CyberWire Daily - The changing face of fraud. [CISO Perspectives]

Episode Date: November 11, 2025

Fraud has always been a consistent challenge. As the world has continued to become increasingly interconnected and as new technologies have become widely available, threat actors have continued to evolve their tactics. In this episode of CISO Perspectives, host ⁠Kim Jones⁠ sits down with Mel Lanning from the Better Business Bureau to discuss fraud and how it has been evolving in recent years. From exploiting cryptocurrencies to utilizing emerging technologies, Kim and Mel look into how threat actors are changing and refining tactics in the current threat landscape. This episode of N2K Pro's CISO Perspectives podcast is brought to you by our sponsor, Meter. Meter provides a full-stack, enterprise-grade networking solution—wired, wireless, and cellular—designed, deployed, and managed end-to-end. From hardware to software, ISP to security, Meter delivers seamless, secure, and scalable connectivity for modern business environments. Learn more about ⁠Meter⁠. Want more CISO Perspectives? Check out a companion ⁠⁠blog post⁠⁠ by our very own Ethan Cook, where he breaks down key insights, shares behind-the-scenes context, and highlights research that complements this episode. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyberwire Network, powered by N2K. This exclusive N2K Pro subscriber-only episode of CISO Perspectives has been unlocked for all Cyberwire listeners through the generous support of Meter, building full-stack zero-trust networks from the ground up. Trusted by security and network leaders everywhere, meter delivers fast, secure by digital. design and scalable connectivity without the frustration, friction, complexity, and cost of managing an endless proliferation of vendors and tools. Meter gives your enterprise a complete networking stack, secure wired, wireless, and cellular in one integrated solution built for performance, resilience, and scale. Go to meter.com slash CISOP today to learn more and book your demo. That's M-E-T-E-R.com slash C-I-S-O-P.

I am, by nature, a sheepdog in the way that Dave Grossman defined the term in his essay. I have an overly developed sense of justice and a need to keep bad things from happening to good people. This is why I soldiered for many years when they were lucrative opportunities, to do other things, and why I chose cybersecurity when I hung up my Army Greens. So when a friend asked me several years ago why security professionals do what they do, I told her what has since become known as my single mom at Walmart story. Picture a single mom shopping at Walmart.

She is staying just above the poverty line simply through hard work, determination, and personal resolve. Her kids don't wear new clothes, but they are always neat, clean. Their bellies are never empty, if only through the three jobs she works. It's shopping day. She's clipped her coupons throughout the week and is trying to get her shopping done before she starts her third shift. The kids are tired but well behaved. Her card is full. She goes up to the checkout counter and swipes her card and the transaction is declined. She knows there should be money in her account, but discovers to her horror that my systems have been had. And because of that, someone has stolen her data and stolen all of her money. Regardless of why you got into security,

preventing fraud and its impacts on our constituents weighs heavily on us all. Despite our best efforts, the impacts of fraud and consumer scams continue to rise. According to the Federal Trade Commission's 2025 data book, consumers reported, losing more than 12.5 billion, with a B, to fraud in 2024, which represents a 25% increase over the prior year. This number is not driven by an increase in fraud reports, which remains stable. Instead, the percentage of people who reported losing money to a fraud or scam increased by double digits. Fraud losses impact the bottom line of corporations and can undermine consumer trust in organizations.

As individuals, we continue to feed the beast that we call the data-different economy, often at the encouragement or even requirement of business entities. Everyone, whether consumers or cyber professionals, need to realize that the increased potential for fraud or scams should that data become exposed to bad actors. This threat is only exacerbated by the increased processing and analytic power, represented by generative AI systems. CISOs must continue to learn how fraud can be limited via more innovative and accurate methods of establishing consumer identity,

all without creating friction in the consumer experience. My two cents. Welcome back to the... to see-so perspectives. I'm Kim Jones, and I'm thrilled that you're here for this season's journey. Throughout this season, we will be exploring some of the most pressing problems facing our industry today and discussing with experts how we can better address them. Today, we are looking at fraud and how this long-standing problem has continued to evolve in recent years, and how new technologies are primed to exacerbate this problem.

