LPRC - CrimeScience – The Weekly Review – Episode 130 with Dr. Read Hayes, Tom Meehan & Tony D’Onofrio featuring Guest Speaker: Adam Oberdick

Episode Date: December 15, 2022

NEW INTERVIEW with Lead Director at CVSHealth – Adam Oberdick! In this week’s episode, our co-hosts discuss the continued planning of LPRC Integrate, Twitter allowing previously censored individuals back in, the continued cyberattacks this holiday season, and a riveting interview with Adam Oberdick about the innovation initiatives at CVS! Listen in to stay updated on hot topics in the industry and more! The post CrimeScience – The Weekly Review – Episode 130 with Dr. Read Hayes, Tom Meehan & Tony D’Onofrio featuring Guest Speaker: Adam Oberdick appeared first on Loss Prevention Research Council.

Hi, everyone, and welcome to Crime Science. In this podcast, we explore the science of crime and the practical application of this science for loss prevention and asset protection practitioners as well as other professionals. All right. Welcome, everybody, to another episode of Crime Science. The podcast is the latest in our weekly update series from Gainesville, where I'm located, and then our team all over the place distributed. But we're joined by our co-host here today. We've got Tony D'Onofrio, we've got Tommy and our producer Diego Rodriguez, and I'm going to ask Tony to introduce our very special guest in a minute here. What we're doing on the podcast, as we mentioned, is we're going to start to

ease back to where we were pre and during the beginning of the pandemic. And that's where we had very special guests on, talk with them a little bit about what they're up to, what the challenges they're facing are, and their perspectives. And those guests will include practitioners, people that are in the field or in the home offices that are out there trying to better understand and affect all the theft, fraud, and violence issues and beyond that they're dealing with to support, enable, empower their enterprise or organizations in these almost bizarrely rapidly changing times with what we're dealing with and how it continues to morph. changing times with what we're dealing with and how it continues to morph. We'll also have some criminologists here and there. Those of you who might remember that we've interviewed quite a few

over the last few years, and those are also very sought after. I understand some universities and colleges will have their students tap into these. So we'll be including both. I think it adds more value to all of us to hear everybody's perspectives, to get an idea of what's going on. And LPRC was founded 22 years ago by 10 practitioners, 10 decision makers in the retail asset protection or loss prevention field that realized they wanted to go beyond their own experience and expertise and even beyond benchmarking with people that they know and trust, they wanted to inject some science, some research, some more perspective into what their decisions

should be and could be and how to better shape what they're doing and how they're doing it. So this continues that tradition here at Crime Science, the LPRC podcast. So with no further ado, I wanted to talk a little bit real quickly here. We've got, again, a reminder for our members and prospective members, LPRC kickoff, always following the last day of the NRF Big Show in Manhattan in New York City, will be hosted again by Bloomingdale's at their flagship store. Always grateful to Bloomy's for that. Thank you, Peter and Fred and the team. That will be January 18th.

Reach out to us at operations at lpresearch.org for more information to get registered for that. There is a capacity of 100 or 102, something like that. I'll have to check and see where we are, but I know it's filling up fast. We've talked a lot about on this podcast. Following that, we'll have LPRC's annual winter planning meeting for our board of advisors called Ignite, but on the 22nd of February 23. But this year, we're going to also, the day before that,

have our first LPRC integrate, and that's going to be our tabletop war game type exercise where we're going to go through, in this case, a very aggressive shoplifting scenario. From the time they're posting and tweeting and doing things online as they drive through and so on through our community, commit their aggressive acts in our simulated store, our engagement lab, we call it. They're going to exit and go through the rest of our four square block test area and go to affect another location. And we'll be trialing dozens of sensors, again, oral, digital, and visual sensors to see what we can pick up, how we can integrate those, how we can use them for early warning, for real-time battle tracking and notifications, and then, of course, for unprecedented levels of forensic evidence that can be rapidly transferred to our law enforcement

partners at all the levels, local, state, and federal, in a more meaningful, impactful way. So maybe we can take some of these individuals and crews out of circulation so they can't continue to harm for longer periods of time than is maybe available right now. But it's going to allow all of us at the LPRC, all 70 plus retail corporations, all over 100 solution partner members, our retail association members and manufacturers and beyond to all work together and to figure this thing out and integrate across this ecoscape that we're dealing with. This will be the first of many, many scenarios.

