:25.992 --> 00:25:27.995
steal accounts and how to sell them.

00:25:28.114 --> 00:25:29.380
He learned verified accounts

00:25:29.381 --> 00:25:30.713
sold more than non-verified.

00:25:30.788 --> 00:25:32.725
He was stealing usernames left and right.

00:25:33.062 --> 00:25:34.306
Of course, Ricky wasn't

00:25:34.309 --> 00:25:35.302
the only guy doing this.

00:25:35.303 --> 00:25:37.006
In fact, he wasn't even discovering

00:25:37.011 --> 00:25:38.236
how any of this stuff worked.

00:25:38.507 --> 00:25:40.166
He was just learning from others

00:25:40.167 --> 00:25:41.537
who were doing the same thing.

00:25:42.453 --> 00:25:44.107
There was this one SIM-swapper that

00:25:44.109 --> 00:25:46.096
Ricky met online named Joseph Harris,

00:25:46.357 --> 00:25:47.490
who I interviewed a while back.

00:25:47.491 --> 00:25:48.774
If you want to hear Joseph’s story,

00:25:49.023 --> 00:25:50.421
you can listen to that episode.

00:25:50.423 --> 00:25:52.336
It’s Episode 118, called Hot Swaps.

00:25:52.604 --> 00:25:54.267
RICKY: So, me and Joseph were kind of

00:25:54.268 --> 00:25:56.281
in the same world, you know, taking

00:25:56.281 --> 00:25:57.825
usernames and whatnot like that.

00:25:58.503 --> 00:25:59.940
We never really talked or anything.

00:25:59.947 --> 00:26:00.683
Like, I knew him, he

00:26:00.685 --> 00:26:01.546
knew me, type of thing.

00:26:01.585 --> 00:26:04.327
But then I ended up stealing a couple

00:26:04.327 --> 00:26:06.022
of his PlayStation names that he had.

00:26:07.028 --> 00:26:08.289
He asked for them back and I was

00:26:08.289 --> 00:26:10.256
just like, fuck off, pretty much.

00:26:11.232 --> 00:26:13.165
Then he was like, okay.

00:26:13.715 --> 00:26:15.270
Then I felt bad, and we talked,

00:26:15.406 --> 00:26:16.544
but I never gave them back.

00:26:16.894 --> 00:26:19.019
But we talked and we became friends.

00:26:20.564 --> 00:26:21.374
JACK: Even though you never gave

00:26:21.374 --> 00:26:22.467
them back, you became friends.

00:26:23.355 --> 00:26:23.818
RICKY: Yeah.

00:26:24.294 --> 00:26:26.009
JACK: This is a strange world

00:26:26.250 --> 00:26:27.926
that he’s in, where you earn

00:26:27.926 --> 00:26:29.901
respect for being a great liar.

00:26:30.121 --> 00:26:32.447
You earn respect for stealing things.

00:26:32.770 --> 00:26:34.460
Even if you steal things from other

00:26:34.461 --> 00:26:36.498
forum members, their reaction is

00:26:36.500 --> 00:26:38.232
like, oh man, he caught me out.

00:26:38.233 --> 00:26:39.768
I should have secured my username better.

00:26:39.809 --> 00:26:40.686
Man, he’s good.

00:26:41.275 --> 00:26:43.135
Him and Joseph became friends,

00:26:43.283 --> 00:26:44.755
and they would swap strategies

00:26:44.765 --> 00:26:46.002
for stealing usernames, and

00:26:46.004 --> 00:26:47.024
they would help each other out.

00:26:47.464 --> 00:26:49.140
But what makes all this so scary to

00:26:49.142 --> 00:26:50.909
me is that I don't even think Ricky

00:26:51.129 --> 00:26:53.496
was particularly good at computers.

00:26:53.832 --> 00:26:55.239
You have someone with very little

00:26:55.241 --> 00:26:56.735
computer skills that can just come

00:26:56.736 --> 00:26:59.378
at us and steal our stuff so easily.

00:27:00.096 --> 00:27:01.051
It was really hard for

00:27:01.052 --> 00:27:02.291
victims to do anything.

00:27:02.316 --> 00:27:04.096
Instagram customer support is always

00:27:04.105 --> 00:27:06.329
overwhelmed, and I bet so is Microsoft,

00:27:06.521 --> 00:27:08.678
and they often side with the thief by

00:27:08.678 --> 00:27:09.842
telling them, yeah, there’s nothing

00:27:09.844 --> 00:27:11.128
we could do to help you get it back.

00:27:11.426 --> 00:27:13.184
It takes a lot of effort to

00:27:13.184 --> 00:27:14.733
recover a stolen username.

00:27:14.952 --> 00:27:16.116
So, victims often would just

00:27:16.138 --> 00:27:17.908
give up and stop trying, and

00:27:17.908 --> 00:27:19.879
they'd feel helpless in all this.

00:27:20.310 --> 00:27:22.507
It just makes me wonder, how can I even

00:27:22.509 --> 00:27:24.113
protect myself when the company who

00:27:24.115 --> 00:27:26.504
keeps my stuff safe has these flaws?

00:27:26.994 --> 00:27:27.970
I mean, think about it like this.

00:27:27.980 --> 00:27:29.569
Suppose I go and stay at a hotel

00:27:29.728 --> 00:27:31.074
and I leave my valuables in the

00:27:31.074 --> 00:27:32.343
room and I leave for the day.

00:27:32.740 --> 00:27:34.244
I’m assuming my stuff is nice

00:27:34.244 --> 00:27:35.712
and safe behind a locked door.

00:27:36.188 --> 00:27:37.870
But we’ve seen stories where criminals

00:27:37.872 --> 00:27:39.603
will target a guest in a hotel,

00:27:39.616 --> 00:27:40.717
and they’ll go to the front desk

00:27:40.717 --> 00:27:42.466
and say, oh, sorry, I’m staying in

00:27:42.695 --> 00:27:44.878
Room 1020 and I locked myself out.

00:27:45.189 --> 00:27:46.556
Can I get a new key to get in?

00:27:47.108 --> 00:27:49.014
The front desk sees these situations

00:27:49.014 --> 00:27:50.689
happen every day where a guest

00:27:50.700 --> 00:27:51.896
gets locked out of the room,

00:27:52.191 --> 00:27:53.880
and they want to help the guest.

00:27:54.243 --> 00:27:56.183
So, if a criminal is posing as

00:27:56.184 --> 00:27:57.877
a guest and they're convincing

00:27:57.877 --> 00:27:59.853
enough, they’ll likely get the key.

00:28:00.254 --> 00:28:01.566
It might play out like this; the front

00:28:01.567 --> 00:28:03.506
desk will ask for a photo ID, of course,

00:28:03.506 --> 00:28:05.178
but if you say, oh yeah, you know what?

00:28:05.684 --> 00:28:06.668
I left it in the room.

00:28:06.875 --> 00:28:08.174
I was going to the pool and I didn't

00:28:08.174 --> 00:28:09.567
bring anything, and that’s the problem.

00:28:09.567 --> 00:28:10.590
I left everything in the room.

00:28:11.139 --> 00:28:12.264
That’s a real scenario

00:28:12.265 --> 00:28:13.306
that happens all the time.

00:28:13.717 --> 00:28:15.618
So, the hotel is used to this kinda thing.

00:28:16.069 --> 00:28:17.642
So, the hotel front desk might

00:28:17.642 --> 00:28:19.282
say, well, can you give me some

00:28:19.282 --> 00:28:20.446
more details about yourself?

00:28:20.446 --> 00:28:21.592
Like, what's your phone number,

00:28:21.610 --> 00:28:23.263
e-mail address, full name.

00:28:23.852 --> 00:28:25.934
If you can verify those things, you are

00:28:25.974 --> 00:28:27.993
absolutely getting the key to that room.

00:28:28.737 --> 00:28:29.854
And who would be good

00:28:29.855 --> 00:28:30.877
at doing such a crime?

00:28:31.147 --> 00:28:33.823
Liars would be, someone who can lie to

00:28:33.823 --> 00:28:35.942
the front desk person’s face to get the

00:28:35.942 --> 00:28:38.252
room key, which it sounds like Ricky

00:28:38.329 --> 00:28:39.911
must have been a really good liar to

00:28:39.919 --> 00:28:42.861
convince so many customer support reps

00:28:43.098 --> 00:28:45.254
to give him the information he wants

00:28:45.402 --> 00:28:47.130
so that he can get into an account.

00:28:47.797 --> 00:28:49.842
It just makes me wonder, how do you

00:28:49.867 --> 00:28:52.625
protect yourself when a company that has

00:28:52.626 --> 00:28:54.243
your stuff doesn't have good security

00:28:54.244 --> 00:28:55.842
controls to protect their customers?

00:28:56.376 --> 00:28:58.158
So, Ricky’s progressing through this

00:28:58.167 --> 00:28:59.955
scene, making a few hundred dollars

00:28:59.956 --> 00:29:02.093
with each Xbox gamer tag he steals, and

00:29:02.093 --> 00:29:03.639
then moving up to a few thousand dollars

00:29:03.641 --> 00:29:05.163
for each Instagram name he steals.

00:29:05.708 --> 00:29:06.728
But he started having trouble

00:29:06.729 --> 00:29:08.513
getting into some e-mail accounts.

00:29:08.564 --> 00:29:10.532
Like, some he just could not get into

00:29:10.533 --> 00:29:12.112
because his social engineering skills

00:29:12.113 --> 00:29:13.752
just didn't work there or his password

00:29:13.753 --> 00:29:15.148
recovery tricks just didn't work,

00:29:15.438 --> 00:29:17.231
especially when two-factor authentication

00:29:17.263 --> 00:29:18.638
was on for some e-mail accounts.

00:29:18.869 --> 00:29:20.557
So, he told a friend, do you know

00:29:20.566 --> 00:29:23.004
more ways to get into e-mail accounts?

00:29:23.426 --> 00:29:24.524
That’s when his friend told

00:29:24.524 --> 00:29:26.625
him about SIM-swapping.

00:29:26.726 --> 00:29:26.765
RICKY: [Music]

00:29:29.393 --> 00:29:31.563
Then as security and stuff

00:29:31.885 --> 00:29:33.843
escalated, that’s when simming,

00:29:34.095 --> 00:29:35.446
like SIM-swapping, became a thing.

00:29:36.354 --> 00:29:37.752
So, if we couldn't get it through

00:29:38.421 --> 00:29:39.568
the password reset or anything,

00:29:39.568 --> 00:29:40.641
through a security question,

00:29:40.990 --> 00:29:41.853
we could just SIM-swap them.

00:29:42.966 --> 00:29:44.079
JACK: You’ve probably legally

00:29:44.089 --> 00:29:45.959
SIM-swapped yourself a few times.

00:29:46.141 --> 00:29:47.814
Any time you get a new phone and you

00:29:47.816 --> 00:29:49.806
have to move your number to the new

00:29:49.811 --> 00:29:51.790
phone you get, well, that’s a SIM-swap.

00:29:51.801 --> 00:29:53.023
That’s all it is, moving a

00:29:53.023 --> 00:29:54.399
mobile number to a new device.

00:29:54.787 --> 00:29:57.405
But what Ricky wanted to do was pose as

00:29:57.409 --> 00:29:59.341
the customer and convince the carrier

00:29:59.341 --> 00:30:01.096
that he just got a new phone and he wants

00:30:01.097 --> 00:30:02.884
to move his number to this new phone.

00:30:03.586 --> 00:30:05.254
I went into SIM-swapping more in depth

00:30:05.286 --> 00:30:07.263
with Episode 112, called Dirty Coms,

00:30:07.470 --> 00:30:09.033
which by the way just took the lead for

00:30:09.033 --> 00:30:10.418
the most downloaded episode of mine.

00:30:10.614 --> 00:30:13.023
It has now achieved 1.2 million downloads,

00:30:13.025 --> 00:30:14.399
and if you haven't listened to Episode

00:30:14.399 --> 00:30:15.943
112, you should absolutely go do it.

00:30:17.007 --> 00:30:18.442
But basically what Ricky learned is

00:30:18.442 --> 00:30:20.103
that he can call the mobile provider and

00:30:20.108 --> 00:30:22.213
trick them into moving someone else’s

00:30:22.218 --> 00:30:24.455
phone number to his phone, and if he

00:30:24.455 --> 00:30:26.538
can get that, then he can get into their

00:30:26.553 --> 00:30:28.303
e-mail account, say something like, oh,

00:30:28.303 --> 00:30:30.476
I forgot my password, and it’ll text

00:30:30.479 --> 00:30:32.512
them a code to generate a new password.

00:30:33.120 --> 00:30:34.628
He can read those texts now.

00:30:35.120 --> 00:30:36.750
From there, he can reset the password

00:30:36.750 --> 00:30:39.069
to the inbox and look at it and start

00:30:39.084 --> 00:30:40.408
rummaging through it looking for

00:30:40.417 --> 00:30:42.495
usernames and gamer tags to steal.

00:30:43.279 --> 00:30:45.291
RICKY: Once I had the target that I

00:30:45.291 --> 00:30:46.340
was going for — like, usually I had

00:30:46.341 --> 00:30:47.735
their name or something or their e-mail

00:30:48.058 --> 00:30:50.061
and I needed the number or address

00:30:50.062 --> 00:30:51.171
or something — I would just usually

00:30:51.175 --> 00:30:54.959
typically call up Amazon, PayPal, or eBay.

00:30:55.977 --> 00:30:57.572
Those were like — I was gonna get their

00:30:57.572 --> 00:30:58.620
information from one of those three

00:30:58.620 --> 00:31:00.043
companies as long as they had that on

00:31:00.044 --> 00:31:02.454
file or that person used one of the three.

00:31:03.917 --> 00:31:05.173
Social engineering — I would just be

00:31:05.173 --> 00:31:06.684
able to get the pertinent information.

00:31:07.168 --> 00:31:10.516
JACK: Okay, so, you called Amazon,

00:31:10.520 --> 00:31:13.005
and what information do you have,

00:31:13.006 --> 00:31:14.305
what information are you looking for?

00:31:15.613 --> 00:31:16.315
RICKY: I’m specifically

00:31:16.517 --> 00:31:18.145
probably targeting the number.

00:31:18.738 --> 00:31:19.714
JACK: You want the phone number.

00:31:20.396 --> 00:31:20.895
RICKY: Yeah.

00:31:21.148 --> 00:31:22.928
JACK: Associated with an e-mail address?

00:31:23.430 --> 00:31:26.313
RICKY: Yeah, so if I knew you had

00:31:26.313 --> 00:31:28.442
@Jack on Instagram and I had your name,

00:31:28.778 --> 00:31:30.862
I would be able to call up as you.

00:31:31.616 --> 00:31:33.383
I’ll probably — at this point I’m probably

00:31:33.383 --> 00:31:35.157
gonna have a little bit about you,

00:31:35.489 --> 00:31:37.008
maybe the e-mail address or something.

00:31:38.147 --> 00:31:39.925
I would just see if you had any three

00:31:39.926 --> 00:31:41.903
of those accounts; PayPal, Amazon, eBay.

00:31:42.125 --> 00:31:43.015
If you had one of them, I was

00:31:43.015 --> 00:31:44.602
gonna call them up as you.

00:31:44.940 --> 00:31:47.071
I would say, hey, my name is Jack.

00:31:49.475 --> 00:31:50.405
I need help verifying my

00:31:50.405 --> 00:31:51.371
account or something like that.

00:31:51.549 --> 00:31:53.267
Or if it was eBay, I think I would

00:31:53.267 --> 00:31:54.237
say I need help with an order.

00:31:55.024 --> 00:31:56.620
Then they'd be like, okay, what order?