Let's get into it. Mel Lannning has been a crusader in the nonprofit sector for over two decades. As executive director of the BBB Institute for Marketplace Trust, Mel has directed her passion at helping consumers and small businesses recognize, combat, and recover from fraud and scams. I sat down with Mel to discuss the trends that she is seeing in the fraud space, and the impact. of those trends. Thank you. No, before we get started, I just want to say that the views and opinions I expressed today are my own and do not necessarily reflect the opinion of the BDB Institute, the International Association of Better Business Bureaus, or independently owned and operated

better business bureaus. Fantastic. This will make sure you stay employed, which is a good day. So let's take this back to, I like to bring things back to bare concept and then build from there to make certain that when we all use terms that we know what we're talking about, what we're not talking about. So you are an expert compared to me, most of the people on the, on who we'll be listening and definitely compared to me. But in layman's terms, what's fraud? Yeah, it's a great question. And actually, technically, fraud and scams, which is what I focus on mostly are scams, are a little, can be defined differently by depending on who you speak to. So when I talk about scams, what I mean by that is somebody who is a criminal who is doing some sort of scheme to steal your money or your identity. or whatnot.

And so they may pretend to be somebody else. There may be all kinds of different tactics that they use, but they will convince you to take action to pay them money. And then there's fraud, which is very similar. And the difference with fraud is that oftentimes it's somebody taking money out of your account where you haven't actually giving them permission to do that. That's interesting. That's interesting.

So fraud would require access to my monetary instruments, if you will, my checking account like Freda card, et cetera, that I am not giving them that they are using to extract my money, et cetera, whereas a scam is convincing me to part with my money. That's correct. I know the institution you work for in where. what is designed to do. Talk to our listeners about what the Institute for Marketplace Trust does and who it represents within the community. Let's do a little education about that first, please. Yes, so the BDB Institute for Marketplace Trust is the 501C3 educational foundation

of the International Association of BDBs. And so we are a nonprofit organization. So is the Better Business Bureau, by the way. It's a C6. and has the same mission that we do, which is to foster marketplace trust. But the Institute does a lot of charitable work, and particularly the biggest part of our portfolio is around scam prevention and educating people on how to protect themselves, creating tools to help them protect themselves, and so forth. And so we have programs that are delivered by our network of BBBs, as many of you know, there are better business bureaus in all of your communities.

And so we work at the national level to create programs and resources that are then distributed by local BBs and their local communities. Is the target for your education individuals or is it small businesses? Is it both? It's both for sure. Or are you seeing then the bulk of interest in the services that you provide? Are you seeing small businesses begin to rise to the occasion and recognize that. but they themselves are becoming bigger targets?

Or are you seeing individuals, or is that something you track? So we get the bulk of our reports to our platforms. So just another note, we have a platform called B&B scam tracker, and people are allowed to come in and report scams. And they can also actually search to find out if they're being targeted because we publish scam reports. So we do a lot of research around that. And so when you ask about data, that's where I'm referring,

as I'm going into looking at our research, And the bulk of our reports for scams come from individuals, for sure. And we are trying to, one of the focuses for us is to get out and understand a little bit better of what's happening because small businesses are definitely being targeted as well. I'm not sure they're reporting it as often as individuals are. And so it's a matter of self-reporting, right, can be a problem. It depends on who's reporting and that's what you know. And so that's the other thing. When we look at what the full impact of scams are,

it's hard to understand because we only know what's being reported. And we know there's a lot of people that never report the scams when they're targeted. Based upon what you're seeing, is there any trend in terms of the types of scams that are being perpetrated? And what are the top, and again, I don't need you to go back into burying you through the data now, just top of head, what are the top two or three scams that seem to be perpetrated here? And the follow-on to that, has there been any change in terms of those top two or three in the past X number of years? Definitely. So we publish every year what's called the BB scam tracker risk report.

And it's essentially a full data year-over-year comparing what's happening with scams targeting both individuals and small businesses. and it actually has a list of what we call the riskiest scams. And so that's how we differentiate what's having the biggest impact on people. So it's not just what's the volume of a specific, what's the most common. It's which scams are actually having the biggest impact on the public. So what are you seeing? Yeah. And the way that we decide that is there's three things we're looking at.

