Defeating Online Scams and Disrupting the Cybercrime Chain | Ariana Mirian

But mostly it's how can I just pile up Scrooge Mcduck size things of money in my warehouse? And money's great. We all need it. But like, yeah. At the end of the day, behind all the computers, all the cell phones, all the, you know, social media handles its people. And, you know, I, you and I have talked about it quite a bit, but I, I've always been so motivated by like, how can we use research to, to answer, you know, questions about people in service of better security outcomes?

I, I, it's like the best of both worlds for me. I'm like security and people. What more could you want? I love that combination. Yeah. And I know like for I know your background, but the people you know listening probably don't. So tell me a little bit about how you got started in security. I know you went to Michigan and computer science in the, you know, the beautiful Ann Arbor, but what was your focus? Did you think you wanted to do security then? Like, was that your thing going in? Great question.

Yeah, so I've, I've been working in security for a little over a decade now, which is like kind of crazy to think about time. What is that saying? It's like the days are slow, but the years are fast. I'm like when did? The days are long, but the years are short. Yeah. Yeah, yeah, yeah. I just completely. Butchered it. Thank you. Yeah. So I basically stumbled my way. I was like an undergrad doing computer science. This is when computer science wasn't like the hotness it is right now. And I kind of stumbled my way into this security lab that was doing a lot of Internet wide scanning and it really piqued my interest. I was like, wow, security, It's just like this ever evolving field.

You've got attackers, you've got defenders, you've got people in the middle. Like this seems like it could be a fun thing, like genuine. I was just like, I don't know, this seems cool. And the more I dug into it, the more I was like, wow, there's all this data, but we don't really have good answers about like people and how to protect people and, or at least that's what it felt like at the time. This was again, a long time ago. I don't we've made but. I think that's still true though for the most part, honestly.

Now we have more data about people and more open questions, I think actually. But yeah, there's a question of like, how can we use data to help, you know, improve security outcomes for the end user? Is was very motivating to me. It was much less formula well formulated at the time. I was just like people data. This seems like it's interesting. And Long story short, that took me to UCSD where I did my PhD. So I was super fortunate to work with like some wicked smart people who are Internet measurement experts. So like their research, their goal is like we take data about the Internet, about people and try to make sense of it. So yeah, that my PhD was fantastic. I had a great time.

And then very full circle afterwards, I ended up working at a security startup called Census, which does Internet wide scanning. It was like this great full circle moment. I went back also fantastic people. You know, that's where where you and I met. And most recently I've actually moved on from census and I've actually started a company with, with two old colleagues of mine called Be Safe where we are trying to use data about the world to protect people from scams and specifically pick butchering scams.

So that's kind of like a summary of my background That was maybe too long. I I get excited about data and security if you can't tell. It's well, that's why you're here. No, that was not too long at all. The I love the part about you just kind of stumbling into the security lab at at Michigan, which I think for people who don't know the back story of census, like that's where census came from. Is that like Internet wide scanning projects at Michigan? You know that I think it was called Z map at the beginning, right? For.

Well, yeah, it was like Z Map was like the tool and then we were using Z map to do a bunch of research and then we were like, wow, this Internet wide scanning thing is actually really hard. Would I feel like pulled together all this data and just like made it accessible to people because you have to like get the boxes set up, you have to work with your network and like the IT admins, the IT admins work. You want to do what for? You want to scan the Internet every day, multiple times a day. Why would you do that? And we're like, no, no, no, there's like good intentions there, We promise. But you know, effort. And it's like we kept hearing this in in the research world. And so then put together this like, academic repository, which then evolved into census.

Yeah. And so that's why it was really fun to come back full circle because I was like, I know this research area, I know how the Internet works. But like, seeing it evolve into its own company was just really satisfying to to experience. And it was a good time. Yeah, it was. It's funny that you say I know how the Internet works. Like there probably aren't like 20 people on the planet that truly understand like how the Internet works, like, you know? Internet works. Caveat you. Know I understand, yes, but yeah, you would be at the tippy top of the pyramid like the people that do that kind of work most people are like there's a bunch of computers that are connected and and things move between them and then they show up on my screen I mean that's kind of and that's fine. That's all you mostly need to know, but you know, it's it just in the like 6 months that I was at Census, you get under the covers there and you're like, Oh my God, it's incredible how big this thing is.

