Speaker 0:00

Good morning everyone. Welcome back to BCX Connects, the show that tries to keep you one click ahead of disaster. My name is Garith Peck. I'm the managing executive for cybersecurity here at BCX. With me today is my colleague Chris Bester. Welcome Chris. Good morning, Harid. Thank you. Cool. So I think it's that glorious time of the year again, Black Friday. It's the time where the economy surges, logic takes a vacation, and uh we you know we buy appliances that we don't need, and apparently uh even a uh a toaster that connects to the Wi-Fi is is important to people's lives at the moment. So um, and this is exactly what hackers love. I think uh it's uh that opportunity that we create for them. That's true, yeah.

Speaker 1 0:49

We're creating the opportunity, and and it it's it's about the rush as well for that that that

The Dopamine Effect

Speaker 1 0:54

sales rush. That dopamine. The dopamine effect. Um we spoke about it earlier. It's it's it's it's the same as gambling, you know. Once you pull that lever and you you win a couple of coins, you want to pull it again. You know, it's it just creates that that that sense of uh excitement and and so forth. So you um common sense goes out of the window, though. 100%.

Speaker 1:16

I mean like Black Friday is is literally open season for cybercrime. Um that's when everyone is distracted, um emotions are high, and you know the the wallets are open, right? And and and that's where the cyber criminals take advantage of the psychology of a sale. So if we start there, why does this madness happen every year? Right? So what what is it about a 70% off sale that makes people abandon reason um faster than uh a Windows update? That is always the the the the the question. Yeah, uh bogbles your mind, isn't it? Yeah, it's uh yeah, it's I think it's it's for me it's about behavioral economics, you know, the that that flash that flashing countdown uh timer with only two left uh uh items on the banner, you know, that uh triggers that uh FOMO.

Speaker 1 2:06

FOMO is the right word, yeah. Um it's right. Well this this one um thing we wrote about a while ago is this this criminal, well, cyber criminal, he says he works one day a year, and that's on Black Friday. Yeah. And he makes enough money on Black Friday to keep in touch the whole year. So and and that he he he really uh uses that behavioral aspect of people of of of of of that sales urgency uh type of thing.

Speaker 2:36

And and yeah, that's yeah, and and I mean from a psychological perspective, you know, like you mentioned, that dopamine hits like the the circuits like gambling, you know, it it gets people that chemical rush, the idea of saving when you're not actually saving anything, you know. So it's it's what you can call uh vagus in a shopping cart. Exactly, yeah. So I I think they the the the the whole thing it's it's driving around it's driven around emotion, right? So it's emotional, it's impulsive, and it's online. And this is the hacker's dream. Because this is the combination that they that they look for, because they they don't need to outsmart um complex firewalls or complex uh systems or antiviruses or anything like that. They now need to just outsmart your attention, you know, to your attention, man. That that is the the the psychological hook. The human weaknesses, yeah. And

The Human Weakness

Speaker 3:25

the scale of this problem is big because I've seen some numbers where uh you know statistically, Black Friday weekend globally is around 150 billion US dollars. That's that is you know the uh what they are projecting for this year. In South Africa alone, we we we're looking at about 20% increase in our e-commerce spend, and then that and and that's a massive attack surface, especially if you are not cautious, if you are not conscious, um uh, etc. So and the data backs it up because Checkwood Labs, they also said that fishing campaigns during this period is up by 30%. Uh sorry, but up by 200%. Um so that means that leading up to Black Friday, there's a whole barrage of campaigns, um, of fishing campaigns that's already out there. Aggressive, aggressive fishing campaigns, yes. Yeah, Sabrik um also reports that the card not present fraud is also up, and um this is up by 80% um, you know, for uh banking crime locally. So it's predictable chaos. Um the the the criminals plan for this like it like it's a uh a marketing campaign.

Speaker 1 4:33

Exactly, and the banks plan for it as well, because I mean they have extra shifts of people, you know, just working in the background trying to counteract um uh fraudulent cases and things like that.

Speaker 4:43

Yeah, I think and I think maybe let's let's unpack that for the users, right? So so there's there's trends and there's tackers. So if you unpack what shoppers are facing this year, so the classics are there, you know, the the the fake courier messages, clone shopping sites, dodgy whatsapp deals, you know, but there are new flavors out there. I think the the the fake courier ones, I mean I know somebody personally that I was impacted by the fake courier ones because now with Timu, with Sheen, um Shine, I don't know if you pronounce it correctly, um take a lot. So they were making a lot of uh um online um purchasing, so there was a lot of courier uh messages coming through, and there was one specific courier message that was asking for a payment, you know, um, and they assumed that it was related to the Timu uh clearance, uh clearing uh uh uh fee that they needed to pay, and they volunteered the credit card information and boom, you know, money was taken.