We're looking at, yes, the volume in a specific scam type. So, for example, online purchase scams. Those are those scams where you go online, you buy something, at a fake website and it never arise. So you're out the money that you spent. About 30% of what we get are online shopping scams. So that has the most volume or exposure, if you will. The second thing we look at is susceptibility, and that's the percentage of people who say they lost money when they're targeted by that specific scam type. So with online shopping scams, it's pretty high. It's like 80-some percent typically report. If they ran into that website, they actually went ahead

and they paid and they lost their money. So it's pretty high. And then the third factor is median dollar loss. And that is on average, how much do people lose when they did lose money to this scam type? And so for online shopping scams falling up on that, it's pretty low. It's like $100. You know, so it's the impact overall, over the last few years since the pandemic, that was one of our riskiest scams, just because it was hitting so many people and such a high percentage of people were losing money to them.

But the overall loss is pretty low. It's not going to change your life. It's a volume-based attack. It's not trying to steal $100,000 from you. It's trying to steal $100 from 10,000 people. Exactly, exactly. But however, the thing that you're asking about the change we've seen over the last few years, Kim, and that dropped to number four this year.

Really? Yeah. So while it's the most prevalent of the scam types we track, The impact is still the same, but the reason it dropped is because the scams that landed in the top three spots are just having a huge impact on people right now. And they are? Yeah. Long story short. The riskiest scam this year is investment slash cryptocurrency scams.

And that was also riskiest last year. So this is the second year in a row. We've seen that happen. And what happens there is that's a combination of. a scammer basically promising to get you, make you money at very little risk to no risk, which we know is not something that's true. There's no investment opportunity that comes with zero risk. So it ranges from all kinds of different opportunities.

They offer you. They take your money and they're going to make money for you. The cryptocurrency we've sort of connected it that was collected as a separate scam type, but we found that over the last few years that most of the investment, scams are crypto now. So a lot of what's happening is people are promising to help you make money in crypto. What they're doing is they're encouraging people to go onto fake platforms and put their money in. What happens is the money appears to be growing and people get very, very excited and then they

start taking loans out. They start, you know, basically investing those savings into it because they think I can actually retire early. I'm making all this money on it. not realizing that they're about to lose their life savings. So let me, I'm going to take us a little bit off of that tree branch, just a little. I want to come back to talk about what the top two are because I think it's important. Are we seeing a prevalence error, an uptake in crypto scams?

And again, I understand these are all opinions. I understand that opinions may not be fully supported by the data, but you have more data and looking at this closer than we are right now. We've become to see, at least here in the States, a normalization, if you will, of crypto, if not an encouragement around crypto, given the changes in the regulatory framework and the encouragement from the executive branch of government here. Do we, and maybe the timing will help with this, could this be a contributor? Do you think this is a contributor? Does the timing of this uptick indicate it might be a contributor, or am I drawing false inferences, which I very well may be? What do you think?

I'm not sure. I think so for our data, I would tell you there are more of them, but I don't think that's the reason it landed number one. It isn't because of the prevalence. It's because of the massive amount of money people are losing when they do. That's the reason that's, and the other ones on our top three, similar. And the other thing I would say on this is crypto is, there's legitimate cryptocurrency platforms, right? The issue is this is brand new still. There's not as much regulation around it.

And anytime that's the situation, scammers are going to come and take advantage of that, right? They're going to try to take advantage of the news. They're trying to take advantage of new technologies, particularly around areas where people may not fully understand how it works. and basically become impersonators to pretend like they know what they're doing and offer up this great opportunity for you. Have you ever seen, have you ever imagined how you'd redesign and secure your network infrastructure if you could start from scratch? What if you could build the hardware,

firmware, and software with a vision of frictionless integration, resilience, and scalability? What if you could turn complexity into simplicity? Forget about constant patching, streamline the number of vendors you use, reduce those ever-expanding costs, and instead spend your time focusing on helping your business and customers thrive.

Meet Meter, the company building full stack zero trust networks from the ground up with security at the core, at the edge, and everywhere in between. Meter designs, deploys, and manages everything in enterprise needs for fast, reliable, and secure connectivity. They eliminate the hidden costs and maintenance burdens, patching risks, and reduce the inefficiencies of traditional infrastructure. From From wired, wireless, and cellular to routing, switching, firewalls, DNS security, and VPN, every layer is integrated, segmented, and continuously protected through a single unified platform. And because Meter provides networking as a service, enterprises avoid heavy capital expenses and unpredictable upgrade cycles. Meter even buys back your old infrastructure to make switching that much easier.

