Ronnie Tokazowski
Appearances
Darknet Diaries
141: The Pig Butcher
So the way I help them is I help them a couple ways. So the first place is that when it comes to understanding the emotions in our body tied back to a lot of the way the scam works, people feel a lot of shame. They feel a lot of hurt. They feel a lot of disconnect because of the stigmas associated with it. What I mean by that
Darknet Diaries
141: The Pig Butcher
is when you're a victim like this, people don't want to come forward on this. So I try and help them learn how to work with their own bodies in that regard. So that's one way that I help them. The second way is I point them to the resources where they can go and submit a live request.
Darknet Diaries
141: The Pig Butcher
So they may be working with IC3, it may be working with colleagues who also work with romance scams, or it may be helping introduce them over to some of the crypto assets where they can start pulling some of that money back. The third thing I do is, again, just trying to help put them in contact with the right people.
Darknet Diaries
141: The Pig Butcher
Because what happens is, when you're in this scam, your head's spinning 1,000 miles an hour. You don't know which way is up. You don't know which way is down. You don't know who to trust. And many of us work behind the scenes to try and help be that good driving force for many of these victims. And when we go and we try and help them out, that's where we do our assistance.
Darknet Diaries
141: The Pig Butcher
In addition to that, we've also been running a... mailing list for the last seven years, talking on many things as a result of business email compromise and overlapping things with that.
Darknet Diaries
141: The Pig Butcher
And we have close contacts with a lot of the banks and financial institutions to help either try and reverse some of that money or do what we can to get some of that money back or try and flag those assets where we know, hey, these are actually part of a scam.
Darknet Diaries
141: The Pig Butcher
I really wish I could say that that was the upper limits, but I have seen so much more. I'm working with one victim now. I've been working with him for the last two weeks where he was suicidal and didn't know which way to turn. Jeez, you really take some heavy phone calls.
Darknet Diaries
141: The Pig Butcher
So very much the same way as the first person. He found a relationship. And as the relationship built, they're like, hey, I have this great investment opportunity. They strung him along as far as they could. And once he went and put some of the money in, he saw his returns. It was the same story. this individual actually was ready to retire. He had several homes as well.
Darknet Diaries
141: The Pig Butcher
So because of that, he ended up opening and doing a second mortgage on a couple of his homes in order to pull some money out. So because of that, and because of what he was able to pull out on those homes, he may now be facing losing those homes as well. And as it stands right now, he has lost over $1.7 million. Dang. I mean, I've...
Darknet Diaries
141: The Pig Butcher
It's awful. I was at an RSA last year, or this year as a matter of fact, got to speaking with somebody who had a, it was a grandfather who had committed suicide and they didn't know why. And they ended up going to look through his records and it was over $5 million that he had lost.
Darknet Diaries
141: The Pig Butcher
Whoever is behind this is just ruthless. I wish that was an isolated case, but I've also had another victim out at DEF CON a couple years ago. And for her, she ended up losing her house, losing custody of her kids, lost her relationship with her husband, and... lost her business and she was into over a tune for a million dollars.
Darknet Diaries
141: The Pig Butcher
And when I asked her what kept her in, she said her husband was abusive and she just wanted to feel loved. And that's the reality of many of these crimes is that people don't realize that you have two factors at play here. You have the financial losses and then you have the emotional hurt that goes along with it. And somebody may lose... $90,000, it may mean nothing to them.
Darknet Diaries
141: The Pig Butcher
Or you may have somebody who loses $8,000 and it's the entire world to them. So it really, right now, we're not accounting for the emotional losses on this or the emotional damages for many of the victims.
Darknet Diaries
141: The Pig Butcher
Yeah. So first and foremost, one of the constant patterns I've seen, and this is something I've seen with many victims, I've kind of discussed and researched the topic. Many of them tend to be extremely trusting, where if you were to be walking on the side of the street, this is the type of person who would go and help a homeless person in need.
Darknet Diaries
141: The Pig Butcher
If a dog was hurt on the side of the road, they would go and help them out. And they're some of the most kind of souls you'll ever meet. And because of that trust, the scammers have figured out that they can go manipulate and abuse that person and get them to do things that they want.