Speaker 1 5:38

Yeah. And then the the the problem also now um with the influx of AI tools is

Influx of AI Tools

Speaker 1 5:45

you know criminals, the cyber criminals actually using the AI tool to scrape your personal information. They they they they they form your uh a picture of your shopping habit. Correct. They know exactly what you've been buying over the last month.

Speaker 6:00

So they the interesting thing on AI that you mentioned, because like now there's also AI deep fake adverts that is also being pushed out. So influencers promoting fake stores, um, you know, uh there's a lot of look-alike domains, you know. Um people are not paying attention, there might be a letter swapped out of take a lot as an example. You know, there's fake payment portals, but the new one that that that that everyone is like uh talking about is the QR code scams that's happening now. So so stickers uh uh the stickers are swapped on delivery slips, you know, um that lead you to malware instead of uh tracking information. So the hackers are uh are definitely innovating faster than um what our retailers are, you know. Um so it's uh it's actually quite scary. And the thing is, why why do we fall for it? I mean, this this part, yeah. I think we've spoken about the human nature in our previous podcast, and we've spoken about the human element, but um even the smartest people still fall for this. They still but um and I think this is where we talk about where pressure overrides logic. Common sense fly out of the window. Yeah, um, so there's there's that term that they use where they said it's scarcity bias. Right now, scarcity bias, you know, you believe something is valuable because it's almost gone. Um whether you need it or not. That's that countdown thing where you know there's only two items left and you know you're not gonna get it anymore, etc. There's also the the social proof is is another um issue

Social Proof

Speaker 7:36

because what a lot of people like to do when they're before they purchase an item, they're gonna look at comments and reviews, not knowing that in many of these reviews or some of these reviews could be all fake. Right? And that's true, yeah. I mean so you assume legitimacy of a of a specific item based on comments that you see.

Speaker 1 7:56

Yeah, just a while ago I actually wrote about it and I said, you know, don't trust the the reviews on the actual website where you buy. Um but it turns out that maybe some in some cases up to 90% of those reviews are just put there by the actual guys. I mean it's fake, it's not correct. Correct. Rather go into um something if you want to review a site, go into something like Hello Peter or or go into Reddit and just find uh you know independent review on the site and people are and there's also another thing called uh authority bias, you know.

Speaker 8:31

So that's where the logo looks right, you know, but your bra your but your brain fills in the trust or the gaps and add a flashing timer, and your your brain and uh literally shifts into this whole frontal cortex mode where the logic part that limbic system is like that emotional part is out the window. So you stop thinking and you like reacting.

Speaker 1 8:53

Yeah.

Speaker 8:53

So for me, uh that's the equivalent that I would say Black Friday is literally a psychological DDoS attack.

Speaker 1 9:02

That's a quite an interesting um way to put it. Yeah, you're quite right. You know, it's throwing them in its uh DDoS.

Speaker 9:10

Yeah, it's so it's like um in the same scenario like a DDoS, you they're flooding the brain. Yeah, you're flooding the brain, crashing the reasoning.

Speaker 1 9:18

Exactly. So DDoS on the DDoS of the brain, if you can call it if you want to if you may. Um and it's really aggressive marketing, and they they they just flood, flood, flood, flood. And and you know, um and and in our daily lives, we're on our phones like 60% of the day, if not more. You know, some people are more. And and that's that's where all these things happen. You pick up your phone, you see this message, oh what's that? You know, and and it's another marketing um thing, is or another special, another suggestion. Suggestion. And and and and that's where that oh um you you mentioned you know people do uh buy things just because they they're special. And and you uh people buy superfluous items, they never knew existed, you know. But all of a sudden, uh it's urgent, I need to have it.

Speaker 10:08

So let's let's uh um talk to our users about you know how to stay sane and safe.

The Survival Tips

Speaker 10:14

So we we we we give our liver our listeners the survival tips um you know um before they start buying that electric scooters for their for the poodle. So I think uh number one, uh Chris, I think um type the URL the URL yourself. You know, don't click on an SMS or or social media. I mean, what do you think about that? Yeah, and be wary of the QR code. Yeah, correct. Look out. Uh I mean, number two, look out for the HTTPS or uh padlock item. You know, if it's an unsecure site, you know. Don't even go near it. Don't go and don't go near there. I think number three, I would say um never shop using public Wi-Fi. Very true.