Go to meter.com slash C-I-S-O-P today to learn more about the future of secure networking and book your demo. That's M-E-T-E-R dot com slash C-I-S-O-P. Rinse takes your laundry and hand delivers it to your door, expertly cleaned and folded, so you could take the time once spent folding and sorting and waiting to finally pursue a whole new version of you. Like tea time you. Or this tea time you. Or even this tea time you. Said you hear about Dave?

Or even tea time, tea time, tea time you. So update on Dave. It's up to you. We'll take the laundry. Rinse. It's time to be great. So the second riskiest are employment scams. And these are hitting young people particularly,

Although they're hitting all age groups, but it's number one riskiest for the younger age groups that we track. And what happens in this typically is somebody is looking for work and they have an online interview with a really great potential. It's a job offered that often is remote work. It's great pay. You know, it's low skills like anyone could do it kind of thing. And so what happens is they get hired and they start work in the traditional. way that this has been perpetrated is the new employer basically will say, we are going to send you a check in the mail for office equipment or training or whatever it is that's needed.

And as soon as it gets to the person, it comes FedEx, they make it look very official. That person is told to put it in their bank account. And then very quickly, they're told, transfer that to this other account. And that's the account that will be sending you your office equipment or setting you up for your training and whatever it is. And one of the key things about this that I think is interesting is that young people, I know I have teenagers who don't really know how checks work. They don't know that when you deposit it in the bank, that even though it's in your account,

it hasn't cleared the other bank yet and it might not be good and it may come back out of your account. And so what's happening is folks are transferring their own real funds before realizing that the bank. Before the check clears, so the check itself is kited. Yes. You send me a check for $1,000 that doesn't have anything backing yet. I transfer you $1,000 out of my account that really exists.

So that's now when your account is gone forever. And the check you sent me bounces in there, I disappear as well. Yes. Okay. The other interesting thing about this, though, is that one thing about scammers is they change their tax. tactics constantly, right? They're just figuring out, like I said, they're using anything new that works. So one of the newer employment scams that we're seeing is now people are being hired to do online marketing where they go to a website and they're just checking things off

and whatever and they're getting paid in crypto. And now, so it's the same, it sort of takes you, it's just a different way to onboard you into the same scam where you end up on these platforms and they're paying you in crypto and you start to see the money and then you're putting your own money in. So you hire me to go review things online or what have you. You agree to pay me in crypto.

So you pay me in crypto within the environment and I'm being asked to what transfer real money out instead to a business account? Is that what's happening? Or what's happening? Yeah, what's happening is people start to see the money grow. And so they're like, wow, I have my own crypto account

they're paying me and look at how quick it's growing. And so they get excited to put their own money in to sort of start to make it. It's an investment scam, and it turns into that eventually. So we've got crypto scams. We have employment scams. We have a combination of employment scams using crypto. What's the third? The third also can involve crypto as well.

The third are romance slash friendship scams. And you probably have all. heard of these romance scams that have been going on talk us through it anyway yeah so typically traditionally what's happened is these are folks who reach out um and fill a gap in somebody's life you know it's it's somebody who and and the reason we changed the name is it used to just be romance scam it's now romance slash friendship scam because it doesn't always have to be a romantic encounter it could be you just met your best friend you know and this is this is somebody who's there for you ways. And so these are really relationship scams. And they can start in a variety of different ways.

A lot of times they start with a random text that's intentionally very big, but it sounds like they know you. So it might be, hey, are you bringing the plates tonight or something really? And so the person being nice is that you have the wrong thing, which is gives the opportunity for the scam or to start a conversation with the person. And before you know it, you've started a conversation with this pursing and it develops, it develops into something. It can also happen with a direct message on a social media platform. It can happen on a dating website. It can happen on all kinds of social media where they just, they connect with you and start a conversation. And what happens with a lot of folks is, and this can particularly happen if somebody's going through a major life change,