Darknet Diaries
141: The Pig Butcher
A lot of what happens is from that control perspective, they will actually, quote unquote, I'm going to use a term that one of the victims used to me, is that they'll essentially hijack their own consciousness and give them a different perspective of reality and a different perception of reality.
Darknet Diaries
141: The Pig Butcher
And what happens is the victims will be manipulated to a point where they will be pulled away from friends, they'll be pulled away from family, and only put all their trust in this one person. And because of that, and because of the kind words that they're saying, the victims will want to go and be with that person.
Darknet Diaries
141: The Pig Butcher
In addition to that, you've also got a case where they will say the right words in the right way. to make the victims want to stay in it even longer. So like I said, it's a matter of working with the emotions and kind of manipulating the people in that way too.
Darknet Diaries
141: The Pig Butcher
Another piece I also noticed is that when it comes to how we as humans process our emotions, so many of us are just disconnected and we don't even know how our emotions work. It's like, we might feel this one way about this one thing, we might feel this one way about another, but we don't realize that we actually pick up emotions from other people.
Darknet Diaries
141: The Pig Butcher
And because of that, it's something where we don't understand how those mechanics work in our own bodies, let alone how we are emotionally manipulated to go and do this thing or influenced to go and do that thing.
Darknet Diaries
141: The Pig Butcher
Yeah, so I'll kind of talk on the geographic of where some of these skill sets are. So for the pig butchering angle, which is mostly out of Southeast Asia, we see scammers who are skilled in setting up websites. They're skilled at working with cryptocurrencies. They understand that they need to influence a person's emotions and play on their emotions.
Darknet Diaries
141: The Pig Butcher
We have some tutorials and documents from the scammers where it's like a 30-page PowerPoint in Chinese that essentially comes down to, here's where you go and tell them this piece. Here's where you influence their emotion here and do this. So they understand that emotional manipulation piece there. For some of you romance scammers in Nigeria, they're a whole different basket.
Darknet Diaries
141: The Pig Butcher
For them, they're sophisticated in money laundering. They know how check systems work. They know how to wire money from a United States bank out to another bank. And they also understand the underlying cryptocurrency networks to go and cash out a gift card or move money over here for Bitcoin.
Darknet Diaries
141: The Pig Butcher
So it's something where depending on the geography of where the scammers are coming from, it really depends on what that skill set is. And that's just two of the top countries that we see. But there's probably four more that I could list off that we see elements of social engineering scams coming out of that, again, go back to that human emotion and kind of those human pieces.
Darknet Diaries
141: The Pig Butcher
Yeah. And the other thing too, because of that safety, we will go and play so much on... trusting the social media providers to be like, okay, this social media provider has a really big name. So that means they have to be safe and I can trust anything that's coming from there. So because of how large many of these providers are, there's inherent trust of using these platforms.
Darknet Diaries
141: The Pig Butcher
And so many victims will go and be like, okay, I'm going to go and trust Facebook for seeing this stuff. Yet, there was an article that came out a couple weeks ago that said, no, 8 out of 10 cybercrime or 8 out of 10 cases of cyber fraud originate on Facebook.
Darknet Diaries
141: The Pig Butcher
So when you see numbers like that, it's something where the scammers are going to use those trusted platforms to try and go after people on that. But no, I agree with you 100% is that it definitely adds a different level of fear
Darknet Diaries
141: The Pig Butcher
to how the scam actually works is because, yeah, it's like that scammer is now in your bedroom with you, and they're now stuck in your head as you're ruminating over all of the ways where they'll be like, okay, does this person love me? Are they trying to build this relationship? What else is going on? And the victims run it through their head over and over again.
Darknet Diaries
141: The Pig Butcher
Yeah, so many of them will be texting back and forth or using WhatsApp to communicate. Like I said, we know that that's how some of them are. And many of them are receiving like Multiple messages per day. The one colleague who was in for $90,000, I'm pretty sure they would have been sending pictures back and forth.
Darknet Diaries
141: The Pig Butcher
Just because again, you're not thinking of it in the case of, okay, this is a victim. You're not trying to think of it as somebody who believes they're in a relationship. So you're going to go and do everything that you can that you believe of that you're in a relationship. I had one victim who was sending pictures of his food to his girlfriend.