It's first of all, it's not a thing, but it's like how big the networks are and the fact that any of this works. Yeah. That anything gets where it's supposed to go is incredible. It's a. It's like 40 miracles strung together every two milliseconds. I, I, I share, I share that same feeling, Dennis. I mean, whenever something, and you know, I, I know a lot you and probably a lot of people listening to this are going to relate to this joke. But like whenever there's a big outage, it's like, oh, like big tech company just went down or had an outage. It's like, oh, is it DNS?

It was probably DNS. And then like 90% of the time it is. And I'm like this very fragile protocol is still the backbone of a lot of what we're doing. And that is it is what it is and keeps your day interesting. Somehow it works, yes. So you mentioned be safe and I really want, I'm fascinated to hear the premise behind this. Where did the you mentioned that a couple of old colleagues sort of got in touch and were like, hey, we have this idea, we want to run with it, we think you should be involved.

Like where did the germ of this idea come from? Yeah. So let me just take a quick step back. You have you received these texts that are like, hey, John, have you fixed the reservation or like, hey, Mary, are you still up for golf? And you're like, no, this is Dennis. I don't know who John or Mary is. Right. Totally. Yeah. Yeah. So, so these, these sorts of texts are unfortunately the beginning of this type of cybercrime that is often referred to as pig butchering or conversational scams.

And so it has just, it's a, it's an interesting shift where we still see a lot of deceptive tactics. You know, people will send emails, they'll be like, hey, here's the doc. You sign sign this link and you click on it and then accidentally give out your information. This is a little different where attackers are trying to converse with people on all sorts of messaging platforms. The messages look really innocuous. And they will build trust over time with potential victims for days, weeks, months.

I mean, truly, this is what we see in the data, which I'll get to the data in a little bit. And then at the end of this, they're like, hey, you know, Ariana, we're good friends. You trust me? I trust you. And then they ask for some sort of financial exfiltration and it comes in a lot of different forms, right? Sometimes it's like, hey, we're good friends. I've got this investment opportunity. Just give me X amount of money. Sometimes it's romance schemes. It's like very well crafted romance schemes. And it is these long running trust based scams that are like devastating people. I mean, I think the most recent report, the FBI and it has a bunch of data through the IC 3, it's something like $20 billion of reported losses, which is an insane number, right. And that's.

Just a reported number, so you can probably multiply that several times over. Right, right. And like, I think the FTC has has tried to do some of these multiplications, of course, like we don't know the true number, but we're like the, the, the estimations are in like, you know, closer to hundreds of billions because there's so much shame, right. When people realize or they don't realize, they don't report, they don't want to talk about it. And so the premise of, you know, be safe was it's it started off as like a research project, right? So often like the, the confines of academia. And the idea was could we create a long running system, system that engages with attackers naturally, you know, with the goal of mapping that entire attacker life cycle from initial inbound.

Hey, are we still up for golf all the way to hey, send me money at this account, download this malicious app, go to this weird domain. And with the idea being that in trying to map that entire life cycle, you get more information about the scheme, of course, but then you can go find people to partner with and shut down those pieces of attacker infrastructure before real victims pay out. And, and this is, you know, where a lot of this human oriented mindset comes in is like, OK, this is like a little bit of a tangent. I hear so much in this line of work that people are like, Oh my God, but why would anyone fall for that? Victims are so bad.

And I'm like, no, hard stop. This is psychological manipulation at its best. And there are so many, you know, not so many, but there's a number of people who are who are coming out to share their stories of how they got scammed. And it's it's like you see the data, but then you hear these anecdotes and you're like, yeah, that's a really convincing story. Oh, they talked to you for five months. Yeah, of course you're going to believe that that's someone who you like that that's someone who has your best interest in heart. And so the idea is like, you know, we can try to train people.

We can try to warn people. We can try to say like, hey, don't engage with this. But our philosophy is more let's shut down those pieces of infrastructure before real victims get harmed because, like, yes, they're going to be heartbroken, but at least their bank accounts will be whole. And that's kind of the the crux of the idea, yeah. Yeah, I for people that maybe, I mean, I think everybody's gotten one of those texts at some point. You know, it's like I get all different forms of them all the time. You know, a few months ago it was like the, the toll fraud scams were a big thing or you know, that's a that's a separate one.

I think, you know, that's just, you know, that'll cost you like 50 bucks or whatever it is. But these, the ones that you're describing are like you said, a long term play that like involves being invested in this trust relationship for weeks or months at a time. And it's a a variation on real world scams that have been going on for literally decades or hundreds of years. You know, like there's tons of Hallmark movies about this. Like you can just go watch those there. There's lots of them.