Speaker 1 10:58

Yeah, you you call it called public Wi-Fi, it's now called hack hacking.

Speaker 11:02

What's it? It's it's it's now the the the hotspot is now called a hack spot.

Speaker 1 11:06

Hackspot, that's what you call it.

Speaker 11:07

Yeah, so that that free mall Wi-Fi, no, no, it's yeah, don't don't use it. Stay away, stay away. So number four, um virtual the use of virtual cards uh one-time pins, you know. I think most South African banks offer them now. I think that that's a good practice uh for consumers to use. So I think number five, you know, check your statements immediately. You know, quicker you see the problem, the better the bank can assist you to reverse it. Um number six, I think don't post your shopping confirmation on social media. Very, very true. You're not manifesting abundance, you know, you you're manifesting identity there.

Speaker 1 11:47

You know and and and and that's so strange for me. People have this this real urgency to tell everyone that they what they bought, where they went, and all that kind of thing on social media. You know, you get and and I said everybody is on their phones, and if you you're a friend that has on on Facebook, that will pop up, I just bought this.

Speaker 12:07

What there's the AI twist, uh like you know, so we we uh we hear a lot about the uh AI scams, you know. We've spoken about deepfakes, there's also the synthetic voices that are entering the game, you know. So I I think uh what's happening here? I mean, you know, how is AI changing this uh Black Friday scam?

AI Impact on Black Friday

Speaker 1 12:29

It gives the the the cyber criminal a uh like a huge range of tools that he doesn't need any expertise on. He and in the past, you know, they actually needed some sort of some level of quite a deep level of expertise to pull these things off. Yeah, AI is doing making it easier for them.

Speaker 12:51

I don't I don't know if you've seen um there was this thing where we they they're seeing AI generated uh customer service agents. Okay, I haven't seen that. Um it's like well they sound completely human, you know. They they they they're guiding victims through fake payment verification, you know, and it's and it's and it's all AI. Um there's also um deep fake celebrity endorsements. Now you'll see a product and all of a sudden you you see your favorite actor you know endorsing the store. Endorsing the product, yeah, yeah, you know, convincing people that the local stars are promoting non-existent stores. You know, it's um so even like the phishing pages are dynamic now. You know, they they watch your cursor movement, you know, they change their tone based on your hesitation. Um there's a lot of intelligence behind the the background of this. So so the personalization is really become more criminal. Exactly.

Speaker 1 13:46

Yeah, so and and like I said earlier, they the AI use they use the AI to scrape your your behavior. Yeah, correct.

Speaker 13:54

From from your social media and from your um 100%. Yeah. So I mean it's that's basically what I like to call marketing 2.0, you know, but for villains. For villains. Yes. So it works, it works like, you know, because AI can can scale social engineering faster than humans could. And true. Yeah. So I think look, final thoughts, Chris. I think to summarize for me, Black Friday is not just a shopping event, right? It's it's a psychological operation. Uh, your dopamine is under attack, your attention to uh your attention is currency, and your data is the real price. So I think the the the the best ideal price for

Black Friday Safety Tips

Speaker 14:34

for Black Friday, Chris, what would that be? Not getting hacked.

Speaker 1 14:37

Not getting hacked, not getting or don't buy that superfluous item that you don't need. Yeah, and don't don't and don't don't volunteer your data to don't volunteer your data. Check your check your bank account. Yeah, couldn't I couldn't agree more. And and and uh another thing that pops up lately is that um charges are going off twice. Yes. Um check your bank account, go and check that it doesn't go off twice. You know, um make sure that there's not all of a sudden two or three other transactions that you don't know about, yeah, hidden behind your transaction. And especially during Black Friday shopping. If you if you're active on this time at shopping, check your bank account daily. Even two times daily matters.

Speaker 15:20

So uh yeah, I look at you more. So I think um in our next episode, uh what we're gonna do here is we're gonna switch gears, we we're gonna talk about the business side, how companies get hit, you know, how the human error costs millions through Black Friday, um, and why that fishing isn't just a consumer problem, it's the enterprise uh epidemic. So everybody stay tuned for the next episode, and thank you very much um for for for chiming in. Um stay focused, stay uh conscious, stay aware, and um save your money. Don't uh be spending on Black Friday.