How a Fake Podcast Invite Nearly Hacked Laura Shin

**Austin Campbell** (0:00)
Today, we want to start with something contemporaneous that just happened with regard to Unchained to explain to people exactly how things are still working in crypto and how to keep yourself safe, which is somebody tried to spearfish Laura earlier today. So Laura, can I have you tell the story of what we were talking about before we went live and what happened?

**Laura Shin** (0:24)
Yeah, so it wasn't today, it was last week, but I had agreed to do a podcast with somebody. And when I logged in, the link wasn't working and I was getting this notice saying that I had to download some software. And so it's so funny because they did actually convince me to download the software. And I even got to the point where I even executed a terminal command. And here's the crazy part.
If you look at the screenshots of my conversation with this person, the whole time I kept saying, oh, this is how people get hacked. Because initially I kept refusing to do all the things. And I have covered hacks, I've covered phishing attempts, I've covered just all kinds of scams in crypto. I was, I think, the first person to write about SIM swaps back in 2016 And even before crypto, I covered personal finance, I covered identity theft, I covered so much about scams and social engineering. Like I interviewed the main social engineering people well before I ever got into crypto. So it's just so funny because I keep saying to this person, oh, but you know, I, like I would refuse them and then I would be like, this is how people get hacked. So here's the thing, like now I realize, okay, here is how this person got me to override all of my internal alarm bells and all my learnings.
They said, oh, well, it's a special crypto podcasting platform. And they sent me the link to the X account. And I looked at this X account and 153 people that I follow are following this account. And I was like, oh, I guess it's a crypto podcasting platform I've never heard of. And so then the notion that like maybe I actually needed to download some special software was no longer so strange. But I also remembered that I had this moment where I was like, I feel like I should tweet to ask my followers if this is, but then because this person kept messaging me, so I just didn't do these things that floated through my head. And then when the software of course didn't work, then he was like, oh, well, there is these like terminal instructions. And even that, I was like, what the hell? Like I just was, and I think I said no again multiple times, but then they were like, no, no, no, I swear, like all these people use it. And I think they again use the X account. So my point is the good news is I don't think I lost anything. I didn't have, like I have to, there's a lot of things I have to do because I had to reset my computer to factory settings. I had to take it offline. Like there were just a lot of things I had to do. And so even today I'm still downloading apps that I use. I'm still logging in to them. Like there's, I'm still changing passwords. There's kind of like a lot that's going on.
But yeah, it's just funny and embarrassing because like I knew all the things. I knew I had so much knowledge. I'm literally trying to teach the guy about social engineering and how, you know, and anyway, so yeah, I still, I still didn't listen to myself. And that's exactly how social engineering works. It's exactly, it preys upon your desire to be a nice person. And oh, and by the way, you know, this quote unquote podcast, like of course, you know, I looked it up on YouTube and yeah, it's a legit podcast. But is that account that was trying to get me to do all those things where they really connected to, you know, that group? Probably not. In fact, like 99.999% not.
So, yeah, last thing I'll say is just Seal 911 They've been on the show so many times. Everybody always talks about them, but they truly are an amazing resource. And they helped me, you know, over the weekend. And yeah, they yelled at me a little bit too, but I deserved it. So that's, that's basically the story.

**Austin Campbell** (4:25)
Now, and I think you raised some interesting threads in there, which is if you think about, like this is something the banking industry struggles with as well, right? If you think about the threat vector of social engineering attacks, even people who are informed about how they work do fall for them because the attackers are trying to prey on you at the exact moment where your mind is occupied with other things and you are not fully aware. And that's one reason they always try to create time pressure. Like we need you to log in for this podcast. Oh, the cutoff is coming at 4 p.m. Oh, so rule number one for anybody. When you have somebody on any form of social communication or even texts, applying time pressure to you and you're not certain about something, the first question you ask is, is this truly catastrophic if I don't do it? And if the answer is no, just don't do it.