00:31:57.021 --> 00:32:00.274
Once I verified them, the name and the

00:32:00.278 --> 00:32:02.411
e-mail on file, what I would do is be

00:32:02.411 --> 00:32:04.024
like, oh — like make conversation; be

00:32:04.024 --> 00:32:05.889
like, oh, by the way, what's my number

00:32:05.896 --> 00:32:08.337
ending in whatever your number ended in?

00:32:08.340 --> 00:32:09.536
Because they would be able to see

00:32:09.725 --> 00:32:10.995
the last two digits or something.

00:32:12.319 --> 00:32:13.428
They would just read off the number.

00:32:14.421 --> 00:32:15.489
I’m not gonna say there wasn't

00:32:15.499 --> 00:32:18.266
people who haven't gotten away, like

00:32:18.267 --> 00:32:19.247
I couldn't find them or something

00:32:19.249 --> 00:32:20.101
or I just gave up because it

00:32:20.101 --> 00:32:21.461
was too hard and on to the next.

00:32:21.788 --> 00:32:24.137
But 90-something percent of

00:32:24.137 --> 00:32:26.092
the time it was successful.

00:32:26.614 --> 00:32:27.776
JACK: That’s such a hard number

00:32:27.776 --> 00:32:29.220
to believe, because nobody’s

00:32:29.221 --> 00:32:32.660
taken my Instagram yet, and I know

00:32:32.714 --> 00:32:34.063
people would love to have that

00:32:34.063 --> 00:32:35.785
feather in their hat, to hack Jack.

00:32:37.405 --> 00:32:39.730
RICKY: Yeah, I mean, from personal

00:32:39.730 --> 00:32:42.203
experience, I like what you guys do,

00:32:42.320 --> 00:32:45.639
but this was also back in 2015 or so,

00:32:45.948 --> 00:32:49.279
and if you had the username @Jack and

00:32:49.279 --> 00:32:53.719
somebody came and asked me for that

00:32:53.721 --> 00:32:55.963
handle, I was probably gonna get it.

00:32:56.534 --> 00:32:58.092
JACK: It’s real interesting to me how

00:32:58.095 --> 00:33:00.380
Ricky pieces all this together, isn't it?

00:33:00.592 --> 00:33:02.007
I mean, he’s grabbing at a

00:33:02.029 --> 00:33:04.189
single digit of a phone number

00:33:04.394 --> 00:33:06.179
from this place or that place.

00:33:06.305 --> 00:33:08.378
He’s grabbing at just a few digits

00:33:08.380 --> 00:33:10.254
of a social security number from here

00:33:10.256 --> 00:33:12.473
or there, and then he’s connecting

00:33:12.474 --> 00:33:14.107
it all together to get a more

00:33:14.108 --> 00:33:17.081
complete detail view of his victims.

00:33:17.218 --> 00:33:18.333
Like, for instance, he might go to

00:33:18.334 --> 00:33:20.540
Amazon not knowing if this target of

00:33:20.543 --> 00:33:23.092
his has an Amazon account or not, and

00:33:23.093 --> 00:33:26.436
he would say, hey, I forgot my password.

00:33:26.881 --> 00:33:27.834
The website would say, okay,

00:33:27.834 --> 00:33:28.837
what's your e-mail address?

00:33:28.868 --> 00:33:30.587
He would put in the e-mail address,

00:33:30.855 --> 00:33:32.088
and then it would say, alright, well,

00:33:32.088 --> 00:33:34.862
we just texted you a code which ends

00:33:34.863 --> 00:33:37.372
in these two digits, 34 or whatever.

00:33:37.538 --> 00:33:38.484
He’s just like, great.

00:33:38.495 --> 00:33:39.658
That’s all I wanted to know,

00:33:39.672 --> 00:33:41.352
the last two digits of the phone

00:33:41.361 --> 00:33:43.160
number associated to this account.

00:33:43.503 --> 00:33:44.815
You might think, what's the big deal

00:33:44.816 --> 00:33:46.386
if someone knows one of my social

00:33:46.386 --> 00:33:47.497
security numbers, right, or the

00:33:47.497 --> 00:33:48.901
last two digits of my phone number?

00:33:49.106 --> 00:33:49.896
This is why.

00:33:49.902 --> 00:33:52.101
This is why right here, because people

00:33:52.103 --> 00:33:54.050
like Ricky are grabbing at every little

00:33:54.050 --> 00:33:56.034
detail to steal things from you so

00:33:56.034 --> 00:33:57.846
that it’s just enough information that

00:33:58.093 --> 00:33:59.639
they could social engineer someone to

00:33:59.646 --> 00:34:01.040
give them the rest of the information.

00:34:01.399 --> 00:34:02.976
They are persistent and

00:34:02.976 --> 00:34:04.959
clever and incentivized.

00:34:05.370 --> 00:34:06.670
I mean, how many times have you

00:34:06.672 --> 00:34:08.346
been asked to provide only the last

00:34:08.356 --> 00:34:09.993
four digits of your social security

00:34:09.995 --> 00:34:11.751
number to get something done?

00:34:12.395 --> 00:34:14.204
So, the goal here was that Ricky

00:34:14.205 --> 00:34:15.509
needed to convince the mobile

00:34:15.510 --> 00:34:17.851
provider he’s actually the customer.

00:34:18.101 --> 00:34:19.514
They would ask him to prove it by

00:34:19.514 --> 00:34:21.435
providing things like a social security

00:34:21.437 --> 00:34:23.811
number or personal details, and Ricky

00:34:23.811 --> 00:34:24.849
would be able to get this kind of

00:34:24.849 --> 00:34:27.274
information off you because he had access

00:34:27.275 --> 00:34:29.035
to a people search database that for

00:34:29.037 --> 00:34:31.137
three bucks he could enter in whatever

00:34:31.332 --> 00:34:33.495
little info he had on you, and it would

00:34:33.495 --> 00:34:35.711
give him back a ton of details, which

00:34:35.714 --> 00:34:38.067
drives me nuts that we're so relaxed

00:34:38.069 --> 00:34:39.804
about our personal data and just give

00:34:39.806 --> 00:34:42.181
it to anyone who asks nicely, because

00:34:42.201 --> 00:34:44.295
our lack of care about our own personal

00:34:44.301 --> 00:34:47.072
data translates to a lack of care for

00:34:47.125 --> 00:34:48.614
other companies to keep our personal

00:34:48.616 --> 00:34:50.746
data private, and that translates to

00:34:50.748 --> 00:34:52.500
criminals like Ricky who are exploiting

00:34:52.513 --> 00:34:55.353
our lack of care for his personal gain.

00:34:55.880 --> 00:34:58.410
We should be way more protective of who

00:34:58.412 --> 00:35:00.235
we're giving our private information to.

00:35:00.608 --> 00:35:01.397
RICKY: All you had to do was put

00:35:01.620 --> 00:35:05.396
your name in the search, and it would

00:35:05.398 --> 00:35:07.085
show me all your addresses and stuff.

00:35:07.423 --> 00:35:08.395
That’s how I would be able to

00:35:08.395 --> 00:35:10.612
buy the correct social, because

00:35:10.784 --> 00:35:12.528
let’s say your name is like a

00:35:12.532 --> 00:35:13.931
very common name or something.

00:35:14.269 --> 00:35:16.105
But I can match up your dox, like

00:35:16.105 --> 00:35:17.287
your address and stuff, on the page.

00:35:17.303 --> 00:35:19.213
That’s how I know what social to buy.

00:35:21.422 --> 00:35:22.774
So, I’m not just blowing through

00:35:23.096 --> 00:35:25.337
everybody named John Doe, and

00:35:25.637 --> 00:35:26.449
there’s a hundred of them.

00:35:27.751 --> 00:35:29.724
I would just specifically target the one

00:35:29.731 --> 00:35:32.144
that had the correct dox and buy their

00:35:32.145 --> 00:35:34.712
social for $3, call up AT&T, Verizon,

00:35:34.712 --> 00:35:37.195
or T-Mobile or Sprint, and give them

00:35:37.196 --> 00:35:38.497
the last four of the social to verify

00:35:38.499 --> 00:35:39.767
the account, and just SIM-swap them.

00:35:41.476 --> 00:35:43.231
JACK: Okay, is it that simple?

00:35:43.254 --> 00:35:44.675
You could call up this place and

00:35:44.681 --> 00:35:46.029
say, hey, I got a new phone number?

00:35:46.170 --> 00:35:46.789
RICKY: Back then, yeah.

00:35:47.534 --> 00:35:48.186
JACK: Okay.

00:35:49.238 --> 00:35:50.417
Then can we verify

00:35:50.432 --> 00:35:51.616
who — that it’s actually you?

00:35:51.616 --> 00:35:53.191
Okay, what information do you need?

00:35:53.268 --> 00:35:54.350
Well, let’s have your social.

00:35:54.374 --> 00:35:55.200
Okay, here it is.

00:35:55.390 --> 00:35:56.196
Do you have your phone number?

00:35:56.198 --> 00:35:56.788
Okay, here it is.

00:35:56.790 --> 00:35:57.758
That’s all we need, sir.

00:35:59.196 --> 00:35:59.960
RICKY: Yeah, that was it.

00:36:00.156 --> 00:36:01.662
Then they would ask for the new

00:36:01.769 --> 00:36:03.547
IMEI and the new SIM card number.

00:36:05.122 --> 00:36:06.709
I had a burner phone, and that was it.

00:36:06.962 --> 00:36:09.115
I’d get the text and I’d be in and out.

00:36:11.606 --> 00:36:13.450
JACK: [Music] When Ricky started

00:36:13.453 --> 00:36:15.636
SIM-swapping in 2015, he was

00:36:15.636 --> 00:36:16.917
going after video game accounts

00:36:16.938 --> 00:36:18.283
and social media usernames.

00:36:18.798 --> 00:36:20.587
This is when his efforts

00:36:20.587 --> 00:36:21.699
really kicked into gear.

00:36:21.710 --> 00:36:23.354
He was taking over dozens of phone

00:36:23.360 --> 00:36:25.328
numbers and stealing lots of usernames.

00:36:25.897 --> 00:36:27.717
But after a while he started to connect

00:36:27.718 --> 00:36:29.441
some dots, and his friends did, too.

00:36:30.064 --> 00:36:31.191
All these usernames he was

00:36:31.191 --> 00:36:33.377
selling made his Bitcoin wallet

00:36:33.490 --> 00:36:35.347
keep getting bigger and bigger.

00:36:35.675 --> 00:36:38.112
At the time, in 2016, Bitcoin was on

00:36:38.112 --> 00:36:40.241
this massive bull run, rising steadily

00:36:40.257 --> 00:36:42.371
and quickly, which meant a lot of

00:36:42.374 --> 00:36:44.169
people were getting into Bitcoin.

00:36:44.952 --> 00:36:46.879
If you went anywhere online back

00:36:46.880 --> 00:36:48.780
then, you would definitely hear

00:36:48.781 --> 00:36:50.785
someone talking about Bitcoin.

00:36:51.260 --> 00:36:52.049
SPEAKER 1: It’s called Bitcoin,

00:36:52.070 --> 00:36:53.687
but it isn't really a coin, okay?

00:36:53.689 --> 00:36:55.021
It’s an intangible thing.

00:36:55.030 --> 00:36:56.531
It’s a logarithmic number.

00:36:56.768 --> 00:36:58.343
SPEAKER 2: Bitcoin has outperformed

00:36:58.746 --> 00:37:01.471
every other investment around.

00:37:01.550 --> 00:37:02.770
SPEAKER 3: Trading never ceases.

00:37:02.992 --> 00:37:04.997
Every ten minutes Bitcoin’s

00:37:05.009 --> 00:37:07.114
heart beats [snaps fingers]

00:37:07.114 --> 00:37:09.149
and transactions are processed.

00:37:09.585 --> 00:37:11.029
The exchanges never close.

00:37:11.536 --> 00:37:13.370
JACK: Social media and YouTube was

00:37:13.372 --> 00:37:15.420
going nuts about cryptocurrencies.

00:37:15.448 --> 00:37:17.212
If you were holding Bitcoin then, in six

00:37:17.212 --> 00:37:18.490
months your money would have doubled,

00:37:18.531 --> 00:37:19.977
and it was rising exponentially.

00:37:19.999 --> 00:37:21.189
It would have doubled again four

00:37:21.191 --> 00:37:22.337
months after that and then doubled

00:37:22.337 --> 00:37:23.464
again three months after that.

00:37:23.694 --> 00:37:25.255
A lot of people were jumping in

00:37:25.265 --> 00:37:27.245
fast, investing, holding, and

00:37:27.247 --> 00:37:29.372
surprisingly telling everyone

00:37:29.373 --> 00:37:30.384
else what they're holding.

00:37:30.680 --> 00:37:31.562
SPEAKER 4: I personally — I

00:37:31.563 --> 00:37:32.962
own Bitcoin in my hedge fund.

00:37:32.986 --> 00:37:34.223
I own Bitcoin in my fund.

00:37:34.237 --> 00:37:36.333
I own Bitcoin in my private account.

00:37:37.836 --> 00:37:40.105
It is a huge deal.

00:37:40.536 --> 00:37:41.837
SPEAKER 5: I will show you my

00:37:41.903 --> 00:37:44.510
trend trading strategy for crypto.

00:37:44.770 --> 00:37:47.380
JACK: Ricky had Bitcoin and Ethereum

00:37:47.384 --> 00:37:49.421
himself, so he was watching videos

00:37:49.423 --> 00:37:51.085
like this, and he was seeing this new

00:37:51.087 --> 00:37:52.927
surge of holders come onto the scene.

00:37:53.418 --> 00:37:55.513
He understood crypto enough to be familiar

00:37:55.514 --> 00:37:58.104
with how it all worked, how it’s stored,

00:37:58.217 --> 00:38:00.354
how to transfer it, how to secure it.

00:38:01.094 --> 00:38:03.062
See, Bitcoin is electronic money.

00:38:03.164 --> 00:38:04.744
To transfer it, it’s really no

00:38:04.745 --> 00:38:06.235
harder than just sending an e-mail.

00:38:06.806 --> 00:38:09.436
When it’s sent, there’s no way to undo it.

00:38:10.005 --> 00:38:11.935
So, Ricky and his online friends got

00:38:11.937 --> 00:38:14.321
the idea that instead of hacking into

00:38:14.322 --> 00:38:16.720
people’s stuff to steal something to

00:38:16.722 --> 00:38:18.785
then sell it to turn it into Bitcoin,

00:38:19.232 --> 00:38:21.312
why not just hack into their crypto

00:38:21.312 --> 00:38:24.036
wallets directly and just steal it?

00:38:24.825 --> 00:38:26.298
Because after a while, social

00:38:26.299 --> 00:38:27.324
media handles and gamer

00:38:27.325 --> 00:38:28.536
tags just weren't enough.

00:38:28.681 --> 00:38:30.952
It was time to go bigger, something with

00:38:30.955 --> 00:38:33.653
greater payouts and an even greater risk.

00:38:34.022 --> 00:38:35.535
It was time to target

00:38:35.585 --> 00:38:37.067
people’s crypto wallets.

00:38:37.120 --> 00:38:37.908
[To Ricky] Well, you would SIM-swap

00:38:37.924 --> 00:38:39.491
them to get what, a username?

00:38:40.290 --> 00:38:40.658
RICKY: Yeah.

00:38:40.705 --> 00:38:42.058
Like I said, if we couldn't take

00:38:42.058 --> 00:38:44.682
the e-mail or something but we had

00:38:44.682 --> 00:38:45.813
the number on file, we would just

00:38:45.813 --> 00:38:47.524
SIM-swap it and then reset the e-mail.

