Jono, Ben & Megan - The Podcast - Megan Accidentally Hacked The Hackers | Itty Bitty Bit

Episode Date: September 9, 2026

After scammers targeted Megan Papas' credit card, they quickly discovered there wasn't much left to steal. Plus, Sean Lyons from Netsafe explains the simple thing every Kiwi should do before reacting to a scam.   Join the Itty Bitty Hitty Committee HERE!Instagram:  @THEHITSBREAKFASTFacebook: The Hits Breakfast with Jono, Ben & Megan See omnystudio.com/listener for privacy information.

Megan, you had a crazy morning yesterday. Yeah. We weren't really talking about it on the radio. It was all happening off here. I know. It was a little bit scary at the moment. So yesterday I was getting text messages incessantly while we were doing the show.

And they were from my bank. And they were, I don't know if anyone else gets this, but when I do transactions, especially big ones, you get like two-factor notification. So they sent me a code and they were like, there's a transaction for 600. $148, here's the code to make it go through. It's a good thing they've got that, eh?

Yeah. It's a terrible thing when you're trying to log into the work, Microsoft's program, the old two-step. But for financial purposes, it's great. You're right. Yeah. So I text, because we have a rule, like, don't spend over $200 without mentioning it to each other.

And it was 600. And I was like, um. How many times you've broken that rule out of interest? Well, I have a little hack for that. Yeah. Well, don't tell on the radio. No. No.

So I was like, wait, what are you spending $650 on? And he was like, that is not me. So this is your husband, Andrew. He's like, I'm not doing anything. He's like, I don't need a code. That's not me. I'm at the gym. And I was like, oh, what?

And then as I was texting him, another one came through for $470. And I was like, oh, this is not good. And so they kept coming through. But like lower and lower denominations, I got the next month for 300 and something. And so I was like, you need to call. now and like figure out what's going on because someone's trying to get some money. So he calls the number on the text. Oh, so you guys share the credit card and you're both getting these messages.

No, I'm getting the messages, but I sent him screenshots. I see. So he calls the number on the text and it was like, if you have an issue, call this number. And that's when I suddenly thought, I'm going to check that this number's real. And it doesn't look like it is. It looks like it's a scam. Oh, so the scammers were sending you the old. authentication texts?

Yes. I don't really know what the deal is. I don't know but he finally got through to the bank and the fraud team at the bank were already on to it and see that lots of people are getting this particular scam at the moment and already that morning that had heaps of people.

The best part of this story is the scammer's they ended up with a dud. They couldn't have picked a worst credit card. Megan Pappas's card. This is probably quite a good little hack in some ways that you can talk about. I mentioned this to my husband so many times. So all they managed to get in the end, they kept trying,

and all they managed was like $150. Because that's all I had left on my credit card. It was pretty much maxed out. They're like, 6.48, no, okay, 4.40. Jeez, how long are we going to go on this one? This lady's in financial strife. Anything they feel bad about the proper bits of money into account. At the end of it, you're like, oh, geez, not this one, no, it's not this one.

Yeah. So only lost 150 bucks. Not great. And, you know, they're going to get it back and all that palava. But I did point that out to my husband so many times. I was like, lucky that my credit card was like pretty much maxed out. Ben was saying you could have used this time to buy more stuff and blamed it on the hackers. But the hackers who have also conveniently sent all the products to your house.

I know. And when I was on the phone to the bank, they were like going through the transactions. And the hackers used like a Kmart name. It's not K-MAT. Came-out has nothing to do with this. But that's what they put it under the guise of. And I was like, well, I haven't shopped it Kmart recently. But you could.

You could have. And then they were like, oh, what about pack and save? And I should have said, oh, no. I haven't been a bag and z-pedal station. No. Not me. Not me. Bunning's.

No. What about this clothing store? Oh, no. I was like, damn it. We're going back to 2024 here. You're happy for a while. Hey, next. Well, speaking of a big scam, we're going to talk to a scam expert for things that you can do to maybe not have this happen to you.

It seems harder and harder to avoid now. Sean Lyons, he is the Chief Online Safety Officer at Netsafe, and he joins us right now. Happy New Year to you, Sean Lyons. Thank you very much. Throwing you a little bit by the happy year. It's our show catchphrase. So you must hear about this. Well, every day it feels like someone somewhere is getting scammed in New Zealand.

Well, it's more than every day. It's multiple, multiple, multiple times every day. 15,000 or so last year reported to us, and we know that. That's just a small drop in the ocean. A lot of people get scammed and don't ever talk about it because they feel like they're silly. They're stupid, and it's nothing to do with the people on the other end. We're not technically doing things wrong in that case, right?

No, absolutely not. And, you know, the think that's the majority of people will, most of the transactions they have, nothing will ever go wrong, but there are people out there. They'll do it by putting pressure on people in order to do these things. So it is not about what we do, it's about what they're doing. How do they actually get your credit card details, Sean? Are they purchasing them from the dark web or what's happening?

That's one of the mechanisms is out there, that we see or we hear about data leaks every now and again and those things end up out there for sale. But also people get tricked into giving over their credit card details. There's a lot of scams out there that are just out there to harvest information from you. So you end up with a phone call or a text or something, and all they're looking for is a date of birth, or they're looking for your address, or they're looking for a credit card number.

If they're not taking money at the time, you think, okay, there was nothing in that. But there are people out there just harvesting information that then gets used to scam you later on. But there are lots of ways people can end up losing their credit cards. I heard of one where they call you and just ask inane details, but that they were actually using your voice so they could then recreate your voice. Is that true? Yeah, there was certainly one.

It didn't happen much over here because we didn't have too many of the sort of voice print bank accounts. But there were certainly countries where they used your voice to identify you to get into your own bank account. And then I don't hear so much of that anymore. And I think the banks have sort of taken away those voice recognitions because of it, because it has become who easy to get a voice print of somebody and then synthesise. What is the best thing you can do to protect yourself? It's going to sound really, really silly, but the best thing you can protect stuff in these things is stop and breathe.

The one thing that the scammers do more than anything, and just about across any type of scam, from credit cards to romance scams to bank impersonations, the thing they do is they push and they pressurize you. They generally will, whatever their story will be, there'll be something about it that means you've got to act now. When someone's telling you, I can see the money flying out in your account, you need to give me your login details now,

that's a really tough thing to resist. But it is to resist and say, actually, I'm going to stop, I'm going to end this call, I'm going to delete this email, and I'm going to get in touch with my bank or the government or whoever it is, that's supposedly on the phone. Or I'm going to stop and talk to my friends and my family, my partner, somebody I work with. Someone who's not as emotionally attached,

but just taking that time to put it back on, put the ball back in your court, not in theirs, and just take that time to think how likely is what's going on actually really true. Okay, so Megan, you do this is wrong? Yeah, no, and also do you think it's a good idea to, like, max out your credit card so that they actually can't take any money. Because that was a good thing for Megan, she didn't have much money in hers. We're going to add that to our list of the

for the future of Megan because that's really worked well. Perfect. She's hacked them. She's hacked the hackers, mate.