And there's a reason they work because most people want to feel like other people have their best interests at heart. They want to, you know, engage with other people on, you know, on a human level and have real conversations. And that involves trust. And if you are trusting the person inside your phone that you don't know bad shit happens. You know, it's and there's not a lot of there's a bunch of different approaches to like the security awareness training approach to this is like, I think we both know does not really work. I know you did some work on that in the past, but I mean, yes, people need to be aware that these scams are there, but like training them out of falling for them is not a thing that works. It just doesn't like we have 20 years of anti phishing training that does prunes proves that that really doesn't work on a large scale.

Totally, totally. And yeah, you know, you know, and, and, and I don't want to hate so much on training. Like I think that awareness is a great thing and that security, right? It's like the Swiss cheese model. There's multiple layers of defense. However, I don't think training is like the one firewall, right? It's there are going to be people who are not aware. They're going to be people who respond to the text because they're like, oh, I want to make sure Mary finds her golf partner or whatever. Right. It's like, it's like a very thing to be like, oh, wrong number.

No, sorry. And then the person falls up and it's like, oh, well, what's your name? Yeah. Oh, like, oh, we're chatting. What's your name? What are you up to? It's like, it mimics real world conversations where like you run into someone and and they're like, oh, I thought you were my friend, but you just look like her and you're like, oh, well, what, what's your name? Like that's. Maybe. Friends too. It's, it's, but it's, it is now online. There's all these different tactics. But yeah, it's, it's devastating because you know, you, you hear these stories, you see the, the aggregate reports from like FBIFTC, etcetera. But then you also hear these stories of people. And it's like, I see these news stories all the time because that's where my sphere is.

People think oh scammed out of $500,000 and you're like. I know. That's someone's life savings, that. They probably mortgaged their house twice to get. Yeah, yeah. And you see them like, pop up on like the local news here where I live. And, you know, like, every couple months, because somebody will write into the investigative reporter at the Boston news station is like, this happened to me. And you're just like, oh, my God, it's so devastating. Like, that ruined someone's life, you know, literally ruined their life.

Right. And you know, it's like these are the the people who are executing these sorts of like scams are really, they have playbooks, right? So like, I just, I want to take it back. Like a lot of these folks, unfortunately, who are like on the other side of the phone are, are human trafficking victims, right? So they're part of these like compounds, a lot of which are in Southeast Asia right now. I mean, if you just Google like Southeast Asia scam compound, you'll find so many reports. And unfortunately, these people are being told like, Hey, you have to do this, otherwise bad things will happen to you. And they're given playbooks like they are given phone forms and playbooks.

It is an operational like transnational criminal effort. And it is paying out. Like, that is why it is so successful. And that's also why I really want to lean on the psychological manipulation part because I'm like, I, I don't blame any of these victims. It's like very natural to to respond to someone when they engage with you. Yeah, that's the scope of the problem that you just kind of like touched on there. I don't think people understand that.

You know, I think they figure these are kind of like lone scammers down in the Bahamas or something like that or the the old Nigerian Prince, you know, kind of infrastructure which was semi organized. But what you just said is true of like most of those people are human trafficking victims. Their passports are taken away whenever they get to whatever country they're in. Their families are threatened or held hostage as while they're stuck doing this job in this, you know, scam call center somewhere in Southeast Asia for essentially like there's no end to it, you know, until they can escape or if they pay back some insane debt that they owe for being, you know, moved across borders illegally.

And yeah, they have, they have playbooks just like a normal call center would Like, you know, you call your bank or the Target call center or whatever. They have a yeah, they're, it's professionalized and horrifying and gross. Yeah. Right. And it's like we we see instances of that in our data, like we'll, you know, mention as we're engaging with scammers like Oh yeah, you know, really into classic rock. And then a couple days or weeks later, they're like, hey, I remember you said you like classic rock. Here's Pandora link to classic rock and it's like the level of personalization doesn't make you think transnational cybercrime organization it makes. You think?

Oh. That's a person who like you listen to me, right? It's, it's so convincing. I'm like, like honestly shocked. And also why, you know, and I find myself in the space because it's, it's a really big problem. It's a, it's a big problem that I, I is only growing and that's why, you know, we kind of came together to be like, hey, let's take the system that has shown to be able to run, engage with attackers, get this like really interesting infrastructure data, and then go find partners who like want to work together to shut it down with the end goal of like trying to prevent again, people who. Have fallen for the manipulation to to experience even more harm, right?