So some have asked, why would we start before what the military and some law enforcement call bang? Why are we going left to bang, not just at that contact point once somebody starts doing something to harm somebody that's tangible, physical, that's visible? And that's, again, going out there in place and time. And because we are trying to understand, I think all of us would love to know there's somebody thinking about harming us, about victimizing us, our people, our places before they do it. So we want to understand there is a presence out there, particularly online, partnering with law enforcement and other retailers to get an earlier and earlier warning about that.

We want to understand how many people might be coming our way. Is this an individual? Is this a crew? Is this a makeshift crew that's going to commit this burglary, this robbery, this aggressive shoplifting, this ORC booster hit, this riot, you know, looting or burning, whatever the situation might be or worse. We want to better understand their intentions to the extent that we can, the sentiments. What are they intending to do? Not just who they are, how many they are, but what are they intending to do to harm us and how are they intending to do it?

What are their capabilities to actually carry that out? That's something that we all want to understand. Do they have weapons? Do they have transportation? Do they have insider knowledge? Do they have things that can better enable them to create more harm rather than less? to create more harm rather than less. And so, again, each and every one of these information points,

these priority intelligence requirements allow us to more deeply and broadly think about things. But those are, again, aiming points for sensors to know. Those are aiming points for our action tools to maybe dissuade these people to affect their choices or decisions to the good and reduce the probability they're going to really hit us. Or if they do, they won't create as much damage probability they're going to really hit us. Or if they do, they won't create as much damage. So we want to understand their interactions. Who are they interacting with? What are they interacting with? Are they going online? Are they driving by? Are they coming in our stores like we saw at the Topps Market shooting situation where he was there

more than once, that individual that killed so many people? he was there scouting. That's not very common, but we'd like to know that. What are those interactions? What's their progression? Are they actually moving toward their goal, their intention of hurting us, harming us? That's something that's very important. It's one thing to know if they do or don't initiate, but do they continue to progress? And you look at the data we got up at ICSC in Washington, D.C. the other day when our team was speaking to all the shopping center security managers, vice presidents, directors, that FBI briefing by the Behavioral Analysis Unit 1, BAU-1, was really a lot around that progression and how many don't follow through with their threats, their intentions. They just die out or they're just not able to. So more people are thinking about it than do it. We

all know that. But we do need to know that's our mandate. Somebody's coming there to steal a bunch of stuff or to threaten or harm, if at all possible. And so what are their responses to interventions that we put out there? We'd like to know, are they chatting about that? Are they telling people online or on the street? Are there indications that they, how they're responding to what we're doing to deter and disrupt them and document them? Are they going to other places, crime displacement? It's very important to us all to know, are the things that we're trying working? And it doesn't mean that, uh, we shouldn't continue to try, but should we maybe refine or alter the way we're doing things? So that could be also things that we can measure before bang left a bang out there. So that chatter, uh, the event

attempts, do they stop here and move somewhere else? Do you see clusters move? Do you see the people that are coming to continue to harm? That's what we're doing with crime mapping and getting ready. We had a meeting last week with the Gainesville Police Department crime analysis team and their command team that, okay, we want to go back to mapping offenders. We're getting ready to do the same in Port St. Lucie Police Department in Florida as two test sites to understand how far are people coming to victimize a certain place. And that's called journey to crime. Individuals, how far is that journey as a cluster at the aggregate?

And so if we see people are coming from farther and farther away, maybe the local people are getting the message and are not going there anymore. The people that are naive to the message are still coming there, things like that. So I won't belabor it anymore, but that's given you the message are still coming there things like that so uh i won't belabor it anymore but that's given you some more insight into how our research scientist team looks at whatever we're dealing with to support our retailer members uh ourselves and with our legion of solution partners in this business so with further ado, let me head over to Tony D'Onofrio. Tony, welcome, and let us hear what you've got. Thank you very much, Reid, and today we have a really a great, great guest to join us. Adam is actually a leader in this industry, and so I want to briefly read his bio, but want to really get into a Q&A with him. So, welcome, Adam.

but want to really get into a Q&A with him. So welcome, Adam. Hey, gentlemen. Thanks for having me. Yeah, so Adam Overdick is the retail executive with over 20 years of experience in asset protection, retail operation, and dot-com fraud at both the geo and global level. He's currently the lead director of future operations at CVSL, where he leads the strategic planning, risk assessment, and innovation roadmap for CVS asset protection. Previously, Adam led the Nike.com North America fraud team and the Europe, Middle East, and Africa Nike retail loss prevention team. He has held leadership position in global retail operations, along with field leadership across North America.

