How the Dark Web Actually Works | How Crime Works | Insider

[00:00] My name is Brett Johnson, former United States  most wanted cyber criminal through fraud,   identity theft, and scams. I was able to  steal millions of dollars. And this is how   crime works. I built and ran the first organized  cyber crime community. It's called Shadowcrew.  

[00:18] I regret every single instance of that, of the  people that I knew, that I that I victimized,   that trusted me, that put faith in me  every single day. There's no fixing that.

[00:34] I looked for that opportunity to profit wherever  it may be. And I didn't give a damn about my   victims. And I didn't care about my victims start  to until I started to interact with victims on   this side of the fence. My online criminal history  began doing eBay fraud around the year 1997. And  

[00:52] what I mean by eBay fraud is, you know, listing  things that I didn't have, getting the money from   people, and scamming these people. I was selling  cameras that didn't exist, autographed baseballs,   you know, Sammy Sosa, Mark McGuire, and they were  selling for $60 on eBay. Go down, buy a case of  

[01:06] baseballs, pick up a Sharpie, start autographing  them. And typically, when I was doing eBay fraud,   I'd profit about $12,000 a month. That leads into  selling pirated software. So, I was doing that,  

[01:18] stealing a lot of money, and I got worried about  how much was coming in. thought I was going to be   looked at for money laundering and figured the  best thing I could do is get a fake driver's   license. I was going to use the fake ID to open  up bank accounts so I could have the stolen money  

[01:34] filtered through the bank account cash out at the  ATM. And that's how I happened upon counterfeit   library and counterfeit library. They only dealt  it was a degree mill. They dealt in counterfeit   degrees and certificates. It's fake IDs. It's  fake work IDs. any type of university degree  

[01:51] that you might want. Send him the $200, send him  my picture. Three, four weeks later, I get this   fake driver's license. So, I start using it to  open up accounts, drop addresses, cash checks,   everything else, and stealing even more money. Few  weeks into that, and I'm becoming friends with the  

[02:06] owners of Counterfeit Library because I was also  sharing information about how to commit fraud. Two other individuals come in. One was called  Mr. X was his screen name. The other one was be  

[02:21] Beelzebub. Be Beelzebub. He made fake IDs. Mr.  X made a very passable social security card.   And we became buddies. So be Beelzebub. He came  up with this idea. He's like Gollum. My screen  

[02:33] name was GollumFun. I'll sell the fake IDs. Mr.  X will sell the social security cards and we'll   build this site, this forum. And I was like,  sounds like a damn good idea. Because I was   also sharing information about how to commit  fraud. and it becomes like this criminal field  

[02:48] of dreams. People were welcomed in to share and  exchange criminal information. You can simply   come in and you can read all of the threads.  Something that might be sold as a tutorial   would be tax return identity theft, how to file  those taxes, where to target those victims. So,  

[03:05] Counterfeit Library transitioned from a degree  mill type of website into a eBay fraud site,   a social engineering site, a cyber crime  channel site. But initially my position was   as a reviewer. I became basically the gatekeeper  of counterfeit library. Every single product and  

[03:23] service went through me. So if someone had a  product or service for sale, I would get it in,   verify it, talk about it, and vouch for that  seller. So they would send you physically that   driver's license or that social security card  or that passport or what have you. All right?  

[03:40] You'd get it and you'd give your thoughts on  it and you would say this seller is reviewed   and verified. That tag would then be changed  to reviewed seller. The rules that we had,   hey, no drugs, no counterfeit currency, no  child pornography. Over the space of a year  

[03:57] and a half, two years, we were geez, we were  a couple of thousand members at that point. We're doing pretty well with counterfeit library.  It's fake IDs. It's eBay fraud. PayPal fraud. It's  

[04:12] strictly scams is what it is. Is we're coming  across with that. One day this guy comes over   and he had this screen named Script. He was this  Ukrainian spammer. And what he says is he says,  

[04:24] "Hey, I've got credit card information." And  Script dealt with what we call the COB, the   change of billing, just the credit card details  and the ability to update billing information. So,   you would be able to log into the credit card  account. you would see the available balance on  

[04:39] that card. These days they refer to it as account  takeover. We had never seen anything like that.   And the initial response from the community was  this guy has got to be law enforcement. And I  

[04:51] was like, hey dude, if you're going to sell on  counterfeit library, you've got to be reviewed. So   he was like, okay, let's get reviewed. He's like,  oh, I need a drop address. And I've earned a phone   number. I give him a drop address. I give him a  phone number. He gives me the card information.  

