- Just ahead on "Black Issues Forum," the holiday season is upon us and so are cybersecurity scammers looking to steal our joy and our dollars.

From text messages to emails to snail mail, they're attacking us from every angle.

How do you tell the difference between the real deal and the fraud?

Well, don't go too far because we'll break it down with our experts in just a minute.

[soft upbeat music] - [Announcer] "Black Issues Forum" is a production of PBS North Carolina with support from the Z. Smith Reynolds Foundation.

Quality public television is made possible through the financial contributions of viewers like you who invite you to join them in supporting PBS NC.

[upbeat music] ♪ - Welcome to "Black Issues Forum."

I'm Kenia Thompson.

It's the holiday season and a lot of us are shopping online.

But before you start buying or selling, there are some things to look out for.

We've invited our cybersecurity and tech experts to help sort it through.

Let's welcome to the show De'Von Carter, founder of CarTek Consulting, an information security consulting firm that specializes in business security and solutions, and April Dawson, associate dean of technology and innovation as well as a professor of law at North Carolina Central University.

Welcome to the show.

- Happy to be here.

- Thank you for having me.

- Well, I wanted to start off talking or taking a look at some images that I pulled.

I've experienced some of these situations myself.

My mom has experienced some, our friends and family has, but these are screenshots, emails, text messages that some people get, right?

So this first one, this is a real email that was sent to a Facebook Marketplace seller.

This happened after a buyer expressed interest in an item that they were selling and quote, unquote attempted to send the money via Zelle, but encountered an issue.

So what I was told is what they actually did was try to deposit more money than the actual price of the product and then asked the seller to send back the excess, when in reality they never received anything.

I'd love to get your feedback.

Let's pull up that image again.

And I wanna start off by you guys just telling me, De'Von, starting first.

What are some red flags that you're seeing in this email that people should be looking out for?

- [De'Von] Well, the initial red flag for me would be the domain name of the email address, right?

Zelle, and for that matter, Cash App or Venmo, they're not gonna send any type of support emails from any free email services or anything like that.

So that's the first red flag for me.

- [Kenia] Yeah.

April, what are you seeing in this?

- [April] So, certainly a sense of urgency.

So whenever you see, you know, an email or something that's saying, this is an important matter, you need to act very quickly, that's a sign as well that you need to just kind of slow down.

So most of these scams happen very quickly and the scammers know that they want people to be very emotional in how they react.

- Yeah, good point.

De'Von, would Zelle send an email like this?

So let's say it was actually from Zelle, we saw that domain.

Would they send an email like this though?

- Likely not.

Most of these companies, they're not gonna send any type of email that is requesting you to do any type of financial transaction or request any type of sensitive information.

That's just not how they operate.

- And so some people may not use Zelle, though.

They may use Cash App, they may use Venmo.

Are those the same kind of thought process that they, a piece of communication like this would not be sent from them?

- No, it's the same for all of those companies.

They're very, very careful about what they send out.

They want to be ensure that they can't or can avoid liability if they give wrong instructions or anything like that.

So they're not gonna request that type of information through email.

- And how safe is it to use these services?

'Cause a lot of people, I'm assuming, are using them.

- Well, for me, I think they're pretty safe.

They do a great job from, you know, encryption, being careful of how they're sending data back and forth between the companies.

They vetted out their processes for a very long time and so they're pretty safe with that.

- Yeah, well that's good to know.

'cause I used them too.

[Kenia and De'Von laugh] April, the person who received this email said that in their Zelle account, it did look like there was a pending deposit of $500.

How is that possible?

And does that trap people sometimes?

- Oh, it absolutely traps people, because as you use it, so many of us use it.

Zelle, you know, Venmo, they're very convenient.

As De'Von mentioned, they are fairly safe.

The issue is of course, user error.

And we know how they work, they work for the most part instantaneously.

And so if you see in your account that you've got these pending funds, your assumption is that the funds will be there, you know, very soon.

But what the scammers do is they will send the funds from a either fake account or an account that doesn't have sufficient funds, so it shows up as pending.

And people seeing that don't necessarily realize that.