Darknet Diaries
141: The Pig Butcher
Yep. So sometimes that is a red flag. However, some scammers have figured ways around that. I know in the concept of like deep fakes and AI, and I know it's a whole buzzword right now, but some scammers are using that technology in order to generate video content. messages back and forth.
Darknet Diaries
141: The Pig Butcher
The other thing too, some of them will also use online video without audio and they'll just be kind of like moving in the camera like, oh, my microphone's not working. Or they'll go and share and have a phone call with them and they won't share video and just say, hey, this part here, my video isn't working.
Darknet Diaries
141: The Pig Butcher
So they know that that's a piece that people use as a metric, but they will go and try and find different ways to bypass that.
Darknet Diaries
141: The Pig Butcher
BEC is a business email compromise. Okay, so let's stop there. Okay, sounds good, sounds good.
Darknet Diaries
141: The Pig Butcher
No. So if you go and look up the history of BEC, business email compromise has been the number one crime seven years in a row, minus last year. But the way most people know it as is if you receive an email that says, Hi, I'm the CEO of your company. I need you to do this urgent wire transfer for me. Can you wire $40,000 out to this account?
Darknet Diaries
141: The Pig Butcher
And that's what most people think of as business email compromise.
Darknet Diaries
141: The Pig Butcher
Right. And phishing is kind of the overarching term for any email-based threat like that.
Darknet Diaries
141: The Pig Butcher
Yeah. So business email compromise, in most of the cases, it does not use malware. It does not employ any of those tactics around trying to install software on the computer. At most, they will do credential phishing where they'll try and harvest the email credentials and email passwords. But for a vast majority of business email compromise, there is no malware tied to that.
Darknet Diaries
141: The Pig Butcher
There's only been a handful of cases that have been publicly documented specific to BEC actors using malware or something like that. But just for the most case, there is just no malware that's tied back to those types of crime.
Darknet Diaries
141: The Pig Butcher
Yep. And that is exactly what it is. So we did a study. What we found was that When you go and think of your Nigerian print scams, your 419 scams, or you have this long lost relative in Nigeria, you go send me this money. What we found was that business email compromise was not some new crime. It was a symptom of ignoring your quote unquote easy 419 scams.
Darknet Diaries
141: The Pig Butcher
And we've had direct confirmation that the scammers behind business email compromise are are the same people who have been doing these Nigerian print scams for years.
Darknet Diaries
141: The Pig Butcher
So very much with what you said, they realize, oh, wait, no, I can go and get $40,000 out of this company as opposed to going to hit this one victim over here. And that's where we see the overlap between the romance scams is that when the...
Darknet Diaries
141: The Pig Butcher
is when they go and send that phishing email to that company, they will use those romance scam victims as the money-muling network to send money for these scams. So the victims will be the ones who will be receiving the money, who then wire it from the United States elsewhere in order to launder it up the chain.
Darknet Diaries
141: The Pig Butcher
They have. They have. Yeah. And it's a combination of honing their skill, yet still keeping the stigma that these things are simple and unsophisticated. And that's the thing is that quote, unquote, simple and unsophisticated crime, again, minus last year, it was number one crime seven years in a row based on financial losses.
Darknet Diaries
141: The Pig Butcher
Business email compromise. So from 2015 to 2021, it was the number one cybercrime based on losses year after year. And the only reason it was not the number one LAT for 2022 was because we had this crime called pig butchering that came up. So the way it was ranked was pig butchering was number one, business email compromise was number two.
Darknet Diaries
141: The Pig Butcher
We've seen cases where they will go and find and use different lead generation services in order to identify the key controllers and the key stakeholders within the company. And when they do that, that's where they get that information on who's the person within the company that they can go ahead and target.
Darknet Diaries
141: The Pig Butcher
And based on something that tells us that we've seen, we know that they'll target the controllers of companies. We know that they will target companies different financial advisors. So they will go and find that recon in order to identify who can I target within the company.