00:38:47.960 --> 00:38:49.145
JACK: [Music] That was the whole point

00:38:49.235 --> 00:38:51.581
to the SIM-swap, to access their e-mail

00:38:51.582 --> 00:38:54.219
account, by saying I forgot my password,

00:38:54.231 --> 00:38:55.848
and it would text them a code to reset it.

00:38:55.956 --> 00:38:57.382
Once he got into the e-mail account,

00:38:57.395 --> 00:38:59.439
it was suddenly a high-stakes,

00:38:59.518 --> 00:39:01.136
mad dash kind of moment.

00:39:01.622 --> 00:39:03.787
Typically it was a group effort.

00:39:03.909 --> 00:39:04.942
A few of his close friends

00:39:04.971 --> 00:39:06.203
would also be part of this.

00:39:06.397 --> 00:39:07.404
Once the phone number was

00:39:07.406 --> 00:39:08.714
moved over to his new phone,

00:39:08.924 --> 00:39:10.828
suddenly everyone was engaged.

00:39:11.029 --> 00:39:12.201
First they'd crack into the e-mail

00:39:12.201 --> 00:39:14.113
address, then that username and password

00:39:14.113 --> 00:39:15.732
would get shared to the group, and his

00:39:15.732 --> 00:39:17.968
crew would start looting the inbox,

00:39:17.982 --> 00:39:20.560
looking for anything crypto-related to

00:39:20.560 --> 00:39:23.591
try to see where their Bitcoin was stored.

00:39:23.797 --> 00:39:24.834
RICKY: If we're in your Gmail,

00:39:24.856 --> 00:39:25.680
we're searching the inbox.

00:39:25.685 --> 00:39:26.589
If we're in your iCloud, we’re

00:39:26.593 --> 00:39:28.977
searching pictures, text pads,

00:39:29.804 --> 00:39:31.263
drafts and stuff like that.

00:39:32.066 --> 00:39:34.153
For Gmail specifically, a lot of

00:39:34.153 --> 00:39:35.868
people will save passwords on Gmail.

00:39:35.871 --> 00:39:38.134
So, we're gonna check all those

00:39:38.142 --> 00:39:39.314
passwords and then see if they work.

00:39:40.729 --> 00:39:42.391
I will say there was one time

00:39:43.191 --> 00:39:45.402
that me and a couple friends, we

00:39:45.403 --> 00:39:47.950
were able to get into an account.

00:39:48.027 --> 00:39:49.827
So, he had a blockchain account.

00:39:50.511 --> 00:39:51.435
We were like, okay, let’s go.

00:39:51.471 --> 00:39:52.119
So, we went into the

00:39:52.122 --> 00:39:53.174
blockchain, reset the password.

00:39:53.174 --> 00:39:53.617
We're in.

00:39:53.902 --> 00:39:56.685
It had mid seven figures in it.

00:39:59.077 --> 00:40:02.104
He had a password to send the money out,

00:40:02.984 --> 00:40:04.364
and we could never find that password.

00:40:07.002 --> 00:40:09.521
So, we never took anything.

00:40:10.178 --> 00:40:11.009
We’re sitting there looking

00:40:11.062 --> 00:40:12.257
at — we're looking at that much

00:40:12.261 --> 00:40:15.897
money, and we never got it.

00:40:16.897 --> 00:40:18.310
JACK: People will typically store their

00:40:18.315 --> 00:40:19.879
crypto in one of two places, either on an

00:40:19.879 --> 00:40:22.118
exchange or in their own private wallet.

00:40:22.404 --> 00:40:24.138
If it’s on an exchange, well,

00:40:24.140 --> 00:40:25.466
that would quickly be discovered,

00:40:25.468 --> 00:40:26.993
because he’s in their inbox.

00:40:26.999 --> 00:40:28.140
So, he’s just searching for every

00:40:28.140 --> 00:40:30.047
major exchange to see if that

00:40:30.049 --> 00:40:31.196
person has an account there.

00:40:31.819 --> 00:40:33.361
If they found an e-mail like Welcome

00:40:33.361 --> 00:40:35.423
to Coinbase, then they'd know this

00:40:35.423 --> 00:40:37.151
e-mail address has a Coinbase account,

00:40:37.566 --> 00:40:38.826
and they'd just go into Coinbase

00:40:38.827 --> 00:40:40.051
and say, I forgot my password.

00:40:40.308 --> 00:40:41.561
They'd say, no problem.

00:40:41.561 --> 00:40:44.366
We’ll e-mail you a recovery link,

00:40:44.367 --> 00:40:46.076
and they would recover the password.

00:40:46.680 --> 00:40:49.101
Boom, he would get into Coinbase and then

00:40:49.440 --> 00:40:51.686
have full control of someone else’s money.

00:40:52.348 --> 00:40:54.355
If the person is storing it in a private

00:40:54.356 --> 00:40:56.008
wallet, then to get access to that

00:40:56.010 --> 00:40:57.202
you would need the private key for

00:40:57.202 --> 00:40:59.092
that wallet or a seed phrase, which is

00:40:59.093 --> 00:41:00.649
what’s used to generate the private key.

00:41:01.008 --> 00:41:02.599
Ricky and his team understood what

00:41:02.600 --> 00:41:04.431
these keys and phrases looked like.

00:41:04.565 --> 00:41:06.846
So, he would look for them in the inbox.

00:41:07.366 --> 00:41:09.132
Because these are things that you never

00:41:09.133 --> 00:41:10.772
want to lose if you're holding crypto.

00:41:11.080 --> 00:41:12.814
A lot of people will just e-mail

00:41:12.815 --> 00:41:14.234
themselves the private keys.

00:41:14.526 --> 00:41:15.950
So, surprisingly, searching for

00:41:15.964 --> 00:41:17.636
‘private key’ or ‘seed phrase’

00:41:17.656 --> 00:41:20.145
resulted in finding crypto wallets.

00:41:20.868 --> 00:41:22.281
But sometimes people would take

00:41:22.285 --> 00:41:24.136
screenshots of these things and store them

00:41:24.136 --> 00:41:25.906
on their iCloud or Google Photos account.

00:41:25.942 --> 00:41:27.790
You know, for safe keeping.

00:41:28.183 --> 00:41:29.690
Surely no one has access

00:41:29.690 --> 00:41:31.357
to your photos, right?

00:41:31.936 --> 00:41:33.243
Well, this crew would rummage through

00:41:33.244 --> 00:41:35.323
those photos, looking for anything that

00:41:35.344 --> 00:41:38.118
looked like a photo of a password or a key

00:41:38.118 --> 00:41:40.620
or a wallet, anything sensitive like that.

00:41:41.171 --> 00:41:43.497
Eventually they would find a

00:41:43.502 --> 00:41:45.492
crypto wallet and drain it.

00:41:45.757 --> 00:41:46.925
RICKY: The people that would — that

00:41:46.926 --> 00:41:48.126
were in the e-mail would do that, and

00:41:48.127 --> 00:41:49.230
then they would send it out to one

00:41:49.230 --> 00:41:50.836
of our fresh wallets that we all had.

00:41:51.985 --> 00:41:52.531
JACK: And then from there

00:41:52.534 --> 00:41:53.798
split it however many ways.

00:41:53.801 --> 00:41:54.223
RICKY: Yeah.

00:41:54.423 --> 00:41:56.502
From there, then you split it separately.

00:41:56.828 --> 00:41:57.586
We're a group, so we

00:41:57.587 --> 00:41:58.442
always split everything.

00:41:58.825 --> 00:42:00.434
But like, I’m busy, I’m working.

00:42:00.758 --> 00:42:03.261
They have to just wait for me to be ready,

00:42:04.118 --> 00:42:06.146
'cause I typically had the burner phone.

00:42:06.517 --> 00:42:07.319
JACK: Ricky doesn't remember

00:42:07.319 --> 00:42:08.734
the first crypto heist he did.

00:42:08.740 --> 00:42:09.785
He says it was probably something

00:42:09.785 --> 00:42:11.718
low, like probably under $20,000.

00:42:12.082 --> 00:42:12.881
If you split that four

00:42:12.883 --> 00:42:14.493
ways, it’s way less, right?

00:42:14.877 --> 00:42:16.464
Because he was in this crew,

00:42:16.515 --> 00:42:17.814
and Ricky had a certain skill

00:42:17.816 --> 00:42:19.502
set that complimented his crew.

00:42:19.736 --> 00:42:21.051
RICKY: Mine was probably doxxing

00:42:21.060 --> 00:42:22.705
the person, finding the information.

00:42:22.707 --> 00:42:24.020
I had the burner phones.

00:42:24.144 --> 00:42:25.587
JACK: This was the beginning

00:42:25.819 --> 00:42:28.352
of Ricky’s crypto heist spree.

00:42:28.997 --> 00:42:30.305
We're gonna take a quick ad break

00:42:30.305 --> 00:42:31.432
here, but stay with us, because

00:42:31.437 --> 00:42:33.077
when we come back, I’m gonna

00:42:33.089 --> 00:42:34.310
introduce you to his mother.

00:42:36.990 --> 00:42:38.095
While researching this episode,

00:42:38.095 --> 00:42:39.598
I met this guy named Mark.

00:42:39.827 --> 00:42:41.668
MARK: My name is Mark Kreitzman, and

00:42:41.671 --> 00:42:44.460
I’m pretty much a lifelong tech guy.

00:42:44.644 --> 00:42:45.756
JACK: When I sat down with him to listen

00:42:45.756 --> 00:42:47.838
to his story, his story takes place at the

00:42:47.839 --> 00:42:50.196
same time Ricky was doing all this stuff.

00:42:50.259 --> 00:42:51.430
MARK: At the time I was working

00:42:51.430 --> 00:42:53.232
on something in the crypto space.

00:42:53.854 --> 00:42:56.312
I had been interviewed a couple

00:42:56.312 --> 00:42:57.767
times, so I was interviewed

00:42:57.768 --> 00:42:59.236
on a couple YouTube channels.

00:42:59.285 --> 00:43:03.631
I had my name and persona on the website

00:43:03.645 --> 00:43:05.214
that I was developing at the time.

00:43:06.102 --> 00:43:06.542
JACK: [Music] There was this

00:43:06.544 --> 00:43:08.797
night in 2018 that permanently

00:43:08.801 --> 00:43:10.263
burned into Mark’s memory.

00:43:10.591 --> 00:43:12.502
He remembers driving through the Arizona

00:43:12.502 --> 00:43:14.629
desert on his way to visit his dad.

00:43:15.872 --> 00:43:17.417
MARK: I was actually talking to my father,

00:43:17.433 --> 00:43:18.890
and then all of a sudden the line is dead.

00:43:19.997 --> 00:43:20.993
JACK: But Mark doesn't freak out.

00:43:21.006 --> 00:43:22.135
He’s driving through the Arizona

00:43:22.135 --> 00:43:23.809
desert, far from civilization.

00:43:24.040 --> 00:43:25.299
The reception isn't great out there,

00:43:25.300 --> 00:43:26.294
so he’s thinking, you know what?

00:43:26.295 --> 00:43:28.000
Maybe I’m just out of range of the towers.

00:43:28.195 --> 00:43:28.939
MARK: I was sitting there on

00:43:28.939 --> 00:43:30.268
my — on the dashboard, so I

00:43:30.268 --> 00:43:32.396
could see the front of the phone.

00:43:32.396 --> 00:43:34.840
It said — it was like a network

00:43:34.843 --> 00:43:38.422
disconnect error, and an SOS at the top.

00:43:39.033 --> 00:43:40.099
JACK: How strange.

00:43:40.386 --> 00:43:41.721
But he can't do anything now.

00:43:41.721 --> 00:43:44.361
There’s no cell service to call customer

00:43:44.361 --> 00:43:45.797
support even if he wanted, and he’s

00:43:45.798 --> 00:43:47.326
still driving to his dad’s house.

00:43:47.765 --> 00:43:48.819
Maybe it’ll start working

00:43:48.819 --> 00:43:49.470
when he gets there.

00:43:49.913 --> 00:43:51.051
Mark concentrates on the

00:43:51.053 --> 00:43:51.877
road in front of him.

00:43:52.301 --> 00:43:53.718
His headlights carve out a small

00:43:53.718 --> 00:43:54.971
bubble of light on the road.

00:43:55.989 --> 00:43:58.109
About ten minutes go by, and still

00:43:58.174 --> 00:44:00.114
his phone isn't connected to anything.

00:44:00.799 --> 00:44:02.285
Panic starts to sink in.

00:44:03.000 --> 00:44:04.599
He knew about SIM-swapping

00:44:04.605 --> 00:44:06.410
attacks, and now his thoughts

00:44:06.524 --> 00:44:07.611
were starting to eat him up.

00:44:08.105 --> 00:44:09.622
What if someone targeted him?

00:44:10.181 --> 00:44:11.440
His heart started racing.

00:44:12.199 --> 00:44:14.227
But this can't happen to Mark.

00:44:14.227 --> 00:44:15.292
He was smart about this.

00:44:15.294 --> 00:44:16.685
He put safeguards in place

00:44:16.903 --> 00:44:18.377
for this exact attack.

00:44:18.583 --> 00:44:20.944
It is not possible to SIM-swap him.

00:44:21.024 --> 00:44:23.035
He thought about this and he was ready.

00:44:23.590 --> 00:44:24.767
MARK: I knew that it could happen,

00:44:25.052 --> 00:44:27.187
and — but I thought — I had set up

00:44:27.187 --> 00:44:29.480
my account profile with the carrier

00:44:29.524 --> 00:44:33.326
to where if I wanted to make a change

00:44:33.326 --> 00:44:35.182
on my account, I would have to go

00:44:35.182 --> 00:44:37.252
into a store physically and have my

00:44:37.252 --> 00:44:39.345
driver’s license and my passport.

00:44:39.696 --> 00:44:41.404
JACK: Yeah, so, he set up his account to

00:44:41.404 --> 00:44:43.700
require two forms of ID, and he had to

00:44:43.707 --> 00:44:45.861
be present in the store for it to happen.

00:44:46.118 --> 00:44:48.064
There was no way to change

00:44:48.066 --> 00:44:49.482
his number over the phone.

00:44:50.270 --> 00:44:51.423
But despite putting those

00:44:51.423 --> 00:44:53.361
safeguards in place, his thoughts

00:44:53.361 --> 00:44:55.743
were still racing about what if?

00:44:55.957 --> 00:44:57.397
What if it did happen?

00:44:57.982 --> 00:44:59.386
There was no one around to help,

00:44:59.826 --> 00:45:01.322
and he had no working cell phone.

00:45:01.868 --> 00:45:03.078
He was all alone on the

00:45:03.078 --> 00:45:04.299
road with his thoughts.

00:45:04.863 --> 00:45:05.745
Maybe it’s just a

00:45:05.745 --> 00:45:06.942
network connection issue.

00:45:07.246 --> 00:45:08.659
Maybe the bill didn't get paid.

00:45:09.077 --> 00:45:10.020
Maybe the credit card

00:45:10.020 --> 00:45:11.034
got marked as stolen.

00:45:11.545 --> 00:45:12.471
What is it?

00:45:12.480 --> 00:45:13.268
What's wrong?

00:45:13.855 --> 00:45:15.773
A little over an hour goes by

00:45:15.827 --> 00:45:18.353
with no connection, and he finally

00:45:18.437 --> 00:45:19.915
arrives at his dad’s house.

00:45:20.209 --> 00:45:22.386
MARK: As soon as I got close to my

00:45:22.387 --> 00:45:24.598
parents’ house, the Wi-Fi kicks in and six

00:45:24.609 --> 00:45:26.646
password resets went right at my phone.

00:45:27.694 --> 00:45:29.221
So, that’s when I knew that

00:45:29.248 --> 00:45:30.942
it was an actual nightmare.

00:45:31.399 --> 00:45:33.040
My dad’s — opens the door.

