Advertise on podcast: Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

A listener asked Matt to ask Craig about the theft of FBI data, and Craig started with who holds it. Much of what the federal government keeps — background-check records, applications to the FBI, even the designs of weapons made by defense contractors — sits with third parties. The group behind this one is called ShinyHunters; its reported leader was arrested by Dutch police the day before the show. Craig's point was the gap between the government and its vendors: last week every federal agency was required to patch ScreenConnect, a remote-support tool with a serious vulnerability. "Well, the government did all of that work, but how about its contractors? How about regular businesses?" Then the identity problem. States now require age verification for certain websites, so people hold their driver's license or passport up to the camera next to their face. Craig said more than 100 million of those records have now been stolen. A password can be changed. An email address can be changed. "But iris scans at the airport? Are you kidding me? You can't pop out your eyeball. You're not Tom Cruise." Also in this segment: CMMC, the cybersecurity framework for defense contractors built on NIST standards, and Craig's view that its Level 2 requirements are effectively no longer enforced The tech-company agreement signed at the White House on AI, which Craig compared to the governor's "sidestep" in The Best Little Whorehouse in Texas Researchers in China who got an AI to design bioweapons and explain how to use them, and why Craig says the risk is people giving instructions, not AI acting on its own NVIDIA's open-source OpenShell, which puts gates on what an AI agent can reach About 800 Microsoft patches last month, which Craig tied to attackers using AI The opener: "Feeling very techy. How about you?" Newsletter and Insider Session announcements: CraigPeterson.com

On October 13, Microsoft ends support for Office 2021 — Word, Excel, Outlook, and PowerPoint stop receiving security patches that day — along with the extended security updates for Windows Server 2012. Danny, sitting in for Jim Polito, asked the obvious follow-up: how does anyone find out what they are running? Craig's answer started with what people assume covers them. "Most people think, oh, I've got antivirus software. I've got Windows Update turned on. So, I'm all set. It is not true." Windows Update does not update all the software on a Windows machine, and antivirus only tries to stop an attacker who is already in. The average person has more than 60 programs on their computer that they don't know about. Danny had just found a pile of them himself, cleaning up his startup list to speed up a slow machine. Craig pointed out that he had done more than speed it up: every old program deleted is one less thing that can go out of date. He described the scan he wrote to show every installed program, flag the ones that are vulnerable, and explain the worst one in detail — what it is, why it matters, and what to do. He is updating it for the Microsoft announcements, and the new version goes to the newsletter list later in the week. Then Boston Scientific, in Marlborough. Hit on August 25, it took two full weeks to recover. Investigators traced the entry to a single internet-facing network-management device on the perimeter. No patient data was stolen and no files were encrypted, but for weeks the company could not ship product. Craig's advice was to have someone check the outside of the network, starting with Microsoft Remote Desktop and the firewall. Also in this segment: Zero-day vulnerabilities explained: the hole the attackers know about before anyone else does Almost 1,000 Microsoft patches a month, which Craig ties to vulnerabilities found with AI The U.S. ban on imported Chinese firewalls Eleven federal prison sentences in Virginia for a scam that borrowed strangers' phones to get into their Navy Federal banking apps — and Craig's 12-digit passcode before Face ID will work Turning the air conditioning back on for an 80-degree day after taking the unit out: "We'll get through a couple of days, honey. Put the fan on." How to reach Craig with a question: [email protected], and Danny vouches that he answers Newsletter and Insider Session announcements: CraigPeterson.com