Darknet Diaries
141: The Pig Butcher
Mm-hmm. And we actually did a study where we gave gift cards to the scammers and tracked where they clicked from. Crazy, crazy insights that we were able to gain from that. But it was such a different perspective of what we thought we were going to get. But like I say, it was really fascinating with some of the data we had that came back from that.
Darknet Diaries
141: The Pig Butcher
Another area to look at for a lot of domains is how long has the domain been registered? If it's been registered within like the last month, more than likely it's going to be a phishing email. So looking for the reputation, the age of domain is a very, very important
Darknet Diaries
141: The Pig Butcher
successful way to do stuff because most scammers will go and just like get one month's worth of domain time and then use that for their attack.
Darknet Diaries
141: The Pig Butcher
Yeah. And just from the way BEC is, so many of these emails still get through. There's a reason it's been the number one crime 70 years in a row. So many email gateways are trying to put protections. And a lot of information security focuses on the malware, the APTs, the blinky boxes. And this stuff still gets passed because there's no malware. There's no malicious URLs or content in there.
Darknet Diaries
141: The Pig Butcher
It's manipulating the humans. So many of these attacks just bypass your email gateways. with a lot of your BEC actors from an attribution perspective. This ties back to groups such as like Black Axe, where they will go and use those type of manipulation in order to gain that foothold. Wait, so what's Black Axe? So Black Axe is one of the larger Nigerian con fraternities that dabble in this.
Darknet Diaries
141: The Pig Butcher
So if you're unfamiliar with the term confraternity, think of a college fraternity here in the States, but mixed with black magic and voodoo. And what I mean by that is some of the hazing rituals for black acts include a human sacrifice or trying to use those type of techniques in order to, quote unquote, gain extra powers to become a better scammer. What?
Darknet Diaries
141: The Pig Butcher
Hey, hey, trust me, trust me. Yeah, no, I'm dead serious on it. No, it's not like I went off into Cyberland, but no, no. But no, Black Axe is one of the larger groups who's doing a lot of the business email compromise activity.
Darknet Diaries
141: The Pig Butcher
And specific to the human sacrifice, the way that that plays out, is for your Nigerian scammer, they are called a Yahoo boy. So in order to become a better scammer, a Yahoo boy plus, there is a human sacrifice ritual where you have to kill somebody to gain better powers to go and continue this type of scamming.
Darknet Diaries
141: The Pig Butcher
And like I said, sounds far out there, but it's widely documented that this is unfortunately one of those cases and that's why I get so bitter towards ransomware is that people are like, oh, somebody might die here, over here. Somebody might die over here because of this ransomware attack. I'm like, no, we have people literally sacrificing each other because of this stuff.
Darknet Diaries
141: The Pig Butcher
And like, that's where the problems are on some of these cases.
Darknet Diaries
141: The Pig Butcher
Okay, yeah, yeah. So this was a Black Axe case they had down in South Africa. And like I mentioned earlier, I do a lot of work backing forth with law enforcement, so I get to hear a lot of the good stories as a result of this. But they were doing the case. They went down to go and arrest the individuals. And they were kind of at this compound down in South Africa.
Darknet Diaries
141: The Pig Butcher
And they were able to get into most of the houses and most of the buildings. And there was one window in the back that they couldn't get into. So they were able to bust it down, got in there. And in that building, what they found was they found a pile of money covered with blood and dead chickens.
Darknet Diaries
141: The Pig Butcher
So as they came out and unlocked the door to get in there, they kind of got talking to the people that they were addressing. And they were like, what's this? Because you don't really expect to find that on a law enforcement engagement. So what the scammers had said was, well, it turns out that the magic here in South Africa is not as strong as the juju in Nigeria.
Darknet Diaries
141: The Pig Butcher
So we need a larger pile of money. And that's one of the things that most people don't realize is that there is a spiritual aspect that plays on this that many of the scammers believed. And when you account for that and you account for a lot of the way that they perceive a lot of that stuff, it gets really, really interesting.
Darknet Diaries
141: The Pig Butcher
And because of, again, that spiritual aspect, it's like I said, there's so many other things that the scammers are kind of playing with and using or believe that they don't fully understand, like, well, they're playing with, in my opinion.
Darknet Diaries
141: The Pig Butcher
Yeah, yeah. I'm the kind of guy who's at a dinner table. I was like, hey, let's talk about blood sacrifices and voodoo.
