Criminals Steal $200,000 From a Volunteer Fire Department

(MUSIC INTRO)

[00:00:01] Bob: This week on The Perfect Scam.

[00:00:03] Eric Bernard: When we were headed to the hospital in Pittsburgh, our ambulance, which was very old, it’s not like the ones you see today, it’s an old van-style, we blew the engine and dark, thick smoke is filling the ambulance. The driver, my friend, pops out and he opens the back doors. We’re on a hill in Pittsburgh overlooking a steel mill. We drape a sheet so nobody could see, and out came that baby.

(MUSIC SEGUE)

[00:00:30] Bob: Welcome back to The Perfect Scam. I'm your host, Bob Sullivan. Volunteer firefighters embody a spirit of selflessness that's really inspiring. Yes, they are willing to run into a burning building to save their neighbors, but they do a lot more than that. They freely give away hundreds of hours of their time. They undergo extensive training. Most of them serve as emergency medical volunteers too, and they usually save local governments millions of dollars with the only pay, a squeeze of a hand after some injured or sick or vulnerable person has been carried to safety, or in some rare cases, the utter magic of helping a woman give birth to a healthy baby under very trying circumstances. More on that in a moment. That's why when you hear today's story about a scam that quite literally stole money from volunteer firefighters who were in the process of buying new ambulances to help save their neighbors, well I'm sure it'll make your blood boil. But listen to longtime volunteer Eric Bernard tell the story and you'll learn a lot of old-fashioned rescue worker wisdom along the way. Don't miss his explanation of the golden hour, or the best way to keep your nerves calm during a crisis. And of course, the best way to avoid this new, unnervingly common scam. Here's Eric.

[00:01:55] Eric Bernard: Hi, my name is Eric Bernard and I'm the President of the Rockville Volunteer Fire Department in Montgomery County, Maryland.

[00:02:03] Bob: And just roughly, where is Rockville?

[00:02:04] Eric Bernard: Rockville, Montgomery County, Maryland, are a suburb of Washington DC. The county borders DC on the northwest side. We are the county seat. The county has over a million residents with the majority being minority. A very unique area.

[00:02:23] Bob: A very unique area, and a big area which requires a very big volunteer fire department.

[00:02:31] Eric Bernard: So Rockville is one of 19 volunteer fire departments that make up the Montgomery County Fire Rescue Service. Now we're what's known as a combination system. So it's a hybrid. We have approximately 1450 active volunteers county-wide, and we have a little over 1100 career folk. And we all work side by side. And Rockville is one of the largest of those 19 volunteer fire departments, and Rockville has over 300 active men and women, also almost half female, half minority, that provide fire rescue and emergency medical services responses here in Rockville and the greater Rockville area. So we cover other parts of Montgomery County too.

[00:03:21] Bob: Three hundred is a very large number.

[00:03:23] Eric Bernard: It is a, yes, one of the largest in the country. And they have to meet the exact same standards as any woman or man that were joining Montgomery County Fire and Rescue as a career firefighter. So we take the exact same training at the same training academy side by side with people who are doing this as their career.

[00:03:45] Bob: This isn't the kind of thing where you volunteer between 9 and 10 o'clock on a Saturday twice a month, right? It's a lot more than that.

[00:03:51] Eric Bernard: Right, right. So interesting fact that the average American volunteers four hours a year, usually through a faith-based organization. Now our volunteers do a minimum of 720 hours a year at Rockville. It's a minimum one night a week. You're assigned to the same night each week. So my shift is Tuesday night. So Tuesday we need to be there and ready to go at 5 pm, and we stay till the next morning 7 am, and then every six weeks we have to do a 24-hour shift on a Saturday; Saturday 7 am to Sunday 7 am.

[00:04:29] Bob: So unless my math is wrong, every Tuesday you don't sleep?

[00:04:34] Eric Bernard: Yeah, it's a, it, it can be a problem depending on what unit you are riding.

[00:04:39] Bob: So on a typical Tuesday night, how many of you are sitting there in the fire department waiting for something to happen?

[00:04:44] Eric Bernard: We have approximately 28. Five of those will be paid. The other 23 to 30, we have some new trainees. They come in and do their practice calls. Many will go to class from 7 pm to 10 pm, come back at 10. We can have as many as 30. We, at our station, we can comfortably sleep 32 people.

[00:05:06] Bob: (chuckles) Oh, you have a, what sounds like a hotel to me, wow.

[00:05:09] Eric Bernard: Well, more like an army barracks, unfortunately (laughs). It's from 1966. It was originally built with no facilities to stay the night, no female facilities, and um, yes.

[00:05:23] Bob: I just so admire what you do, the devotion there just seems remarkable to me. So thank you.

[00:05:27] Eric Bernard: Oh, it's our pleasure.

[00:05:29] Bob: Perhaps you've seen that oftentimes when there's a medical emergency, a car crash or at someone's home, a fire truck is first on the scene. That's because many fire department volunteers are also trained to handle medical issues. In fact, that's most of their work.

