Advertise on podcast: New Money Review podcast

In the latest episode of Unseen Money, Timur Yunusov helps Paul Amery unravel a strange real-life story involving a spoofed eBay delivery, Paul’s phone number and a photo of an Indian lady in a pink dressing gown. The story is part of a rapidly growing form of crime involving so-called “synthetic” identities. In a synthetic identity fraud, criminals create fake online identities by blending real, stolen data with fabricated information. They then use those identities to conduct money laundering and fraud. In the podcast, we cover: (00’ 25”) How Paul got a DPD delivery notification for an eBay parcel he hadn't ordered (1’ 20”) How DPD provided “proof of delivery” to a woman in a pink dressing gown (2’ 45”) How eBay showed no interest in investigating the transaction (3’ 15”) Why a synthetic identity combines real and fictitious information (4’ 40”) How criminals use synthetic identities to decrease online friction (6’ 40”) Possible use of synthetic IDs in buy now pay later (BNPL) fraud (7’ 10”) Why synthetic identity frauds don’t fit the standard stolen identity playbook (7’ 40”) Why synthetic ID cases deserve much greater scrutiny from anti-fraud teams (11’ 30”) Identity theft (account takeover) and synthetic identities (13’ 00”) Why synthetic identity fraud has boomed post-COVID (21’ 40”) AI and machine learning have turbocharged synthetic identity fraud (23’ 40”) Who’s buying the sets of synthetic IDs? (24’ 30”) How criminals use synthetic identities in frauds (29’ 30”) Dead souls, the Russia-Ukraine war and the exploitation of fake identity sets

Tech firms and governments are pushing passkeys as a replacement for online passwords. They argue that using passkeys will help cut down on fraud, prevent account takeovers and protect against password theft. But Paul Amery and Timur Yunusov are sceptical that passkeys will take off. Listen to the latest episode of Unseen Money from New Money Review to find out why. Here’s what we discuss in the podcast: (0’ 45”) why we need to get rid of passwords(2’ 35”) safer and less safe ways of using passwords(3’ 05”) password management practices(4’ 10”) what is a passkey?(6’ 10”) how passkeys replace reliance on a password with reliance on a trusted device(7’ 10”) what if we are trying to use our phones less?(8’ 00”) using your laptop as an alternative(8’ 20”) hardware devices to store your passkey(10’ 00”) passkeys won’t protect you against state surveillance or a kidnapper(12’ 20”) passkeys are only as secure as the surrounding infrastructure(13’ 00”) what happens if you lose the trusted device?(14’ 20”) unresolved questions regarding lost passkeys(14’ 50”) Paul’s unhappy experience setting up passkeys(15’ 50”) why financial institutions lag in introducing passkeys(16’ 50”) Timur’s survey of security research on passkeys(18’ 10”) where is the weakest link in the passkey enrolment chain?(19’ 30”) why Timur is sceptical of tech firms’ invitations to enrol passkeys(21’ 00”) who’s pushing passkeys and why?(22’ 30”) why some friction in online transactions is a good thing(23’ 30”) why Timur would not use a web browser passkey to access a bank account(27’ 30”) why large-scale passkey adoption is still far away(28’ 30”) passkey technology could be imposed

Last week, Google’s threat intelligence group warned that artificial intelligence (AI) is making malware attacks more dangerous. [Malware is malicious software—programmes designed to disrupt, damage or gain unauthorised access to computer systems—usually delivered via phishing emails, compromised websites or infected downloads] “Adversaries are no longer leveraging artificial intelligence (AI) just for productivity gains, they are deploying novel AI-enabled malware in active operations,” Google said in a 5000-word blog. Are malware programmes using Large Language Models (LLMs) to dynamically generate malicious scripts, obfuscate their own code to evade detection, and leverage AI models to create malicious functions on demand, as Google warns? Or it this yet another case of tech firms selling solutions to a problem they have created themselves? Listen to the latest episode of Unseen Money from New Money Review, featuring co-hosts Timur Yunusov and Paul Amery, to hear more about the effect of AI malware. In the podcast, we cover: Google’s warning about the rise of AI malware – reality or hype? (2’ 35”)Why LLMs were originally protected from harmful behaviour (4’ 10”)How criminals learned to develop LLMs without guardrails (4’ 55”)Model context protocols (MCPs) and AI agents as offensive tools (5’ 30”)Malicious payloads and web application firewalls (7’ 35”)Tricking LLMs by exploiting the wide range of input variables (8’ 30”)The state of the art for fraudsters when using LLMs (10’ 10”)Timur used AI to learn how to drain funds from a stolen phone (11’ 05”)How worried is Timur about the rise of AI malware? (14’ 20”)AI has dramatically reduced the cost and increased the speed of producing malware (15’)AI, teenage suicides and protecting users (16’ 50”)AI for good: using AI to combat AI malware (19’)How a Russian bank used AI chatbots to divert fraudsters (19’ 40”)Data poisoning—manipulating the training data for AI models (22’ 10”)Techniques for tricking LLMs (23’)Only state actors can manipulate AI models at scale (25’ 40”)The use of SMS blasters by fraudsters is exploding! (27’)