Darknet Diaries
141: The Pig Butcher
Yeah. Scattered Canary was a mostly Nigerian cyber fraud group that we found back in 2018 that was engaging in business email compromise. The reason we named them Scattered Canary was because one, they were very scattered in their targeting. And two, they were kind of our canary in the coal mine that let us identify a lot of things around 419 scams and business email compromise.
Darknet Diaries
141: The Pig Butcher
One of the things that happened during the pandemic was was unemployment money was given out fairly easily. And whenever one of these programs happened, the scammers are quick to jump on that. And they quickly jumped on that bandwagon for a lot of the unemployment funds. What Scattered Canary did... was they used different email accounts or email accounts that had the Google.bug in them.
Darknet Diaries
141: The Pig Butcher
And they went and hit the unemployment fraud systems. And at the peak, we saw them hitting 14 different states. For unemployment fraud in general, where that stands, we are upwards of around $400 billion that's been stolen as a result of some of these things. And there's some new information coming out from about ID.me and how some of the stolen money may not have been fully articulated.
Darknet Diaries
141: The Pig Butcher
But what we know of right now is that $100 billion was confirmed from Secret Service. We know that $400 billion is up in question for the money that was taken.
Darknet Diaries
141: The Pig Butcher
Billion with a billion with a B. Yeah. Yeah. And that's kind of where the lines get muddy between business email compromises because we know that Scouter Canary, again, who was doing business email compromise, we know they were doing romance scams. We know they were doing unemployment fraud. And that's kind of why I say BEC is the number one crime that's out there because...
Darknet Diaries
141: The Pig Butcher
That's over $500 billion that we know are tied back to business email compromise scammers who are doing this. And we know other scammers were involved in that too. But no, it's, yeah, it was $100 billion that was confirmed from Secret Service. There's a possible, it's a possible $400 billion that is up for discretion and kind of being pushed through for Congress.
Darknet Diaries
141: The Pig Butcher
But that's what it looks like the new number is going to lay at is about $400 billion that has been confirmed.
Darknet Diaries
141: The Pig Butcher
Treasury has lost. Not only is that a lot of money that the U.S. Treasury lost, that's a lot of money that came out of... Are you an American citizen?
Darknet Diaries
141: The Pig Butcher
Okay. So that's a lot of money that came out of mining your pocket. In addition to that, scammers, what it looks like is it may have been upwards of about $400 billion. So... And the other kicker here too is that fraud is still happening. Two of my intelligence sources out in Nigeria, within the last two weeks, they're still stealing money from the government. The average salary for a Nigerian
Darknet Diaries
141: The Pig Butcher
is 100 U.S. dollars per month. So when you go and you have that much money coming in, it becomes very enticing for your youth out there to want to go and try and do this fraud.
Darknet Diaries
141: The Pig Butcher
Yeah, so hearing that story, I've heard it a thousand times over.
Darknet Diaries
141: The Pig Butcher
Welcome to the last seven years of my life. Because it's something where it's very disheartening. And like I said, staring at this stuff for so long, it's something where it's like, it is very disheartening because you do feel defeated. You do feel like, okay, we've literally lost $500 billion. And that's just what we know.
Darknet Diaries
141: The Pig Butcher
Oh, yeah, yeah. So my name is Ronnie Tokazowski. I've been fighting business email compromise for the last eight years now. So my role in this is I work behind the scenes with a lot of people who are working with romance scam victims. I do a lot of work with Secret Service, FBI. I also work back and forth with victims too.
Darknet Diaries
141: The Pig Butcher
If we were to actually piece together what we knew, I'm just going to throw this out there. We're easily over a trillion dollars that we lost here. And a lot of what it comes down to is, admitting that there was a problem, admitting that something needs to be fixed, admitting that something needs to give.
Darknet Diaries
141: The Pig Butcher
Because if you keep having this much money that's going out and you don't admit that it's a problem, like you're just going to be stuck. And when you go and look at the 20, 25 years of Nigerian print scams, this is the whole reason that we're here right now is because no one wanted to admit that, no, this is actually something that's happening.