they've lost their spouse, they've been through a divorce, you know, they're lonely in some way. And this person suddenly is their best friend and they're always there. I've talked to victims who say later, even after they realize it was a scam, how much they missed that person. And this person was the only one that was there for them whenever they needed them. They were always there. And so their relationship scams, and I say that because in some cases, we find out later that this person texted throughout the day for weeks and months on end to build this relationship. So the idea is to build trust with this person and eventually if it's been gone on for much you almost this person this is like your best friend it's no longer this person you met online it's this is one of my best friends and then it turns

into something else where it traditionally it would be you know somebody was overseas and they're stuck in jail and they need you to send money or they're stuck in customs and they need you to send so there's always a reason an urgent reason I'll pay you back but I need to send me money That's the traditional romance scam. It's evolved into the cryptocurrency scams. What we call, unfortunately, the term law enforcement has used is pig butchering. As I understand that term, please correct me if I am wrong. It amounts to continuing to take different, as when you butcher a pig or butcher any animal,

continue to take different slices of meat and find different ways. to actually utilize as many parts of the pig as you can. And in this case, it's the same thing, finding different ways to extract money from your target. Am I reading that correctly? Is that your understanding? Yeah, I think. If not, please.

Yeah, I mean, I have had it described of just fattening up the pig for slaughter. So you get them to put more and more money in over time until it's time to finally, like, steal the money. So in all three of your, and I'm going to push a little bit, and I understand that I'm pushing for opinion and I understand that this opinion may not be supported by the data. But in all three of these scams, we're seeing crypto variants of this within the environment. First question is, are you seeing an increase in volume of reporting, you know, in recent years? Of reporting specific scam types or just in general?

in general? I mean, I definitely think we've seen an increase in crypto scams in general. Like I said, the reason it's on our list is because of the impact and the amount of money people are losing. But I definitely am hearing it more over the last five years for sure. I think the exposure is still fairly low for straight up crypto investment scams compared to other things like online shopping. But they have definitely gone up over the years.

So I guess the next question that I would ask is we've talked about that for individuals as well. Talk to me about what you're seeing in small business. Same priorities within small business, same types of scams, targeting different order in terms of priority against small business. Talk to me. Yeah. So for small business, we're seeing things like fishing and social engineering. You know, that's a big one for small businesses, trying to get employees to click a link and, you know, put ransomware or malware, and then business email compromises another

one that's significant. And that's where somebody pretends to be your boss and, you know, send you a tax to say, I'm in a meeting and I can't talk right now. And I need you to wire this money to this account right away. I've got to ask, what are we doing wrong so I could tell the younger CSOs that are out there listening to this, please be better than I am, because clearly I didn't get it right. What do we need to do differently or better? I think, see, I can speak for a small business, I guess, more than I can speak to anything

else. And I think for that audience, I think it's just this need for constant training for everyone. And, you know, I think tactics change constantly, even though fishing and, you know, BECs are still around. they're just, I think you just have to remind staff constantly that this is an issue. And I, even for my job, I'm constantly in trainings to remind myself. Because I think from the social engineering aspect of things, there's all these things you can do on the cyber end to try to do your multi-factor authentication and all this. But they're focused, I think a lot of scammers are focused on the personal aspect, the human aspect, and trying to get to your,

your employees. And that's why I say I think one of the big things is just it isn't a once and done kind of training with your employees. That's the other thing. So number one, make sure any new employees are constantly updated and they're thinking about this stuff all the time. And then just have regular trainings. You know, it's got to be something that you talk about quite a bit, especially for small businesses that don't have the resources that big companies might. Let's talk a little bit regarding expectations. management out in the environment. I remain of the opinion, and again, I know this is a little bit outside your wheelhouse,

that there's an expectation of perfection regarding stopping bad guys within cybersecurity. If we were doing our jobs right on my end of the fence, fishing would never happen. Scambers would never succeed, et cetera. And I try and remind people that there's been law enforcement. around for hundreds if not thousands of years in one form or fashion, your crime has not been eradicated. So is this a case of we need to expect that scammers were, a scammer's going to scam and people are going to be hit and we probably need a different metric in terms of how we measure whether or not we are being successful or not. Am I being unrealistic or does that make sense

to you and talk to me? I think it makes sense. I think those of us who are in this field and talk about scams all the time, it's really frustrating because it just continues to evolve and scammers evolve. And we evolve with it. So I think to your point, we've made a lot of, you know, a lot of changes and we've done a lot of good to try to protect people. It's just that it's we're advancing at the same level with these scammers, right? So they're using the technology to scam people.