Some people have labelled the recent alliance between Silicon Valley and right-wing populist leaders “techno-fascism”. Is that too strong a term? No, says Jacob Silverman in the latest New Money Review podcast. “What do you call it when the highest levels of the corporate world merge with the executive of the government?” Silverman asks in the podcast. “I think that’s corporatism or fascism.” Silverman is the author of a new book, “Gilded Rage”, in which he chronicles the radicalisation of Silicon Valley.   Focusing on a few central characters—Elon Musk, Peter Thiel, David Sacks and Donald Trump—he poses a question that should concern us all. What happens if the world's richest and most powerful men decide to dismantle democracy? “I think it’s very worrisome,” says Silverman. “We keep on breaching markers—things that haven’t happened before.” Listen to the podcast to hear a discussion of: The post-9/11 convergence of technology and the security stateHow tech firms colluded with Trump to merge corporate and political powerWhy the technology of freedom may be incompatible with democracyTech titans’ desire for social and physical escapeJD Vance, the tech industry’s man in the White HouseThe religiosity of Peter Thiel and JD VanceRising nationalism and the booming defence tech industryHow cryptocurrency catalysed the Republicans’ resurgence in the USCryptocurrency as an accessory to political corruptionHow the AI boom was fed by the crypto bubbleWhy Jacob sued Twitter—and what happened nextDonald Trump, Jeffrey Yass and the US government’s about-face on TikTokSocial media as the informational battleground of global geopolitics

Long gone are the days when the Escobar family had to spend $2,500 a month on rubber bands to hold the cash they earned trading cocaine. Now, the invention of cryptocurrency has made money launderers’ life a whole lot easier—or has it? Investigative journalist Geoff White joins Paul Amery and Timur Yunusov in the latest episode of Unseen Money to discuss: Why a New York crypto money laundering case is attracting such close attentionHow technology has changed the business of crimeCryptocurrency mixers and decentralised financeNorth Korea and the Axie Infinity hackThe ugly mix of organised crime, state sponsorship and espionageSanctions regimes, cryptocurrency stablecoins and dollar hegemonyHackers, social media and money launderingWho will run the world’s digital money?

The decentralised finance (DeFi) market is booming—but the world’s best hackers are on a constant look-out for ways to steal your crypto tokens. North Korea, which recently committed the largest theft in cryptocurrency history, is probably top of the hackers’ game. What do crypto users need to know about the risks in this unregulated but fast-growing market? In the latest episode of Unseen Money from New Money Review, Timur Yunusov and Paul Amery are joined by Arseny Reutov, chief technology officer at Decurity, a security audit and ethical hacking firm specialising in DeFi. During the podcast, we discuss: Malware, ethereum and the recent $1.5bn Bybit hackState-of-the-art techniques in DeFi hacksMixers, cross-chain bridges and the laundering of stolen fundsHow North Korea became the world leader in crypto hacksWays of detecting flaws in DeFi smart contractsWho audits DeFi?Incentives to report, rather than exploit smart contract flawsIs DeFi security improving?