00:45:33.631 --> 00:45:35.507
He wants to greet me, give me a hug,

00:45:35.507 --> 00:45:36.765
and I’m like, I got an emergency.

00:45:36.765 --> 00:45:38.468
I hadn't seen him in two years.

00:45:40.311 --> 00:45:40.974
It was panic.

00:45:40.976 --> 00:45:42.299
So, as soon as I got my mobile phone

00:45:42.304 --> 00:45:44.627
working, now I have to go deal with all

00:45:44.635 --> 00:45:47.620
the accounts, like the e-mail they got

00:45:47.621 --> 00:45:49.422
into to make sure they didn't set up some

00:45:49.428 --> 00:45:51.877
CC where it’s like, every e-mail I send

00:45:51.879 --> 00:45:54.623
out they get a copy without me knowing.

00:45:55.199 --> 00:45:56.630
JACK: So, when you see that, now

00:45:56.630 --> 00:45:58.650
you — now your suspicion is confirmed.

00:45:59.160 --> 00:46:01.617
So, I imagine your heart sank.

00:46:01.710 --> 00:46:03.524
MARK: [Music] Oh yeah, it was — I

00:46:03.524 --> 00:46:06.024
mean, I still have PTSD over it today.

00:46:08.015 --> 00:46:10.622
JACK: Six accounts, one attack.

00:46:10.988 --> 00:46:13.408
It all happened so fast, all

00:46:13.410 --> 00:46:14.807
while Mark was stuck behind the

00:46:14.808 --> 00:46:16.060
wheel in the middle of the desert,

00:46:16.095 --> 00:46:17.910
unable to do a thing about it.

00:46:18.174 --> 00:46:19.337
By the time he made it to his

00:46:19.337 --> 00:46:20.835
dad’s house, he called the carrier

00:46:20.837 --> 00:46:22.191
to try to find out what happened.

00:46:22.578 --> 00:46:23.763
MARK: Hey, I think something’s wrong.

00:46:23.763 --> 00:46:25.647
I think my mobile account got stolen away.

00:46:26.006 --> 00:46:27.285
JACK: The person on the line

00:46:27.307 --> 00:46:28.810
jumps into liability mode and

00:46:28.810 --> 00:46:30.751
wonders if Mark is the one lying.

00:46:31.084 --> 00:46:32.098
MARK: Well, how am I —? I

00:46:32.099 --> 00:46:33.410
called you on my phone.

00:46:33.757 --> 00:46:36.043
I was in such a panic that I rushed inside

00:46:36.044 --> 00:46:37.407
the house and called you from my cell

00:46:37.408 --> 00:46:39.098
phone, so how am I even able to call you?

00:46:39.551 --> 00:46:40.765
JACK: Good point, says the carrier.

00:46:40.991 --> 00:46:42.472
Mark quickly starts trying

00:46:42.473 --> 00:46:43.626
to recover his account.

00:46:43.687 --> 00:46:45.542
He knew he had been SIM-swapped.

00:46:45.605 --> 00:46:46.693
He knew his accounts were

00:46:46.694 --> 00:46:47.712
taken over by someone else.

00:46:47.712 --> 00:46:48.926
He knew people were trying to

00:46:48.926 --> 00:46:50.467
steal money from him right now.

00:46:50.485 --> 00:46:52.236
There was no time to say hi to dad.

00:46:52.406 --> 00:46:53.515
He rolls up his sleeves

00:46:53.532 --> 00:46:54.632
and gets busy trying to get

00:46:54.634 --> 00:46:55.892
control of his accounts again.

00:46:56.169 --> 00:46:57.888
Lucky for him, he was able to get his

00:46:57.890 --> 00:46:59.997
phone reconnected rather quickly, but

00:46:59.998 --> 00:47:02.338
the hackers had an hour head start.

00:47:02.743 --> 00:47:04.822
So, he’s racing to do damage control.

00:47:04.938 --> 00:47:06.605
He did a password reset on his e-mail.

00:47:06.641 --> 00:47:07.393
He got back in.

00:47:07.503 --> 00:47:09.457
He looked to see what e-mails came in that

00:47:09.457 --> 00:47:11.315
were password resets for a few accounts.

00:47:11.504 --> 00:47:12.640
MARK: It was a bank account, it

00:47:12.642 --> 00:47:14.869
was two crypto accounts, two cloud

00:47:14.869 --> 00:47:16.301
accounts, and an e-mail account.

00:47:16.648 --> 00:47:17.830
So, I have to reset them

00:47:17.830 --> 00:47:19.140
and check the details.

00:47:19.245 --> 00:47:20.950
JACK: One was his Coinbase account.

00:47:20.960 --> 00:47:22.883
Someone changed the password on it.

00:47:23.949 --> 00:47:25.590
That’s where he kept his Bitcoin.

00:47:25.830 --> 00:47:28.151
It’s not good to see that someone

00:47:28.341 --> 00:47:30.339
got access to his Coinbase wallet.

00:47:30.855 --> 00:47:32.442
He resets the password there and

00:47:32.442 --> 00:47:33.812
gets into it to see what happened.

00:47:34.062 --> 00:47:34.794
MARK: The only thing I had

00:47:34.794 --> 00:47:36.966
at that point was Bitcoin.

00:47:37.578 --> 00:47:38.930
It’s the only thing I cared about.

00:47:38.932 --> 00:47:40.183
I wasn't doing anything else.

00:47:40.185 --> 00:47:42.145
It was pure Bitcoin.

00:47:42.149 --> 00:47:45.408
So, they just took the 2.2 Bitcoin away.

00:47:46.111 --> 00:47:47.482
JACK: Dang, they stole all of it.

00:47:47.817 --> 00:47:49.044
It was everything he had.

00:47:49.567 --> 00:47:50.961
That wasn't worth a lot of money at

00:47:50.962 --> 00:47:53.335
the time, but still, they got him for

00:47:53.335 --> 00:47:55.748
everything, and it all happened so fast.

00:47:55.748 --> 00:47:56.836
Mark was mortified.

00:47:57.082 --> 00:47:57.767
It’s like coming to your

00:47:57.767 --> 00:47:59.106
house just to see the place

00:47:59.317 --> 00:48:01.122
ransacked, your valuables stolen.

00:48:01.465 --> 00:48:03.306
Suddenly you feel so vulnerable.

00:48:03.308 --> 00:48:04.352
You feel defenceless.

00:48:04.374 --> 00:48:05.544
You don't know if they're

00:48:05.544 --> 00:48:06.970
coming back or what's next.

00:48:07.128 --> 00:48:08.496
MARK: At that point my mobile service

00:48:08.501 --> 00:48:10.575
is working, but then every time I

00:48:10.575 --> 00:48:12.917
went to sleep, I’m thinking, well, are

00:48:12.917 --> 00:48:15.466
they gonna SIM-swap me an hour later

00:48:15.482 --> 00:48:18.084
and then port it back at 4:00 a.m.?

00:48:19.189 --> 00:48:21.133
So, for about sixty to ninety

00:48:21.133 --> 00:48:23.767
days, every day I woke up, whether

00:48:23.767 --> 00:48:25.437
it was 3:00 in the morning, 6:00,

00:48:25.437 --> 00:48:28.203
7:00 in the morning, I would look

00:48:28.205 --> 00:48:30.064
at my phone and see if it had LTE.

00:48:30.933 --> 00:48:33.526
I didn't use Wi-Fi for about ninety

00:48:33.526 --> 00:48:35.297
days because I was afraid that would

00:48:35.299 --> 00:48:37.732
mask it, where I’d wake up and — I’ve

00:48:37.769 --> 00:48:40.388
got Twitter updates, e-mail updates,

00:48:40.388 --> 00:48:43.038
whatever comes in on the phone over data.

00:48:43.057 --> 00:48:45.536
I might get tricked in thinking that

00:48:45.872 --> 00:48:47.774
the voice and the SMS is still working.

00:48:48.369 --> 00:48:50.529
JACK: [Music] Mark became obsessed with

00:48:50.552 --> 00:48:52.540
trying to find out who did this to him.

00:48:52.628 --> 00:48:54.587
He called the mobile provider over

00:48:54.651 --> 00:48:56.732
and over again seeking answers, but

00:48:56.732 --> 00:48:58.818
they refused to tell him anything.

00:48:59.128 --> 00:49:01.540
All he wanted to know was what employee,

00:49:01.575 --> 00:49:03.614
what store authorized this SIM-swap?

00:49:03.633 --> 00:49:04.966
Because he put those protections in

00:49:04.966 --> 00:49:06.548
place, so how did all that get ignored?

00:49:06.900 --> 00:49:07.991
But they were protecting their

00:49:07.991 --> 00:49:10.209
employees by not saying which employee

00:49:10.214 --> 00:49:11.641
did it or how it happened or what

00:49:11.644 --> 00:49:13.175
department did it or what store.

00:49:13.599 --> 00:49:16.045
But after a lot of persistence and a lucky

00:49:16.045 --> 00:49:18.860
break, he traced it back to an employee

00:49:18.907 --> 00:49:21.317
at a third-party phone store in Memphis,

00:49:21.326 --> 00:49:23.235
Tennessee — you know, the ones that say

00:49:23.481 --> 00:49:25.025
they're authorized resellers of a mobile

00:49:25.025 --> 00:49:27.932
provider — nowhere near where Mark lived.

00:49:28.561 --> 00:49:30.454
It happened to be that employee’s

00:49:30.477 --> 00:49:33.389
last day at work, and it looks like

00:49:33.389 --> 00:49:35.570
someone paid them to SIM-swap a

00:49:35.574 --> 00:49:37.407
few phone numbers before leaving.

00:49:37.989 --> 00:49:39.897
So, while it says very clearly in Mark’s

00:49:39.897 --> 00:49:41.973
account ‘Do not SIM-swap this customer

00:49:41.973 --> 00:49:43.861
unless they show two types of photo ID

00:49:43.866 --> 00:49:46.243
and are there in person’, the employee

00:49:46.316 --> 00:49:48.015
had enough privileges in the system to

00:49:48.017 --> 00:49:50.779
simply type, yeah, I saw both IDs and he

00:49:50.779 --> 00:49:53.261
was here in person, and he was able to

00:49:53.269 --> 00:49:54.971
conduct the SIM-swap, because at the end

00:49:54.973 --> 00:49:56.397
of the day, that’s all this really is.

00:49:56.703 --> 00:49:58.238
It’s a confirmation on a computer

00:49:58.240 --> 00:50:00.014
somewhere that you saw both IDs.

00:50:00.556 --> 00:50:02.051
Mark says that’s as far as he

00:50:02.052 --> 00:50:03.239
got with his investigation.

00:50:03.241 --> 00:50:04.861
He doesn't know where his money

00:50:04.862 --> 00:50:06.221
went or who actually stole it.

00:50:06.634 --> 00:50:07.865
Just because the guy in the store

00:50:07.865 --> 00:50:09.380
did the SIM-swap doesn't mean that

00:50:09.380 --> 00:50:10.663
he’s the one who stole the crypto.

00:50:10.859 --> 00:50:13.149
He just got paid his cut for

00:50:13.168 --> 00:50:15.834
doing the swap, which is known as

00:50:15.835 --> 00:50:17.777
an innie, an insider to help you

00:50:18.034 --> 00:50:19.476
get someone else’s phone number.

00:50:20.225 --> 00:50:22.121
While this absolutely terrified Mark

00:50:22.122 --> 00:50:24.578
and infuriated him, he didn't feel like

00:50:24.578 --> 00:50:25.819
it was a big enough loss for him to

00:50:25.824 --> 00:50:27.881
open an investigation and go to court.

00:50:28.504 --> 00:50:30.391
Even if he somehow recovered his Bitcoin,

00:50:30.395 --> 00:50:31.875
it would cause way more in lawyer

00:50:31.875 --> 00:50:33.388
fees and it just wouldn't be worth it.

00:50:33.865 --> 00:50:35.136
So, he let it go.

00:50:35.435 --> 00:50:36.962
The thieves got away cleanly

00:50:36.964 --> 00:50:38.906
with his 2.2 Bitcoin.

00:50:39.982 --> 00:50:41.509
It’s been over a decade now

00:50:41.514 --> 00:50:42.911
since this attack, and still

00:50:43.007 --> 00:50:44.647
Mark can't fully shake this.

00:50:44.852 --> 00:50:46.404
Like, every time he flies, he gets a

00:50:46.404 --> 00:50:48.491
little worried that his phone service is

00:50:48.493 --> 00:50:50.343
going to be disconnected for a few hours.

00:50:50.547 --> 00:50:51.861
Like, a twenty-hour trip to

00:50:51.870 --> 00:50:54.216
Asia is pure agony for him

00:50:54.600 --> 00:50:56.236
after being a victim like this.

00:50:56.538 --> 00:50:57.727
MARK: I mean, I still

00:50:57.729 --> 00:50:59.741
have PTSD over it today.

00:51:00.388 --> 00:51:02.598
Not to take away from real PTSD, but it’s

00:51:02.598 --> 00:51:07.229
sort of this digital PTSD of not knowing.

00:51:07.410 --> 00:51:08.991
Every time I wake up, it’s like, okay,

00:51:08.991 --> 00:51:10.481
I’m gonna log into my computer, log

00:51:10.483 --> 00:51:13.772
in, open up my phone, and of course

00:51:13.782 --> 00:51:15.665
everything has been safe since then.

00:51:16.740 --> 00:51:18.095
But yeah, it was painful.

00:51:18.096 --> 00:51:19.610
I was very angry for months.

00:51:19.626 --> 00:51:20.876
I couldn't sleep for months.

00:51:21.103 --> 00:51:22.157
JACK: But despite this being a

00:51:22.157 --> 00:51:24.642
traumatizing moment for Mark, he used it

00:51:24.665 --> 00:51:26.682
as sort of an origin story of his own.

00:51:27.042 --> 00:51:28.775
He was so sick of mobile providers

00:51:28.778 --> 00:51:30.578
being pointless at protecting us

00:51:30.578 --> 00:51:32.176
against SIM-swaps that he started his

00:51:32.177 --> 00:51:34.947
own service to stop people who try

00:51:34.948 --> 00:51:36.488
to hijack phone numbers like this.

00:51:36.826 --> 00:51:38.428
His company is called Efani.

00:51:38.700 --> 00:51:40.164
It’s a mobile carrier that resells

00:51:40.167 --> 00:51:42.101
AT&T and Verizon service with one

00:51:42.103 --> 00:51:44.137
big difference; extra protection

00:51:44.194 --> 00:51:45.693
against SIM-swap attacks.

00:51:45.894 --> 00:51:47.928
As we heard from Ricky Handschumacher,

00:51:48.196 --> 00:51:49.863
the social engineering starts long

00:51:49.863 --> 00:51:51.439
before the phone call even starts.

00:51:51.598 --> 00:51:53.182
As he told me, he found many of

00:51:53.182 --> 00:51:54.441
his targets because they were just

00:51:54.469 --> 00:51:56.616
too public about their crypto.

00:51:57.046 --> 00:51:58.772
Someone would post on Twitter, excited

00:51:58.772 --> 00:52:00.838
that their coin is going up, or spoke

00:52:00.838 --> 00:52:03.027
on a panel about investing in certain

00:52:03.028 --> 00:52:05.094
coins and then posting that to YouTube,

00:52:05.367 --> 00:52:07.001
or they would share tips on what to

00:52:07.002 --> 00:52:08.826
invest and how to store your coins.

00:52:09.126 --> 00:52:10.352
It’s all an attacker needs

00:52:10.352 --> 00:52:11.544
to hone in on their targets.

00:52:11.545 --> 00:52:13.214
The more they know about what accounts

00:52:13.215 --> 00:52:14.887
you have or what coins you have or what

00:52:14.888 --> 00:52:16.760
software you use, then the more they can

00:52:16.762 --> 00:52:19.338
use that to craft an attack just for you.