[00:05:48] Eric Bernard: Just like most fire rescue EMS departments in the country, Rockville and Montgomery County is a fire-based EMS system. So every firefighter in Rockville and Montgomery County has to be at a minimum level training of EMT, Emergency Medical Technician. Many of our members, we have quite a few volunteers that are paramedics. So an EMT is about 250 hours of training. A paramedic is 1500 hours of training.

[00:06:19] Bob: When there's any kind of a medical crisis, it's often a fire truck or something that looks like a fire truck which shows up first.

[00:06:24] Eric Bernard: Yes, because we are so busy, so the, the women and men that are volunteering on Tuesday nights that are riding the ambulance or the paramedic unit, they are out from 5 minutes to 5, maybe we'll see them once or twice before midnight, uh because they will be on so many calls. And when the EMS transport units are on a call, we will send the closest fire engine, truck, rescue squad, ALS chase car, which is, in our case, a Tahoe, but yes, people will often say, well I, I called for a heart attack and this big ladder truck showed up along with a fire pumper and the paramedics. And why is that? Well, that's because we're all trained in emergency medicine, and for Rockville and Montgomery County, it's 82% of all of our calls are emergency medicine.

[00:07:13] Bob: Are medical, not, not for fire or something like that.

[00:07:15] Eric Bernard: Not for fire, yeah. An actually working fire, something burning other than a piece of paper is about 1% of our calls.

[00:07:23] Bob: Yeah.

[00:07:24] Bob: And because there are so many volunteers willing to put in all this time on all this training and to set aside a night each week or more to care for their fellow human beings, well that keeps your local taxes down too.

[00:07:40] Bob: I think this is an important point to make too. Ambulance services, emergency services in general, are very expensive. But the fact that you have all these volunteers saves a lot of money, right?

[00:07:48] Eric Bernard: Yes, it's estimated Montgomery County, our volunteer system in those 19 departments saves approximately 26 million dollars a year to our county taxpayers.

[00:08:00] Bob: Being a volunteer firefighter is a calling. Each volunteer has a story explaining how they got their start. For Eric, well he was just a teenager in Pittsburgh when he heard the call.

[00:08:12] Eric Bernard: I'm a, of an age that our favorite pastime was roller skating. And I would go Friday evenings if my parents would let me out to a roller rink with a, a friend of mine who was almost two years older than me, and one night, on a Friday night when we were roller skating, he collapsed in front of me. And I had no idea what to do. At not quite 18, he had a stroke, and I’m 15, and I had no clue what to do. He had just finished EMT training and was trying to convince me, hey, you know, you should come volunteer in on our rescue squad. After that night of waiting for the rescue squad to come and help him and he, he survived, I said, yes, yes, I absolutely want to do that. So at 15, I signed up to uh one of our suburban rescue squads and I did that, became an EMT at 16, the earliest you can. I became a paramedic at 18. And I went into the military. I served in the United States Navy as a combat medic, airborne. I was assigned to go to the USNS Comfort. And when I got stationed in Bethesda, Maryland, I drove up Rockville Pike looking for a volunteer fire department. I ran into Rockville in November of 1987, and I’ve been here since.

[00:09:33] Bob: And in his 40 odd years of volunteering in this DC suburb, well, Eric has seen just about everything.

[00:09:42] Eric Bernard: Yeah, most of our personnel, we see the gambit. I responded on 9/11 to Rockville, to my station where uh all of our volunteers, we went from a crew, a day crew of 10 to 40 people at our station. And we sent people to the Pentagon. And then two days later we got called to New York. So I was at Ground Zero for two weeks until the day that they turned it into a recovery operation. I’ve been on plane crashes, motorcycle crashes, Metro crashes, yes it takes its toll on career and volunteer, all professionals. I’m glad in Montgomery County we offer peer panels. We have on-staff clinical psychologists available free of charge to all of our people. But yeah, our volunteers see everything. And, of course, the occasional building and house fire.

[00:10:37] Bob: But one of his favorite stories, well it happened on one of his first days on the job.

[00:10:43] Eric Bernard: The first call that I can remember where I was trained as an EMT by myself, I was, I had just turned 16, it was the weekend of Thanksgiving. I, my birthday falls on Thanksgiving, and my other young friend, partner who was 18, he was the driver, we ran a young girl, she was having her third child. And I was going to deliver my first of 13 children, and when we were headed to the hospital in Pittsburgh, our ambulance, which was very old, it’s not like the ones you see today, it’s an old van-style, we blew the engine and dark, thick smoke is filling the ambulance. The driver, my friend pops out and he opens the back doors. We’re on a hill in Pittsburgh overlooking a steel mill. We drape a sheet so nobody could see, and out came that baby. And she was so grateful and the baby’s crying. We’re crying. Smoke pouring out of our ambulance, and we’re waiting for the City of Pittsburgh ambulance to come help us and take the mom and kid to the hospital. And, and they were fine and you never forget stuff like that.

[00:11:51] Bob: I don't know about you, but hearing stories like that takes my breath away. And along the way, well there's been plenty more like that.

[00:11:59] Eric Bernard: I just remember mostly older people that just look in your eyes and say, thank you. Grab your hand. That always brings tears to my eyes, and that’s why, that’s why I personally do it, no compensation for 44 years, and all the women and men that I serve with.