His education includes a BA in criminal justice from Marshall University, along with a continued education in CFI and FEMA emergency management. Adam, of course, is also a member of the Loss Prevention Research Council Innovate Team and the Loss Prevention Foundation. So let's get into it. Let me first ask you, how did you get into risk and LP, Adam? Yeah, it was all part of the plan, right? We joked about this not too long ago, but we're such a large profession across the world now. It's so funny how everyone seems to just stumble into it, right? And it was the exact same thing for me. I was a 17, 18-year-old kid right in university at the time and needed a job like everybody else.

I needed money and went to the local Kmart, if everybody remembers Kmart. How could you forget, right? Kmart. How could you forget, right? But I went to the local Kmart and was looking for anything that they were willing to offer, cashier, stocking shelves, working in the back of house, whatever it was. And this gentleman walked in and said, well, how about boss prevention and we'll pay you an extra dollar an hour. And I had absolutely no idea what he was talking about, but I took the money for sure. And that's how it started. And I was catching shoplifters for, you know, the first few months and learning all about, you know, this crazy profession that, that we're in and that's evolved so much since then, but that's how I stumbled into it. Right. Um, was catching

shoplifters and Kmart was fantastic. They, uh, you know, had an amazing group of people and leaders and business owners that were always so willing to teach you everything, not only just about loss prevention, but also just how to run a good store, right? And how to run the business. So really, really fond memories of that time and really great people that I was working with too. Well, you're bringing back memories of the Blue Light Special. So which was very, very famous. It was the Wild West. Yes, it was. So you moved on and you have a major role right now at CVS.

Can you tell us a little bit about some of the projects that you're working on right now? Yeah, you know, we're doing a couple of really cool things right now. I think the most exciting thing is this innovation hub. So we are really striving to try and be more innovative over the next couple of years in trying different technologies, seeing what works, seeing what helps out not only our CVS colleagues and our loss prevention team, our asset protection team, but also improves the consumer journey. Right. And I think that that's kind of the key there. And so what I mean by this innovation hub is we've got this collection of lab stores, right? And I think we're at five or six of these lab store environments

where we're going to be able to try things on a small scale. I think one of the things that a lot of people can relate to is it's really difficult to pilot something across 10, 20, 100 stores, right? And sometimes you just have to start really small and say, does this technology even work for this business, right? Do people actually use it? How does it work with interacting with consumers

and with our colleagues? What's it like with our IT department, right? Like, what are the challenges? And starting small, right, as a proof of concept and then rolling out to a pilot and scaling has been beneficial to this point and something that we're going to continue to try to strive on.

But this lab environment gives us that opportunity to test things out at a really small scale, which you two, which you and Reid have been instrumental in setting up as well, right? So we appreciate the partnership and support there. But I think that's the way forward for us. And we're trying some really cool things. That's very, very cool.

And I agree with you based on the work that we've been doing together, there's some tremendous potential there. A lot of these are big projects. So what approaches have you found the most useful in getting approval from senior management to get some of this stuff funded? Yeah, that can be really difficult, as everyone listening probably knows, right? There's always going to be competing priorities, especially with asset protection, loss prevention, right?

It's difficult to be a support function of any size company. Right. And you have to understand how you fit into that organization and into the organization's goals and initiatives. And I think that's probably the biggest thing that I've learned over the course of my career, but also something that's been very successful here lately at CVS is understanding that story. been very successful here lately at CVS is understanding that story, right? And how does your story tie into the company or your leaders' objectives and initiatives that they're trying to get after and their strategies that they're trying to execute and achieve, right? And everything has to tie back into that. It's not anymore. It's not just about it's going to save X amount in shrink, right? Or we're going to deter X amount in shrink deterioration. It's all about how can we tie that back

into improving the consumer journey or improving the working environment for our employees and our colleagues, right? You have to be able to tie that back into things that are important to the business and to everybody working there, not just shrink metrics any longer, right? And I think that that's been one of the really important things.

And again, we've been really successful with being able to tie those things into it. And if you guys know this, if you're really if you're really tactical about it, really strategic about it, you know, everything that asset protection does impacts everything about a company. Right. It impacts everything from the colleagues and the consumers to the way that we process merchandise. Like we can do that and we can build those stories and tie those connections in with senior leadership.