00:52:19.764 --> 00:52:21.200
I always tell people the number-one

00:52:21.200 --> 00:52:22.844
rule about having crypto is don't

00:52:22.908 --> 00:52:25.483
tell anyone you have crypto, because

00:52:25.504 --> 00:52:27.326
even if your digital security is

00:52:27.333 --> 00:52:29.121
tip top, I’ve heard stories about

00:52:29.122 --> 00:52:30.884
people getting drugged or robbed at

00:52:30.885 --> 00:52:32.945
gunpoint to get someone’s crypto.

00:52:33.472 --> 00:52:34.672
It’s brutal out there.

00:52:35.368 --> 00:52:37.709
For Mark, all that became a very

00:52:37.711 --> 00:52:39.406
painful lesson that he still thinks

00:52:39.409 --> 00:52:41.643
about nearly a decade after his attack.

00:52:41.930 --> 00:52:44.613
MARK: With crypto, my wife knows that

00:52:44.613 --> 00:52:46.346
when I’m gonna do anything with crypto,

00:52:46.348 --> 00:52:48.799
it’s like, stay thirty feet away from me.

00:52:49.491 --> 00:52:51.127
I don't want any distractions.

00:52:51.127 --> 00:52:53.194
I don't want anybody asking me a question.

00:52:54.451 --> 00:52:56.913
I’m just really very conscious now about

00:52:57.419 --> 00:52:59.837
the fact that most hacking — a lot of

00:52:59.842 --> 00:53:02.743
people think that hackers are trying

00:53:02.743 --> 00:53:04.592
to hack into your laptop or they're

00:53:04.593 --> 00:53:07.392
trying to hack into the back end of

00:53:07.393 --> 00:53:10.116
your Android phone, your iOS phone.

00:53:10.634 --> 00:53:12.540
But the reality is is that it’s probably

00:53:12.540 --> 00:53:15.560
like 99% of hacking is hacking the

00:53:15.560 --> 00:53:17.986
human mind, and it’s trying to get

00:53:18.051 --> 00:53:21.741
you to make a mistake or a company,

00:53:21.752 --> 00:53:23.507
somebody that works at a company that

00:53:23.509 --> 00:53:25.786
you rely on for them to make a mistake.

00:53:26.534 --> 00:53:27.656
It really just comes

00:53:27.656 --> 00:53:29.151
down to hacking the mind.

00:53:29.540 --> 00:53:30.981
JACK: We have no idea if Ricky

00:53:31.011 --> 00:53:32.252
actually hacked Mark or not.

00:53:32.287 --> 00:53:33.750
He probably didn't, but I wanted

00:53:33.750 --> 00:53:35.952
to talk with Mark because I wanted

00:53:35.952 --> 00:53:36.966
to get a feeling of what that

00:53:36.966 --> 00:53:38.449
scenario is like for the victim.

00:53:38.630 --> 00:53:39.784
What does the SIM-swap look

00:53:39.785 --> 00:53:40.830
like from the other side?

00:53:41.026 --> 00:53:42.035
It sounds awful.

00:53:42.129 --> 00:53:43.101
Nobody should have their

00:53:43.102 --> 00:53:44.221
stuff stolen like that.

00:53:44.664 --> 00:53:46.903
Ricky didn't just stop at one heist.

00:53:47.102 --> 00:53:48.391
Once he got a taste of the money

00:53:48.392 --> 00:53:50.170
that he could steal, he was hooked.

00:53:50.333 --> 00:53:52.805
He wanted to do this again and again, and

00:53:52.805 --> 00:53:54.704
very quickly, the money started adding up.

00:53:54.982 --> 00:53:57.461
In 2018, the year Mark was targeted,

00:53:57.798 --> 00:54:00.616
Ricky Handschumacher and his crew got so

00:54:00.616 --> 00:54:02.131
good at this that they were bringing in

00:54:02.144 --> 00:54:04.133
millions of dollars from their victims.

00:54:04.368 --> 00:54:05.417
RICKY: We found the money, we send

00:54:05.417 --> 00:54:08.430
it out, and — a couple million here,

00:54:08.446 --> 00:54:09.792
a couple hundred thousand there.

00:54:10.581 --> 00:54:11.186
It adds up.

00:54:11.510 --> 00:54:13.518
JACK: These numbers are startling, right?

00:54:14.927 --> 00:54:16.359
You've had to be surprised by your

00:54:16.361 --> 00:54:18.587
first big hundred-thousand-dollar

00:54:18.588 --> 00:54:20.490
or million-dollar lick.

00:54:20.547 --> 00:54:21.105
RICKY: Yeah.

00:54:21.147 --> 00:54:22.856
When I started doing it all, like

00:54:22.863 --> 00:54:24.363
actually SIM-swapping and crypto and

00:54:24.364 --> 00:54:27.672
stuff, like late teenager, maybe twenty

00:54:27.778 --> 00:54:30.219
— and I was like, damn, dude, I’m making

00:54:30.220 --> 00:54:33.959
more than people make in a lifetime,

00:54:34.353 --> 00:54:38.795
or more than their decade of a salary.

00:54:38.890 --> 00:54:40.310
I’m making that in ten minutes.

00:54:45.756 --> 00:54:47.026
JACK: [Music] Ricky said that he would

00:54:47.027 --> 00:54:48.456
sometimes pay an employee at a cell

00:54:48.456 --> 00:54:50.203
phone store a couple hundred bucks to

00:54:50.203 --> 00:54:53.254
help them do a SIM-swap, an insider who

00:54:53.254 --> 00:54:55.374
could bypass the security protections,

00:54:55.674 --> 00:54:57.013
just like what happened to Mark.

00:54:57.924 --> 00:55:00.316
This insider, he says, didn't know exactly

00:55:00.318 --> 00:55:02.132
how much was being stolen in crypto.

00:55:02.439 --> 00:55:03.474
They were just happy to get a few

00:55:03.474 --> 00:55:04.498
hundred bucks to change someone’s

00:55:04.501 --> 00:55:05.513
phone number in the system.

00:55:05.928 --> 00:55:07.204
But that was nothing compared to

00:55:07.204 --> 00:55:08.699
the lion’s share that Ricky and

00:55:08.712 --> 00:55:10.059
his crew would get from the heist.

00:55:10.336 --> 00:55:11.334
RICKY: So, once I had a couple

00:55:11.334 --> 00:55:12.594
million, I was like, damn,

00:55:14.314 --> 00:55:16.481
my moral compass checked in.

00:55:16.482 --> 00:55:19.033
I’m like, actually

00:55:19.034 --> 00:55:20.320
screwing people’s lives up.

00:55:20.558 --> 00:55:21.680
I have my own kid.

00:55:22.086 --> 00:55:24.167
My kid’s gonna be set for life,

00:55:24.571 --> 00:55:27.527
like just living life now.

00:55:28.347 --> 00:55:29.610
But we just kept going.

00:55:30.143 --> 00:55:31.063
It was like — almost like

00:55:31.063 --> 00:55:32.138
an addiction at this point.

00:55:32.687 --> 00:55:33.939
JACK: While all this was going on,

00:55:33.939 --> 00:55:35.499
Ricky was living a double life.

00:55:35.629 --> 00:55:37.267
He had just turned eighteen.

00:55:37.274 --> 00:55:38.535
He had just finished high school.

00:55:38.538 --> 00:55:39.663
He did not get the baseball

00:55:39.663 --> 00:55:40.725
scholarship for college.

00:55:41.066 --> 00:55:42.977
He did get a girlfriend, and they

00:55:42.977 --> 00:55:44.551
had a kid together, and he was

00:55:44.551 --> 00:55:45.886
still living at home with his mom.

00:55:46.687 --> 00:55:49.009
He had a 9:00 to 5:00 job for the county’s

00:55:49.038 --> 00:55:51.279
park and recreation department, you know,

00:55:51.279 --> 00:55:53.656
to keep up with the ruse that he’s got

00:55:53.656 --> 00:55:55.682
some normal job with a regular income.

00:55:56.091 --> 00:55:57.897
But of course, that job was boring

00:55:57.968 --> 00:55:59.397
compared to his online world,

00:55:59.622 --> 00:56:00.886
where millions of dollars were

00:56:00.886 --> 00:56:02.173
passing through his fingers.

00:56:02.486 --> 00:56:04.154
RICKY: So, I was just changing

00:56:04.154 --> 00:56:05.343
trash bags and stuff like that at

00:56:05.343 --> 00:56:06.937
a park, sitting in a work truck.

00:56:06.937 --> 00:56:08.093
So, I had all the time in the

00:56:08.093 --> 00:56:09.718
world to just be on my phone, like

00:56:09.730 --> 00:56:11.038
talking to everybody on Discord

00:56:11.040 --> 00:56:12.029
or Skype or something like that.

00:56:15.002 --> 00:56:17.296
While I’m at work, we're just

00:56:18.051 --> 00:56:19.176
hitting targets for crypto.

00:56:20.184 --> 00:56:21.754
DEBBIE: I had no idea, a

00:56:21.755 --> 00:56:22.947
boy that works for the city.

00:56:23.375 --> 00:56:25.128
JACK: This is Debbie, Ricky’s mom.

00:56:25.294 --> 00:56:26.679
DEBBIE: He had a county job.

00:56:27.120 --> 00:56:28.236
It wasn't the best money,

00:56:28.236 --> 00:56:29.581
but I was happy he had it.

00:56:29.585 --> 00:56:31.499
He had good benefits, he had retirement

00:56:31.588 --> 00:56:33.946
with it, and he went to work every day.

00:56:34.259 --> 00:56:35.819
JACK: She had no idea her son was

00:56:35.821 --> 00:56:37.349
living this double life, bringing

00:56:37.349 --> 00:56:39.117
in anywhere from $100,000 to a

00:56:39.124 --> 00:56:40.551
million dollars from victims.

00:56:41.021 --> 00:56:42.247
But having all this Bitcoin was

00:56:42.290 --> 00:56:45.053
pointless unless Ricky could spend it,

00:56:45.286 --> 00:56:47.101
and this is where he had to be careful.

00:56:47.314 --> 00:56:49.714
Crypto exchanges require KYC, which

00:56:49.714 --> 00:56:50.964
stands for ‘know your customer’.

00:56:51.019 --> 00:56:52.790
They want your full name and picture

00:56:52.793 --> 00:56:54.537
of your ID before they will let you

00:56:54.698 --> 00:56:56.694
exchange cryptocurrency for cash.

00:56:57.161 --> 00:56:58.432
So, that wasn't going to work.

00:56:58.432 --> 00:57:00.305
His Bitcoin wallet was likely marked as

00:57:00.308 --> 00:57:03.007
fraudulent, and if he used an exchange

00:57:03.016 --> 00:57:04.747
and gave them his name, then they

00:57:04.748 --> 00:57:05.919
would probably call the cops on him.

00:57:06.357 --> 00:57:08.188
So, he needed a new plan, a way to cash

00:57:08.192 --> 00:57:10.034
out Bitcoin without using an exchange,

00:57:10.226 --> 00:57:12.602
and basically he just found another

00:57:12.602 --> 00:57:14.484
person in the world who would do it.

00:57:14.781 --> 00:57:16.243
Like, he would send them the Bitcoin

00:57:16.243 --> 00:57:17.402
and they would hand him cash.

00:57:17.768 --> 00:57:20.241
He met them through localbitcoins.com.

00:57:20.529 --> 00:57:22.185
RICKY: I had a guy in the Tampa area.

00:57:22.332 --> 00:57:25.194
If I needed $20,000 cash or less, I can

00:57:25.196 --> 00:57:27.639
go to him, or if I needed more, I had

00:57:27.639 --> 00:57:31.439
a guy that was in Miami, and he never

00:57:31.439 --> 00:57:32.790
scammed me, but I would send him the

00:57:32.794 --> 00:57:34.321
crypto and he would mail me the cash.

00:57:35.339 --> 00:57:36.011
JACK: Yeah, let’s talk

00:57:36.020 --> 00:57:37.127
about both of these, right?

00:57:37.129 --> 00:57:38.534
So, when you go to meet someone,

00:57:38.840 --> 00:57:40.047
how does this meet go down?

00:57:41.718 --> 00:57:42.424
RICKY: Typically it was at

00:57:42.578 --> 00:57:43.596
a McDonald’s or something.

00:57:43.596 --> 00:57:44.743
We would just go sit in the booth.

00:57:44.743 --> 00:57:46.051
I would send him the Bitcoin.

00:57:46.127 --> 00:57:47.459
We would wait for the confirmations

00:57:47.459 --> 00:57:48.937
and for him to get it in his account,

00:57:49.673 --> 00:57:51.586
and he would give me the cash.

00:57:51.991 --> 00:57:53.462
Prior to that, though, we had the

00:57:53.464 --> 00:57:56.093
deal locked in at a certain amount,

00:57:56.187 --> 00:57:57.607
'cause Bitcoin would go up and down.

00:57:58.346 --> 00:57:59.388
But I would typically just

00:57:59.406 --> 00:58:01.707
lock in the deal, and I’d

00:58:01.716 --> 00:58:03.212
be — okay, we’ll meet at 7:00.

00:58:03.218 --> 00:58:04.209
This is where we’re going.

00:58:04.221 --> 00:58:05.221
He would send me an address,

00:58:05.223 --> 00:58:06.201
and I would just go there.

00:58:06.520 --> 00:58:07.211
JACK: And then he’d just

00:58:07.239 --> 00:58:08.256
hand you an envelope?

00:58:08.716 --> 00:58:09.886
RICKY: Yeah, or just straight

00:58:09.888 --> 00:58:11.216
cash or an envelope and whatnot.

00:58:11.225 --> 00:58:12.926
But it was always a public place.

00:58:12.971 --> 00:58:15.067
It was never in a dark alley

00:58:15.067 --> 00:58:16.131
or anything crazy like that.

00:58:16.471 --> 00:58:17.618
JACK: That’s the classic way

00:58:17.629 --> 00:58:19.312
LocalBitcoins worked; you meet

00:58:19.314 --> 00:58:20.493
someone in person, you send them the

00:58:20.497 --> 00:58:21.973
Bitcoin, and they hand you the cash.

00:58:22.301 --> 00:58:23.470
Of course, they’d take a

00:58:23.471 --> 00:58:24.734
percentage for doing this deal.

00:58:24.736 --> 00:58:27.120
Maybe they'd give Ricky 95% of the money

00:58:27.120 --> 00:58:28.999
and keep 5% for themselves for the trouble

00:58:28.999 --> 00:58:30.600
of having to launder these Bitcoins.

00:58:31.109 --> 00:58:32.339
So, he actually had a lot of people

00:58:32.339 --> 00:58:34.408
making decent money on LocalBitcoins

00:58:34.419 --> 00:58:35.828
just buying crypto off people.

00:58:36.196 --> 00:58:37.697
But eventually Ricky needed to cash

00:58:37.700 --> 00:58:39.834
out bigger and bigger amounts, and this

00:58:39.836 --> 00:58:41.785
person he was working with wasn't able

00:58:41.785 --> 00:58:43.781
to cash out what he needed, so Ricky

00:58:43.788 --> 00:58:46.268
had to find someone new, and this new

00:58:46.286 --> 00:58:48.467
person was like, send me the Bitcoin;

00:58:48.614 --> 00:58:50.302
I’ll send you the cash in the mail.

00:58:50.535 --> 00:58:53.047
RICKY: It typically would just come

00:58:53.105 --> 00:58:59.183
in a vacuum-sealed, clear envelope

00:58:59.464 --> 00:59:01.274
wrapped in another envelope kinda thing.