Darknet Diaries
141: The Pig Butcher
Yes, there were people who were actually being socially engineered into this. We have to work with those people in order to identify some of that. Trust me, I totally resonate with you. I totally feel you when you feel defeat on that because a lot of times I do too.
Darknet Diaries
141: The Pig Butcher
But knowing that I'm on the right side of this, knowing that I'm helping victims, knowing I'm helping them recover their money, and knowing that I'm helping reshape a lot of the way that the industry thinks about themselves, that's what keeps me fighting this stuff every day.
Darknet Diaries
141: The Pig Butcher
Because a lot of what happens is the scammers will go to different dating websites. They will go and... Find people in order to date. They will move the discussions off of the platform just because most of the platforms cost. But they'll move it to WhatsApp. And then from there, they'll start grooming the person. They'll say loving things.
Darknet Diaries
141: The Pig Butcher
We've had pick cases where some of the victims might send nude pictures over to their lover. And once they go and are exchanging those sweet nothings, the scammers directly build that relationship, build those emotions.
Darknet Diaries
141: The Pig Butcher
Yeah. So the term pig butchering comes from a Chinese phrase called Xia Zhupan, which is essentially a broiled... I think it's broiled meat. I forget the exact translation. But what the concept is, is the scammers will go and try and fatten the pig, if you will. So what they will do is extract as much money as they can out of a victim.
Darknet Diaries
141: The Pig Butcher
And where the pig butchering comes in is that once the scammers get to a point where they feel like they can't get any more money out of the victim, they will take the pig in for slaughter or slaughter the pig. And what they mean by that is actually pulling the rug out from under the victims and like walking away and essentially be like, I got all the money that we could.
Darknet Diaries
141: The Pig Butcher
Him and his girlfriend, they were dating for several years. Like, they've been together for as long as I've known. It's probably about eight years now that they've been together. So they were engaged to be married. They had a house together. And unfortunately, things happened and that relationship kind of flopped. So they went their separate ways. He lost the house.
Darknet Diaries
141: The Pig Butcher
And unfortunately, it wasn't really a good circumstance. breakups are hard.
Darknet Diaries
141: The Pig Butcher
So he went to go online and go date somebody. So he went onto a dating platform, found this really pretty French girl who was very involved with him and very kind of attached to him. So the two of them really hit it off. And at some point she popped the question to say, hey, I'm also doing a lot of crypto investments. Is that something that you'd be interested in?
Darknet Diaries
141: The Pig Butcher
Being in the field, he knew a good bit of crypto. He's naturally a very skeptical person. So he did his research on a lot of the way that they present the money. So he went, they provided links and information for him to check once he went and submitted his money.
Darknet Diaries
141: The Pig Butcher
And the way that the application was presented to him was, and this is his perspective, I'm still trying to get the full scope here, but there was actually a browser that they could use within crypto.com that will have it show up that actually looks like the application. And looking at some of the screenshots, it looks like it was right within the crypto.com application.
Darknet Diaries
141: The Pig Butcher
And because of that, when your user goes and clicks that stuff, it appears to be 100% legitimate.
Darknet Diaries
141: The Pig Butcher
In addition to putting his own money in there, because of the high returns that were being shown, he also went and had gotten a loan. So he actually used a loan to go and put more money into it because, again, if you can use that loan to go and get more money, who wouldn't do that? So that's another common thing we see with a lot of people is they'll go take loans out from a financial institution.
Darknet Diaries
141: The Pig Butcher
They'll take a second mortgage out on their homes in order to go and get more money based on those investments.
Darknet Diaries
141: The Pig Butcher
And it was very exciting. From there, the scammers were able to successfully collect about $90,000 out of him.
Darknet Diaries
141: The Pig Butcher
What he did was he used the exact same emotional manipulation tactics against the scammers. And what he did was he was like, hey, I'm going to go ahead and invest more, but I need to pull this little bit of money out in order to help with this loan. So if you can let me pull some of my money out or wire it over here, I'll go ahead and do that.
Darknet Diaries
141: The Pig Butcher
So he was able to get $10,000 of his back by, again, deploying those same tactics against the scammers. And he was able to build up enough trust with them to where he's able to get that money back.