A lot of times it just takes the right story. That's excellent input. You know, you've had a quite an interesting and successful career. So what do you think today with all this change that's going around us on LP professional needs to actually have a successful career in the field? Yeah, that's a tough question. I really like that question because I think it's similar and different for everybody at the same time,

but I think a couple of really big things there are balance, right? So you have to, and that comes across a couple of different ways, but the balance in the workplace, meaning you have to know when to step on the gas and when to pull back, right? And you have to know, like I said before, where your place within the organization is, whether it's as a district manager in asset protection or whether you're at the corporate office, you have to know where your place is, right? And understand how your function fits into the business. And sometimes, you know, that can be a real kick in the butt. But having that understanding and that respect for what's happening across the business can go a long way. So balance in that part in the business is key. And balance in your personal life too, right? And this is always really difficult, especially for LP and asset protection. You're always getting calls late

at night and on the weekends and supporting teams and supporting employees because it's the right thing to do, but you have to be able to find that balance, right? And I think that burnout is a thing in asset protection and LP, as you guys know, right? And it's something that we have to be really mindful of. And as leaders, you have to make sure that your team is not overstretching, and that can be really tough. So I think balance is a skill set that is learned, right? And something that you have to make sure that you're continuing to try and practice. The other thing is communication. And again, this comes to life in a lot of different ways and something that you have to constantly work on. But communication in terms of being able to set realistic and clarify those realistic expectations constantly with your partners and your peers and your stakeholders and your leaders, right?

Like communication and clear communication is what gets those things accomplished and what makes sure that you can do the things that you need to do to be successful. Make sure that you can do the things that you need to do to be successful. The second piece, as much as we talk about corporate partners and peers, or if your store teams, right, your store managers, your cashiers, whoever it is, asset protection is just so much about building relationships just as much as it's about the tactical things that we need to do to save money for whichever company or business that we're working for, right? Like those are the key things.

And so you have to understand that that takes time. You have to understand that there's a process to it and that you're not going to be able to get the things done you need to unless you build those relationships the right way. And again, that doesn't come across the same way for everybody every single time. You have to really learn and be empathetic and practice that act of listening to be able to understand who people are and what's important to them so that you can build those relationships. And that's been, again, one of the keys, I think, to being really successful in this profession. That's excellent input. And I think the audience will appreciate it. Just a couple of quick questions that I want to get to. One is, you've been involved with technology a lot. And at LPRC, we talk a lot about technology. Any favorite technology that you see

are most critical today, especially as we see and we get out of COVID and so on and going forward? Yeah, I think there are a couple. And I think one is kind of what you would imagine in terms of capturing analytics or integrating analytics into things that you already have, right? So how can we do that in a way that's not invasive to our consumers and to our employees or colleagues, right? So how do we make sure that we are striving to implement technologies that continually capture analytics that will help us make decisions, right? And how do you harmonize all of those technologies together, right?

So if it's a smart camera analytics with smart shelving, with smart EAS towers at the front, all these things should be working in conjunction and together so that you're getting a really good snapshot of what's leaving the building, right? And if you tie that back to a really good POS analytics system, you're able to say like, okay, these things walked out and we don't have a corresponding or correlating sale to go with it, right? So I think you always want to be sure you're capturing data with any new technology that you're putting in. The flip side of that, and this kind of gets back to the basics, but I think super relevant now is having a case management system that is super simple and gets

you what you need, the information that you need in a really crisp and clear way, right? And I think as you're starting to see now, especially with the work that LPRC is doing and some of these other major players, is sharing that information in a way that makes sense for your business across other retailers and other organizations, right? And so now you're building out this repository of all of this really great information, right? And it's almost like open source, right? And it's almost like open source, right? So you're making sure that you're getting as much information about what's happening in your business at the right time and in the right places, not only from an asset protection

and a loss perspective, right, but from a safety perspective too. And I think those things are key. And one of the things that we're finding out, and the reason I say it needs to be simplified is at CVS, at least, we're asking our colleagues or our store managers to input some of those things that they're seeing, right, whether it be incidents. And you can't have a platform that takes 20 minutes, 30 minutes to input a case, right, or an incident, whether it be from the store or from our asset protection team. So you have to be really crisp and clear on what that is. And it has to have a really good user interface that makes sense and gets you the information that you need. Again, very good input. And let me just conclude,