[00:12:17] Bob: But back to that scene of engine smoke billowing out of the front end of an ambulance while a baby is being born in the back end. Avoiding a repeat of that scene is how we get to our story today. Because Rockville's very busy department beats up its ambulances pretty good and it's time to get two new ambulances. So Rockville wants to do that before one of their units ends up stuck on the side of the road. And Eric and crew starts to make plans. Quite a process, buying an ambulance is not like buying a car. You don't go down to the emergency vehicle dealer and negotiate on a price.

[00:12:54] Eric Bernard: They make them so much more advanced than they used to. They’re made on industrial chassis. The costs are incredible; well over $350,000, so we have an apparatus replacement plan. One of our volunteer chiefs works very hard in putting a schedule out. Our, we have a committee of volunteers that spec out with various manufacturers how we want this ambulance or ambulances to look, what features we want, and it is about a two-to-three-year build time right now post-COVID. So we decided to buy two economy of scale, uh you’ll save about $50,000 doing that.

[00:13:35] Bob: So the purchase of two new ambulances that will arrive in two or three years, well that takes a lot of planning and coordination, and of course, money. But Rockville has a plan for that too.

[00:13:48] Eric Bernard: Yes, we have, we're eligible for certain grants, and state funding that is merit based on need. And then in Montgomery County, there is an insurance reimbursement program for ambulance billing. So uh we do get funds from that all based on application and need and spec. So we had been saving and continue to save because the total bill’s close to 800,000. And then we do take out loans at times for apparatus. Ambulance are actually the cheapest responding vehicles that we purchase. Today a pumper is closer to $760,000 each. A ladder truck has a big ladder on it, that’s about 1.2 million, and the heavy-duty rescue squad, that’s closer to 2 million dollars.

[00:14:36] Bob: Wow.

[00:14:37] Eric Bernard: Yes. So it's all big, big dollars and so we, through our apparatus management plan, we start saving, we apply for these grants, and they, they come between 50 and 100,000 dollars a year, and we put that into an investment account that we have and try to build that money and each year add to it.

[00:14:59] Bob: As you might imagine, you can't order $800,000 worth of ambulances to be built over the next couple of years without making a substantial down payment. It's going to take $220,000 to place the order. But Rockville is ready and pulls the trigger on the down payment in April 2024, this year, and then wires the money to the manufacturer, at least that's what's supposed to happen. But about five days after the $220,000 is sent, Eric gets a panicked call from another fire department member.

[00:15:36] Eric Bernard: It was midmorning. I got the call from one of our other volunteers who was just astonished. He said, "You’re not going to believe this, this is not a joke." At the firehouse we like to play a lot of pranks on each other.

[00:15:49] Bob: Sure. You thought it might be a prank at first, yeah.

[00:15:51] Eric Bernard: Right, right, right.

[00:15:53] Bob: Unfortunately, it's no joke. The ambulance vendor is called to ask when will the wire transfer be complete. But the department has made the transfer. In fact, five days earlier. Something has gone horribly wrong.

[00:16:08] Eric Bernard: We made a down payment of $220,000 to the vendor we have, we're using, and we've used this vendor before. And during the transactions, both on the phone, via email, and wire transfers, somebody spoofed our volunteer treasurer’s email and our business manager and started a new chain under our Rockville email and our vendor and gave false wiring instructions. We made the transfer to what we thought was our vendor, and that actually his computer was spoofed in three different locations, one being in London, England, according to the Secret Service. And uh we lost that money.

[00:16:53] Bob: A criminal had hijacked the conversation, impersonated the vendor, and given false wiring instructions to the fire department. So that $220,000 destined to buy new ambulances to help the department rescue the neighbors, well that was stolen.

[00:17:09] Bob: You had spent years accumulating this money for the purpose of buying an ambulance, and in, in an instant, these folks took it.

[00:17:15] Eric Bernard: Yes, absolutely.

[00:17:17] Bob: This is the kind of thing you've heard us talk about before on The Perfect Scam. It's become common in real estate transactions unfortunately. A criminal impersonates a real estate agent, hijacks an email conversation at a critical time in a big transaction, and convinces the buyer to wire the down payment to an account the criminal controls. A similar thing here only this was the down payment on lifesaving ambulances.

[00:17:42] Eric Bernard: I got the call that this may have happened, and it’s that sinking fear, stomach, nauseating feeling that first off, who would steal from a volunteer fire department? And how did it happen?

[00:17:56] Bob: I'm guessing one of your other thoughts immediately must be, oh, well there must be some way to fix this, right?

[00:18:02] Eric Bernard: Yes, yes. I said, okay, it can’t be that bad. We can recover. My wife happens to be a realtor and I hear the horror stories almost daily of people buying houses and getting the wrong transfer instructions. So it is a common fraud that occurs. I had not heard of it occurring with volunteer fire departments. And shortly after we found out, our vendor told us, oh yeah, you’re actually the third client that this happened to. So I said right away, oh, we know where the problem is. It’s not us. We’ll be able to get our money back.