Most scams where the victim is tricked into paying money to fraudsters originate on social media—often on Facebook, Instagram and WhatsApp. But in the UK around one scam in five—and nearly half by the total value stolen—exploits weaknesses in our telecommunications infrastructure. That could be someone spoofing the number of a legitimate entity, such as the tax office or your bank, when calling you. It could be a scammer exploiting security vulnerabilities in the mobile network to compromise and intercept voice and SMS messages. In a rapidly rising form of fraud, criminals impersonate the nearest cell phone tower and send messages that look like they’re from your bank or mobile service provider. One click on a link and you’re soon handing over valuable personal information or downloading malware that gives the scammers access to your payment app or crypto wallet. In the latest episode of Unseen Money from New Money Review, my co-host Timur Yunusov and I are joined by telecom cybersecurity expert Dmitry Kurbatov, chief executive of UK-based company SecurityGen. In the podcast, Dmitry explains how criminals can spoof a trusted entity’s phone number when calling you. We look at SIM swap frauds and discuss who bears responsibility for the continuing security flaws in mobile networks. We highlight in which countries users are currently most exposed to mobile phone-based frauds. We look at the recent SK Telecoms breach in South Korea, which exposed the personal and financial data of up to 23 million users. And we describe the ever more ingenious methods being used by scammers to subvert telecoms networks. Some technical terms used during the podcast: “SIP trunking” is the digital method of making and receiving phone calls and other digital communication over an internet connection. “SIP protocol” is a signalling protocol used for initiating, maintaining, and terminating multimedia sessions, including voice, video, and messaging. “SIM farms” or “SIM boxes” bridge the internet and cellular networks, enabling the routing and redirection of calls or messages through multiple SIM cards. “Rich Communication Services (RCS)” are a messaging protocol that enhances traditional SMS by offering richer features like multimedia sharing, group chats, read receipts and typing indicators. “Drive-by smishing” is where fraudsters use fake base stations to force victims’ phones to connect to a fake mobile network and then use SMS messages to distribute malicious links or initiate scams. In “software-defined radio”, components that are conventionally implemented in analogue hardware (e.g., mixers, filters, amplifiers, modulators/demodulators, detectors) are instead implemented by means of software on a computer. A “global title” is an address used in SCCP (Signalling Connection Control Part, a network-layer protocol in telecommunications) for routing signalling messages on telecommunications networks. “SS7” is a set of telecommunications protocols that are used to exchange information between different telephone networks. “IPX” is a telecommunications interconnection model for the exchange of internet protocol-based traffic between customers of separate mobile and fixed operators.

The UK’s company formation process is fast, easy and cheap. The net result of being open to almost any business is that up to half the companies on the UK’s Companies House register may have no legitimate purpose. Instead, those companies are used by fraudsters as a vital tool in scams and money laundering schemes. Many are set up using fake identities and addresses. Often, they break the reporting rules and never file accounts. And Companies House has become a honeypot for organised crime groups from around the world. In the latest episode of the Unseen Money podcast, Timur Yunusov and I are joined by dark money expert Graham Barrow, who has exposed some of the worst failings of the UK’s company formation regime. Belatedly, the UK government is acting to address those failings. But will new legislation go far and fast enough? Listen to the podcast to find out.

In the latest episode of Unseen Money, Timur Yunusov and Paul Amery talk about the role of QR codes in scams and whether these popular barcodes may lull users into a false sense of security. Also in this episode: team Trump's Yemen fiasco, Signal and Telegramhow scammers can mass-blast SMS phishing messagesbrowser-within-browser attacks and their possible use in scamswhy the trend of limiting bank compensation to scam victims was inevitable

There’s a big security loophole affecting plastic payment cards—called a replay (or pre-play) attack. Banks have known about this loophole for years. But they may still blame you, the victim, if a scammer makes use of it. In a 2022 fraud, a former British soldier holidaying in Brazil found that £20,000 had been charged to his bank card in eighteen separate transactions. The ex-soldier, Henry Williams, said he’d only used his card once and that most of the money had been taken from his account without his knowledge. His bank, a well-known British high street name, initially refused to compensate him, arguing he must have authorised all the payments. Only a year later did the bank agree to refund him—partially and with a grudging apology. Even after one of the UK’s best-known security experts intervened on behalf of the victim, the UK’s financial ombudsman, which is supposed to settle complaints between consumers and financial services businesses, sided more with the bank. How does a replay attack occur? Most plastic debit (or credit) cards contain a chip which is used to identify and authenticate the user. The chip comes into action when the user taps the card on a contactless payment terminal (or inserts the card into the terminal and then enters a PIN code). At this point, the payment terminal generates a number that is supposed to be unpredictable, ensuring that each payment transaction is a fresh one. Unfortunately, payment terminals can be tampered with and the supposedly unguessable number can be manipulated. This opens the door to replay attacks—and to more paydays for criminals. As many as half of all payment cards and half of all terminals may be vulnerable to exploitation, says my Unseen Money co-host Timur Yunusov, who demonstrates a card replay attack in this YouTube video. In the latest episode of Unseen Money from New Money Review, we explore replay attacks: how they occur, why the vulnerability is still there more than a decade after it was exposed, and why the payments industry is so reluctant to address the issue.