And I guess my hope is that we can use AI to stop scammers. I'm hopeful that there's a way, and I don't know what that is, to sort of use AI to sort of detect in real time scams and try to help more. The one thing I am seeing in the work that I'm doing is you can't pin this on one organization or one segment of society, right? This is, if we're going to solve this problem, we have to work with government agencies and businesses and big companies and nonprofit organizations. We all have to be working together to figure this out. Okay.

So let me push you for specificity, if possible. You are now a supreme ruler and empress of the world for a day. So you now have an opportunity to fix or solve this problem. What are the top three things that you would be doing or arm twisting? encouraging, conjoling, et cetera, the world to do to help make it harder on the bad guys? I don't know if I have three, but I would say that the top thing for me, I think, and there's work being done through the Aspen Institute with about 80 different organizations, including ours, to figure this out.

And it includes companies, it includes nonprofits, it includes government agencies. And the number one thing in the United States that they're looking at is a national fraud strategy that is driven by the government because other countries are ahead of us in a lot of respects in terms of taking taking this issue on. And so that's one thing I would love to see happen is there be, and the thing is I think what gets confusing is, yes, there are a lot of government agencies dealing with scams. And I could name off about 10 of them. The problem is, I think that they're all kind of out there on their own doing it. I think there needs to be a unified strategy where you bring everyone together to figure this out.

And I think that would, that's the hope from this work that's being done right now. And this fall, I know they're going to be coming out with their recommendations for that. Fantastic. If there's one thing you would want my audience to know and these listeners to know that we haven't talked about, what would that be? Can I give a two? Two things? Of course. Sure.

If you get targeted by a scam, please report it. That information is critically important to us, to everybody that's doing this. If we don't know what's happening, we can't warn people. We can't try to stop the scam in the future. And then the other one is just to think about people who have been through this. If you know someone who has been scammed, think about how you react to them, because there's a lot of shame for victims of financial fraud, and it's different than other crimes. we talk about it differently, we treat them differently, and it's something that can be incredibly

embarrassing, but we know that these scammers are professional criminals, so we have to put the blame on the criminal and not on the person and not make them feel worse. So that's the other thing I would just say for anyone out there that knows somebody who's been through one of these scams is to step back and think about how you handle it and how you help them. It was fantastic, and we will leave it there. conclude, though, one question. Can anybody get access to the reports, et cetera, that your institute puts out? Yes, they're all free on our website. If you go to BVB MarketplaceTrust.org,

there's a whole section on research and all of our reports are available for free. Also go to BVBscamtrakker.org if you want to report scams or you want to search to find scams that have been published, that's another thing if we could put it in a blog because we estimate that we were able to help people avoid losing about $43 million last year alone by using skim checker. We'll make sure that both those links end up in the blog. So as always, this was educational. You are always a joy to talk to and let's not make it six months until we talk again. Thank you so much for giving us your time and your energy and your knowledge. We'd really appreciate it. Thanks, Kim.

And that's a wrap for today's episode. Thanks so much for tuning in and for your support as N2K Pro subscribers. Your continued support enables us to keep making shows like this one, and we couldn't do it without you. If you enjoyed today's conversation and are interested in learning more, please visit the CISO Perspectives page to read our accompanying blog post, which provides you with additional resources and analysis on today's topic. There's a link in the show notes.

This episode was edited by Ethan Cook, with content strategy provided by Myon Plout, produced by Liz Stokes, executive produced by Jennifer Iben, and mixing sound design and original music by Elliot Peltzman. I'm Kim Jones. See you next episode. Securing and managing enterprise networks shouldn't mean juggling

vendors, patching hardware, or managing endless complexity. meter builds full-stack zero-trust networks from the ground up, secure by design, and automatically kept up to date. Every layer from wired and wireless to firewalls, DNS security, and VPN is integrated, segmented, and continuously protected through one unified platform. With meter security is built in, not bolted on. Learn more and book your demo at meter.com slash CISOP. That's M-E-T-E-R.com slash C-I-S-O-P.

And we thank Meeter for their support in unlocking this N2K-Pro episode for all Cyberwire listeners.