Like I, I don't want to downplay the emotional harm, but you know, I'm like, man, if I, if we can save some people from paying out money, yeah, that's a win. Like, no doubt, yeah. Because that's obviously the lifeblood of these, you know, transnational organized crime groups. Like they don't get into these businesses if they're not profitable and profitable on a huge scale, which these obviously are because they're spreading. I mean, I don't know how much, how much of what you guys are doing is sort of focused on the US or North America and how much of it is like all over the the world.

I will say we are very much focused in the US because that's that's where we're based, that's that's the ecosystem we're familiar with. This is happening all across the world. Like we're seeing instances of this in like the UK has a lot of really good reporting and actually the UK and Australia both have passed legislation about this. So these scam, let me take a quick step back. These scams are often classified as authorized push pay fraud. And so this is because like me as a victim, I am being led to believe this person is real, they're trusted. So I go to my bank account, I transfer, let's say $10,000, but I'm willingly transfer that, right? And I, I don't know if you've seen like, I know my bank, I tried to send money to my mom a couple months ago and they had all these warnings because I've never sent her money bank account.

And they were like, you sure, you know this person. I was like, no, I'm really certain I know. But I got all these warnings which are great. And also the playbooks account for that. And they're like, no, no, no, just click through that. Don't worry, like send the money. And so these scams, because people are willingly sending it, they're not being deceived. I mean, they're being deceived based on the trust. But it's not like the classic, you know, I, I got you to click on a DocuSign and got your details that way. It's, it's being classified as APP fraud. And now the UK and Australia have legislation protecting victims of this APP fraud.

So much like in how in the US, how we have credit card fraud protections, you know, it's like your bank has to reimburse a certain amount. They also are passing legislation because it's such a big problem. And they're like, listen, like the banks have to pay back in some way as long as there's like proof of document, except, you know, and there's all these caveats. But it is that's a long way to say this is absolutely a worldwide problem. And we're seeing that play out in, you know, the way that people are trying to shore up their defenses, the way they're trying to educate consumers, but also how policy is being changed to address or attempt to address this really growing type of of scam and fraud.

That's what I wanted to ask you because you mentioned sort of working with partners that want to help shut these things down. And you mentioned the IC3, the FB is Internet Crime Complaint Center that does a ton of good work on this stuff. But I mean, the FBI has its handful with, you know, terrorism, sort of traditional cybercrime, you know, all that kind of stuff that they're trying to get a handle on. So I don't know how far down the list that's this kind of stuff falls for them, but I'm sure it's not above the things I just mentioned. You know, I, I, I can't say what it is for prioritization, but in, in the most recent like cybercrime annual report that I dropped like two or three weeks ago, I as a data nerd, I'm like, please go look up like IC3, like annual 2026 or 2025 cybercrime report.

They actually have a call out to this operation within the FBI Co operation level up where this is a new tactic that they are taking where they're they're getting data from from various people, various partners and they're finding victims in real time and trying to prevent those losses. So they will like actually try and contact the victim, get to them in person and be like, hey, we're seeing a lot of like weird stuff. Yeah. Let's like take a pause and, and they have a call out in this report. I, I forget the exact numbers, but it's like ex people contacted, I think it's something like 500 million prevented in losses or something. And so like maybe not number one concern. I I I'm not in these agencies so I can't say. Yeah, but.

Seeing it in the government agencies where they're like, yeah, so we have this thing that we're doing and it's like kind of working, which is awesome to see from a government perspective and agency perspective. Yeah, it is, because they don't. I mean, it's not the easiest thing in the world to get your arms around, I would think, from a law enforcement perspective, because it's not something that you can totally monitor that easily. It's all these ad hoc interactions between victims all over the country and fraudsters in Borneo or Malaysia or wherever. Right.

And, and again, because like we have data on this, one of the things that makes this so tricky also is that like a lot of these conversations move between platforms. So like, let's say that you start with an SMS and then at some point, and we see this, the majority of the time the attackers are like, Hey, actually, let's move to WhatsApp. Here's my WhatsApp number. And so then all of a sudden you're moving into a channel that's end to end encrypted. You're, you're moving the conversation. So now it's like fragmented across these different platforms.