[05:06] card number, expiration date, three-digit security  code. He's changed that billing information to   that drop address and the burner phone number  from the actual card holder information. I   place an order with Thompson's Computer Warehouse  for $4,000. The same card, I also place an order  

[05:23] with Dell's Outlet for $5,000. Goes through $9,000  worth of product. goes through, get the products   shipped to me, they arrive, and the way that  works is you would receive the merchandise, and  

[05:35] then what would you do? You'd resell it on eBay.  I get back online with Script. I post the review   on Counterfeit Library. And within the space of  two to three days, Counterfeit Library transitions  

[05:49] from that fake ID and eBay fraud to basically a  credit card theft site. Once Script comes in and   starts offering credit card details, at that point  in time, counterfeit library simply explodes.  

[06:04] Turns out that Script had a lot of buddies. They  were stealing all these credit cards. Within,   you know, 30 to 60 days, we had hundreds of posts  per day of people that were looking for this  

[06:16] information of different sellers that were coming  out selling credit card details or physical credit   cards. We had more traffic than we know what to  do with. There's a few different ways you can   steal credit card details. You can get it through  fishing schemes. You know, you'd get their name,  

[06:28] social, date of birth, card numbers, pins, all  that stuff. And it a fishing attack was spray   and prey. So, you'd send out two million emails.  If you got 20,000 back, that's a good day. You got  

[06:41] 20,000 card numbers all of a sudden. You can do  it physically. All right? And that that involves   a skimmer. Maybe you're you install one at a bank,  at a gas pump, and you insert the card or you give   through and that captures the credit card details.  So, there's several different ways to get credit  

[06:59] card details and information. Most of the data was  coming out of America. You know, you can't order   a lot of computers to a Ukrainian address. You  need to order it to an American address and then   have them shipped out or cashed out from there.  So, script is the first guy, the first Ukrainian  

[07:17] that comes into English-speaking environments.  All right. For cyber crime or scams or fraud to   succeed online, three things have to take place.  You have to gather data. Gather the tools. You  

[07:30] then commit the crime. And then finally, you  have to be able to cash that crime out. Well,   they had the tools. They knew how to commit the  crime. What they could not do was cash it out.

[07:45] If you were good, you would profit $30  to $40,000 a month. Cobs, that change of   billing typically sold for 8 to 10% of whatever  the available balance was of that card. So,  

[07:59] if you're buying just stolen credit card details,  just the card holder's name, number, address,   things like that, that's going to run, you know,  seven bucks up to maybe $30 per card. You know,   where do you put that money? Well, I had a house  in Charleston, South Carolina. Spare bedroom. Cast  

[08:13] a lot of it in there. I also had bank accounts  in several different countries. When I was a   criminal, I lived very very quietly. I had a  house on the water. It was not an expensive house.  

[08:25] I would typically eat at home. If I ate at a  restaurant, it would be someplace like Applebee's,   something like that. So, I was able to save some  money. But you have to understand that when I   was committing crime, money got to the point  where you didn't understand the value of it.

