LPRC - CrimeScience – The Weekly Review – Episode 251 Ft. Sam Yeung, PhD (LPRC)

Episode Date: September 17, 2026

In this episode, host Tiffany Frison is joined by Research Scientist Sam Yeung, PhD, to discuss his latest publication, Social Engineering in Retail: A Practitioner’s Playbook. Dr. Yeung explores the growing threat of social engineering scams targeting retailers, the risks these schemes pose, and the potential operational and financial harms they can cause.

Hi everyone and welcome to crime science. In this podcast, we explore the science of crime and the practical application of this science for loss prevention and asset protection practitioners as well as other professionals. All right. Welcome everyone to this week's crime science podcast here at the LPRC. I am your host, Tiffany Fryson. And today we are joined by Dr. Sam Young. Sam, do you want to say hello?

Hello, everyone. Thank you, Sam. So today we're going to be talking about Sam's most recent publishing the social engineering and retail of practitioners playbook. And before we get started, I just want to say everyone, thank you so much for tuning in today. And we'll go ahead and get into the nitty-gritty, the content here. So first off, Sam, can you tell us where this idea? of creating this playbook came from? Yeah, sure.

I am a research scientist and the facilitator of the Weetel Fort Working Group at the Laws Prevention Research Council LPRC. So one of the topics that our retail partner frequently brought up is the social engineering scams that the employee have experiencing in various forms and different levels of harm. So this is a frequently brought up topics. So by discussing with the co-chairs of the retail voting group,

we just decided this is a timely topic, given the rise of AI to make it even more difficult to tackle. Okay, very good points. Yeah, and then so can we kind of have a brief overview of what this playbook is and maybe like how people can use it. Yeah, sure. This is really one of the non-traditional deliverable from LPRC. First is in the form of a playbook.

It's not in the form of traditional like word file or PowerPoint. It's an HTML file that is meant to serve the loss prevention professional at a So if you want to jump to specific type of flat landscape, you can just click a particular HTML link and it will bring you right to that part. If you want to have a quick guide in terms of how your employee should respond, you can also directly jump to the last part with Appendix A, B, and C, so that you can have a quick reference. So it's not meant to be a long report rather is something a two. a tube that hopefully the retail loss prevention practitioner can have in their two kits for quick references. And of course, you can also upload it to a large language model of your choice to extract specific parts for your other departments or your higher up management so that they can have a

different perspective. But the materials are there for easy consumption. That has been the goal. Awesome. Yeah, that's great. Yeah, and I'm glad you pointed out that this isn't the typical type of publishing from us here at the LPRC. Even when I saw it, I'll just even make an anecdotal note. I was like, well, this is so different. But I think it will be very useful for people. So can we talk a bit about how this data was collected and how the playbook was put together? I know you mentioned that it spawned from the retail fraud working group,

but kind of how was all of this put together and where did the information come from? Yeah, sure. So although I'm a scientist, I like to do experimental research like randomized control trial, but this is largely the accumulation of wisdoms of the LP professionals. At the beginning, we decided to work on this topic and this point. Playbook in particular. So for each of the Retail Fort Working Group meeting, we just focus on a specific part of social engineering. For example, different channels, what to do about it, and what are the precautions, what are the new trend. So we synthesize all the information shared by the loss prevention professional in the retail working group and then put together in a format that is useful. for the LP practitioners. So this is largely the crystallization of all the wisdoms that people contribute to it.

And so the retail for working group attendees should really be part of the offer at least. Awesome. That's very good. And then, yeah, very good, awesome. So let's talk like semi-finding. here. Can you provide some insight into what types of people typically use social engineering to commit crimes? I think you touch on that in this playbook as well. First of all, they obviously are not honest people. That is for sure. That's number one. Number two is that they actually know

human psychology very well. And they use different forms of tactics to create a sense of urgency. realism as well as threat so that when you're frontline employees in the retail environment you feel you feel compiled to you feel stressed to compile to the order so as for the specific types of people i really do not have the hard data on it but they know the game very well that they are successful. So if you are operating at one business and your business survived for over five years, then you are really good at it. But these guys have kept evolving and they continue to scam our retail partners. So they really know their game and they continue to evolve. That is for sure. Okay. Yeah, that's a very good point. I think even from my time involved in the retail fraud

working group, I know there's been changes all the time on the type of social engineering scams out there. So the point that it's always evolving is, I think, very, very relevant. And then, so what are like kind of some of the different types of social engineering crimes that we talk about here in the playbook? Sure. If you go to the social engineering playbook, we really try to broke it down into different channels. And of course, it can be in person, it can be by the phone, it can be in the form of email, various communication channels as well. But the key here, I may be ahead of myself of the incoming questions, but the tactics that they use is that they come from legitimate source, such as higher up in the loss prevention department, or maybe from

the law enforcement such as FBI or from the police and then they have a way for people to remove cash from the cashier or in the form of a gift card sharing the code from the gift card. So we can categorize them into buy different channels by different types of target value, maybe coming from a Bitcoin ATM may be coming from gift card or maybe sharing the information. But a key component of social engineering is that people felt victim to social engineering rather be a ruling a compass of a crime. So there's a key distinction we need to make here. Yeah, very good point. And I just want to point people to where all of this is detailed within the playbook. So this is kind of within the part to where we get into the different types of social engineering, correct?