you're an active member in a bunch of industry groups, including the Loss Prevention Research Councils. So coming back for SOCR, what do you think of this additional passion is so important? And how do you see these groups actually helping move the industry forward? and so important? And how do you see these groups actually helping move the industry forward? Yep. So I have always been really vocal that the success comes from those relationships

and comes from oftentimes the partners, the vendors, the solution providers, the consultants, right? Because you guys are so intertwined with several different retailers across the industry that you know what works and you can scale or help businesses scale really quickly, right? So as an example that I give often is if you're starting a new position, whether it's in your current employer or you're moving to a new company, you bring those

relationships along with you, right? Whether it be LPRC or any of the consultants that you have or any other organizations, and they can help you get to scale really quickly, right? Because again, they know what's happening in the business. They understand the challenges. They understand the technologies. They say, hey, here's what's working over here. Why don't we try that? Or hey, maybe we should connect you with this person. They had a similar incident or a similar challenge. We think you might be able to do something similar, right? So I think that those are the things that you have to be able to bring with you. And that's why I love, you know, LPRC, especially with the Innovate. And you have so many different retailers that are sharing, you know, challenges and stories

and say like, hey, we're all kind of seeing the same thing. How do we get really good at this together? Right? And the same thing with LPF and any of the others like Rila and any of those trade shows. Those are where you build those relationships, right? And that's where you find the right people and you carry them with you the entire way. And they're just as invested in your success as you are with them, right? And I think, again, it just gets back to building those relationships.

But I've always been very vocal about that. And, again, I really appreciate everything that you guys have done for me as well. Well, thank you very much, Adam. It's been really an insightful discussion, and I really appreciate all your input. So looking forward to hear more of your successes going forward and working with you from many different perspectives. So with that, let me turn it over to Tom. Well, thank you, Adam, for joining. It's great to have a guest on, and it's good to all be together.

I'll just go through some kind of cyber risk, kind of the normal. We're two weeks away from Christmas, and the bot attacks are in full swing. So nearly half of bot attacks are U.S.-based, if you think about that. I think that a lot of people, this big, huge world, although we hear a lot about Eastern Europe and Central Europe, but nearly half of the bot attacks that are occurring are US-based. So it's at 49%. And what you see after that is United Kingdom, Canada, Australia, and South Korea would be involved in that as well after that fact. So we're seeing about a 50% increase in bot traffic. And for those of the listeners that don't know, bots are just probably what you think

they are. They're automated or scripted attacks that don't need humans. They're often using machine learning, some of the same technologies that we are deploying to defend ourselves, the that we are deploying to defend ourselves, the bad guys are using to attack. And bots have really gotten smart over the years before. When bots first hit the scene, they were very fast and websites traffic was easy to identify this as a bot. Now you have bots that mimic human behavior that constantly attack. Right now, there is a six times increase in automated online gift card lookup attempts. We talk a lot about the LPRC fraud and gift card fraud.

If you think about that in the last 60 days ago, there is six times the amount of normal attempts here. What these bots do is sometimes they use random generated numbers. Sometimes they have an algorithm piece. Sometimes they're just attacking. And at times they can do hundreds of millions of checks a day over a landscape of retail. Three times the spike in fake account creation in the week before Black Friday. So if you think about that, people going in and making fake accounts to try to do nefarious things online, there's about a million won products or a hundred purchased from a bot. This is all really interesting because this is not necessarily survey data. This is based on reported. And then there's about a 45% increase in API scraping attacks.

And overall, 50% of the holiday bad attacks originate within the four walls of the United States. I think that's really important to note because I think we often talk about outside the U.S. And for those of the listeners here that say, hey, I'm not involved in cybersecurity, I think one of the things that we all talk about is the impact on gift cards and what happens in the stores when they happen. There are a whole host of other bots like promotional bots that look at coupons and really look to push the envelope of discounts. But really, the big, big push today is account takeover and gift cards. Just a quick note, Twitter, I feel like we've been talking about it a lot. Elon Musk buys Twitter. There's so much activity, good, bad, or indifferent on Twitter. Twitter Blue, which was the subscription

service that was released yesterday that allowed folks to pay for verified accounts, officially went live. I think there are actually a whole bunch of things, if you're a Twitter user, that will be a benefit here. It's $8 a month if you're buying directly from the web, or $11 if you're doing it through iOS, but it allows everybody to get verified. And there's three levels of verification. One is a personal verification with a blue checkmark.