And sometimes they even move to like another one. And this is very intentional because it's in their playbooks. But yeah, it's like it's such a fragmented problem because then all of a sudden you get, you see at the end payment platform, financial institution, whatever. It's like, oh, this person is now sending money to, It's like they don't have the context right. And the context spread out across the Internet, across all these different platforms. And it is really a tough, tough problem to address, that's for sure. So how does the the platform and the technology actually works work without giving away your, you know, any sort of secret sauce here, but what's the what's the general flow of the way things work?

Yeah, absolutely. So like you can kind of think of, think of us as like a large sensor platform. So we set up sensors across a ton of different places where messages will come in, wait for these like seemingly innocuous messages to show up. And then our system, right? Our, our, our, the system that we develop will engage with these messages in an attempt to figure out like, is this a scam or not? And this is where like the security and AI research skills that you know, our team has really comes in handy is to like try and, and train different parts of the system to be like, hey, this is like high likelihood scam. Like actually, no, this is just a legit wrong number. And then you know, for those things that are very, that are verified scammy intent, which you can usually tell within like the 1st 10 messages, we just continue to engage. And like I said, the system can engage naturally. It has all these like safety guard rails because who are very concerned about, you know, AI

and security. So and a little bit, you know, like I back on cybersecurity, MY2 colleagues, their background is in AI research. And so I'm very fortunate to continue to work with smart, awesome people and kind of combining those forces has been really fruitful in this endeavor because, you know, we have both of those guardrails in place. And then we just continue the conversation right until the point where they're like, hey, here's the account, here is the payment platform, here's whatever the final ask is.

And that final ask can look different. But like I said, the philosophy is like by engaging with them, naturally, you're able to like see the patterns, the playbooks, whatever. But then you can also see where they're trying to send money and and that's where you know that that really interesting information comes in. Do you have a sense of whether these groups are using AI on their end? I mean, we know that most of it is human based sort of out of necessity, but is there a way to to know whether they're using AI to sort of optimize some of this for themselves? Amazing question, Dennis, I'm so glad you asked because we have looked at that like, you know, it's so fun being trying to tackle this problem, but also, you know, having a, a very like research oriented mindset because we saw this data coming in and we're like, how much of this is AI generated? And at least what we're seeing right now is like, so a lot of the scammers like 20 ish percent

of the time will send some sort of multimedia, like a picture, a video, a voice memo. This is super interesting because sometimes the pictures will have the details of what, where they want you to send money itself. And so like being able to like ingest it and analyze, Yeah, like space parsing and putting it in the image, Right. Exactly. Interesting. OK, Yeah. That's yeah. You're smart. You're good at what you do. Yeah. But to answer your original question that a lot of the AI voice clips seem like they're, sorry, a lot of the voice clips seem like they're AI generated and there's evidence of that. We can run analysis and be like, yeah, this is like something that was computer generated.

But the images and the videos and stuff, it just appears like they're stolen, like they're not deep. And so we're seeing instances of these attackers using AI, but it's not all AI generated. And I mean, we know that because the compounds still exist. They're using it, but they're not replacing the humans entirely, at least not yet. And, you know, I can't say who knows what the next few years hold in this world of AI and, and computation, but maybe it shifts that way. And, and, and that's where, you know, we're like, Hey, we need to be prepared for anything, whether it's human generated, AI generated, but we're just not seeing that at, at wide scale yet.

And I, and I will say, I know there's a lot of like reports around AI usage and like targeted attacks. And I think that's different here because this is a little bit more like send as many messages as possible, try to reach as many people as possible. And then if you get like a point O1 success rate, that's still your payday and. So then. Right. The economics are also a little different than like a targeted like oh, how do I get Ariana to click on a malicious thing or like trick her specifically? Yeah. Yeah.

Yeah, I would just from, from the outside, my sense is that they would almost need humans for like just about every step of these scams just because they need some sort of naturalistic back and forth to keep a human victim engaged. You know, people are so sort of used to dealing with chat bots now over the last three years, like you, even people that aren't in the tech world like we are, I think can kind of detect like this is this is a robot. Like, yeah, there's something off here. Like the syntax is is goofy or you know the the responses are coming too fast or too slow or whatever it is. Right, right, right, right.

Yeah, I think that's very true right now, but. Right now, like, yeah, but yeah, like a month from now, who knows? Right, right. And I'm like, and it's really interesting cuz I'm like, you know, the economics are very much in the favor of using humans again, because they're traffic, they're victims themselves. And I'm like, OK, so at what point? And not, I don't, I don't mean to be crude about it in, in any way, but I'm like, you know, these cybercrime organizations are thinking about their return and their profit. And so I'm like, at what point does that flip? And you're no longer trafficking people because you just have really good AI systems that are prolifically available and ubiquitous.