[00:18:33] Bob: But, as the smoke starts to clear, there's even more bad news. The department is told that after 24 hours or so there's really no way to reverse the transaction. That $220,000 has been stolen. So Eric decides to go public with the story.

[00:18:51] Eric Bernard: And there's a local gentleman, Dave Statter, who worked for Channel 9 for years as a reporter, actually started as a volunteer firefighter in Prince George’s County; he has helped us with um, knowledge for years on how to deal with it. So we decided to get ahead of it and put it out, tell the public so it wasn’t innuendo, it wasn’t like we were trying to hide anything. Said, hey, if this can happen to us, a very sophisticated organization, it can happen to anybody.

[00:19:20] Bob: As you might imagine, news that someone stole from the local fire department hits the Rockville community hard. And Eric just wants to make sure everyone knows what's going on. But he doesn't anticipate what happens next.

[00:19:34] Eric Bernard: When we hit that go on the media blitz and the public and the media, their response was amazing. Local businesses donating, holding events for us. Every elected official: we have great relationships with our elected officials. They called, texted, emailed, said how can we help? We’ve got state delegates that are drafting a bond bill to help us make up the difference. We have communities, businesses, members. We’ve had, older peo--, residents drop off $10 checks at the firehouse. So we took a very bad situation and we turned it positive to help educate the public that this happens on a daily basis and it even happened to a volunteer fire department.

[00:20:14] Bob: I did notice that a GoFundMe seemed to have, be going pretty well. That’s just one of the many ways that folks are trying to help you make up the difference, right?

[00:20:23] Eric Bernard: Yes, yes. GoFundMe. One of our partnering restaurants in the community, the guy’s ironically also from Pittsburgh, probably the best pizza you’ll get in this area, Guiseppe’s, has held two fundraisers for us. They bring food all the time. Yes, the community response, the media response has just been unbelievable. And it's helping us get through this both mentally to know that the public backs us and understands what we're doing, and they get to learn a little bit more about our mission and what we do with their donation, and then financially, helping us to recover.

[00:20:59] Bob: And as donations pile up over the next few weeks, there's even more good news. Thanks to some quick work by police investigators, banks have been able to recover some of the stolen funds. So...

[00:21:11] Eric Bernard: Between law enforcement donations, right now our deficit's about $40,000, which is a huge hit, but it's better than $220,000 and negative press.

[00:21:22] Bob: Yeah, that was not the, the number I was expecting you to tell me at the end of this call.

[00:21:26] Bob: Now remember, buying an ambulance is a two- or three-year process, so the theft of that down payment could have set the department timeline back. It did not.

[00:21:38] Eric Bernard: There was no delay because our vendor understood, and they did not stop the purchasing of the frames. There’s just such a backlog in everything. As people know when they go out to buy new cars, there’s still issues in supply and demand. It is by magnitude of 10 worse for public safety. Buying anything from a specialty tire to the seats that go inside fire trucks, we wait months. Our gear takes about 6 to 8 months now. We used to get it in two weeks.

[00:22:08] Bob: Wow. So you're looking at like 2026 for delivery of these things?

[00:22:12] Eric Bernard: Yes, yes. We are easy two years out on the build and yes, getting them in service, which is what we planned, right. There’s been absolutely no delay.

[00:22:22] Bob: So there's not going to be smoking engines and women giving birth in the back of the ambulance. You planned for this.

[00:22:29] Eric Bernard: We, we hope not, we hope not. They should...

[00:22:31] Bob: I'm knocking on all the wood around me, so...

[00:22:33] Eric Bernard: Yes, yes, yes. No, we, we have uh, our units are, are nearing the end of their life, but we had projected that two- to three-year timeframe. And the good news is that if one of them do go out of service, we, we partner with Montgomery County Government, and they have spares that they loan us, so that the community won’t go without either way.

[00:22:54] Bob: Part of the reason Eric went public with the story is he really wants people to know what happened to be able to protect themselves.

[00:23:04] Bob: Okay, so what, what would you like people to remember from your story. What, what have you learned from this that you want people to learn from it?

[00:23:11] Eric Bernard: It can happen to anybody. It can happen to any organizations. The days of being complacent when you get an email, a text, or even today, a phone call from a known number, we have taught our leadership, hang up. You get the number that you have for that vendor, that bank, and you call them. Same with an email. You don’t respond to an email. You certainly don’t respond to a text. I’m sure everybody listening gets a text at least once a week purporting to be from the postal service or from FedEx that you have a package that they don’t, it’s not right, you’re not going to get... You never respond to something and someone you don’t know via text or via email. And for your home, build in those safeguards if you do have to transfer money. Follow those same rules. You make the call; you be on the phone with the people whom you’re certain are your vendor and read off those numbers while he or she is on the phone. And only then it’s said.

[00:24:12] Bob: Eric also talked about something he calls the golden hour. And that's a concept you can apply to a lot of situations.