[08:47] The way Shadow Crew pops up, this distance  learning guy was big advocate for distance   learning and he found out about counterfeit  library. Not that we were committing fraud or   the fake degrees they were selling. So his  members from his forum, a couple of thousand,  

[09:04] they come over and start bombarding the forums  there. So we can't conduct any business all of   a sudden. One of the ID guys, his name was  Seth Sanders. He goes off and he builds   shadowcrew.com. He had maybe 60 members at that  point in time, not much traffic, but the site  

[09:20] looks damn good and it operates really well.  He comes back over and he's like, you know,   Gum, why don't you come over to ShadowCrew? And  I was like, man, I was like, we can do that.   make me super admin. Let me make whatever  sub forums I want. Put the number of people  

[09:34] that I want in charge of those forums. He's like,  absolutely. So, we shut down basically the forums   at counterfeit transition over to Shadow Crew.  It was an explosion of users all of a sudden. So,  

[09:46] Shadow Crew was really the precursor of today's  dark web, dark web markets, and financial cyber   crime as we know it. It was the first real  structured forum and communication channel   for online criminal activity. You knew by looking  at someone's screen name what the skill level was,  

[10:02] what the history of that individual was. We  had escrow systems. So if someone didn't trust   another, they could go through me initially and  I would hold the money until they got their item.   Then I would pay the seller. Now before these  criminal communities, the only avenue you had to  

[10:16] network with other criminals was IRC, internet  relay chat. It was rolling chatboard. you had   no idea who you were talking to, if you could  trust them, if they had a product or service,   if it worked, if they had it, or if they were just  going to rip you off because everyone there was  

[10:31] a crook. So, ShadowCrew at its height was 4,000  4,000 members strong. So, out of 4,000 members,   you may have had 60 to 80 different sellers. Most  of it's credit based. Most of the credit based is  

[10:46] online details. We had passport guys, we  had fake ID guys, stuff like that as well. We were naive criminals. Many of us were. All  right. U, we were simply these we thought we were  

[11:03] computer guys, you know, and stealing information  and profiting from that. What we didn't appreciate   is if you're living a criminal lifestyle, how are  you going to make sure that no one rips you off?  

[11:20] And at the end of the day, it relies on violence.  All right, that's really what you have to resort   to. We had never seen any violence at all on  ShadowCrew, any of those platforms. One day a user  

[11:34] comes in and he starts posting these pictures of a  guy who had ripped him off and he had had the guy   kidnapped and beaten and it comes with a message  never steal from me. And that's the first instance  

[11:50] of of violence that we saw on that platform.  Who's involved in cyber crime these days?   every criminal group that is imaginable as taking  part in cyber crime because they they view it as  

[12:04] more safe. It's certainly more profitable.  You absolutely see the Italian mob. You see   the Mexican cartels coming in. You've got these  scam farms that are out there. These buildings,   these organized elements coming together are  different than it was when I was a criminal.  

[12:22] You've got an actual compound or community  of people that are working together running   different basic departments in order to make  sure that that fraud, that crime is successful.  

[12:34] They're really running it more businesslike  than we did when we were committing crime.

[12:46] We had tens of thousands of hits that were  coming in per day. But you have to remember   that you could access Shadow Crew without  being registered. Now, we were able to   see the IP addresses that were coming in. It was  evident that law enforcement was they had several  

[13:01] identities on Shadow Crew. You know, back  then, how do you avoid detection? What's   your operational security? You would try to  have the server located in a country where   it was difficult for law enforcement to subpoena  anything from it. I moved a lot from Kentucky to  

[13:16] Tennessee to South Carolina. I would try to find  hotspots that I could use that that weren't in   my home. You did not have access to these proxy  addresses where you could hide your IP address.  

[13:31] It wasn't until later that those things came  online. Rightfully or not, I was scared to death   that Rico was going to come down on my head and  I was going to get the brunt of everything. So,   I retire, step out of Shadow Crew. About the same  time I stepped out our forum techie, he went by  

[13:48] the screen name of Scarface and CumbaJohnny. His  name was Albert Gonzalez, and he was making money   or stealing money doing the CVV1 hack. So, one  day he's standing at an ATM in broad daylight,  

[14:01] and he's putting one white counterfeit card in  after another, pulling $20 bills out. Just so   happens across the street, two cops are sitting  there and they start to notice this kid, walks up  

[14:14] on Albert, Albert's wearing a disguise, a wig.  Albert falls apart and flips. So Albert flips,   he goes to work for the Secret Service. Albert  comes back into Shadow Crew and he takes over  

[14:28] and he tells the community, "Hey, in order to  remain safe, we need to make sure we're using   this VPN. That way everything's, you know, safe  and secure. Turns out the VPN's owned by the  