And that is what they're using. Like I, I think that's, that's this current situation we're in is terrifying and scary. And that one is also terrifying and scary for completely different reasons. It absolutely is, yeah. And I don't think that's too far off. I honestly don't. I mean, just given the pace of innovation and change that's happening, I mean, just in the last like 3 months, look at how or even less like we were talking before we started recording about Claude Mythos, like God help us that, that seems like it was six months ago. It was like 2 1/2 weeks ago when that happened or three weeks ago that that, if that.

For ingesting the which security is is changing, has needed to increase because I'm like, oh, now we're dealing with this this week, yeah. Great, tremendous, great. Yeah. Because I mean. Lovely. Yeah, even people like you who are crazy smart and put all of your energy into this, like you, there's no possible way to keep up with the rate of change of what's going on in this world, you know, in the in, by which I mean just AI in cybersecurity. Forget about AI usage in, you know, the real world, the outside world.

It's. I don't know how you maybe this is intentional or not, but outside world is the real world. And then we're in our little security bubble of like what is happening here? Like it's just feels, it's sometimes it's very surreal. It is surreal. Like the things that I I see and read and you know, it does just bring me back to this question. Like, OK, so when do these cyber criminal organizations be like, yeah, we're going to start testing some of these AI models and in service of, of executing these these pig butchering conversational scams?

Yeah, that's also where I'm like, hey, we need to be ahead of this, which is, which is what we are working on. That's where we're at. We're like on the other side of like, hey, let's like keep up with all this stuff as it's changing as much as we can scale, you know, try to try to impact the problem as much as possible. But it it is a an interesting existential question of like when do they start using similar things? Right. Yeah. I mean, I was having a conversation with somebody earlier today about this and I mean, my bad.

I don't know this for sure, but just anecdotal evidence I hear from security researchers, I'm pretty sure that like the top level attack groups from China and Russia and possibly elsewhere are using frontier AI models in their own work. They have the resources, right? They certainly have the motivation and they have the money and the people to do it, so I don't know why they wouldn't be. Exactly right, cuz there'd be questions.

The question is not why would you use it? It's like, why wouldn't you use it? Yeah, yeah, yeah. I mean, yeah, it's it is really terrifying because everyday you sort of wake up and you're like, holy shit, another thing happens. Like I didn't even like process what happened yesterday in this world and like security has always moved fast. But I just feel like it's like compounded over the last like year or so. I I definitely feel that way 100%. It just that again, the rate of change has increased to a level where I'm like, I, I am, you know, I think we're all doing our best to keep up and it, and it feels like there, it's a little bit of like running behind the news. I'm like, OK, now there's now there's another thing like I actually did think as we're discussing like, Oh yeah, Mythos was only like 2 weeks ago.

Yes, and like 5 other big things have happened since then that are just, it's, it's so wild. Yeah, I don't know. But that's why, I mean, I'm happy that there are people like you guys focused on a specific problem. They can actually bring some benefit to people instead of just, you know, making somebody else a giant pile of, you know, gold coins in a bunker somewhere in like, the Bay Area bunker. Somewhere. Yeah. No, it is. You know, we, our researchers by trade and, and, you know, are very much motivated by trying to tackle this problem that like I said, it's only growing.

Like you look at all the reports across multiple countries and like the, the graph is up and to the right in terms of number of losses and number of victims. And it's like, OK, so how can we address it? Let's try to go after the the fraudsters themselves and and shut down that infrastructure as quickly as possible so that like my friends family member isn't paying out and that that, you know, at the end of the day, what we're what we're what we're doing. And I feel like you guys have the, I mean, this is a bad way of putting it, but the advantage of everybody kind of understands the problem you're trying to solve.

It's not some insanely complex technical thing where you're like, well, we have this really cool exploit mitigation that like solves, you know, it prevents buffer overflows in it. No, like you. Actually take the CVSS score and then we put it through this model and then. Yeah, right. No, you're like, have you gotten one of these texts? Yes, we try and fix that like. Yeah, I know when I, when I told my family members, you know, and, and friends, they were like, oh, so you're, I was like, Oh yeah, you know, I'm actually leaving my, my current job and I'm going to start, you know, this new venture with, with two amazing colleagues of mine. They were like, oh, well, what what's the problem? Like you, you don't have to dumb it down for me. And I'm like, no, no need.