So then you have people who are, you know, sending the reimbursement and those pending funds can be reversed.

- And that's so sad.

And a lot of times people don't even want to admit that this has happened, because there's a shame associated there.

- Yeah, the embarrassment and shame is one of the things that scammers count on, right?

The more people that don't report, and actually the vast majority of scams are not reported, it means that they're able to be more and more successful with these scams.

And we have to make sure that when we're dealing with our family, particularly our elderly community and the young community, that we let them know that everyone has been a victim of a scam or identity theft at some point.

And there's no shame associated with it, but the only way that we can combat it is if we're open and honest about it.

- Exactly.

Let's take a look at the second image.

It's a screen grab of a voicemail.

And in this voice message, the caller alleges that they are from a tax and debt financial service looking to assist in eliminating debt and to give them a call back.

De'Von, what are your thoughts on this one?

- Honestly, we know these types of services do actually exist in real life.

However, most of them aren't cold calling for these types of things.

When they leave these messages, their goal is to get you to call back and then try to quote, unquote verify your information, which is when they will actually take your information.

So my recommendation would be, you know, if you happen to find yourself in this situation, go online, search out and find reputable businesses to use these services and that'll save you a lot of trouble, but I would stay away from the cold call-type situation.

- Yeah, and that's a little confusing to me, though, right?

Because a lot of folks say, "Don't take the call, but you can call back, right?"

And so us calling back and verifying information almost feels like, "Well, I initiated this," and so that's a bit confusing sometimes.

April, when folks like this are calling, they're likely targeting folks that actually do have debt.

And so how are they getting this information and is that legal?

And is that one of the ways that people fall prey to it because they're likely already dealing with debt?

- Yeah, so, you know, if you think about different demographics, so if you are targeting college students, for example, most college students have incurred some type of debt.

And in fact, most, you know, Americans do have some type of debt.

So even if you're just playing the odds and you're sending these communications to everyone, the odds are, that you're going to get, you know, quite a few hits.

The other things that scammers do is they will hunt through people's discarded mail.

And so if you've got some mail and you're not shredding, information that you receive, you know, your credit card statements could be in there.

So people have to be really cautious about information that they don't secure themselves.

- Indeed, I wanna pull up this next image.

It's one that I personally have received a few times.

It appears to be a text message from a postal service about a package delivery with an incorrect address.

So delivery has been suspended, and I don't know about you, but in the days of Amazon ordering and delivery, it's fair to assume that a lot of people, especially right now, are getting a lot of packages on a daily basis.

And for me, it's alarming to think that I might not get my package.

So why are they doing this?

I'm still like trying to figure out how are they getting, what is the point?

What's the actual scam here in these postal text messages?

April, I'll go to you first.

- Mm-hmm, yes, so, and to your point, right?

We're all ordering online, we're all receiving packages.

And again, it's about playing the odds.

And if they have a number and that number's been verified as being an actual working number, it is, you know, when we're thinking about computer technology and AI, it is so easy to have these bots run and send these text messages.

And again, they are just playing the odds.

And if you click on the links, then oftentimes, there will be malware that's downloaded on your phone and they're able to capture additional information.

So these scammers, the more information they have, the more successful the scams will be.

- Yeah, De'Von, what is the safest way to follow up on this if you're not quite sure if it's fake or real?

- Well, in this particular instance, it's just kind of understand how life works, right?

We'll, the post office is typically not gonna contact you in this way, in fact, that they're not, it's generally gonna be through one of those little post-it messages they put on your mailbox, on your door, and things like that.

So basically, when you see these types of messages, just take a deep breath, think about it for a second, and I think you'll come to the right decision there.

- Yeah, and I think it's very important to emphasize not to click the "Okay" or to the "Resolve This" or not to click anything, I tell my mom that all the time, "Do not touch it."

So, just close it out.

All right, let's pull up this next image.

It's an email screenshot, it's from my personal email.

I received it literally just the other day and it's thanking me for my order.

And it has an attachment that I'm assuming that, it's supposed to be my confirmation or my receipt.

I knew that this was a fake, I knew not to open the attachment, but what are some things that alerts someone that this might be a fraudulent email, De'Von?