[14:41] United States Secret Service. And that's where,  if you read the indictments, that's where the $4   million comes from. That was the amount of stolen  information that went through the VPN during those   months of investigation. Secret Service was able  to get addresses, names. The reason the Secret  

[14:57] Service was created was to protect the nation's  monetary supply. So, of course, cyber crime,   everything's transitioning over to online payments  and everything else. Of course, they are going   to take a role in that. October 26, 2004 was  when Shadow Crew was shut down. CumbaJohnny,  

[15:12] Albert Gonzalez, had had called for everyone to  be online at about the same time. And the idea was   they would swoop in, get everyone. They arrested  26 people across six countries in six hours.  

[15:28] I avoided the arrest because I simply left  Shadow Crew before the implementation of VPN. I   was online and I ended up on Shadow Crew and the  FA the site had been changed. All of a sudden,  

[15:43] you didn't go to the Shadow Crew forums. There  was this page of this guy behind bars. It was this   message of you are no longer safe in the shadows.  you know, we advise you to report to your nearest  

[15:58] United States Secret Service field office and turn  yourself in. Well, I'm not about to do that. So,   there was all this going on. I was living under an  assumed identity in Charleston, South Carolina. I  

[16:10] was very hard to locate. I ended up getting access  to the California State Death Index. I was like,   "Well, I wonder if you can file tax returns  on dead people." And it turns out you can. Tax  

[16:26] return identity theft is what they called it.  I would file tax returns from Sunday through   Wednesday. Thursday I'd plot a map of ATMs.  Friday and Saturday I'd cash out. I'd have  

[16:39] the returns deposited on prepaid debit cards.  Typically cash out in the range of, you know,   $160,000-$180,000 a week and stole a lot of money.  And that's when you learn how to launder money.

[16:55] I was married for nine years and lied to  my wife. I lied to her every day. Every   day. Took her three years to find out I was a  crook. Next six years for me saying, you know,  

[17:07] I've stopped. Will stop. Going to stop. And she  leaves me after nine years. I get depressed. You   know that fear of being abandoned becomes real. I  caused it. Yeah, I caused it. But it it was still   real. walking around the house all day just  crying, depressed. From there, it leads into  

[17:23] into Shadow Crew. And what happens was I was  always this clean cut criminal. I had I didn't   start drinking till I was 34 when my life I never  drank before that. I'm the guy I'm literally that   guy that walks into a strip club and falls in love  with the first stripper that he sees. Her name was  

[17:40] Elizabeth. Elizabeth didn't know what I did for  a living. I had lied to her, too. But I ended   up getting getting engaged to her and I retired. I  stepped out to Shadow Crew April 14th of 04. State  

[17:54] side I had probably 200 250 grand in cash and  went through in the space of just a few months.   Went through all of that. So October rolls around,  Shadow Crew gets busted. I don't have any cash and  

[18:13] I wanted to keep up that facade. So the only thing  because of ShadowCrew being busted, you didn't   know who to trust anymore. The only thing I could  rely on criminal wise was running counterfeit  

[18:27] cashier checks, which I had religiously for years  screamed at people not to do that. February 8th,   2005. I was supposed to pick up a couple of  Tiffany diamond rings. Total like $19,000. I was  

[18:43] in Charleston, South Carolina. I had waited for  the UPS driver to drive up. I met him at the drop   address, got out of my vehicle, tell the driver,  "You've got a package for me." In this case, the  

[18:55] driver said, "Yes, I do. Can I see your driver's  license?" And I pulled out a driver's license. It   was my driver's license. I didn't have the ability  to get a fake one. He handed me the package. I   handed him a counterfeit cash cashier check. I  turn around, take three steps. There's the FBI,  

[19:09] guns drawn, and walk these two Secret Service  agents. They sit down. They look at me and said,   "we'd like to talk to you about some stolen credit  cards, and they took over the investigation."