Have you gotten all these? Texts. No, it's, it's pretty simple. Yeah, yeah. Yeah. And like, some people are like, oh, my God. Yeah, sometimes I respond to those. And sometimes I'm like, yeah, I never respond to that. And I'm like, yeah, a lot more people respond to those than you probably would think. And they're a lot more devastating than you would think. And and it has made my family life a lot easier because previous parts of my research were like, I was like, oh, well, like, imagine this analogy. I'm like, no, no, that text. That's right. Let me just send your phone. I'll show you what the problem is right now. Yeah.

And it's crazy because like, even for Someone Like You or me who is hyper aware of this problem, you get one of those texts. And sometimes I just look at it and it's like the area code that my cell phone number is, which, you know, they're very careful about that. And you kind of look at it and you're like, this could be the guy that I played golf with last summer that like, I can't really remember his name, but it might be him. I don't know. Like I'm never, I barely respond to texts from people I know. So, you know, like the scam ones are not going to get me to respond.

But you can. It's very clear how or why this works. You know, it's, it's not a mystery. Dennis, now I know if you're not responding to my texts, I'll send you. I'll be like Dennis, stop responding to the scam. To the right, stop talking to the guy in Malaysia. You. Know me, respond to me. Yeah, know, no, it's again, it's, it's manipulation of being a human. I, I have no other good way to describe it. It's just like they and, and because texts are cheap, phone calls are cheap, they just keep trying until something sticks and like, that's the unfortunate world, you know, I, I think there's a lot of benefits of being so interconnected. I think this is one of the potential downsides right is. It is now just cheap to message anyone on any platform at all times of the day until something sticks and you're like, oh, and it's like, I was thinking about

this the other day. Like my, my mechanic who's local to my neighborhood sent me a text and I was like, I mean, my car is in the shop today. I think this is real. But you know, I, I, I did my due diligence and I, I checked and it was like, Oh yeah, they changed the number on their web page to match this. But I was like, I don't know, their phone office could be down and they're just like texting me because they're a, a mom and pop shop and they're like, Oh, here's your update about your car. I'm like, this could be pig butchering. I don't know. No, it was actually my car having issues. But like, that's what.

I. You it makes you think you're like is is this? I don't know. I know. And I feel like that's just an occupational hazard of being in this world of like, you're just kind of skeptical and distrustful of almost everything all the time, which is a terrible mindset to have, you know, especially for like somebody like me who's like a generally optimistic person. And you, you just kind of look at everything. Like it.

You look at it like side eyed, like that's bullshit. I don't know. That's yeah, I'm sure that's a scam. I know that's. Right. I know that one's definitely. I know I got, I got a letter in the mail and I was like, is this just another scam? Yeah, it was. It totally was. I was like, damn, now they're physical mail too. Great. Yeah, yeah. All messaging platforms is very literal, right? It's like you're getting on text, you get on social media, you'll get it on any platform you're using getting in the mail. I'm like, yeah, this is a it is an interesting time we live in.

Let me just say that. Interesting is one word for it. Yeah. I mean, I feel like a lot of this just kind of goes back to human psychology and behavior too. Like you know, you mentioned you were sort of like human centric security is where you came from. So you must have been kind of like steeped in that as well, you know, kind of looking at it from the psychological standpoint. Well, and, and, and 100% and you know, that's what a lot of my research over the last 10 years has been around. It's like, oh, when we have people do fishing training, is that effective?

And like, what are the hypotheses for perhaps not being so effective? Like when you ask people to change their passwords, like what happens organizationally and also like to the individual people? These are just some examples of some of the work I I've done and you know, it really, this is also why and I've said it, I've said it before and I'll say it again. I just like can't blame victims. No, I I hear these stories like, like, for example, I don't know if anyone here has heard of of Becky Holmes. She has this book.

I'm going to butcher the title. It's like Keanu Reeves is actually not in love with you. And this is an example of someone putting their story into writing and you read it and you're like, Yep, this is convincing. Next page. Oh, that's tough. Yeah, Yeah. So it really provides, I think, a different perspective because, like I said, I need so many people in this field of work who are like who responds to that? And I'm like a lot, $20 billion of reported losses, a number of people, right? Yeah.

But that's I feel like some of that may be resistance to what you're describing is just like the insular mindset of the tech world of like, I'm too smart for that, you know, because I do what I do. I would never shut up, man. Yeah, you would. Like, if they found just the right lure, I promise you, you would. I know Sisos that have clicked on phishing links and really bad things have happened. And these are highly trained, really smart people like. Totally, totally.