[00:24:19] Eric Bernard: In fire rescue, we have the golden hour; the first hour after traumatic injury is crucial for survival of your patient. We want them at a trauma center getting professional trauma care within that one-hour period of the incident happening. So we are all about numbers. We understand time. Well for us now, it’s 24 hours. Any bank issue, wire transfer payment, if you don’t have satisfaction and comfortability that it has occurred properly, you need to notify law enforcement in that 24-hour period to have any chance of recovering funds that were instantly sent somewhere. Not like putting it in the mail.

[00:25:02] Bob: You know, I bet you have all sorts of wisdom you could dispense like that that emergency services are probably a pretty good metaphor for a lot of these things. The, the idea of a golden hour, you know when, whenever you have a transaction of any kind in your life, you, you do have time to recover, but it’s very short.

[00:25:18] Bob: The golden hour. Remember that nugget of wisdom. Naturally, there's a lot of nuggets of wisdom that we can learn from first responders.

[00:25:27] Eric Bernard: It's, it's unfortunate that we see, it’s usually people that fall victim to this because we are of a trusting nature. You get a call purporting to be from a loved one, a grandson or grandchild, or a kid and, and they need help, and the voice sounds like them because they can do that now with AI technology. You have to just take a breath, calm yourself down. We tell our people, don’t drive recklessly or with such disregard that you now become the problem and get involved in an accident. Do we drive fast, yes, but we drive safe. So the same metaphor is, don’t you become the problem. The instructions are people take a deep breath, collect your thoughts for 10 seconds and make the right decision first.

[00:26:12] Bob: I really like that too. I, I have always marveled at the ability of emergency services people to drive fast, but not recklessly because that, that must be so much pressure behind the wheel, and you're telling me the trick is to take 10 seconds and breathe, something like that?

[00:26:27] Eric Bernard: Yes. Deep breath. So your body, the natural tendency, when you take a deep inhale and exhale, it triggers to your mind that everything is okay. If you go to a physician, a chiropractor, uh and they’re going to do any maneuver on you, they tell you, deep breath first and blow it out. That naturally tells your body everything is okay because you were able to take that time to take a deep inhale and a deep exhale.

[00:26:53] Bob: That's really excellent advice, yeah. Yeah.

[00:26:55] Eric Bernard: Thank you, yes. And it works! Forty-four years in fire rescue EMS, it works.

[00:27:02] Bob: You must know something if you've done it for 44 years.

[00:27:05] Eric Bernard: Yes.

[00:27:06] Bob: Eric also has one request of Perfect Scam listeners.

[00:27:11] Eric Bernard: That they should learn wherever they’re at, who are their first responders. We use the term fire department, but as I said, that’s 1% of what we do. Emergency services, first responders in America, about 70% of the fire departments out there are volunteer. So go learn who covers you, who protects you. They’re all professionals, whether they’re doing this as their job or they’re volunteers or they’re part of a combination system; go learn about them. Make a relationship with them. The people that are going to come to your house, it’s great to know them, great to know their name, especially if you have some type of medical condition or special need that they need to know. Whether it’s a volunteer department or a fully career department, generally you have the same people there and part of our jobs are to know our area. We call it the first do. Whatever fire truck, engine, paramedic unit covers the area closest to their station, we call that our first do, and we even have to know how to get there without looking at a map, we know our specialty buildings. In, in Rockville we have everything from a, a major hospital to one of the largest routes in, in America, busiest travelled roads, we have nuclear reactors, we have the Metro system, we have to be experts in all those areas. So you should be an expert in who is your fire department? Who is your paramedic unit? Who is the beat officer that covers your area? And if it is a volunteer fire company, go visit them. Even if it’s career fire. I’ll tell you what, there’s nothing better than walking in a duty at a quarter of 5 and somebody’s brought a big plate of cookies. (chuckles) Yeah, I’m a little chunky. I’m working on that. But man, around the holiday season at the Rockville Volunteer Fire Department, sometimes you can’t sit at our double tables that are meant to feed 30 people, because there is so much donated food and beverages, non-alcoholic, and little gifts. So you should know who protects you and make a relationship and understand how they work.

[00:29:26] Bob: And of course, if you are in a giving mood yourself, be very careful when it comes to donating money to your local rescue squad.

[00:29:33] Eric Bernard: Just because there’s a fire department there doesn’t necessarily mean they’re going to reach out to you for money. Never donate to something that you don’t know. There are a lot of unscrupulous organizations that purport to collect money for volunteer or career responders. Make sure you’re donating to somebody that is legit. Look online. If they’re not a 501(c)(3) you ask them, "If I make a donation to you, is it tax exempt?" If they tell you no, then it’s either a lobbyist, some type of trade organization, and most often those people calling are not firefighters or emergency providers, and they’re taking at least half of what you’re donating as a fee. We will never call you here in Rockville and ask for money, ever, ever, ever. We do some fundraising via mailers, via checks sent to the fire house, but we will never call and pressure you to ask for money, and you need to know if that happens in your area too. Even if it’s all volunteer, it doesn’t mean they’re all calling you all the time for money. So be careful who you give your hard-earned money to.

[00:30:38] Bob: And again, it's fine to just walk down to the fire station with a check, right?