Sen. Mark Warner went to the Senate floor to call for a government body to oversee AI. Craig read the legislation and the senator's website before the show, and his objection was that the problem it describes is already illegal. Laws against hacking a computer system have been on the books for almost 30 years; people have gone to jail under them, foreign nationals included. "I think what they're trying to do is get legislation that protects them from the laws that exist." Jeff played the other side: if the AI gets loose because of "grossly incompetent nitwits that I chose to employ," shouldn't the government hold a kill switch? Craig's history lesson was the Clipper Chip, the encryption chip the Clinton administration wanted in every device, with a government backdoor built in. His practical answer was that the control already exists: NVIDIA has released open-source software that contains AI agents, watches what they do, and keeps them away from data they are not given — available now, at no cost, to any developer or business. The people who will not run those controls are the criminals, and "any regulations you put in place will have no effect on them." Also in this segment: Craig's two weeks reading the investigations into the AI "breakouts" at Hugging Face, Anthropic, and Google: "They did not break out of anything. They had access." Almost 800 Microsoft Windows patches last month, which Craig attributes to AI being used to find holes The FBI records obtained by hackers last week, and a break-in in Australia The British Columbia lawsuit over an AI company that allegedly knew its product was used to plan a school attack: "They knew or should have known. The tools exist to control your AI." Craig apologizes for not being calmer; Jeff books him to explain next week which Microsoft software is about to lose support, which is in this week's newsletter Heidi still wants the robot bartender Newsletter and Insider Session announcements: CraigPeterson.com

OpenAI launched ChatGPT 6, Sol, and Luna this month, claiming Sol makes about half as many mistakes as the models before it. Matt asked whether that is real progress. Craig's answer was yes, with a catch: the models are not getting smarter. The companies, Anthropic included, have rewritten the code around them so the AI runs the same prompt again and again from different angles and then votes on the most likely answer. The new models use about twice the tokens of the old ones. "And they get a 50% better answer." Matt: "There seems to be a correlation here." The second half was about where the training material comes from. Craig estimated that 60% of the newer content on the internet is AI-written and never reviewed by anyone in the field it covers. The AI companies scraped that content, publishers used AI to make more of it, and the result is a loop: AI writes it, AI trains on it, and the next round is worse. He noted that the European Union now requires AI-generated content to be identifiable by a computer, and that U.S. AI companies are complying in ways that reach American users too. His answer to "what can we do about it" was the conversation they were having: "People are looking for real content from real people, and you can't get more real than radio." Also in this segment: Why industries ask to be regulated: Amazon and the 9,000-plus U.S. taxing jurisdictions, and the four major beef processors, two of them foreign-owned. "Regulations are written to protect the territory." Matt's account of 700 AI agents breaking out of a sandbox to hack Hugging Face's servers in July, and Craig's reply: "That's misrepresenting it." The lawsuit in British Columbia alleging an AI company knew its product was being used to plan a school shooting, and Craig's point that hacking has been a federal crime since the late 1990s Andrew Yang's claim that self-replicating AI code has made the internet unusable for the AI systems themselves Grok's fact-checks on X, and the reflex answer to all of it: "There ought to be a law. That's what my dad used to always say." Newsletter and Insider Session announcements: CraigPeterson.com

OpenAI's model got into Hugging Face. Anthropic said its model had broken into someone first. Then Google said its model had done it before either of them. Jeff wanted to know how these AIs keep "breaking out," and whether he should picture Robby the Robot fiddling with a lock. Craig spent the previous two weeks reading the published investigations, which go back to May, and said nothing broke out of anything: "These AIs were let loose on networks that had access to the Internet. They were given specific instructions that had 100% to do with hacking and breaking into systems." The only one that stopped short was Google's, because one restriction had been left in place: it could not keep guessing passwords. So why are the companies asking Congress to regulate them, regulations already drafted? Craig told the Amazon story from the garage: local retailers complained Amazon did not collect sales tax, and Amazon answered by backing a law requiring online sellers to collect it across more than 9,000 U.S. taxing jurisdictions, something a company with a full-time accounting staff could handle and a small shop could not. Four big beef processors, two of them foreign-owned, got to four the same way. "So I really smell an Amazon.com of 15 years ago." Jeff's comparison: an operator saying "we can't help ourselves from stealing, so you'll have to pass laws," or "the guy who is overweight saying, if only somebody else would padlock the fridge." Also in this segment: Breaking into a computer system has been illegal since the late 1990s, so Craig asks why another law is needed The British Columbia lawsuit alleging an AI company knew its product was being used to plan a mass shooting, and Craig's point that failing to report it is already actionable President Trump's "S.I." and the planned AI czar; Craig has no problem with a U.S.–China hotline for a runaway AI, but says superintelligence "is still in the future" Jeff nominates Craig or Robby the Robot for AI czar, and declines to take sides Craig's newsletter and the software he wrote that shows what on your computer is vulnerable Newsletter and Insider Session announcements: CraigPeterson.com

