Social Engineering: How One Scammer Took $100 Million from Tech Giants

SPEAKER_1 (0:00)

Picture this, you have two of the most technologically advanced, heavily fortified companies on the planet. I'm talking about Google and Facebook back in 2017

SPEAKER_2 (0:10)

Massive targets.

SPEAKER_1 (0:11)

Huge.

And they spend tens, probably hundreds of millions of dollars annually on cybersecurity infrastructure alone. I mean, they employ literally the brightest network engineers in the entire world. And yet, between the two of them, they were conned out of $100 million.

SPEAKER_2 (0:29)

It's wild.

It immediately conjures up the plot of a Hollywood heist film, doesn't it? You know, you expect a team of elite state-sponsored hackers dangling from the ceiling in a server room somewhere.

SPEAKER_1 (0:39)

Yeah, bypassing biometric firewalls with some some incredibly complex encrypted algorithm.

SPEAKER_2 (0:45)

Exactly. But the reality is usually so much simpler.

SPEAKER_1 (0:49)

Right. There was no sophisticated algorithm. There was no massive zero-day exploit ripping through their mainframes.

The culprit was just a single Lithuanian fraudster.

SPEAKER_2 (0:59)

Just one guy.

SPEAKER_1 (0:59)

Just one guy.

And over the course of two years, he simply impersonated a hardware supplier that both of those tech giants regularly worked with.

He mocked up some official-looking letterheads, sent them fake invoices, and they just paid him.

SPEAKER_2 (1:15)

They really did.

SPEAKER_1 (1:16)

They wired $100 million to a scammer because he basically just asked confidently. And if you're listening to this, whether you're a corporate executive or just someone checking your personal email on a Tuesday, this deep dive is going to completely change how you view your own inbox.

SPEAKER_2 (1:32)

Oh, absolutely.

Because an incident like that forces a total paradigm shift in how we evaluate information security. You can build an impenetrable digital fortress, but if the guard at the gate just hands the keys to a stranger wearing a clipboard and a smile, well, the walls are entirely irrelevant.

SPEAKER_1 (1:49)

They're completely useless.

SPEAKER_2 (1:50)

Right. We are so conditioned to view hacking as a strictly technical problem, like a flaw in the code. But the most devastating attacks don't actually target the code at all.

SPEAKER_1 (2:00)

Right. They target the ultimate weak link in any network which is the human brain. This is the fascinating high stakes world of social engineering.

SPEAKER_2 (2:08)

It really is the ultimate vulnerability.

SPEAKER_1 (2:11)

Okay, let's unpack this. Because it's like spending a fortune installing a state-of-the-art alarm system on your house, right? You've got motion sensors, laser grids, encrypted keypads, the works.

But the burglar doesn't waste time trying to hack the circuit board. He just dresses up as a pizza delivery driver, knocks on your door, and you willingly open it for him. You just invite the threat inside.

SPEAKER_2 (2:32)

What's fascinating here is the underlying logic of it. I mean, the economics of that approach are undeniable for an attacker. Why would a bad actor spend eight months trying to discover a complex zero-day vulnerability in an operating system?

SPEAKER_1 (2:44)

Yeah, that takes a ton of work.

SPEAKER_2 (2:45)

He requires immense technical skill. It's incredibly resource-intensive.

The moment the software vendor issues a security patch, that multi-million-dollar exploit is just burned. It's useless.

SPEAKER_1 (2:57)

They just bypass it entirely?

SPEAKER_2 (2:59)

Right. It is vastly cheaper, vastly faster, and far more reliable to manipulate human psychology instead because human psychology hasn't received a security patch in about 200,000 years.

SPEAKER_1 (3:11)

That is such a great way to put it.

But I do want to push back on that a little bit. Because when we hear stories of people handing over passwords or wiring millions of dollars, the immediate assumption is that the victims are just gullible or just lazy.

SPEAKER_2 (3:26)

Sure.

SPEAKER_1 (3:27)

Yeah. We tend to view falling for a scam as a failure of intelligence basically.

SPEAKER_2 (3:32)

And that is a very, very common misconception, and it's honestly a dangerous one. It is not about intelligence or laziness at all. It's about exploiting hardwired evolutionary traits.

SPEAKER_1 (3:44)

Like what specifically?

SPEAKER_2 (3:46)

Well, we are biologically programmed to rely on heuristic processing. These are mental shortcuts that help us navigate a really complex world without experiencing constant cognitive overload. We are wired to be helpful, to avoid social friction, to defer to authority figures, and to react instantly to threats.

So attackers don't bypass our intelligence, they actually weaponize our biology against us. Wow.

SPEAKER_1 (4:12)

Okay. So let's break down exactly how they do that. Starting with this concept known as pre-texting, because this isn't just cold calling someone and blindly asking for a password.

SPEAKER_2 (4:23)

No, not at all.

SPEAKER_1 (4:23)

It's about setting an elaborate, highly personalized stage to manufacture legitimacy, right?

SPEAKER_2 (4:29)

Precisely. Pre-texting relies heavily on information asymmetry. The attacker does their homework long before they ever make contact with you.