00:59:02.203 --> 00:59:04.458
Sometimes it would be inside of a book,

00:59:04.494 --> 00:59:06.548
like a big Harry Potter book or something

00:59:06.549 --> 00:59:08.911
like that, and the pages would be cut

00:59:08.911 --> 00:59:10.457
out and the money would be in there.

00:59:11.014 --> 00:59:12.536
What's funny is I lived with my

00:59:12.537 --> 00:59:14.719
mom, so packages are coming to the

00:59:14.721 --> 00:59:17.366
house, but I’m eighteen years old.

00:59:17.528 --> 00:59:18.728
She’s not going through my mail.

00:59:18.751 --> 00:59:19.869
So, she would just take the envelope,

00:59:19.879 --> 00:59:20.898
put it on my bed, and she’d be

00:59:20.898 --> 00:59:22.032
like, hey, the mail came for you.

00:59:22.523 --> 00:59:23.967
She had no idea what was inside of it.

00:59:24.439 --> 00:59:26.986
JACK: Alright, so you're

00:59:27.477 --> 00:59:29.668
loading it up in crypto here.

00:59:29.709 --> 00:59:30.411
Things are coming in,

00:59:30.423 --> 00:59:32.284
$100,000, $1 million at a time.

00:59:33.104 --> 00:59:34.681
So, you're leading a double life here.

00:59:35.608 --> 00:59:36.369
You're living with your mom.

00:59:36.369 --> 00:59:38.983
Does she have any idea that you're doing

00:59:38.984 --> 00:59:40.409
any of this stuff, involved with this?

00:59:41.125 --> 00:59:41.856
RICKY: First of all, she doesn't really

00:59:41.866 --> 00:59:45.765
understand what the hell crypto was, and

00:59:46.152 --> 00:59:48.915
she was like, Ricky, what are you doing?

00:59:49.026 --> 00:59:49.984
How do you have all this money?

00:59:50.495 --> 00:59:54.252
I bought a $100,000 F-250 Ford truck,

00:59:54.582 --> 00:59:56.946
I had jet skis, I had side-by-sides.

00:59:56.946 --> 00:59:58.556
I had a lot of toys and stuff like that.

00:59:59.113 --> 01:00:01.297
DEBBIE: It really got my attention

01:00:01.448 --> 01:00:02.768
when he came home with the truck.

01:00:03.450 --> 01:00:05.006
I said, what is going on?

01:00:05.158 --> 01:00:06.046
RICKY: I would just lie to her.

01:00:06.229 --> 01:00:07.886
Like, yo, I invested back then.

01:00:09.386 --> 01:00:10.589
At the time when I started, Bitcoin

01:00:10.602 --> 01:00:12.163
was a couple hundred dollars, and

01:00:12.163 --> 01:00:14.774
now it’s, let’s say, $3,000, $6,000.

01:00:15.154 --> 01:00:16.908
So, I made a lot just from

01:00:16.908 --> 01:00:18.154
that, that little growth.

01:00:18.986 --> 01:00:20.009
So, I was able — but

01:00:20.312 --> 01:00:21.167
that’s what I told her.

01:00:21.231 --> 01:00:24.285
Meanwhile I’m stealing it, but — so, she

01:00:24.285 --> 01:00:26.383
has really no idea the severity of it.

01:00:28.975 --> 01:00:30.517
So, my mom, she believed me.

01:00:30.522 --> 01:00:32.075
She believed that I was saying there’s

01:00:32.078 --> 01:00:34.100
no reason for her not to believe me.

01:00:34.741 --> 01:00:35.985
DEBBIE: He never gave me a reason

01:00:35.986 --> 01:00:37.699
not to believe what he was doing was

01:00:37.699 --> 01:00:40.860
wrong, 'cause he wasn't that kinda kid.

01:00:41.444 --> 01:00:42.569
JACK: Ricky’s crypto investment

01:00:42.577 --> 01:00:44.569
explanation wasn't a total lie.

01:00:44.581 --> 01:00:46.563
He did have Bitcoin investments,

01:00:46.822 --> 01:00:47.779
and Debbie didn't have

01:00:47.779 --> 01:00:48.953
any reason to question it.

01:00:49.296 --> 01:00:50.837
After all, her own mother, Ricky’s

01:00:50.853 --> 01:00:52.250
grandmother, dabbled in Bitcoin,

01:00:52.269 --> 01:00:54.250
too, so she knew it was real.

01:00:54.587 --> 01:00:56.540
Ricky also had a young kid at home,

01:00:56.884 --> 01:00:58.346
and Debbie thought why would he do

01:00:58.348 --> 01:01:00.084
anything to throw his life away?

01:01:00.409 --> 01:01:01.468
DEBBIE: I was a single mom.

01:01:01.471 --> 01:01:03.046
I did the best I could

01:01:03.047 --> 01:01:03.911
growing up with him.

01:01:03.939 --> 01:01:05.205
He was a very honest child,

01:01:05.205 --> 01:01:06.913
never got in trouble, never

01:01:06.913 --> 01:01:09.096
was in the principal’s office.

01:01:09.098 --> 01:01:10.435
He didn't get in fights.

01:01:11.008 --> 01:01:12.866
So, when he came home with the truck,

01:01:12.866 --> 01:01:14.824
I just said, I don't know what you're

01:01:14.826 --> 01:01:17.459
doing or what's going on, but that’s

01:01:17.459 --> 01:01:20.304
not normal, and all I know is if you get

01:01:20.314 --> 01:01:22.475
in trouble, there’s not much I can do.

01:01:24.225 --> 01:01:26.564
I mean, I — and I said — at that time it

01:01:26.564 --> 01:01:31.506
was just his daughter, and between the

01:01:31.506 --> 01:01:34.122
mom and my son being the parents to this

01:01:34.124 --> 01:01:37.933
child, they were both younger, and I was

01:01:37.937 --> 01:01:39.442
fairly involved with my granddaughter.

01:01:39.988 --> 01:01:41.872
I just said to him, it’s

01:01:41.879 --> 01:01:43.076
just not your life anymore.

01:01:43.077 --> 01:01:44.589
You have a child involved here.

01:01:45.000 --> 01:01:46.437
JACK: Debbie believed her son and

01:01:46.437 --> 01:01:48.156
was proud of him, and had no reason

01:01:48.156 --> 01:01:49.226
to think he would lie to her.

01:01:49.692 --> 01:01:51.441
In fact, she thought Ricky’s crypto

01:01:51.452 --> 01:01:53.750
savviness could actually help others.

01:01:54.191 --> 01:01:56.036
At the time she worked as a nurse

01:01:56.078 --> 01:01:59.133
in the Pasco County Jail, and one

01:01:59.133 --> 01:02:01.045
day she overheard some sheriff’s

01:02:01.045 --> 01:02:03.198
deputies yapping about crypto.

01:02:03.518 --> 01:02:05.302
DEBBIE: I assumed at this point my son

01:02:05.302 --> 01:02:07.440
was doing really good with crypto, 'cause

01:02:07.441 --> 01:02:09.529
that’s what — the vision I was getting.

01:02:10.263 --> 01:02:12.814
I kinda went into work and

01:02:12.814 --> 01:02:14.785
was saying, yeah, my son does

01:02:15.394 --> 01:02:19.250
crypto, Bitcoin, and he’s done

01:02:19.250 --> 01:02:20.530
really well, and they've matured.

01:02:20.630 --> 01:02:21.876
I remember one of the deputies

01:02:22.087 --> 01:02:23.239
was really interested.

01:02:23.246 --> 01:02:24.091
He’s like, really?

01:02:24.337 --> 01:02:25.227
RICKY: They were like, oh,

01:02:25.227 --> 01:02:26.440
we’d love to talk to him.

01:02:26.825 --> 01:02:27.509
DEBBIE: I was like, yeah, he’s

01:02:27.510 --> 01:02:28.591
doing really good with it.

01:02:29.227 --> 01:02:30.224
One of the guys, one of the

01:02:30.225 --> 01:02:31.461
deputies, wanted to get with

01:02:31.461 --> 01:02:32.616
him and speak with my son.

01:02:32.651 --> 01:02:34.573
RICKY: So, next thing you know my

01:02:34.573 --> 01:02:36.271
mom is having me call these police

01:02:36.271 --> 01:02:37.528
officers and they're coming to

01:02:37.529 --> 01:02:39.305
the house to ask me about crypto.

01:02:39.307 --> 01:02:40.519
They're asking me about investing.

01:02:40.521 --> 01:02:42.253
They're asking me like, what do I think?

01:02:42.322 --> 01:02:43.166
I just went along with it.

01:02:43.167 --> 01:02:44.423
Like, yeah, crypto’s great.

01:02:44.596 --> 01:02:45.671
This is what I recommend.

01:02:46.585 --> 01:02:48.522
I recommend Bitcoin or Ethereum.

01:02:48.857 --> 01:02:50.298
I think XRP was actually

01:02:50.318 --> 01:02:51.629
blowing up at that time, too.

01:02:52.365 --> 01:02:53.804
I think I made a lot off XRP,

01:02:53.811 --> 01:02:55.928
actually, which — not legitly,

01:02:56.237 --> 01:02:59.388
but I used my dirty money and

01:02:59.446 --> 01:03:01.235
put it into XRP, and XRP blew up.

01:03:02.711 --> 01:03:03.504
I was telling them about

01:03:03.504 --> 01:03:05.353
that, and they were loving it.

01:03:05.362 --> 01:03:06.306
So, they were just like, okay,

01:03:06.306 --> 01:03:08.167
cool, thanks for chatting.

01:03:08.843 --> 01:03:10.488
They had no idea I was stealing it.

01:03:11.397 --> 01:03:12.632
JACK: And how were you feeling inside?

01:03:13.341 --> 01:03:14.051
RICKY: Oh, I’m nervous.

01:03:14.052 --> 01:03:15.149
I’m like, mom — that’s when I told her.

01:03:15.153 --> 01:03:15.963
Like, yo, never again.

01:03:16.227 --> 01:03:17.699
Don't tell people what I do.

01:03:17.935 --> 01:03:18.762
DEBBIE: [Music] I said to Ricky,

01:03:18.763 --> 01:03:20.412
and you let this deputy come

01:03:20.412 --> 01:03:22.324
to the house and talk to you?

01:03:25.169 --> 01:03:27.189
JACK: By 2018 the walls

01:03:27.198 --> 01:03:28.448
started closing in on Ricky.

01:03:28.808 --> 01:03:30.839
He says he has a hunch of when

01:03:30.839 --> 01:03:32.140
it all started to unravel.

01:03:32.703 --> 01:03:33.519
One night he was doing a

01:03:33.519 --> 01:03:35.283
SIM-swap, a crypto heist with

01:03:35.283 --> 01:03:36.904
some other guys online, his crew.

01:03:37.600 --> 01:03:40.682
One of the guys was a younger kid, and

01:03:40.682 --> 01:03:43.412
this younger kid was posing as an AT&T

01:03:43.412 --> 01:03:45.167
employee trying to social engineer

01:03:45.169 --> 01:03:47.158
someone into doing the SIM-swap for him.

01:03:47.674 --> 01:03:49.290
But little did this kid know, his

01:03:49.290 --> 01:03:50.759
mother was listening through the

01:03:50.759 --> 01:03:52.500
door, and she heard him trying

01:03:52.502 --> 01:03:54.172
to scam someone on the phone.

01:03:54.851 --> 01:03:57.734
That kid’s mom called the cops on her son,

01:03:57.746 --> 01:04:00.025
and that kid got arrested in Michigan.

01:04:00.761 --> 01:04:03.120
Ricky and his crew did not know this.

01:04:03.357 --> 01:04:04.415
All they knew was that

01:04:04.415 --> 01:04:05.428
kid suddenly went missing.

01:04:05.428 --> 01:04:06.269
That’s strange.

01:04:06.664 --> 01:04:08.282
But they had no idea he got arrested.

01:04:08.955 --> 01:04:11.479
But then that kid came back out of the

01:04:11.479 --> 01:04:14.235
blue and really, really, really badly

01:04:14.235 --> 01:04:15.984
wanted to get in on the action again.

01:04:16.417 --> 01:04:18.892
Ricky suspected that’s really weird that

01:04:18.893 --> 01:04:20.518
this kid got a bunch of money from a

01:04:20.531 --> 01:04:22.579
crypto heist and then disappeared for

01:04:22.579 --> 01:04:24.333
a while and now really wants back in.

01:04:25.109 --> 01:04:26.363
They kept that kid at arm’s

01:04:26.363 --> 01:04:28.148
length, but that didn't matter.

01:04:28.148 --> 01:04:29.437
Another one of Ricky’s friends

01:04:29.437 --> 01:04:31.285
was arrested shortly after, who

01:04:31.286 --> 01:04:33.332
was also present on that same call

01:04:33.333 --> 01:04:34.784
where the kid’s mom overheard them.

01:04:35.208 --> 01:04:37.323
Joel Ortiz was arrested for

01:04:37.325 --> 01:04:38.864
SIM-swapping and stealing millions

01:04:38.864 --> 01:04:40.873
of dollars in crypto from victims.

01:04:40.885 --> 01:04:42.999
He pled guilty, and a judge sentenced

01:04:43.000 --> 01:04:45.103
him to a decade behind bars.

01:04:45.913 --> 01:04:47.395
Prosecutors said that he was the

01:04:47.397 --> 01:04:49.568
first SIM-swapper to ever be sentenced

01:04:49.577 --> 01:04:51.821
to prison in the US, and after

01:04:51.822 --> 01:04:54.468
hearing about Joel’s arrest, Ricky

01:04:54.469 --> 01:04:56.577
was worried that he might be next.

01:04:56.877 --> 01:04:57.862
RICKY: I’ve known Joel.

01:04:57.862 --> 01:04:59.171
I’ve talked with him and I’ve done

01:04:59.171 --> 01:05:01.243
stuff with him and stuff where it was

01:05:01.247 --> 01:05:04.466
like, hold on, this is a huge red flag.

01:05:05.488 --> 01:05:06.956
I remember I was eating at Ford’s

01:05:06.966 --> 01:05:08.702
Garage when it happened when I

01:05:08.703 --> 01:05:10.167
found out that Joel got arrested.

01:05:11.616 --> 01:05:13.232
So, that’s what kinda raised my suspicion.

01:05:13.232 --> 01:05:15.922
I’m like, oh shit, Joel got caught.

01:05:17.361 --> 01:05:19.805
JACK: After hearing Joel went down, you

01:05:19.806 --> 01:05:21.553
would think that it would give you a

01:05:21.553 --> 01:05:24.115
spook of some kind and be like, okay, I’m

01:05:24.130 --> 01:05:27.350
gonna lay low for a couple weeks or clear

01:05:27.353 --> 01:05:29.338
some stuff or get rid of some evidence.

01:05:30.903 --> 01:05:31.539
RICKY: Yeah.

01:05:33.048 --> 01:05:33.936
JACK: But you didn't do any of that.

01:05:35.921 --> 01:05:39.921
RICKY: Um…no.

01:05:42.647 --> 01:05:43.893
JACK: Just a day after learning

01:05:43.895 --> 01:05:45.301
about Joel’s arrest, the

01:05:45.312 --> 01:05:46.650
dominoes started to fall.

01:05:46.848 --> 01:05:47.661
There are moments in our

01:05:47.662 --> 01:05:48.956
life that stand out forever.

01:05:48.962 --> 01:05:50.818
Maybe it’s when your first child

01:05:50.818 --> 01:05:52.825
is born or first kiss or playing

01:05:52.829 --> 01:05:54.259
a video game for the first time.

01:05:54.753 --> 01:05:58.073
For Ricky, that day was July 18, 2018.