[19:26] So, they asked me about some credit cards. I  really don't tell them anything. One agent looks   at me, he's like, "Well, we got your laptop."  I was like, "Yep." And then he looks at me and   he's like, "Well, is there anything you could do  for us?" I think the state had me under like 30  

[19:42] different indictments. I think the total was like  $327,000 was the bond they wanted. Somebody up in   Washington called whoever they needed to call and  got the bond reduced to $1,000. I walk out, it's  

[19:57] like midnight. First call I make is to Elizabeth.  I'm out. And she says, "I'll be there." She pulls   up in a limousine. Gets out, pops the trunk,  gets these two plastic storage containers out  

[20:13] full of my clothes, drops on the pavement, comes  over, hugs me, call me later. Gets in the car,   leaves. I'm standing next to a Secret Service  agent, and this guy looks at me, he's like,   "Uh, is that your fiance?" I'm like, "Yeah."  He's like, "Man, I am so sorry." And of course,  

[20:31] that relationship fell apart. The Secret Service  field office is out of Columbia, South Carolina.   They put me up in a in a, you know, suite, not  sweet, but, you know, payer week hotel. And I   start to work for them. So, working for the Secret  Service. It was typically four to six hours a day.  

[20:47] I was paid $350 a week, plus they took care of  rent and stuff like that. They had me hooked up   to a laptop. The laptop was hooked up to a 50-in  plasma monitor mounted on the wall. Two agents in  

[21:00] the room at the same time. They were at a desktop  computer next to mine. And the job was for me to   educate them on cyber crime and also for me to  help out with investigations. So, target people  

[21:14] surf the forums basically be Gollum again. Target  people for investigations. And that's what I did.   Ultimately, Operation Anglerfish, it arrests John  Gianni, it arrests a few other decently sized  

[21:27] people. You know, eventually the Secret Service  agents, they were monitoring it. They got bored   because a lot of it's just monotonous. You know,  I'm bullshitting around with other criminals,   developing relationships with those guys. On my  laptop, they had Camtasia and Spectre Pro. So,  

[21:42] it recorded all keystrokes and it also took  snapshots of the screen every I think 15 or   30 seconds. All of that data. Everything they  were capturing went on a DVD on a spindle is   what happened. All right. At the same time, I'm  you know, I'm the guy that I've got an ego. I  

[22:02] realized that, okay, all that data, no one's  going to go through those DVDs. No one's really   cataloging any of that [ __ ] I can pretty much do  what I want. So, I start committing crime. So, I  

[22:15] was committing tax return, identity theft, credit  theft, and various other crimes. For 10 months,   I around, rip them off, screw them over. So,  Operation Rolling Stone comes around. That's  

[22:28] that operation where they were supposed to arrest  some of the people that I had been targeting.   One of the guys that they were arresting, I had  taught that kid how to do tax return fraud. Turns   out that the night before he had loaded up  a U-Haul full of stuff, and that stuff was  

[22:44] evidently a lot of the evidence they would need  to charge the guy. So, they come back to me,   did you talk to anybody? And I'm like, nope. Well,  we're going to make you take a polygraph. And my  

[22:56] they as soon as they said that, I'm like, I'm not  taking a polygraph. Call my lawyer. So, my lawyer   gets on the phone and I'm on the phone with him.  He's like, "Uh, Brett, did you do anything?" I was   like, "Yeah." And he was like, "Well, you don't  have to take the polygraph." And I was like,  

[23:12] "Well, that's a good thing." And he's like,  "But if you don't, they're going to throw you   back in jail." So, I take the polygraph, fell it  miserably. Miserably. A subsequent search of the  

[23:24] apartment unveils a lot of stuff. And I had in  the apartment, I had money, had cards, had sewing   identities, all that stuff. And I didn't want them  to find that. They revoked my bond that night.

[23:44] So, they revoked bond, threw me back in the county  jail. Week after that, the state judge reinstates   my bond. No one calls the Secret Service to  tell them that. I walk out. I met with my mom.  