Mm-hmm. Perfect. Yep, I think so. Awesome. And then we were kind of talking on this, but I do want to just ask it as well. So why do you think these social engineering tactics work so often. I know you said the kind of threat and the pressing of the offender trying to get someone to do something, but is there anything else that we could consider here? Yeah, sure. So the overarching point is that they are persuasive. That is number one. For example, this is my experience just from yesterday, my wife was actually sitting right next to me, and she received a call that appears coming from me, Sam Young. And I told her explicitly that, no, I was not calling you.

But she double-checked and doubted herself that I was by accident calling her. So just the familiarity aspect itself may make the scammer more persuasive. Now imagine you are a frontline associate who need to handle a gazillion type of task at the same time. So you already are inclined to certain types of response because your job has been trained to follow order and help customers. Right. So this is another aspect. And of course, the scammers are getting very good on what might have worked better than the others. So sometimes they will gather insider information, for example, the front line associate or the store supervisors to make it even more familiar. So familiarity is definitely a key aspect and the time stress that they create that if you do not do a, such as paying a specific ship,

or pay an electric bill, the store will close or you will be in trouble. So imagine you have been handling 10 things at the same time. You have the training to compile the order and help the customers, whether it's external or internal. And then you have a threat that is placed in front of you. You are really in a vulnerable position to compile to the order. So that is just an unfortunate action. aspect of life here. Right. No, that's very good things to consider.

Okay. And then so I think you also get into it a little bit in this playbook. But what are some of the like solutions or tactics that retailers can use to combat these scams based on what we see here in this playbook? So one frequently mentioned response is frequent training. There's just no substitute of frequent training. If you try to train the employee once a year, it just is not going to work. So frequent training is number one. In the training, you also need to have the employees verify that where the call is coming from.

So maybe you have a EC of average. of information that the frontline people would need to check and verify. And of course, you should separate the frontline employee with their access to a large amount of cash when they are not in the road. So if I'm someone employed as we stocking, I really should have no business in the cashier assets. And this is an emerging topic, but doing some real-life tests on the frontline people, whether of course there's an ethical concern here. But if you do not do this type of infield testing, that's what I would call, you really do not know how your organization stand in this type of scam.

So that may be something that is necessary in the long one. And then just to further educate the people that nobody is really safe from this type of scam, even as a researcher and scientist myself. Right. Yeah. No, it's a very pervasive part of life now, I feel, you know. Um, very good. But and then I do want to just note for people as well. So kind of some of these details and the tactics and everything are in part five. And part, uh, and part three, part what to do about it. Okay, perfect. And part five. Okay. Perfect. I just want to, you know, have,

have a landing point for people to go back to refer to. Um, perfect. And then, um, out of everything, that we've talked about today so far. Is there any other things that people can take away from this playbook or this area of study? From the playbook, I think instead of a long report that people rarely read because they are just too busy, I think as an organization, we need to produce at a form that our partners can easily consume.

That is why I create. this strange, strange document. But the whole idea is that people can just look at it for five seconds and then already got the main idea of which part might be useful to them so that they can jump directly to it. So this is meant to be something that is as practical as possible for their everyday social engineering headache that they are trying to solve. Very good. Awesome. Yeah, no, I definitely think this is a great resource for a lot of people.

And then so I know like I believe still in retail fraud, we're focusing on social engineering or has that? There has passed for the second half of 2026. We are focusing on account take over. Okay. Perfect. So in the area of social engineering, is there anything else that's coming up within like this kind of area of research? For social engineering, it is just a constant topic. And thanks to our retail partner, we learn about how the bad guys, unfortunately, are using the latest technology such as smart eye glasses. So that now they can actually stealthily. we call the PIN that the Frontland Associate enter into the cashier.

So it's getting more scary, but we just need to be on the lookout when something suspicious happens near the cashier or POS system. Okay, very good points. We've got through my list of questions for you, Sam. Thank you. I just want to say, was there anything else you wanted to? note about this or anything that we've talked about? I think a key take-home message, if anything you remember, is that everyone is vulnerable.

The bad guys are just getting so good at this game that we just need to acknowledge our vulnerability. Maybe there's a good first step in tackling this type of scam. Okay, very good. Thank you for that, Sam. Perfect. Well, thank you so much, Sam. for this conversation today.

Thank you. You're welcome. You have a good one. Thank you. Thank you. Thank you to all of our listeners for tuning into our crime science podcast. And I do want to point everyone to the Knowledge Center. So that is where you can access this playbook and go through all of its resources there.

If anyone has any issues or needs access to the Knowledge Center, please reach out to any of us on the team. If you're interested in getting involved in the retail fraud working group, feel free to reach out to myself at tiffany.f at LPRC.org. And then, yeah, let us know if there's anything that you guys are interested in in this area. But thank you again to everyone, and we will see you all next time. Thanks for listening to the Crime Science Podcast, presented by the Loss Prevention Research Council. If you enjoyed today's episode, you can find more crime science episodes and valuable information at LPRsearch.org. The content provided in the Crime Science podcast is for informational purposes only and is not a substitute for legal, financial, or other advice.

Views expressed by guests of the Crime Science podcast are those of the authors and do not reflect the opinions or positions of the Lost Prevention Research Council.