01:05:59.020 --> 01:06:00.547
On that day, Ricky was still living

01:06:00.547 --> 01:06:01.712
at home with his mom, and he had

01:06:01.729 --> 01:06:02.939
broken up with his girlfriend that

01:06:02.939 --> 01:06:04.116
he had a child with, but he had a

01:06:04.116 --> 01:06:05.578
new woman and a new child with her.

01:06:05.578 --> 01:06:06.605
I think the baby was a few

01:06:06.607 --> 01:06:07.645
months old at that point.

01:06:08.084 --> 01:06:10.031
The day started just like any other day.

01:06:10.290 --> 01:06:11.932
Ricky was getting ready to go to work

01:06:11.937 --> 01:06:13.669
at the parks and recreation department,

01:06:13.727 --> 01:06:15.042
and his girlfriend left the house just

01:06:15.046 --> 01:06:16.667
before him so that she could go to work.

01:06:16.964 --> 01:06:17.997
RICKY: I used to live

01:06:18.013 --> 01:06:19.528
by a cul-de-sac area.

01:06:20.234 --> 01:06:21.232
[Music] When she went to work,

01:06:21.232 --> 01:06:22.017
she’s like, hey, there’s a lot

01:06:22.017 --> 01:06:23.321
of cops in this cul-de-sac.

01:06:24.104 --> 01:06:25.642
I was like, okay, come back.

01:06:25.642 --> 01:06:26.659
Like, that’s weird.

01:06:26.937 --> 01:06:27.679
That’s off to me.

01:06:28.620 --> 01:06:29.740
So, when she went around the

01:06:29.742 --> 01:06:31.164
block the other way, she’s like,

01:06:31.164 --> 01:06:32.201
yo, they're also on this side of

01:06:32.202 --> 01:06:34.199
the house, like on this block.

01:06:34.823 --> 01:06:36.702
I was like, alright, I’m

01:06:36.705 --> 01:06:37.641
pretty sure they're coming.

01:06:39.018 --> 01:06:41.625
I walk outside to go — just

01:06:41.640 --> 01:06:42.613
act like I’m going to work.

01:06:42.620 --> 01:06:44.290
Like, I knew at that point that

01:06:44.291 --> 01:06:45.747
they were probably coming for me.

01:06:45.934 --> 01:06:47.163
I could see them coming down the road.

01:06:47.656 --> 01:06:50.658
I was like, just try to play it off.

01:06:52.126 --> 01:06:53.796
I went to go get up in my truck, and

01:06:53.797 --> 01:06:54.672
they were like, don't go in your truck.

01:06:54.674 --> 01:06:55.713
Don't run, don't run.

01:06:56.214 --> 01:06:58.001
JACK: Ricky stayed still, standing next

01:06:58.004 --> 01:06:59.980
to his truck as officers handcuffed him.

01:07:00.515 --> 01:07:01.305
OFFICER: You wanna lean against

01:07:01.310 --> 01:07:02.343
your truck or something?

01:07:10.388 --> 01:07:10.651
RICKY: Yeah, if — whatever.

01:07:10.651 --> 01:07:10.691
I mean, just whatever.

01:07:10.808 --> 01:07:15.249
[Background talk]

01:07:16.056 --> 01:07:16.703
OFFICER: You have anything

01:07:16.704 --> 01:07:18.306
on you that might hurt us if

01:07:18.308 --> 01:07:19.465
we pat you down or whatever?

01:07:19.546 --> 01:07:19.859
Alright.

01:07:20.246 --> 01:07:20.836
Just hang tight.

01:07:22.535 --> 01:07:23.300
You understand right now

01:07:23.302 --> 01:07:24.333
you're just being detained.

01:07:24.996 --> 01:07:26.267
JACK: This is body cam audio

01:07:26.272 --> 01:07:27.365
from Ricky’s arrest by the

01:07:27.373 --> 01:07:29.023
Pasco County Sheriff’s Office.

01:07:29.090 --> 01:07:30.745
It’s the very same sheriff’s office

01:07:30.745 --> 01:07:32.601
where his mom Debbie worked as a nurse.

01:07:32.879 --> 01:07:35.079
DEBBIE: When they came here that day

01:07:35.079 --> 01:07:37.735
— and, you know, they — I guess it would

01:07:37.745 --> 01:07:39.268
be to raid the house, but they were

01:07:39.268 --> 01:07:41.449
very — doing the search warrant stuff,

01:07:41.455 --> 01:07:43.316
but they did not break down our doors.

01:07:43.328 --> 01:07:44.863
They didn't do anything.

01:07:44.880 --> 01:07:47.046
So, now I kinda get up out of my bed

01:07:47.047 --> 01:07:49.907
and I look into the kitchen area, and

01:07:49.908 --> 01:07:53.351
there’s two cops standing in the doorway.

01:07:53.902 --> 01:07:55.081
They're like, hey, Debbie.

01:07:55.250 --> 01:07:56.647
I need you to come out here.

01:07:56.745 --> 01:07:57.419
JACK: They know you?

01:07:58.804 --> 01:07:59.569
DEBBIE: Yeah, they knew my

01:07:59.571 --> 01:08:00.799
name, they knew everything.

01:08:00.913 --> 01:08:02.296
Now, yeah, I knew some of them

01:08:02.296 --> 01:08:03.570
from coming in and out of work.

01:08:04.835 --> 01:08:06.614
I think I kept saying, what is going on?

01:08:06.615 --> 01:08:07.342
What is going on?

01:08:07.354 --> 01:08:08.260
What is happening?

01:08:08.986 --> 01:08:09.596
JACK: And when they finally tell

01:08:09.596 --> 01:08:11.585
you this is what we think is going

01:08:11.587 --> 01:08:13.232
on, what was your reaction to that?

01:08:13.333 --> 01:08:15.703
DEBBIE: We have — my reaction to that was,

01:08:15.953 --> 01:08:20.011
well, isn't Bitcoin — isn't this legal?

01:08:20.742 --> 01:08:22.043
That was my first reaction;

01:08:22.716 --> 01:08:24.014
but I thought it was legal.

01:08:24.069 --> 01:08:25.991
So, I kinda looked at him and he

01:08:25.991 --> 01:08:28.259
goes, he was not — those coins

01:08:28.261 --> 01:08:29.697
and the money that he was getting,

01:08:29.698 --> 01:08:31.112
Debbie, did not belong to him.

01:08:31.115 --> 01:08:32.193
He was stealing them.

01:08:33.613 --> 01:08:34.617
That’s when I really

01:08:34.750 --> 01:08:38.453
realized like, oh, okay.

01:08:38.456 --> 01:08:39.535
So, now what?

01:08:40.495 --> 01:08:41.397
JACK: Debbie sat outside the

01:08:41.402 --> 01:08:42.615
front of the house with Ricky

01:08:42.622 --> 01:08:44.259
as deputies collected evidence.

01:08:44.344 --> 01:08:45.848
Some of Ricky’s burner phones, his

01:08:45.852 --> 01:08:47.477
iPhone, his crypto wallets, and

01:08:47.487 --> 01:08:48.915
some other SIM cards were taken.

01:08:49.277 --> 01:08:52.356
RICKY: They took my truck, they took

01:08:52.616 --> 01:08:54.919
two side-by-sides, they took a trailer

01:08:54.920 --> 01:08:56.591
I had, the trailer I haul everything.

01:08:57.010 --> 01:08:58.086
JACK: Ricky was taken away in

01:08:58.086 --> 01:08:59.846
the back of a squad car to jail.

01:09:01.126 --> 01:09:04.520
… OFFICER: I have one male adult, 1012.

01:09:06.119 --> 01:09:07.577
Nothing else is in your pockets?

01:09:07.808 --> 01:09:08.314
RICKY: No, sir.

01:09:10.284 --> 01:09:11.367
JACK: They drive off to jail.

01:09:11.840 --> 01:09:12.790
The twenty-five minute

01:09:12.792 --> 01:09:14.493
ride is mostly quiet.

01:09:15.085 --> 01:09:17.054
Ricky is alone with his thoughts,

01:09:17.627 --> 01:09:18.819
but he does ask the officer

01:09:18.820 --> 01:09:20.634
behind the wheel what to expect.

01:09:21.195 --> 01:09:22.769
RICKY: Do you know how all this all goes?

01:09:22.799 --> 01:09:25.142
Like, do I see a judge and then…?

01:09:25.787 --> 01:09:27.074
OFFICER: You’ll have advisors.

01:09:27.455 --> 01:09:27.788
RICKY: I will?

01:09:28.276 --> 01:09:28.569
Okay.

01:09:29.641 --> 01:09:32.070
OFFICER: That’ll be done by

01:09:32.078 --> 01:09:35.089
video, on chat or whatever.

01:09:35.531 --> 01:09:36.577
RICKY: That’ll be today, right?

01:09:36.769 --> 01:09:37.216
OFFICER: Should be.

01:09:37.569 --> 01:09:38.123
JACK: I can't get over

01:09:38.124 --> 01:09:39.501
how calm Ricky sounds.

01:09:39.834 --> 01:09:41.106
He had been cooking up these schemes

01:09:41.107 --> 01:09:43.092
for years to steal things from who

01:09:43.092 --> 01:09:44.862
knows how many victims, starting

01:09:44.862 --> 01:09:46.137
with a few hundred dollars in gamer

01:09:46.138 --> 01:09:47.673
tags to millions of dollars in crypto

01:09:47.677 --> 01:09:49.718
wallets, and it all came to an end

01:09:49.720 --> 01:09:51.600
here in the back of the squad car.

01:09:52.358 --> 01:09:54.230
Maybe he was feeling relief,

01:09:54.334 --> 01:09:55.451
like his big secret’s out.

01:09:55.460 --> 01:09:56.659
He doesn't have to lie to his mom

01:09:56.660 --> 01:09:58.502
anymore or try to walk quietly in

01:09:58.503 --> 01:09:59.972
the shadows of his double life.

01:10:01.005 --> 01:10:01.938
But sitting in the back of the

01:10:01.939 --> 01:10:03.729
car, you have to wonder what

01:10:03.729 --> 01:10:04.827
else is going through his head.

01:10:05.315 --> 01:10:06.608
What’s gonna happen to me,

01:10:07.284 --> 01:10:08.388
and what about my family?

01:10:09.158 --> 01:10:10.065
What about my money?

01:10:11.268 --> 01:10:12.470
But he quietly listens as the

01:10:12.472 --> 01:10:14.081
officer driving him to the jail

01:10:14.082 --> 01:10:15.810
spells out the next steps for him.

01:10:16.768 --> 01:10:17.452
OFFICER: I would think it

01:10:17.452 --> 01:10:18.628
would be this afternoon.

01:10:21.282 --> 01:10:23.083
That’s when they’ll basically just

01:10:23.083 --> 01:10:24.841
announce what you're charged with,

01:10:25.827 --> 01:10:29.060
and then whether you're gonna

01:10:29.060 --> 01:10:30.774
retain your own attorney or whether

01:10:30.774 --> 01:10:32.488
you're asking for a public defender.

01:10:32.950 --> 01:10:33.280
RICKY: Okay.

01:10:33.637 --> 01:10:36.277
OFFICER: And then — but that

01:10:36.277 --> 01:10:37.461
is — again, I don't know if

01:10:37.767 --> 01:10:40.424
you're being charged federally.

01:10:41.228 --> 01:10:41.511
RICKY: Okay.

01:10:41.651 --> 01:10:43.778
OFFICER: Which makes it different, so…

01:10:44.112 --> 01:10:45.636
RICKY: Alright, thank you sir.

01:10:46.628 --> 01:10:48.512
JACK: Ricky was booked in the county jail.

01:10:48.796 --> 01:10:50.880
His mom was so distraught, though.

01:10:51.154 --> 01:10:53.132
She didn't want to see her son in jail.

01:10:53.161 --> 01:10:54.005
What mother would?

01:10:54.426 --> 01:10:55.622
So, she went down to jail to

01:10:55.622 --> 01:10:56.658
see if she could bail him out.

01:10:57.035 --> 01:10:58.297
DEBBIE: I just — it had to be done.

01:10:58.334 --> 01:11:00.011
I wasn't leaving him in jail.

01:11:00.028 --> 01:11:00.677
JACK: Did he go to the

01:11:00.677 --> 01:11:01.708
very jail you worked at?

01:11:01.711 --> 01:11:03.210
DEBBIE: Oh yeah, he sure did.

01:11:03.773 --> 01:11:05.673
All my nursing staff, friends, they were

01:11:05.673 --> 01:11:07.742
all like, oh my god, Debbie’s son is here.

01:11:07.743 --> 01:11:08.583
What’s going on?

01:11:08.603 --> 01:11:12.719
Then the sergeant — they all knew once I

01:11:12.777 --> 01:11:17.008
posted bond for him, get him outta here.

01:11:18.046 --> 01:11:19.445
Yeah, they did do a little

01:11:19.445 --> 01:11:20.545
bit of, let’s say, courtesy.

01:11:20.926 --> 01:11:23.021
I shouldn't say courtesy, but they

01:11:23.022 --> 01:11:25.005
treated him knowing that he was my son.

01:11:25.012 --> 01:11:26.342
Like, let’s move him along.

01:11:27.906 --> 01:11:28.577
You know?

01:11:28.815 --> 01:11:29.333
JACK: Yeah, that must

01:11:29.334 --> 01:11:30.203
have been embarrassing.

01:11:30.214 --> 01:11:31.286
DEBBIE: But yeah.

01:11:31.286 --> 01:11:32.615
Yeah, a little bit embarrassing, a

01:11:32.615 --> 01:11:34.779
little bit of shocking, embarrassing.

01:11:35.486 --> 01:11:37.195
The only thing — and I wasn't actually

01:11:37.197 --> 01:11:38.362
physically working there anymore.

01:11:38.362 --> 01:11:40.270
I had just left like six months prior.

01:11:41.773 --> 01:11:43.123
But I mean, it was still fresh.

01:11:43.125 --> 01:11:45.405
I had worked there for almost ten years.

01:11:45.883 --> 01:11:48.715
JACK: They said his bail was $110,000.

01:11:49.277 --> 01:11:50.701
The cost of a bail bond is usually

01:11:50.703 --> 01:11:52.465
10% to 15% of the total amount.

01:11:52.680 --> 01:11:54.044
Debbie ended up paying that to

01:11:54.045 --> 01:11:55.761
a bail bondsman to get him out.

01:11:55.815 --> 01:11:56.849
She didn't even hesitate.

01:11:56.864 --> 01:11:58.641
She just immediately was there for him.

01:11:59.210 --> 01:12:00.861
Prosecutors charged Ricky with

01:12:00.873 --> 01:12:03.049
grand theft and money laundering.

01:12:04.027 --> 01:12:04.869
The case against him

01:12:04.869 --> 01:12:06.938
dragged on for four years.

01:12:07.301 --> 01:12:08.192
He had to wear an ankle

01:12:08.194 --> 01:12:09.870
monitor during that whole time

01:12:09.887 --> 01:12:11.164
and follow a strict curfew.

01:12:11.515 --> 01:12:13.760
He pled guilty to federal charges

01:12:13.762 --> 01:12:15.101
of computer misconduct and

01:12:15.101 --> 01:12:16.780
conspiracy to commit wire fraud.

01:12:17.400 --> 01:12:18.748
By the time he went before a judge

01:12:18.758 --> 01:12:20.605
for sentencing, Ricky didn't know

01:12:20.605 --> 01:12:22.016
what to expect in the courtroom

01:12:22.072 --> 01:12:23.422
or how it would affect his family.

01:12:24.041 --> 01:12:25.236
His mom and fiancé were

01:12:25.236 --> 01:12:26.342
there during the sentencing.

01:12:26.697 --> 01:12:27.895
DEBBIE: It was horrible.

01:12:27.939 --> 01:12:29.801
It was I think one of the

01:12:29.801 --> 01:12:31.432
saddest days of my life.