[23:59] My mom's outside waiting on me. And I looked  at I was like, "I can't stay." She was like,   "What?" So I take off on a cross country run.  I, I had a truck, get in the truck, head,  

[24:12] west on I 20. No idea where the hell I'm going  to go. I get to Dallas, rented a room for,   for two weeks, started doing tax fraud out of  the local Kinkos. The night everything funded,  

[24:24] 67 cards funded, I ended up with I think like  $130,000 is what I ended up with in cash. I drove   down Route 66, visited Roswell, New Mexico, ended  up in Las Vegas, stole another 160 $170,000 out  

[24:41] of ATMs through tax fraud there. Went out to LA,  stole another 160 grand. come back to the hotel,   sign on to cartermarket.com that morning, and I  am United States Most Wanted, Secret Service Most  

[24:56] Wanted. And I sat there looking at it. That's  the first time my name had been mentioned on a   criminal forum. My picture had been posted,  everything else. I sat there just stunned   looking at it. And finally, I said out loud, I was  like, "Well, Brett, you've made the United States  

[25:12] most wanted list. What are you going to do now?"  And I said out loud, "I'm going to Disney World.   So, that's what I did. I checked out of the hotel  there in Vegas, drove to Disney World, got my year  

[25:25] pass at Disney and Universal, and I was like,  you know, I can I can lay low. I can enjoy the   parks. There's a lot of tourists in the area. I  can hide there, rented a time share with cash,   bought electronics, everything else. And the idea  was, well, I'll just hold up here for a year, then  

[25:40] I'll bug out to Florianopoulos, Brazil, and set up  shop again and do it all again. It was September   16th, 2006, and I heard this knock at the door.  Got my ass out of bed, looked through the people,  

[25:54] another Secret Service agent and an Orange County  Sheriff. Would you guys like to come in? And he's   like, "Well, we need to put you in cuffs first."  I was like, "Yeah, I figured." My understanding   is they used a trigger fish. Back then it was  called Triggerfish, today it's called Stingray,  

[26:10] to locate me. That is a box that simulates  a cell phone tower. Back then, I don't know   what it is now, what the tech is now, but back  then it could locate you within a 7ft radius.

[26:26] I'm arrested. I'm thrown in the Orange County  Jail. Ultimately, the state charges were   dropped in favor of the of the federal charges,  conspiracy, forgery, aggravated identity theft,  

[26:38] and multiple counts of all of those. And it  was like 75 months. When I got to Big Spring,   Texas, at that point, you understand exactly what  prison is. The inmates run the prison, not the   guards. When you get to prison, you're met by your  race. I'm met at the door by the treasurer of the  

[26:57] Aryan Brotherhood. He looks at me, he's like,  "How many more white guys come in?" I'm like,   "I don't know, three or four." Next question is,  "What are you in here for?" My answer is computer   crime. And I smile. No, you don't say computer  crime in prison. That doesn't mean hacking,  

[27:12] credit card theft, all this [ __ ] When you say  computer crime, that means child predator. So,   he's looking at me. He calls his big buddies.  They circle around. What did you say you're in  

[27:25] here for? So, I tell them, you know, I'm  in here for this. And they're like, okay,   sounds good. You still said computer crime.  Now, the way it works, they will not they will   not attack you until they know you are that  predator. At that point, that's your ass. Or  

[27:41] it takes the guards telling them that you're  that guy. Well, no, none of the guards told   them anything. Spent two years at Big Spring. And  at Big Spring is where I realized that the only  

[27:53] person that put me in prison was me. I ended up  serving about seven and a half years total. Anyone that commits cyber crime or computer related  crimes, usually you're under three years or  

[28:10] 5 years supervised release. And during that time,  you're not allowed to touch a computer or there's   certain guidelines that you have to have. I was  released from prison. I went to the halfway house.   Didn't have a job. I had job offers. Deloitte,  no before. Couldn't take them. I asked about  

[28:26] fast food. No, that's a computer. Can't touch  a computer. So, I couldn't get a job. I was   going broke. My probation officer had given me  permission to get a cell phone. And I had signed   on to plentyofish.com. About the same time my  my wife, now Michelle, first date we had, first  