- Again, check that domain name, right?

Official businesses are not using the free email services like Gmail or Yahoo or Hotmail, and what have you.

So really look at that domain.

Also, again, if you're seeing anything where it's trying to force you to do something quickly or act with any level of urgency, that should be a red flag, right?

Because there's no need for that at this point.

So, yeah, tho those are the big things that I would look at first.

- Yeah, April, anything to add with that email?

Yeah, so, you know, oftentimes with these emails, the grammar's not quite right, the punctuation isn't quite right, and those have been red flags to alert people if you're, you know, reading carefully.

Yeah, I will say because of AI, generative AI, and the ability to have, you know, text written very well with punctuation correct.

Some of the like grammar and punctuation issues we have been seeing, we probably won't be seeing as much of them, so we still need to look, but, you know, that won't always be a sign of a fraudulent email.

- Yeah, yeah, in that email, I noticed the spacing was off, so that was an indicator to me.

Last image here, my mom's called me with this one a few times.

iPhone or any phone really that pops up, this message claiming that, "The phone has been infected with the virus."

Six to be specific in this one, and prompts the user, "To follow instructions for removal."

De'Von, can viruses be downloaded onto your phone this way?

What are we dealing with?

- Oh, absolutely, it's a pretty old trick at this point, trying to get you to click on the message to send to a website to either, you know, download additional malware or try to force you into purchasing something to a so-called remove the malware.

That's a pretty normal occurrence at this point.

The thing you wanna remember is when you see these things, don't click on it, right?

Try to get off of that screen, close the tab, reboot your device, remove any new types of technology that you've added to the device.

- Indeed, well, before we move on to the next block, I wanted to share a funny, but very real clip.

It's a phone call scammer who unknowingly called a police officer.

Take a listen.

- [Scammer] Can you verify me your home address?

- No, I will not.

- [Scammer] I'm sorry.

- No, I'm not going to give you my address.

If you have my file on me, you should know what my address is.

- [Scammer] Ms. Stephens, you need to understand one thing over here, that I'm trying to cooperate with you on the recorded line, and even you need to cooperate with me.

Please send me your mailing address.

- My current address is 205 - [Scammer] Mm-hmm.

Saunders, S-A-U-N-D-E-R-S Street, in Apex, North Carolina.

- [Scammer] Want me to read out the complete information to you about the allegations from which you can.

[Scammer] Now there are legal enforcement agencies involved in this case.

So, before we go ahead and give all the complete information to you, I need you to verify me with the last four digits numbers of your Social Security, so I can confirm that the details are given to the right person.

- I'm not gonna confirm my Social Security number with you.

- [Person On Phone] Ms. Stephens, I'm not asking you to confirm your social security number.

What I'm asking you just to verify me with the last four digits of your Social Security, so I can confirm that details are given to the right person.

- I'm not gonna do that.

- [Person On Phone] The Social Security Administration and law enforcement agencies has found 25 fraudulent bank accounts open and used fraudulently using your social security number to commit a fraud of more than $10 million.

This account- - $10 million.

[laughing softly] So that was, again, the caller did not realize they were calling Apex Police Department.

Devon, I'd love to hear your feedback.

25 fraudulent cases, trying to get her information.

Do people fall prey to this?

- Unfortunately, some people do.

The thing to remember is, you know, the tone, the calling with urgency.

I think the police officer, obviously she's trained and skilled in this.

She understands to, you know, not give out that type of information.

So, that's the lesson that we need to learn.

You know, if they're asking you to provide information to verify, no, you ask them, "You give me what you have, and we'll see if you're on target," so.

- Yeah, well, you know, I think that this first segment just show that there are a lot of things that can look to be deceiving, but make sure that you check the spellings, check all the domains, and don't click on anything, I think is what we've learned in that, right?

- Absolutely.

- Yeah.

Well, AI has become a household topic.

While artificial intelligence has the potential to enhance cybersecurity and fraud prevention, it can also be exploited by cyber criminals to carry out identity theft and scams.

April, coming back to you, how has AI been used to work against us?

I know that you've already mentioned a few ways where AI has been used in the emails and such.