Jeff and Heidi hold happy hour at the bar in their house at 6:03, and Heidi has decided what it is missing: a robot bartender. Jeff's terms were that he picks how it looks and she picks what it says. Craig's answer was that the hardware already exists. Bars now have table-top machines that check your ID card and make any drink you order; those start around $30,000, and home versions run about $400. The conversation half is ChatGPT or Claude, spoken rather than typed. It started with a more serious question. Elon Musk and Sam Altman both say AI development should slow down, so why not believe them? Craig pointed to industries that asked to be regulated and what they got from it: the four big meat packers and the USDA-inspector rules a 100-head farmer cannot afford, and Amazon lobbying for online sales tax across more than 9,000 U.S. taxing jurisdictions that no small seller could track. His read on the AI version: "They want to go for an initial offering and they want to make a lot of money. They want press, and guess what? We're talking about it." Jeff's follow-up came from a local candidate's AI-generated campaign song, "the worst song in the history of really bad crappy songs." Craig said 50–60% of the music on some streaming services is now AI-generated, that streaming pays artists a fraction of a cent per play, and that the working answer for musicians is the one everyone faces: monetize differently, which for most of them means concerts. Also in this segment: The buggy-whip argument, and Craig's case that the internal combustion engine cost jobs but created far more, alongside Elon Musk's prediction that AI adds about 20% to economic output over the next decade Craig's keynote on how businesses use AI, and his view that "it's not being used very well or properly" yet Almost 1,000 Microsoft patches this month, and a warning to anyone whose computers are managed through ConnectWise ScreenConnect to check on it Jeff's plan for the bartender: looks of a 26-year-old cheerleader, mind of a 70-year-old Irishman who can tell a joke Newsletter and Insider Session announcements: CraigPeterson.com

Craig's wife sent him an article the morning of the show: Chinese ships moving through the straits of northern Canada are not just passing through. International agreements allow transit through territorial waters at a reasonable pace, but these ships are stopping, and it looks like they are measuring the sea floor. Russia is doing it too. The route used to be frozen; now it can be navigated in summer. Craig used it to explain why the U.S. wants a foothold in the North. It was the last stop in a long Canada conversation. Jim opened on British Columbia's three-year experiment decriminalizing cocaine and fentanyl, which ended early this year. Craig, who grew up in Quebec, went back to the 1970s and the FLQ, and to the separatist movements in British Columbia and now Alberta. He and Jim compared Canada's fleet of about 79 fighter jets with the California Air National Guard's, and Canada's economy, about half California's with roughly the same population. With a few minutes left, Jim turned to AI, and Craig got to the week's working warning. Microsoft had shipped almost 1,000 patches in the month so far, with an off-cycle fix for Remote Desktop, and more on the way. And ScreenConnect — made by ConnectWise, and the remote-management software many IT providers use to support business computers — was under active attack. That was in his newsletter that week. Also in this segment: The "most Albertan man alive" video Craig sent Jim, which Jim says he understood every joke in Craig's keynote on how businesses can use AI well, drawn from using it in his own company, and his estimate that the U.S. is six months to a year ahead of China Jim on ending up in a Matrix pod: "I'm going to be looking for you. Where's Craig? He told me this wasn't going to happen." Craig has asked for Jim's help with a project, and they set a meeting for the next day: "Boy, I don't know how that's going to work out." Newsletter and Insider Session announcements: CraigPeterson.com