[00:30:41] Eric Bernard: Absolutely. Then you, then you have two tasks completed. You get to meet the awesome women and men that are there protecting you, and you make sure that your money or your gift or your homemade cooking food, it goes to the right people.

[00:30:59] Bob: And for a third task, if you bring your dog, your dog might get a dog treat also.

[00:31:02] Eric Bernard: Yes. Yes. Yes.

[00:31:04] Bob: At least, at least in my firehouse, that's how it works.

[00:31:06] Eric Bernard: Well that's awesome. It seems you've got a good station.

[00:31:09] Bob: Yeah, they, the guys just sit out there in the driveway all day long saying hi to puppies, it's great.

[00:31:14] Eric Bernard: (laughs) Love it, love it.

[00:31:16] Bob: And I do admire what you do. So thank you for that Eric, I appreciate it.

[00:31:19] Eric Bernard: It's my honor. Just it's, it's just what goes on in 70% of the fire houses, EMS stations, rescue squads throughout America. Volunteers serving in the community that they live. And the other 30% are made up by awesome people. Everybody’s a professional that aren’t making a lot of money, that are risking their lives to help people they never have met more than likely and you, you don’t know what’s going to happen next. Our motto through our national organization, the National Fallen Firefighters Foundation, is “So everybody goes home.” The goal of every fire department, EMS station, police officer, is to go home after your shift. Number one rule. Everybody goes home. So it’s, that’s who I represent doing this. And there are a million stories just like me throughout America. Go meet yours in your local fire department.

[00:32:16] Bob: If criminals can steal from a volunteer fire department trying to buy ambulances to rescue injured or sick people, surely, they are willing to steal from anyone. So that's why it's so important all of us do our part to stop these crimes. To help with that, we are so lucky today to have Rachel Tobac on the program. You've probably seen her on TV. She appears in 60 Minutes, CNN, in the New York Times, too. She runs a cybersecurity company that ethically hacks people for a living. She calls it social engineering all for the purpose of education. In fact, she's been a guest on The Perfect Scam once before when she hacked my predecessor. She's full of wisdom about how to avoid becoming a victim of crimes like this. I asked her how common these kinds of wire fraud crimes are now.

[00:33:07] Rachel Tobac: Oh, unfortunately it is so common, and it's so sad that it hits in a community like this who's looking to buy an ambulance. It's very, very unfortunate. In the social engineering world, we call this business email compromise, and there's a variety of ways that this happens. So either somebody accidentally gives away their credentials to their email account and an attacker goes in there and they hijack the communications that you have with other people injecting their thoughts, so that you don't even know this is happening or sometimes they just send fraudulent invoices pretending to be you and they get paid.

[00:33:44] Bob: Business email compromise. For example, the criminal engaged in social engineering pretends to be the CEO of a company and emails an invoice to the accounting department demanding that it be paid right away. It's persuasive because who wants to anger the boss? That's how social engineering works. But as we've seen with mortgage wire fraud and this ambulance purchase story, there are plenty of other ways criminals can insert themselves into an email conversation and persuade someone to send money to the wrong bank account.

[00:34:16] Bob: I saw research from a realty organization suggesting that half of all US realtors have had an attempt at impersonation, so somebody's tried to hack their email or whatnot, probably for the purposes of something like this. So this is really rampant, right?

[00:34:28] Rachel Tobac: Oh, it's rampant. It's so common. You know when you make these big purchases like an organization purchasing an ambulance, individuals purchasing a home, that's some of the largest wire transfers, largest amounts of money you ever deal with in your entire life. Attackers know that, and they want to get in the middle and try and steal it.

[00:34:47] Bob: Hacking into a realtor's email to monitor for upcoming transactions is one way criminals might know when to pounce on a mortgage transaction. But how would criminals even know a transaction like an ambulance purchase is about to happen? Rachel had some interesting thoughts about that.

[00:35:03] Rachel Tobac: There's a lot of ways. People talk about things on social media, other people can get hacked to know that this deal is going through. They get word of it. Somebody talks about it excitingly on Snapchat stories, Instagram, BeReal, and now the information's out there on TikTok or what have you. And now they pretend to be someone in the middle of this trusted chain and steal that money.

[00:35:25] Bob: To be clear, we have no idea if that applies to the Rockville crime, but it's a good reminder that a seemingly innocent social media post could put you at risk.

[00:35:35] Rachel Tobac: That's why it's so important to verify that people are who they say they are before taking sensitive actions. I call this being politely paranoid.

[00:35:42] Bob: Oh, I want to hear all about being politely paranoid. What does it mean to be politely paranoid?