01:12:32.893 --> 01:12:33.701
I remember standing in

01:12:33.702 --> 01:12:34.454
front of that judge.

01:12:34.454 --> 01:12:35.838
I just cried and said, look,

01:12:35.980 --> 01:12:37.277
I know my son did wrong.

01:12:37.298 --> 01:12:39.183
I know he did wrong, believe me.

01:12:39.936 --> 01:12:41.347
I can't believe he did all this,

01:12:41.355 --> 01:12:43.691
but he’s — that’s not my — that’s

01:12:43.691 --> 01:12:44.950
not the kind of kid he is.

01:12:45.014 --> 01:12:45.820
It was horrible.

01:12:46.429 --> 01:12:47.454
JACK: What did the judge say to that?

01:12:48.849 --> 01:12:49.974
DEBBIE: She was a woman, and I

01:12:49.977 --> 01:12:51.482
could almost feel her sympathy

01:12:51.485 --> 01:12:54.094
for me and getting it, but the

01:12:54.094 --> 01:12:57.297
law is the law, and I agree.

01:12:57.628 --> 01:12:59.885
The law is the law, and my son broke the

01:12:59.885 --> 01:13:03.445
law, and he had to pay his consequences.

01:13:04.018 --> 01:13:05.808
I let him know you did not

01:13:05.812 --> 01:13:06.965
just do this to yourself.

01:13:06.969 --> 01:13:08.554
You did this to your whole family.

01:13:09.382 --> 01:13:11.357
We're all suffering through this.

01:13:12.572 --> 01:13:13.971
We're suffering more than you are.

01:13:14.501 --> 01:13:16.035
JACK: The judge sentenced Ricky to four

01:13:16.035 --> 01:13:18.132
years in federal prison and ordered him to

01:13:18.132 --> 01:13:21.847
pay $7.6 million in restitution, which is

01:13:21.847 --> 01:13:24.071
what the courts accused him of stealing.

01:13:24.317 --> 01:13:25.612
RICKY: I knew it could have been

01:13:25.614 --> 01:13:26.946
worse and it should have been

01:13:26.946 --> 01:13:28.920
worse, and I was thankful that

01:13:28.955 --> 01:13:30.797
I got the forty-eight months.

01:13:31.088 --> 01:13:32.105
Like, I knew it was coming.

01:13:32.105 --> 01:13:32.991
I knew it had to happen

01:13:32.992 --> 01:13:35.023
because all the havoc I caused.

01:13:35.931 --> 01:13:36.772
I was like, you know,

01:13:38.251 --> 01:13:38.985
I gotta deal with it.

01:13:38.987 --> 01:13:41.223
I did what I did and now I gotta do it.

01:13:44.366 --> 01:13:46.029
I lost — I had to leave

01:13:46.203 --> 01:13:47.859
everybody, my family, my mom, my

01:13:47.861 --> 01:13:50.736
grandparents, my kid, everybody.

01:13:52.108 --> 01:13:53.171
JACK: Okay, so your child was four or

01:13:53.172 --> 01:13:54.999
five months old when you went away.

01:13:56.094 --> 01:13:58.562
RICKY: Correct, and that’s super hard

01:13:58.576 --> 01:14:01.730
because all those — I’ve always said

01:14:02.945 --> 01:14:05.623
the money, whatever, the money can't

01:14:05.623 --> 01:14:07.343
buy back those memories that I missed.

01:14:08.830 --> 01:14:09.857
Like, there’s nothing I could do;

01:14:09.994 --> 01:14:11.979
his first walk, his first talk, stuff

01:14:11.979 --> 01:14:13.168
like that, that money can't buy.

01:14:13.896 --> 01:14:15.352
DEBBIE: It was so hard coming to see

01:14:15.353 --> 01:14:17.769
him in prison and having to leave

01:14:19.090 --> 01:14:21.182
knowing that my kid’s in prison.

01:14:21.833 --> 01:14:24.137
Me and his fiancé, we went

01:14:24.139 --> 01:14:25.736
and saw Ricky at least once

01:14:25.736 --> 01:14:27.465
a month if not twice a month.

01:14:28.438 --> 01:14:29.871
We’d pack up the car, we’d leave

01:14:29.884 --> 01:14:31.699
early one morning, get there.

01:14:31.732 --> 01:14:35.289
We drove six hours, whatever it was, with

01:14:35.301 --> 01:14:37.652
two kids in the car, me and her only.

01:14:37.730 --> 01:14:39.411
No men, nobody to help us.

01:14:43.485 --> 01:14:46.302
We drove down there and had to

01:14:46.952 --> 01:14:49.389
do what we had to do, and then

01:14:50.009 --> 01:14:51.195
spend the night in a hotel.

01:14:51.367 --> 01:14:54.030
It was horrible, embarrassing,

01:14:54.038 --> 01:14:55.874
horrible, a combo of everything.

01:14:56.519 --> 01:14:57.784
JACK: So many criminal hacker

01:14:57.784 --> 01:14:59.248
stories go the same way.

01:14:59.473 --> 01:15:01.675
There’s a video game, a cheat, an

01:15:01.702 --> 01:15:04.210
underground community, an exploit, a

01:15:04.210 --> 01:15:06.634
payday, and then the knock on the door.

01:15:07.102 --> 01:15:08.548
They don't usually have the foresight

01:15:08.561 --> 01:15:10.563
to see how it will inevitably end.

01:15:11.133 --> 01:15:12.228
What do those millions of

01:15:12.228 --> 01:15:14.005
dollars really buy you?

01:15:14.513 --> 01:15:16.420
A couple of years of wealth that

01:15:16.422 --> 01:15:18.347
you can't really show anyone?

01:15:19.245 --> 01:15:21.424
Some screenshots of good old times?

01:15:22.231 --> 01:15:24.409
The skills to find gaps in security

01:15:24.431 --> 01:15:25.556
through social engineering?

01:15:26.764 --> 01:15:28.976
Whatever it is, the windfall was worth a

01:15:28.976 --> 01:15:31.262
lot less when you factor in what you lose.

01:15:31.317 --> 01:15:32.527
That’s the real cost.

01:15:32.870 --> 01:15:35.485
No cryptocurrency can buy back lost

01:15:35.554 --> 01:15:37.907
time or memories with your children.

01:15:38.585 --> 01:15:39.958
That’s what Ricky learned.

01:15:40.416 --> 01:15:41.349
[To Ricky] What was the worst

01:15:41.360 --> 01:15:42.665
part of this whole experience?

01:15:43.013 --> 01:15:45.034
RICKY: The worst part was the victims,

01:15:45.331 --> 01:15:48.365
because they didn't deserve it.

01:15:50.898 --> 01:15:53.682
So, that was the worst part, dealing

01:15:53.682 --> 01:15:56.505
with — I was doing terrible things.

01:15:57.371 --> 01:15:59.565
But I guess you have a chance in prison;

01:15:59.576 --> 01:16:02.269
you're like, dude — looking back on the

01:16:02.269 --> 01:16:05.876
shit that you caused — I can only imagine

01:16:05.877 --> 01:16:07.467
if I was in there and she was with a kid.

01:16:07.592 --> 01:16:10.205
That could have been used for my — their

01:16:10.209 --> 01:16:13.317
kids’ college funds or retirement

01:16:13.317 --> 01:16:14.865
or whatever the case may have been

01:16:14.896 --> 01:16:16.075
that they had that much money for,

01:16:16.475 --> 01:16:18.203
and I just came by and took it all.

01:16:21.766 --> 01:16:23.630
JACK: If it was me, I think I would have

01:16:23.630 --> 01:16:26.853
been — the saddest or the worst part

01:16:26.853 --> 01:16:29.470
of it was just not seeing my child in

01:16:29.471 --> 01:16:31.159
those early day — in those early years.

01:16:32.232 --> 01:16:33.600
Did that have an affect on you?

01:16:35.558 --> 01:16:38.326
RICKY: Yeah, that’s the second part of it.

01:16:38.525 --> 01:16:40.536
The first part was how I

01:16:40.537 --> 01:16:41.994
ruined innocent people’s lives.

01:16:42.395 --> 01:16:45.764
The second part now is I went to prison,

01:16:46.086 --> 01:16:48.294
I affected more people than just myself.

01:16:48.452 --> 01:16:52.103
I lost — I had to leave everybody,

01:16:52.142 --> 01:16:53.303
like my family, my mom, my

01:16:53.304 --> 01:16:56.183
grandparents, my kid, everybody.

01:16:57.036 --> 01:16:57.887
They were devastated.

01:16:58.008 --> 01:17:00.065
I know they were devastated, and it hurt

01:17:00.065 --> 01:17:01.642
me knowing that I hurt them like that.

01:17:01.786 --> 01:17:03.303
Like, my actions caused all that.

01:17:03.913 --> 01:17:05.044
JACK: After serving just a little

01:17:05.045 --> 01:17:06.318
more than two years in prison,

01:17:06.651 --> 01:17:08.646
Ricky got out early in 2024.

01:17:09.076 --> 01:17:10.012
These days he’s thinking a

01:17:10.012 --> 01:17:11.717
lot about the time he has now.

01:17:12.105 --> 01:17:13.672
Since his release he’s tried to turn his

01:17:13.673 --> 01:17:15.585
story into something useful, to reach out

01:17:15.589 --> 01:17:17.911
to the very gamers like him who may follow

01:17:17.914 --> 01:17:19.704
a darker path of social engineering.

01:17:20.330 --> 01:17:21.704
He’s spoken at anti-fraud

01:17:21.704 --> 01:17:23.165
events and security conferences

01:17:23.499 --> 01:17:24.954
like Black Hat and DEF CON.

01:17:25.403 --> 01:17:26.420
SPEAKER 6: Ricky, what would have made a

01:17:26.420 --> 01:17:28.124
difference to you as a teenager that would

01:17:28.124 --> 01:17:29.739
have stopped you going down this pathway?

01:17:31.756 --> 01:17:34.128
RICKY: Probably companies who

01:17:34.133 --> 01:17:36.007
could intervene, like get you

01:17:36.007 --> 01:17:37.417
before you're — it’s too late.

01:17:38.686 --> 01:17:39.812
If you had a chance to use your

01:17:39.812 --> 01:17:41.510
skills for good and after you help

01:17:41.520 --> 01:17:43.233
companies and whatnot, where they

01:17:43.233 --> 01:17:46.059
could be like, hey, we offer you a

01:17:46.059 --> 01:17:48.309
job, said job, into this world where

01:17:48.311 --> 01:17:50.222
you don't have to do what I was doing.

01:17:50.740 --> 01:17:51.382
JACK: I agree with that.

01:17:51.383 --> 01:17:52.842
The people in his bubble at that

01:17:52.842 --> 01:17:54.384
time were all criminals, and

01:17:54.384 --> 01:17:55.797
they used their skills for bad.

01:17:56.341 --> 01:17:58.336
But if he had more exposure to people,

01:17:58.589 --> 01:18:00.628
mentors, for instance, who could show

01:18:00.628 --> 01:18:02.882
him that these hacking tricks he knows,

01:18:03.080 --> 01:18:04.686
the cleverness of his social engineering

01:18:04.687 --> 01:18:06.567
skills and his OSINT skills, can be

01:18:06.567 --> 01:18:09.281
used for good and here's how, I think

01:18:09.295 --> 01:18:11.035
that kind of stuff does influence a

01:18:11.036 --> 01:18:12.572
lot of people to turn away from their

01:18:12.574 --> 01:18:14.902
life of crime and to find a new home,

01:18:15.581 --> 01:18:17.571
to be a productive member of society.

01:18:18.288 --> 01:18:19.756
So, he’s trying to do that now.

01:18:19.769 --> 01:18:21.295
He’s trying to build a pen testing

01:18:21.296 --> 01:18:23.225
company with another former SIM-swapper

01:18:23.225 --> 01:18:24.623
named Joseph Harris, one of the

01:18:24.627 --> 01:18:26.382
people Ricky met in the hacker forums.

01:18:26.759 --> 01:18:27.687
They're hoping to get this

01:18:27.689 --> 01:18:29.123
company up and running next year.

01:18:29.123 --> 01:18:29.133
[Outro]:

01:18:34.366 --> 01:18:34.413
[Outro music]

01:18:41.037 --> 01:18:42.743
A big thank you to Ricky and Debbie

01:18:42.744 --> 01:18:44.266
Handschumacher for sharing this

01:18:44.266 --> 01:18:45.537
story with us, and also thanks to

01:18:45.540 --> 01:18:47.250
Mark Kreitzman for telling us about

01:18:47.417 --> 01:18:48.777
one of the worst days of his life.

01:18:48.807 --> 01:18:49.685
You can learn more about what

01:18:49.686 --> 01:18:51.777
he’s working on at efani.com.

01:18:52.150 --> 01:18:53.598
If you liked this episode, go listen

01:18:53.598 --> 01:18:55.266
to our most popular episode we’ve

01:18:55.271 --> 01:18:57.514
ever made, Episode 112, called Dirty

01:18:57.516 --> 01:18:59.141
Coms, which goes into more details

01:18:59.143 --> 01:19:00.588
about this whole underground world,

01:19:01.080 --> 01:19:02.886
or listen to Joseph Harris’ story,

01:19:02.918 --> 01:19:05.050
which is Episode 118, called Hot Swaps.

01:19:05.858 --> 01:19:06.619
Hey, have you listened to

01:19:06.619 --> 01:19:08.384
my other podcast yet, LOW?

01:19:08.755 --> 01:19:09.686
It is wild.

01:19:09.879 --> 01:19:11.053
A lot of feedback from people are

01:19:11.053 --> 01:19:13.142
saying, pssh, I’ll pass, which is fine.

01:19:13.155 --> 01:19:14.005
It’s not for everyone.

01:19:14.173 --> 01:19:15.942
But I’m getting even more feedback

01:19:15.950 --> 01:19:17.458
from people saying — well, here,

01:19:17.460 --> 01:19:18.445
let me actually pull up one of

01:19:18.445 --> 01:19:19.349
the quotes that came in today.

01:19:19.867 --> 01:19:22.532
"The end of Episode 1 left me speechless."

01:19:23.321 --> 01:19:25.434
Someone else wrote, "it has moved me

01:19:25.438 --> 01:19:27.551
in a way that I did not think a podcast

01:19:27.575 --> 01:19:30.133
could." I mean, when is the last time

01:19:30.136 --> 01:19:32.295
you heard a show that moved you in a

01:19:32.295 --> 01:19:33.950
way that you didn't know was possible?

01:19:34.721 --> 01:19:37.054
If you need that in your life, open your

01:19:37.066 --> 01:19:39.777
podcast player and type in LOW, L-O-W.

01:19:39.811 --> 01:19:41.740
I made it as easy as possible to find.

01:19:42.165 --> 01:19:43.730
Go find it, go listen to it,

01:19:43.732 --> 01:19:44.722
and tell me what you think.

01:19:45.377 --> 01:19:46.949
This show is created by me, the ghost

01:19:46.950 --> 01:19:48.381
in the groceries, Jack Rhysider.

01:19:48.603 --> 01:19:50.007
This episode was written and produced by

01:19:50.008 --> 01:19:52.391
the packet-snacker, Sean Powers, assembled

01:19:52.405 --> 01:19:54.152
by the fridge phreaker, Tristan Ledger,

01:19:54.228 --> 01:19:56.052
mixing by Proximity Sound, theme music

01:19:56.072 --> 01:19:57.694
by the mysterious Breakmaster Cylinder.

01:19:58.528 --> 01:20:00.008
Alright, question; if you dug

01:20:00.011 --> 01:20:02.653
up a tomb that was in a pyramid,

01:20:03.341 --> 01:20:05.252
does it become unencrypted?

01:20:06.501 --> 01:20:07.919
This is Darknet Diaries.