This was the biggest Patch Tuesday on record: Microsoft pushed close to 700 patches in a single month, roughly six times the usual volume. Craig's follow-up question is the one that actually decides whether a machine is exposed. Microsoft is patching Microsoft. Who is patching everything else? Windows Update never touches third-party software — it barely updates Windows itself, Craig said, and it does nothing for the average of 62 other programs sitting on a typical computer, many of which are being actively exploited right now. He named Adobe Reader and WinZip specifically: the current versions are reasonably solid, but almost nobody can say for certain they are running the current version. His phrasing for the gap: vulnerabilities "like driving a truck into your living room and you don't even notice." The question came in from a listener — Andy in Sanford texted to ask what Craig thought of PC-matic. Craig gave a genuinely mixed answer rather than a pitch. PC-matic is whitelist-based rather than blacklist-based, meaning only software known to be good is allowed to run, verified by checksum. That is a real architectural advantage. But PCMag and others rate it in the 60s out of 100, and it is a nuisance to live with. He would reach for Bitdefender first, and then, separately, something that keeps the rest of the software on the machine current — which is the part the antivirus question tends to skip past. Most of the segment was about AI, and Craig's line on it is deflationary. Meta planned to cut about 100,000 employees in waves and replace them with AI agents — putting trackers on employees' computers to capture mouse movements and screen contents as training data — and the project came apart. About 80% of AI projects fail, Craig said, usually from overreach. What AI is genuinely good at is a first draft; what it cannot do is decide. Companies that laid off support staff and handed the queue to an agent have been hiring those people back. And the tell he keeps returning to: if the models have really reached general intelligence, why does every one of them still need a human supervising it? Also in this segment: Aaron's own experience upgrading ChatGPT to Astra — "blown away" by the speed and the tolerance for natural language over careful prompt engineering — and his question about how much more capable the unreleased models must already be Craig on why the newer models feel faster and smarter: built-in self-checks where the AI audits its own reasoning, plus multiple specialized sub-models tuned for law, for Python, and so on, with your question routed to whichever fits Aaron's McKinsey story, and the best analogy in the segment: briefing an AI is like sending a slide to an outsourcing team halfway around the world. Vague instructions come back wrong; precise ones come back close. "You've got to do the work." Craig's observation that AI tends to increase workload — staff stop doing the basic work and become supervisors of it, reviewing output from what amounts to a team of high schoolers A note on the market this creates: people paid $250,000 a year and up to go in and fix systems that were built with AI and don't work Free newsletter and Insider Session announcements: CraigPeterson.com

Craig grew up in Canada and left in the 1970s, and this week he put numbers on why. A driver's license in Quebec cost $300 a year. Registration on the family station wagon cost $3,000 a year. Both figures in 1970s dollars. Auto insurance, by contrast, was free — which Craig turned into the sharpest point of the segment: his father remarried, his stepmother got her license at 26, and she totaled three cars. Craig's question was not about her driving. It was about what happens to the premium. "How much does insurance go up? How much is the risk? Zero, of course, because there is no insurance. So what's her incentive to not hit the next telephone pole?" Most of the segment was Craig's family and Canadian health care, told as first-hand stories rather than argument. His father had a heart attack in Toronto and rode in the back of an ambulance from hospital to hospital looking for one not too busy to take a heart attack; when he was finally admitted, the treatment was an overnight stay, an aspirin, and instructions to call if it happened again. His brother cut a finger off with a cable saw and made the same circuit of Toronto hospitals, holding the severed finger. Craig said the average wait for an MRI or CT scan in Canada now exceeds the life expectancy of some of the people waiting, and that doctors resigning over the workload made the front page of the Toronto papers the same week. Jeff's contribution was the mirror image: the MRI and CT businesses in Rochester, Buffalo, Vermont and Montana whose customers are almost entirely Canadians who drove south. The turn Craig kept coming back to is that none of this changes anyone's mind, including his own family's. Ask his mother and she will tell you the Canadian system is the best in the world — and then hand him her U.S. travel insurance number in case she gets sick while visiting. Jeff's framing was generational: his oldest son, a Stanford graduate, argues the Nordic-and-Canada version of the case, and Jeff's view is that the people who need to hear the counterargument are the ones who never lived under it. Also in this segment: Craig's visit to his mother in Montreal over Labor Day weekend, and the reception he got from a brother-in-law over U.S.–Canada trade and Nexus cards Canadians who have stopped crossing the border entirely — no more Lake George, no more grocery runs to Target and Walmart — and the "buy Canadian" signage with the maple leaf that has gone up in the grocery stores Jeff's standing request for the next trip south: a couple of pounds of smoked meat from Schwartz's, and as many bags of ketchup chips as Craig can smuggle into Vermont. President's Choice. "Cheapy, but good." No newsletter that week — Labor Day and the trip north — but Craig confirmed it returns the following week Free newsletter and Insider Session announcements: CraigPeterson.com