Another is a gray with a business, where a business, I'm sorry, gray is a government or public official, and then there's a yellow for business. I believe this will change over time, but it also really did change some of the data pieces here. Twitter has been in the news pretty regularly. I know most, if not all of the listeners of the podcast, if you're doing any type of active intelligence gathering or open source intelligence gathering related to event driven or threats, you're probably using Twitter in some fashion. I think this is going to continue to evolve. And while I think the news media is really latched on and there's a lot of negative news, what I'm seeing is a lot of the

bot traffic and going down, the fake accounts going down. And I still think there's a lot of the bot traffic going down, the fake accounts going down. And I still think there's a lot of noise on Twitter, much like other social media platforms. But I definitely think there's more to come. Switching gears with Twitter a little bit is Twitter actually had a data leak. This isn't really a breach of sirens. And back in January of 2022, where there was an open or vulnerable API issue that allowed email addresses and phone numbers for some users to be leaked. I think this was one of those things that kind of, there was a small report about it back in July, but really in November, a threat actor actually

went online and really released five and a half million records that were scraped in 2021, mostly email addresses and phone numbers. The data set allegedly had more than 17 million records. I haven't been able to validate that, but this is something that went on. haven't been able to validate that, but this is something that went on. So when we talk about the good about Twitter, just keep in mind that as we continue to use online platforms and give our information out, they are susceptible. So when you can safeguard your information, when you can use a different email address, if there are things that you can do, that will definitely, definitely help you in the sense of protecting yourself. And then FTX, we talked about this.

And again, this is for the listeners that haven't been listening recently. FTX was the crypto exchange that the CEO, Sam Bankman, ran that had probably the most catastrophic crypto fall on record today. And the numbers are almost unfathomable. I mean, a few months prior, the exchange was one of the highest valued exchanges out there. And just six weeks before the total crash, they claimed to have $5.5 billion in assets and only had $600,000. Sam Bankman was actually supposed to testify today.

He was arrested last night in the Bahamas. He's in Bahamian custody, and they're working to extradite him to the United States. There's been a tremendous amount of news coverage on this. And depending on where you sit on this, a lot of this looks like mismanagement and poor communication. And the risk associated with crypto is real. So there is some of this where the bottom fell out. And a lot of these exchanges really didn't have the assets because they were all based on some level of cryptocurrency. Several large crypto exchanges, some in the $30 billion plus area, all had filed for bankruptcy in the last six months, which leaves all of, unfortunately,

not all, but most of all of the folks that had money in them left with going through court proceedings to see what's left over. And it's not hard math if you have a company like FTX that at one point had assets in the $30 or $40 billion range and then ended up with $600,000. It's going to be very hard to pay people back. Another one, BlockFi filed for bankruptcy, and they owe $1.2 billion to their creditors, and some that doesn't include all of their account holding, and they have no money left. So this is all kind of related in some case, because FTX was one of the larger ones. And there is some intertwining with these exchanges.

Some exchanges are designed just to move crypto. Some hold. Some are crypto lenders where they actually are loaning money or taking your money and giving you interest back. So, for instance, BlockFi was a company where you had a 7% interest yield on money that you invested in them. So those are some of the ways those occur. I think this is going to continue to be big news. This affected a lot of folks. I'm sure it affected some listeners.

I know I've spoken to some people who were directly affected in some capacity here, whether it be from holdings with these companies or rewards related to credit cards or other things where the impact has been far reaching. And I think every trade show I've been to in the last four months, I've talked to multiple people that have been directly affected. And it's not all what the news goes. People that have hundreds of millions of dollars in here, there are a lot of regular folks that just put some of their portfolio into crypto and were negatively affected here and unfortunately may never recoup that. So definitely something to be aware of and we'll continue to update here. And we talk about this, I think, often, but with the uptick of holiday shopping, the holiday scams are out and about. So keep that in mind. If you haven't received a text message or an email,

it's a rarity to say that your package is missing or delivered. One thing to note is that this is repetitive intentionally here. Some of these phishing and phishing attacks are becoming much more sophisticated in the sense of they're no longer trying to get you to give them information via clicking on a link. They realize that we've been trained now for the last several years about the risk of clicking on links and downloading. So now they're saying, you know what? Don't click anything.