  We all now use one-time passcodes (OTPs) to verify our identity online. In the last few weeks, I’ve personally received OTPs from Amazon, Apple, Google, the UK Driving Licence Authority, my pension provider, payments app Yotta, National Savings and parking app Ringgo. Some OTPs were sent to me in text (SMS) messages, others arrived via email. Identity authentication online using OTPs is much safer than using a single piece of information like a password. But OTPs are not safe, for a number of reasons. In the latest episode of “Unseen Money” from New Money Review, security researcher Timur Yunusov and I discuss some recent scams that involved stolen OTPs—from a $2m theft from the family of a Moscow teenager to an industrial-scale carding operation in China. Our story covers the security of mobile networks, tech giants Apple and Google, the business models of criminal masterminds and bagfuls of stolen phones shipped around the world.

The UK prides itself in being open for innovative tech firms—and companies in general—to set up business. It takes only £12—and 15-20 minutes—to create a new company online. But the laxity of the country’s system for new company formations has made the UK a goldmine for scammers. And the problem is getting worse: fraud, much of it digital, now accounts for over 40 per cent of all recorded crime in England and Wales In the latest episode of Unseen Money, Timur Yunusov and I discuss a recent Financial Times article about a London-based fraud victim, Livia Giuggioli Firth, who was conned by scammers into sending £325k from her company’s bank account. Instead of asking for compensation from her own bank for being a victim of an authorised push payment fraud, Ms. Giuggioli Firth took the unusual step of suing the scammers’ bank in court. This forced the disclosure of the names if not of the individual scammers, but of the network of companies they used to launder the stolen money. The court case unveiled some of the principal weaknesses in the UK’s system for deterring and catching fraudsters. In the podcast, we discuss: Why the UK is a heaven for digital fraudstersWhy Companies House is still making it easy for criminalsHow the fintech and AI booms have fuelled scamsWho’s responsible in the UK for fighting scammers?How criminals second-guess anti-fraud systems and the need for ongoing due diligenceThe role of cryptocurrency in laundering stolen moneyShould Zuckerberg and Musk reimburse digital fraud victims?Why AI-enabled scams are certain to become more dangerous Want to join Timur and me on a future episode of Unseen Money to talk about how scammers use Companies House registrations to aid their crimes? Drop me a line at [email protected].

Having your identity stolen is a catastrophe. You can lose your reputation, your credit rating, your money, your home or even be accused of fraud yourself. To victims, ID theft feels like a single, earth-shattering event. But it’s likely that the hacker has been stealing different aspects of your identity over time. Your name, address, email address, phone number, bank account number, passport number, medical records and log-in credentials are all valuable bits of information to hackers. Combined, they may be enough for a digital hit on you and your bank account. In the latest Unseen Money podcast, Timur Yunusov and I explore the “personally identifiable information” or “PII” that enables hackers to impersonate and rob us. PII is now traded amongst fraudsters as a commodity. But what kind is most valuable to criminals? Where do they get it? How do they use it in scams? Once we’ve lost our PII, is there anything we can do? Listen on for more.

In the latest episode of Unseen Money, Timur Yunusov and I discuss how to stop a bad dream turning into a real nightmare: when a phone snatcher has your mobile device and is trying to get hold of your money as well. We cover: How a phone thief can access your bank accountsThe security of contract and non-contract mobile phonesBest mobile phone security practices and what to keep safe at all costsMulti-factor authentication and avoiding single points of failureStopping a phone theft from becoming identity theftFace ID or touch ID to authorise payments?The unevenness of payment apps’ securityWhy little can stop the determined hacker We also refer to these New Money Review articles in the podcast: A phone grabber could drain your bank account in minutes How safe are payment cards?

In the latest episode of Unseen Money, we talk about the recent $4.5 million fraud committed against Ol’ga Serova, a 71-year-old former bureaucrat from Samara, Russia. We discuss: KGB legacy: how Russian scammers play on people’s long-standing fear of the authoritiesGreed, fear and social engineering by country: how the weak points of fraud victims vary in Russia, the US and EuropeBig brother in Singapore: new state powers to freeze the bank accounts of potential fraud victimsAML, KYC and Timur’s past struggles to receive his salary into a UK bank accountFintechs fail: the knock-on effects from the UK’s new compensation rules for victims of authorised push payment fraudWill new in-app communication channels help prevent payment scams?Why small, iterative changes in anti-fraud technology are bestSurvival of the fittest: why the weakest and least secure payments firms must go under.