Craig added it up recently: more than 5,000 businesses have had IT services from him over the years. He also used to carry 50 employees to support them. He described cutting that back on purpose — "it's way too many" — down to a family business handling a small number of customers, on the reasoning that the headaches of supporting that many clients with that many staff cost more than they returned. It is an unusual thing for a vendor to say out loud on the radio, and it was the first thing out of his mouth. The bulk of the segment was Craig on juries, prompted by a trial in the news. His argument runs through English common law: the grand jury sits at the top of the structure, and can refuse to indict — he cites a state where one grand jury refused for six months to return any indictment for income tax evasion, on the view that the tax itself was invalid. A trial jury holds a version of the same power and can decline to convict even where the law was plainly broken. Above both sits the legislature, the "general court," which can overrule court and executive decisions. Craig's point is that this is roughly a thousand years old, predates the Magna Carta, and was written into the U.S. Constitution deliberately: "We are the sovereigns, not the government." His concern with the current case is a prosecutor seeking to remove the one juror who disagrees. Also in this segment: The care routine behind the Canada trips: Karen cooked 35 meals, vacuum-packed and froze them, and they drive up every few weeks to clean and do laundry for Craig's mother Craig's stepbrother — a Cisco salesman, so a technical person — and the trade argument that ended with Craig dropping it to keep the peace at a family gathering Bombardier, which makes regional jets and Prevost buses in Quebec, and the tariff push to move that work stateside Nexus passes, the relatives who have not crossed the border in two years, and Jim's memory of watching buses unload Canadian shoppers at the American Falls bound for Walmart and Target Jim's opening, unprompted: Craig's Insider Notes come out weekly, there's no charge, "he's not going to chase you down or try to sell you something" Free newsletter and Insider Session announcements: CraigPeterson.com

On Monday, a client of Craig's was driving down the road when a prompt appeared in the authentication app on his phone: was he trying to log into the company VPN? He said no. It appeared again. He said no again. Craig's team got him on the phone, changed his passwords, and started digging. The login was coming from a data center in New York — until Craig looked at the actual net block, which traced back to China. The attacker already had the man's email address, his VPN contact information, and his password. The prompt on his phone was the only thing standing in the way, and it worked because he answered it honestly twice. Where did they get it all? Craig ran the deep dark-web research his team does for clients and found the whole set sitting there. His advice to listeners is the free version of that same check: haveibeenpwned.com, run by Troy Hunt out of Australia — type in your email address and see where your information has already been taken. Craig spelled it out on air, P-W-N-E-D. The segment opened somewhere else entirely, on Flock cameras. Matt had raised them earlier in the show, and Craig's point was about scope rather than intent: these cameras don't only read license plates, they carry technology that listens for your phone pinging on Bluetooth and Wi-Fi, which means they can identify you in a different car and tie it all together. New Hampshire bars the state from using them — and private companies can. Craig's read on why this keeps expanding is refreshingly unconspiratorial: "The number one job of every employee is don't get fired. Number two job is make my job more important." The incentives point one direction whether or not anyone is plotting. Also in this segment: Craig's worry that people have simply given up — federal employees and military whose whole background check is already out there, throwing their hands up — and his argument that resignation is the one response that guarantees it gets worse Apple's handoff from Tim Cook to new CEO John Ternus, and why Craig thinks an engineer at 51 is good news: Cook was an operations man executing a 10-year plan Steve Jobs left behind, and the rumor is Ternus clears out the stale operations layer OpenAI's claim that Apple has only itself to blame in their trade-secret fight — Craig disagrees flatly, pointing to former employees' laptops and evidence about subverting Apple's internal security Matt's aside about watching an older movie and realizing a getaway driver today would have nowhere to hide, and Craig's answer: Minority Report, billboards recognizing Tom Cruise by face and serving him ads Free newsletter and Insider Session announcements: CraigPeterson.com