[00:35:46] Rachel Tobac: Yes, being paranoid, it means checking to ensure people are who they say they are. When we're talking about sending money, wiring large amounts of money, sending money to somebody either through a wire transfer, Venmo, CashApp, even a check or cash, or providing something like a password or a code or credentials or access to some sort of document, those are sensitive. Attackers can gain access to that, pretend to be you, take over those accounts, take over that money, even steal the rest of your money by gaining access to a bank account or steal the rest of your accounts by gaining access to your email and resetting the password to all those accounts. So we might feel like, oh, this isn't that big of a deal, we're just confirming that a payment's going to be sent, that's a pretty big deal, because an attacker can take over that communication. So what do I mean by verifying that people are who they say they are? I just mean using a second method of communication to confirm we've got the right person and the right instructions before taking action. So if you are in the middle of an email, maybe you verify by calling the phone number that you already have on your file to verify it's going to the right person. Maybe you Signal chat, you chat on WhatsApp, or Instagram message in a thread that you already have with that person. You chat on LinkedIn in a thread you already have with that person, any other method of communication. You can also call back to thwart spoofing. That's whenever you can change caller ID to look like you're calling from anywhere. So it's important to verify people are who they say they are with another method of communication. And I call that being politely paranoid.

[00:37:21] Bob: And no one in this day and age is going to be offended if you ask that second question, right?

[00:37:24] Rachel Tobac: Not really anymore. I think we've all pretty much seen these attacks in the news, we've seen them on social media, we've heard of our friends, family, coworkers getting scammed, so at this point, I think people understand it's not personal. I just need to verify first.

[00:37:39] Bob: So when it comes to a big transaction like buying a house, and a consumer gets instructions on how to wire money, account number, routing number, maybe a SWIFT code, what's the right way to verify this information?

[00:37:52] Rachel Tobac: So it wouldn't be calling say Bank of America, but rather, it would be calling the person that you're interacting with. So let's say you have a big thread and you work at a fire department, and you need to purchase an ambulance. You have a big thread with this ambulance providing company, we'll call it Ambulance-Are-Us, okay?

[00:38:09] Bob: Sullivan's Ambulance Incorporated, yeah, yeah.

[00:38:11] Rachel Tobac: Yes. Sullivan's Ambulance Incorporated, right? I would get on a phone call with Sullivan's Ambulance Incorporated, the phone number you already have on record, and they might have a phone number on their website you've already interacted with, that you already trust. I would call that phone number and I would let them know in an email, "I'm giving you a call to verify that this is the right information so that I don't accidentally send a wire transfer to the wrong person." In most cases, they will say, "Yep, you've got the right info. I sent you that email. We're good to go." Sometimes you'll catch an attacker. And you'll say, "Hey, I just want to make sure this is the right info," and Sullivan's Ambulances Incorporated says, "Nope. That was not us. Somebody, I guess, hacked an email, something happened. Wires got crossed. No, that's not us. We need to do this a different way." And I think people don't always know who am I supposed to contact? So it's the person that's ultimately going to be receiving the money. Making sure they have the right instructions, and if a wire transfer is 100% necessary, you've got to use a second method of communication.

[00:39:15] Bob: And remember Eric mentioned the golden hour, double-checking after the transaction is supposedly complete to make sure the right person ended up with the money. That's important, because if anything has gone wrong, time is of the essence.

[00:39:28] Rachel Tobac: I think checking ahead of time is more important than the checking after, so don't sacrifice that, you know one for the other. But if you have the time, if you have the resources to do both, that is amazing. So I highly recommend that. Checking, verifying people are who they say they are, saying, listen, this is a really big transaction, so I may be sticking with you. I'm going to be calling you back every 15 minutes if you don't, if I don't hear from you about you receiving this transaction. So really get in there and sometimes you've got to make yourself a little obnoxious.

[00:39:55] Bob: It's okay to be annoying.

[00:39:55] Rachel Tobac: You know just to make sure. It's okay.

[00:39:56] Bob: Yeah, it's really is.

[00:39:57] Rachel Tobac: It's $200,000 for an ambulance, it's okay.

[00:39:59] Bob: You know I want to defend victims here because the last time I bought or sold a home, like 7 or 8 years ago, and this stuff was already happening, and so there was a lot of pieces of paper and there was a lot of notifications even from my realtor, beware of wire transfer instructions that are fraudulent. But in the end, you know, I've wire transferred money maybe five times my whole life. In the end, there was still just a person who showed up at my home who, and a piece of paper that I had to fill out. It was not actually easy for me to verify that this was who they said they were, and I think it's actually harder than it sounds to double-check things like financial transaction wiring instructions because it's really unfamiliar.

[00:40:35] Rachel Tobac: That's true, it's really hard. It's very high stress, and a lot of times there's time pressure. You know when you're buying a house you've got time pressure to close quickly and, and get the sale completed. And that's very stressful for people. Now one thing I will say is wire transfers are not your only option for large sums of money. You can use a money order. You can go and you can get a cashier's check, and you can walk it to the person that you're trying to work with. And that's one way to do it. So I highly recommend looking into some alternative options for giving large sums of money to ensure you give it to the right person.

[00:41:07] Bob: What kind of things do you generally advise people when they have big consequential transactions or, or communications like this?