Just call us at this 800 number. And they're really getting much more savvy in the sense of they're setting up websites and setting up Google SEO results so that the numbers come up as accurate. They're also doing things where they're leaving messages with the real phone number to the company and says, you can check the back of your card for the phone number, or you can call me directly at this line to not wait on hold. And some of those small, small things that are occurring are driving people to click on links and look up phone numbers, give phone calls back. And still to this day, we have people giving credentials or

personal information. And then this leads to that bot piece of once a bad actor has a little bit of information, they can then take an automated attack. So be very, very mindful of this. And I've seen a couple of recent texts that are very, very well done that have really, really good information where they'll send a warning or a fraud notice and then several hours later follow up on that notice and ask you to respond with yes or no. And when you say no, they'll send it, you know, I didn't make this purchase. They'll then say, please check your online account or call us at this number. And the behavioral driver here is that they're not just trying to trick, you know, this quick, give me your information. They're actually taking a very slow approach to

this. And it is automated where they're doing just what you'd expect to do, an automated message that says there's potentially fraud on your account. Take a look at your account, not driving you to any links, not driving anything, you telling you go to your account, check your account, then they'll get a message later, verify it, then they'll ask you to call. And the information in which a lot of times people are interested in is any personal identifiable information. So that isn't the kind of age old, it isn't just I'm trying to get your username and password.

Sometimes they're building a pedigree of information so that they can use a bot attack. Sometimes it's as simple as your email address and your zip code. For those of the listeners that know, they know that in some environments, retail loyalty cards just require that to get into an account to use rewards. So it isn't always about the information they're giving. The advice is if you aren't expecting a package, don't worry about it. If you do get a notification, go directly to the merchant or the card or the bank and go through a channel that is established. So the best thing with credit card is to flip that card over and read the card number on the back. If

you're talking about a retailer, you're going to their website through their process versus any shortcut pieces. And we're all humans. So if you call someone and there's a 45-minute wait time or you're waiting for a response and someone says, oh, don't worry about it, just call this direct number, it's playing on some of the things that we're used to. We all have the limited time in the day. And sometimes when we get these are in a state of busyness, and we're just going, oh, man, this could have happened. The other thing is, the law of averages is that a lot of times in this particular climate, you have just made a purchase, right? We're all in the gift season.

So you might find that these are timed almost perfectly by design. It isn't because they have someone watching you. It's a big net that's being cast. And there is an order. Like today, if I got something from Amazon, I'm sure, you know, in the last two weeks, my wife or I have placed an Amazon order for the kids. So it definitely is something to be mindful of. And with that, I will turn it back over to Reid. All right.

Well, thanks so much for an incredible amount of information there, Tom. I was actually taking notes of all the episodes. This is one of the most valuable, usable for me and our team. We're doing a re-triple, doubling, and so on, doubling down on the protections that we're trying to provide here to our members. So huge information. Tony, fantastic interview with Adam. So huge information. Tony, fantastic interview with Adam.

Great call. A true leader and a very thoughtful person that combines that field experience as well as that intellectual and cognitive capacity to really think outside the box and lead teams where no one knows. And maybe no one has gone before so that we can all get better. And we've got, you know, he mentioned the Innovate Advisory Panel that he and Travers from CBS Innovation Team are involved in, his deputy, if you will. Well, there's 29 other retail chains on there with the similar people from those organizations. Just imagine what we're starting to get done by bringing all that talent, all that expertise and experience and all that innovative thinking together. And I can tell you, if we're planning for the LPRC integrate, it's unbelievable. You know, this I just kind of sit back and take notes sometimes with. All right. Here's what I think we're doing broadly. Let's go fill it in for this particular scenario.

We're going to do in February 22nd. but then where we're going to go from there. So thanks again, Tony, for that and all your other information. And thanks, Diego, for your production and Wilson as well. But most of all, thank you to you all that are listening. Stay tuned. Any suggestions, comments, ideas, critiques, please, operations at lpresearch.org on crime science, the podcast. Spread the word, like us, and all the things you hear other podcasts say. Everybody stay safe, have a great holiday season, and stay in touch. Thanks for listening to the Crime Science Podcast presented by the Loss Prevention Research Council. If you enjoyed today's episode, you can find more crime science episodes and valuable

information at lpresearch.org. The content provided in the Crime Science Podcast is for informational purposes only and is not a substitute for legal, financial, or other advice. Views expressed by guests of the Crime Science Podcast are those of the authors and do not reflect the opinions or positions of the Loss Prevention Research Council.