Central Virginia has neighbors close to blows in the street over new data centers. Craig's number for the other side of the ledger: one community found that without the tax revenue a data center brings in, property taxes on every home would rise $5,800 a year. Add $250,000-a-year electrician jobs, emissions cut more than 90% once a site is required to generate its own power, and a mandated 20% energy surplus handed back to the grid, and the case against building locally gets a lot thinner than the protest signs suggest. Then the turn: Jeff points out that a lot of the people fighting these projects are, point for point, reciting Chinese Communist Party talking points without knowing it — sourced, Craig says, from a Wall Street Journal opinion piece, "The Data Center Panic and the U.S. Decline." The mechanism behind it: China is pricing equivalent AI processing at roughly half of what U.S. companies charge, betting that price-sensitive American users and companies will send their data there anyway. Fewer U.S. data centers means more of that traffic — and the underlying economic edge — goes to China by default. Craig also walks a live attack from the day before: a client's phone lit up twice with an MFA prompt asking if he was logging into the company VPN. He said no both times. Tracing the request's network block back past a New York data center landed in Hong Kong. By the time an attacker reaches the multi-factor step, Craig notes, they already have the VPN address, the login email, and the password — the app-based prompt is the last line standing. He ran the client's email through haveibeenpwned.com (free, no account needed) and found the credentials already circulating on the dark web. Also in this segment: An American Medical Association article claiming AI now outperforms doctors with a doctor's involvement even more than AI alone — which Jeff meets with an immediate, cheerful refusal to give up his own physician, "Dr. Bob," over "Dr. Robbie D. Robot" Two live Massachusetts breaches: UMass Amherst hit with fraudulent dead-credit-card charges, and a Marlboro-area robotics manufacturer — supplying military and medical clients — unable to ship product for two weeks after being hacked A reminder that elementary schools are targeted for students' Social Security numbers specifically because a stolen child's number can go unnoticed and unused for years Free newsletter: CraigPeterson.com

A friend of Jim's at Boston Scientific told him the company has come to a complete stop: nothing shipping, nothing receiving, product sitting in the warehouse untouched. Nobody at the company would say who's behind it. Craig's read: this fits a pattern he's now seeing constantly, with both Russia and Iran running AI-assisted attacks against U.S. contractors — including military suppliers whose cybersecurity, despite the assumption, is often not what it should be. Craig had his own live example from the day before. A client — a parts distributor supplying components that end up in military equipment — had his phone light up twice with a prompt: was he trying to log into the company VPN right now? He said no both times, so Craig's team immediately invalidated the password. Tracing the login attempt, what first looked like a New York data center turned out, on closer inspection, to be a narrow slash-24 address block registered all the way back to Hong Kong. The attacker already had the username and password; the multi-factor prompt was the only thing that stopped them. Running the client's email through the free tool Have I Been Pwned turned up his username, email and password already circulating on the dark web. Craig's practical advice, twice over: run your own email through haveibeenpwned.com now, for free, and if you're still relying on your browser's built-in password manager, move to a dedicated one like 1Password — browser managers have been breached before, even if none currently are. Also in this segment: An extended, opinionated exchange about Canadian tax policy, media coverage of the U.S.-Canada trade dispute, and Canadian broadcaster CBC — flagged below for Craig's review before publishing The running bit about Craig's citizenship ("blue card," not a green one — a joke Jim initially bought) and his trip to Montreal this weekend to help his mother Windows Update's blind spot on print servers, which Craig says is now driving active attacks on law firms, schools and manufacturers, covered in that week's newsletter Free newsletter and Insider Session announcements: CraigPeterson.com