[28:43] real date, she asked me 10 minutes into it, she's  like, "What's the worst thing you've ever done?"   I was like, "I just got out of federal prison."  She's like, "No, seriously." And I told her and   I told her all about me. She could she decides to  keep dating me. Finally, I get a job. The only job  

[28:58] I could get was pushing a lawnmower. Bust my ass  10 hours a day, $400 a week. Job ends because it   gets cold, grass starts stops growing, and I get  it in my head. I was like, I got to do something   to show her I'm worth it. Get on the dark web, get  some stolen credit cards, start ordering food. So,  

[29:15] I get caught doing that. Go back to prison.  The lesson I learned was Michelle didn't need   me for me. She just wanted me for me. got out of  prison, got married to her. Shortly after that,  

[29:31] I ended up reaching out to this guy FBI agent,  and I sent him a message. I was like, "Hey,   got nothing but my respect." And at the end of it,  I was like, "by the way, I'd like to be legal."

[29:54] That man responded within two hours. Within  two hours, he gave me references. He gave me   advice. That led to Caprice Hendricks being  the first person that hired me to speak for   the card not present group. AARP has me as an  ambassador for them. I work hard every single  

[30:12] day. I wake up every morning to protect people  from that person that I used to be. Today I lead   a a very blessed life. that I don't deserve,  but I'm grateful for it. Every single day,  

[30:30] I regret who I have been. I regret every  single instance of that, of the people   that I knew that I that I victimized, the  people that I didn't know that I victimized,   of the people that that loved me, that trusted  me, that put faith in me every single day.  

[30:49] And the only thing I can do I you can't  fix that, man. There's no fixing that. Cyber crime is the third largest economy on the  planet. You've got China, you've got the United  

[31:05] States, you've got cyber crime to the tune of 10  trillion dollars a year. It's a booming industry.   When I was a criminal, you had to understand  every single dynamic or aspect of the crime you   were committing. your your own security, the  company's security, how to make fake IDs, run  

[31:21] drop addresses, launder money, everything else.  That's changed. Now you have fraud as a service.   Every single product and service is off the  shelf. A criminal now doesn't have to understand  

[31:33] any aspect of the crime. They can immediately  buy tutorials, take live instruction classes,   buy anything that they need online and immediately  start being successful and profitable at crime.   Because of that, because of the ease of access of  telegram, things like that, you see crime continue  

[31:50] to explode. It absolutely has to do with the  pandemic as well. You know, during the pandemic,   we saw a lot of criminals committing unemployment  fraud, PPP fraud, stuff like that. What advice   do you have for the general public on how to  best protect themselves from cyber crime? Okay,  

[32:05] let's talk about that threat landscape. You  got mass media out there. They paint computer   criminals or attackers as hackers, computer  geniuses. No, it's not computer geniuses. It's   the stuff we know about we're not doing anything  about that creates that opportunity for attack.  

[32:21] All right. 90% plus of every single attack uses  a known exploit. It's something you know about.   It's something you've been told about that you're  not doing anything about. That opens that door.  

[32:34] 56% of companies experience a breach because of  third-party access. Your network's only as strong   as the weakest device which accesses it. Over 41%  of every single router on the planet has a default  

[32:48] password. Oh, and that's not even the big one. The  big one, 80% of every breach begins with a fishing   attack. What makes fishing so important? Why is  it so widely used? A fishing attack is a social  

[33:02] engineering attack. It boils down to how good of  a social engineer am I, a liar am I in convincing   you to do that thing? They know what it takes  to manipulate you into giving up information,   access, data, or cash. Why would I try to brute  force past a firewall if I can send an email to  

[33:17] someone sitting behind that? That creates  that threat landscape for individuals. It's   not that difficult. It begins with freezing your  credit. Credit freezes became free September 2018.  