[00:41:13] Rachel Tobac: Yes. Recognize that attackers take advantage of moments of urgency or fear. And so a lot of times we feel the time pressure to take care of something immediately because a family member, a friend, a colleague says, "We need this done in the next 15 minutes. I need money. I'm trapped in Europe. I need $1000 in CashApp." Or "I need you to wire this money to the ambulance company. They're yelling at us," or, right? There's this time pressure, this sense of urgency. This sense of urgency does happen in real life. Urgent, you know, urgent emergencies do pop up, but it's rare in our lives that we have to deal with true emergencies. The need to take an action within the next one minute, and helping people recognize what an attacker is trying to do typically is getting you to take an action within the next one minute. So if you feel like, ooh, I've got to do this right now or this person's not going to have money to get on a train. They're on a plane that's about to take off. They need access to this thing right this second because the bank's closing. Like that type of one-minute requirement should set off some alarm bells for us. It should help us go, hmm, wait a minute. This is a little bit too much time pressure. I'm noticing a sense of urgency; I remember in the podcast Rachel said that sense of urgency is a principle of persuasion often used against us to hijack our emotions and get us to do things faster than we normally would. So when you notice that sense of urgency, that's actually when I want you to pump the brakes. If someone's trying to get you to do something within 30 seconds to one minute, maybe take 5 minutes. Take a step back. Verify identity. Verify the exact steps the money's going to the right place. The emails are going to the right people and then take the action.

[00:42:54] Bob: That, that one-minute threshold, I like, that's a very simple, straightforward rule. I like that a lot.

[00:42:59] Rachel Tobac: Yeah, and it, it's helpful for people because yeah, I mean we run into true emergencies a few times in our lives. It happens, right? You've got to get somebody to the hospital. You've got to do this. You've got to send money. I mean it happens but it's rare. And when it does happen, we have to verify first. So you get a call from your nephew and they say they just got into a car accident, and they hit somebody who was pregnant. This is a super common scam right now, especially hitting grandparents. And they say, "I need money because they're going to throw me in jail. I need $1500. Can you CashApp it to my friend because my phone's not working in the crash." And they go, "Oh my, yes. How do I help you stay out of jail?" Right? They want to be good helpful people. This is a one-minute style emergency. All we have to do is call that person back to thwart spoofing, on the phone number that we already have on file on our phone. Send them a text. Send them a Signal message, an Instagram message, a Facebook message. Any other method of communication to say, "Hey, how are you doing? Are you okay? I'm just verifying identity before I send the money." And they're going to go, "No, wait, Grandpa, no, I'm fine. What are you talking about?" And we'll catch the attacker. I think if you can be politely paranoid, you're 90% of the way there. And then if you can also make sure that you use long, random, and unique passwords on every account, I recommend a password manager and use multifactor authentication, that second step when you log in, especially on your email, your bank account and more, like your social media that you care about, really, really goes a long way in preventing attackers from taking over your accounts.

[00:44:24] Bob: So speaking of professional life, a big theme of this podcast, and I think it's an important lesson for everybody to remember all the time, is that this could happen to anyone under the right set of circumstances.

[00:44:34] Rachel Tobac: Oh, absolutely.

[00:44:35] Bob: We all end up putting situations or put in situations where things are suddenly urgent or you're distracted or whatnot. There was a story on CNBC.com today about someone who was a Silicon Valley executive who sent $400,000 to the wrong wire address on buying a house. So can you, uh just confirm for our listeners that you work with some of the best cybersecurity companies in the world. But you've seen really smart, really professional tech people be victims of crimes like this, right?

[00:44:58] Rachel Tobac: Oh, absolutely. I mean Mark Cuban, we all know Mark Cuban, right, from Shark Tank; he lost access to his account on Twitter recently. This just happened, and Mark Cuban's a tech guy, right? So yes, there's no reason why people have to feel critically embarrassed in these situations like, and like they have to stay silent. It's actually better to get it out, open into the world and say, this is what heard and let people know what's going on in your life. Because I guarantee you, you're not alone. Anybody who has gotten that grandparent scam, that nephew scam, a wire transfer scam has probably heard something similar and talk about it. Raise the alarm bells for people in your community and at work and your friends and your family, because you're not alone.

[00:44:39] Bob: You are not alone. You have friends, family, The Perfect Scam, and the AARP Fraud Watch Helpline at 877-908-3360 which you can call from 8 am to 8 pm Eastern, Monday through Friday, if you really need to talk with someone, if you think you might be in the middle of a crime or someone you love is in the middle of a crime, or you can always send us an email at theperfectscampdocast@aarp.org. For The Perfect Scam, I'm Bob Sullivan.

(MUSIC OUTRO)

[00:46:23] Bob: If you have been targeted by a scam or fraud, you are not alone. Call the AARP Fraud Watch Network Helpline at 877-908-3360. Their trained fraud specialists can provide you with free support and guidance on what to do next. Our email address at The Perfect Scam is: theperfectscampodcast@aarp.org, and we want to hear from you. If you've been the victim of a scam or you know someone who has, and you'd like us to tell their story, write to us. That address again is: theperfectscampodcast@aarp.org. Thank you to our team of scambusters; Associate Producer, Annalea Embree; Researcher, Becky Dodson; Executive Producer, Julie Getz; and our Audio Engineer and Sound Designer, Julio Gonzalez. Be sure to find us on Apple Podcasts, Spotify, or wherever you listen to podcasts. For AARP's The Perfect Scam, I'm Bob Sullivan.

END OF TRANSCRIPT