The FBI, CIA, NSA, CISA and others issued a warning about active AI-driven attacks on American critical infrastructure. Craig, who ran the FBI's InfraGard online training program, explains what's actually exposed: old controllers that open and close valves, set flow rates, decide how much acid or base goes into the water — many of them reachable directly from the internet, on networks that have been comprehensively mapped for years. Several water systems have already been shut down; one town lost power along with its water. Josh, who works InfraGard in his own homeland security practice, asks the right question: if an adversary can use AI to find and exploit these holes, what stops us using ours to find and patch them first? Craig's answer is the best story in the segment. Last year a botnet was running attacks out of tens of thousands of home routers — cheap hardware bought at Staples or Walmart, full of holes. So the FBI and NSA hacked into those routers, on private home networks, and patched them, breaking the attackers' control. Our government hacked our own equipment to fix it. As far as Craig knows it has happened exactly once. He's honest about the limits: defensive AI exists at Microsoft, Anthropic and OpenAI, but it can't help with vulnerabilities people don't know they have. And you can't change the consumer — people still buy cheap Android phones. Also in this segment: Remembering Dolly Parton, who wanted to be faxed rather than called and didn't want her mind fed into an AI — alongside the Dolly Parton Experience built from lasers and technology, and hundreds of unreleased recordings A defense contractor employee who clicked one email and exposed the company; Craig has worked similar cases with the FBI's Boston office The two things to do about it: delete any program you haven't used in a while, on your phone as well as your computer, and put something like OpenDNS in front of your browsing so a known-bad link can't resolve Free newsletter: CraigPeterson.com

The detail that makes this scam land is not the fake website. It's what happens two seconds after you use it. Craig walks the whole sequence. Attackers use AI to build a pixel-accurate copy of a bank's site — he uses Bank of America as the example and is careful to say he's picking on the scammers, not the bank. They send a wide net of email claiming fraudulent activity on your account, knowing that some fraction of any list banks there. You click, you land on the copy, you enter your username and password. Then the clever part. They immediately redirect you to the real bank's site, which naturally says the login failed and asks you to try again. You assume you fat-fingered it. You log in properly, everything works, you get on with your day — and you never form the thought that anything went wrong. Your credentials are gone and nothing about the experience told you so. The FBI's figure for the Phantom Hacker scam, which leans on this and related techniques against older Americans, is over a billion dollars since last year. Craig's defence is one habit, stated plainly: never click the link. If an email about your bank worries you, go to the bank's own site yourself. If there is a genuine problem the message will be waiting for you when you log in, and you can ask their support directly whether the thing you received was real. Two further pieces of practical advice, both concrete: Multi-factor authentication matters, but not the text-message kind. Something you know plus something you have is the right shape, and an authenticator app is the right implementation. Text messages are easy to fake and easy to intercept, and Craig notes they have been used to steal hundreds of millions. He is genuinely surprised how many banks still rely on them. Use a credit card, not a debit card. Fraud on a credit card is not your liability. Fraud on a debit card means the money has already left your account and you are now arguing to get it back, under policies that vary bank to bank. Craig went decades using only a debit card and no longer does. Also in this segment: The tech support imposter version, which caught Craig's own father — and the IRS variant, where Craig personally took six calls in half an hour demanding Amazon gift certificates to avoid jail Why the young are not the safe bet people assume: a study found Gen Z will hand over an email address for a donut, on the reasoning that everything about them is already out there anyway Both men on refusing to give a Social Security number — Craig uses a passport card instead, and notes drily the original promise that the number would never be used for anything but Social Security and would never become a national ID Craig's newsletter that week on business AI projects, against the MIT finding that 95% of them fail Rush trivia to open: the band's biggest-charting song was "Take Off" with Bob and Doug McKenzie, and Rick Moranis and Geddy Lee went to school together Free newsletter: CraigPeterson.com