[33:31] Today the population 12%. 12%. The other 88%  are victims waiting to happen. All right. So   freeze the credit of every single person in  the house including children. Children are  

[33:43] the number one victims of identity theft. One  in four 25%. All right. So freeze the credit.   That's free. You have to contact all three credit  bureaus. Do you use the same password and you   know log in across multiple websites? Chances  are you do. 80% of the population does. So,  

[34:00] good password security. What does that  look like? That's up to you. You know,   you can use a password manager, use pass keys. If  you're -- I'm not against a password notebook as  

[34:12] long as it's not at your desk at work. So, these  things are important. From there, you can look at   multi-factor authentication, things like that, but  it begins with freezing credit, monitor accounts,   place alerts, good password security, and then  you go from there. If you've got just a modicum  

[34:28] of security in place, chances are I'm going to  find an easier target. All right. You've still   got the investment schemes. You've got the  romance schemes that are out there. What's   interesting is over time you're getting you've  still credit card theft is still huge. Make no  

[34:42] mistake about that. But there's almost an a shift  in the mindset of online criminals where they're   going more toward the scam environment. They're  more relying on manipulating through that liar,  

[34:55] social engineer. They're more relying on tricking  that victim into sending cash out instead of doing   account takeovers and things like that. Trust is  usually established through technology tools. So,   they'll use spoof phone calls. You won't see  the phone number they're calling from. You'll  

[35:10] see your bank, the FBI, sheriff's department,  Social Security Administration, something like   that. The idea is to try to get that victim to  do a knee-jerk reaction. Oh, and click. Well,  

[35:24] you're done at that point. This morning I got  an email as I was walking here from Coinbase.   Someone logged into your account. I'm like, "Oh,  now you open up the email. Someone has accessed  

[35:38] your account. They've logged in." Then it's got  the link. Do you click on the link? No. By God,   you do not. You close out that email. You go  to your browser. You type in cocoinbase.com.  

[35:51] I logged in. No one had access my account, but I  did change my password. So that that's something   you got to understand. You know, whatever you  do, report those crimes to law enforcement. If  

[36:04] you don't report these crimes, people like  me, we get away with it and we keep going. And I grew up knowing how to do insurance fraud,  faking stolen cars, charity fraud. So that's the  

[36:20] life I grew up in. When I became an adult, I  had the opportunity to choose that different   path and I didn't. I found eBay and liked eBay a  lot. I was like, there has to be some way to make  

[36:34] money on this. Didn't know how. Began doing eBay  fraud around the year 1997. I used to watch Bill   O'Reilly on Inside Edition a lot and he had a show  that night and they were profiling Beanie Babies.   The one they were profiling was Peanut the Royal  Blue Elephant selling for $1,500. So I skipped  

[36:50] class the next day, go around all these little  Hallmark short stores looking for Peanut, but they   had these gray ones, the exact same elephant, just  a different color. Had these gray ones for $8.  

[37:02] Found a picture of a real one online. I posted it.  I used a picture of a real peanut Beanie baby. So,   this woman wins the bid. I don't want to be on  the defense of the conversation. I want her on  

[37:16] the defense of that. So, I send her a message.  Hey, you win. Congratulations. By the way,   we've never done any business before. I don't even  know if I can trust you. What I need you to do,  

[37:29] go down to the US Postal Service, pick up a  couple of money orders. They're issued by the   United States government. That protects you. More  importantly, that protects me. You send me those,   I'll send you your animal with the US postal  money orders. The reason I chose that is you  

[37:45] could actually cash those money orders out  at the post office. All right? And because   that victim wanted that Beanie Baby so bad, they  believe that. That allows me to establish that   trust and defraud them. She believed that.  Sends me the money orders. I cash them out.  

[38:02] send her the creature in the mail. I did it did  that crime under my own name. Dumbass that I am.   Immediately get this phone call. This is not what  I ordered. And that's the first online crime that  

[38:15] I committed. I ended up defrauding a woman of  $1,500. A lot of them, they get so exasperated,   they throw their hands in the air, they walk  away, you don't hear from them again. So that   that's the first online crime I committed  and got away with it and it emboldened me.  

[38:31] you keep going. I was a piece of and if you  understand that not just about me but about   these guys that are online doing this, you  can you can probably protect yourself better.

[38:53] Hi, I'm a producer on How Crime Works.  If you enjoyed this video, then please   subscribe and comment below with more ideas of  topics you'd like us to cover in this series.