How else can it be used to work against us?

- Yeah, so one of the scams that I think we're familiar with is when the grandparent is getting a text from their grandchild saying, "I've been arrested, I need you to send me money."

But with AI, it's gone up a level where scammers are able to use the voice of the individual, of the grandchild, and because of artificial intelligence, be able to craft a message using the actual grandchild's voice.

- [Kenia] Oh, wow.

- 'Cause a grandchild may be on social media, and once you're able to pick up those vocal intonations, you're able to recreate.

And so, that's certainly one way that we've seen scammers actually using artificial intelligence to increase the apparent authenticity of the issues, of the claims.

- Wow.

I hadn't heard that one before.

So Devon, my next question was gonna be about voice recognition, but you know, we have so much of our lives on social media right now and videos, and I mean, even the show, right?

Someone could just grab our voices.

How do we protect ourselves from that?

- Honestly, that's a great question right now.

We're still trying to figure that out.

I think AI has just kind of jumped on us really quickly here, and so we're still trying to catch up a little bit with that.

I think the important thing is to, you know, obviously be careful with what you're putting online, make good decisions in that space, and that'll help.

But really the verification part of it, right?

- [Kenia] Yeah.

- Call somebody, reach out to somebody, talk to a real person and understand the situation.

- Indeed, so let's say we do find ourselves in a space where we've been compromised.

April, what do we do?

What type of legal actions can we take?

How do we ensure that it stops once we find out that it happens?

- Right, and so the first thing you wanna do is contact law enforcement and let them know that you've been a victim.

So, your local law enforcement within your county.

You also want to contact at the federal level, the Federal Trade Commission.

You can file a complaint, indicating that you've been a victim and provide that information.

And also the North Carolina Department of Justice has a consumer protection division.

You can file a complaint there as well.

So, you wanna make sure that you notify and file those complaints.

And what that does is not only begin to protect you, but also protect other people.

So, hopefully they can find the scammers.

One of the things that you need to be really mindful of if you're thinking about identity theft, is people using your- if they get your social security number, being able to file a tax refund against you.

And so putting blocks on your credit account, on your social- on your IRS account, so that there has to be multiple layers of verification before things can be done in your name.

- Yeah, so Devon, if this does happen, are there services that we can enroll in, credit monitoring services that can help us, prevent it from happening in the future?

And that continue, you know, monitoring what's going on with our identities?

- Absolutely, there's numerous services out there that do credit monitoring.

I mean, you can in fact go to the credit bureaus directly themselves and put locks or blocks or holds on your credit, so that people can't use your credit to make large purchases.

There's also services for what we call dark web monitoring.

So, they monitor the dark web to- - Can you pause for a moment and define the dark web for us?

- Oh, absolutely.

So when we think of the internet as a whole, it's really three pieces.

It's the internet that we know.

We go to google.com and we search.

Then you have what's called the deep web.

And that's the things that are behind like logins or behind payment walls, such as like getting into your bank accounts and things like that.

And that accounts for roughly 98 to 99% of the internet.

But then there's a very small percentage called the dark web.

And this is where there's no indexing.

You're not doing any searches to find anything, and it requires a special web browser or VPN in order to gain access to it.

So, when we talk about the dark web, what we're talking about is that specialized place where some bad people can do some bad things, and that's where people's information ends up after most big breaches.

- And how concerned do we need to be about this?

Does this affect everyday users?

- It absolutely can.

I mean, if you think about it, if your information is available and being sold and brokered on the dark web, then that's potential for identity theft at any moment, and so You know, having your credit monitored, being vigilant about checking your accounts regularly for any anomalous activities.

All those things to help ensure that if something does happen, you're on top of it.

- Yeah, April, I wanna bring in, I was thinking earlier about my kids and then my parents, right?

So the youth and the elderly, how do we ensure that they're protected?

And I think kids too 'cause we're not necessarily monitoring our kids' credit reports right away because we don't think that there's a potential issue there.

But what happens if they get compromised or the elderly get compromised?

- Yeah, it can be incredibly challenging because, you know, the more you know, the more you can protect against it.