And, and you know, this is, this is something I've thought about a lot. I, so many of our security protections rely on the user to like making judgment calls and being aware and being up to date. And at some point, I forget when this switch happened, but in my career, I was like, this is not sustainable. And so I very much am on the side of like, what can the systems do for us? Like, how can we protect people? And like there's, there's so many examples of this, but like, how do we protect people without them knowing?

So like, how do we just get to that point where they don't need to make a decision? Like one of my favorite examples of this, it's not scam related, but it's more like browser security is, you know, for years a lot of the major browsers were trying to like get every website over HTTPS and get all connections over HTTPS. And at some point Chrome was like, hey, there's all these pages with mixed links. Like they have like third party web pages that are HTTP, we're just going to upgrade them to HTTPS.

Like we're just going to do that for you. And so you no longer have a user who's sitting at their web page being like, oh, that like weird symbol. I don't know, like is this say, is it not? It's like the system just to say like, hey, we're going to just implement that protection. And I think that's just like a lot of where my mind goes is like, how do we build these systems, create these data sources, like pull together the ecosystem to protect people without them knowing? Because like, man, it's tough to be a person on the Internet right now. It is so hard.

You're so right. This is why you go on like 3 week long hiking trips and you're just like, I'm out. Like no, thank you. No, Yeah, yeah. Yeah, it's. You need to disconnect a little bit to like see the problem fresh. No doubt. And but you're so right about kind of that invisible layer of protection that needs to exist because we cannot rely. And it's not, this is not victim blaming, but we can't just rely on humans to defend themselves from persistent, you know, well trained, in a lot of cases, well resourced attackers. This is their job.

They are trained to make money from you in one way or another. You're not really trained to defend against that. And you shouldn't have to be. You know, it's, like, exactly. There's a reason that the government decided to put, like, fluoride in the water 50 years ago, Like, help people. Yeah. Yeah. It's like a great non security. Oh my God, Dennis, I'm going to. I might have to start referring to that as a non security example. It's all yours. Yeah, exactly. It's like this is just good for you or like these these OK, I kept now I'm thinking about other I'm looking at economic examples.

Never mind but. Go for it, yeah. Like like how it's like, you know, you're you like a lot of like savings accounts are like 4 O1 KS. They're just like, yeah, we're just gonna auto enroll you. It's like, yeah, that's just good for you. It's just good for you. Like we're just doing it. It's like, how can we just opt people into protections and like the security and Internet is different and. Yeah, but. Other systems, but no exactly this. We have thousands of years of human behavior to sort of look at and understand that humans are fallible and we're all going to make mistakes and we can't just train them out of that in the same way that we can't, you know, bug fix our way out in into security.

Like, yeah, Mythos is finding giant piles of bugs. Great, we go and patch all of those. There's another pile behind that like that. We can't just keep doing that on infinitum, you know, that's. Piles on piles on piles, yeah. So many bucks. I know, and I'm just, I, I going back to a comment and you said prior, it's just so interesting how cybercrime, you know, continues to evolve, but also mimics a lot of human history. I mean, like this. And again, I, I might butcher the details of this, but there's like the Spanish prisoner scam where people would get letters from someone who's like, hey, stuck in Spain. I'm in prison.

But like, if you give me some money, I'm going to be able to get out. I can like get out of the situation and then I'll get access to my money and then like I can pay you back with interest. And it's like that same thing is happening just on my phone. It's it's, and this is like 100 year difference that we're seeing. And so it's like human psychology is the same, you know, how people react has remained the same, just the methods at which they are being manipulated, exfiltrated, etcetera.

Like that's just changing. And so, yeah, how can we protect people knowing that we're valuable, as you said? Yeah. The the methods change, people don't. I mean, that's kind of what it comes down to, unfortunately. Yeah, yeah. Well, Ariana, thank you so much for coming on. This is a delight. It was so nice to see you. I'm really happy for you. I'm really excited to see how this goes. Thank you, it's my pleasure. It's always fantastic to chat and thank you for for having me and and letting me talk about pig butchering scams and and conversational scams. You know, as much as I'm like, yes, we need system level defenses.

Even if one person hears this and and tells, you know, the people in their life like, hey, don't respond to those texts. I also consider that a win. So like, tell people in your life, let them know like those texts are not as innocent as they seem. And and you know, hopefully in a couple years this will be less of a problem. But I hope so, yeah. Awesome. Great to see you. Likewise see you later.