But oftentimes, with the elderly, they may be isolated, they may not be aware of some of the scams out there.

They may be lonely.

So they're more susceptible to a lot of these scams, and the scammers target the elderly.

So we have to make sure that we, you know, inform, we have to make sure that we don't shame them because a lot of elderly victims are fearful that, you know, their money will be taken away or their family will start be controlling because they have fell victim to this and they're just really embarrassed by it.

So we need to remove the stigma and provide the information.

And if there is an elderly person who has been a victim, we just have to make sure that we follow the steps in terms of notifying law enforcement, putting a block on the account.

But I think one of the biggest things is just to make sure that we don't shame and blame and we provide support.

- Yeah.

- And we have to do the same thing for our kids as well.

- Yeah.

- Because as they are becoming, moving into adulthood, they don't oftentimes want to admit that they've been a victim.

And scammers are targeting the young people as well.

So many scams come from social media.

- Yeah.

- And Instagram is one of the biggest areas where young people or any of us become victims of scams.

- Yeah, question I had, is it expensive to fight this?

If it happens to you, can it be costly?

April, I'm sorry.

- It can be, yes.

It can be very costly, especially if you're not able to recoup those funds, right?

- Yeah.

But I mean, even in getting someone to advocate for you, does that cost a lot?

- Well, it does to the extent you can find someone who is able to take the case.

But oftentimes, if the funds cannot be recovered, there's not much that can be done.

But it does take a lot of time, energy, and effort and our time is valuable.

And so one of the, you know, one of the suggestions is if you're paying for something, you know, if you pay with your credit card, you may be able to get that refunded if you're using your debit card, I think it becomes a little bit more problematic.

- Okay, that's good to know.

And then these ID theft programs that, you know, prevention, are they costly?

Are they, like, a monthly subscription?

How does that work, De'Von?

- Many of them are monthly subscriptions.

They do a fairly good job of alerting you when they see your information out there.

But you still have to take action.

You'll still have to make the calls, you'll still have to reach out to law enforcement and things like that if you see something nefarious happen on your accounts.

- Yeah.

And are they budget friendly?

- Yeah, I would say so.

You can see them anywhere from 20 bucks a month on up.

So not terribly expensive.

- Okay, well, De'Von, we've got a couple minutes left.

I know that you work in this every day.

I'd love for you to share exactly what you do and your services and perhaps how folks can get in touch with you.

- Oh, absolutely.

So I am the owner of CarTek Consulting.

We are a cybersecurity consulting firm.

We do everything from security assessments, penetration testing.

We have a monthly monitoring services for small businesses where we can provide security support for them and from a cybersecurity perspective.

We do security architecture, consult, you name it.

From a cybersecurity perspective, we can handle it.

If you ever wanna reach me, you can go to my website, www.cartekconsulting.com.

That's C-A-R-T-E-Kconsulting.com.

Or you can hit me on Instagram @CarTekConsulting.

So that's me.

- Wonderful, thank you.

And April, I know that you work every day with students, getting them to be experts in this space.

Anything you wanna add to things that perhaps we need to know as we're moving forward into AI and just protecting ourselves?

- Yes, absolutely.

So at the NCCU Law school, we have a Technology Law and Policy Center.

We just recently had an AI and the Aging Community Workshop for the community members to come to the law school to hear from a representative from the North Carolina Department of Justice.

We have another one coming up in the spring.

You can reach out to the law school.

- Wonderful.

- And I just wanna give a shout out to De'Von, who is a proud graduate of NCCU School of Law.

- Great, I gotta wrap it up there.

April, De'Von, thank you so much for being with us.

- Absolutely.

- Thank you.

- We invite you to engage with us on Instagram using the #BlackIssuesForum.

You can also find our full episodes on pbsnc.org/blackissuesforum and on the PBS video app.

Thanks for watching, I'm Kenia Thompson.

I'll see you next time.

[gentle upbeat music] ♪ - [Narrator] Black Issues Forum is a production of PBS North Carolina with support from the Z. Smith Reynolds Foundation.

- [Announcer] Quality public television is made possible through the financial contributions of viewers like you who invite you to join them in supporting PBS NC.