181: Ricky

Childhood habits and lies

0:00I think that when I was a kid, I was a good liar. Don't ask me where it stemmed from, probably because I was always getting in trouble. I learned that if I was a good enough liar, that I could sometimes lie my way out of trouble. But I was reading this post on Reddit the other day, and so many memories came back to me. There was this post. Some dad was complaining about his son being a ding-dong. He's like, my son, who's 15, wanted to get some ice cream, so we gave him a few bucks and sent him to the store.

0:36And it happened to be buy one, get one free sale, and we all knew that too. So he went, he bought some ice cream on his own, and he came back with just one tub of ice cream. The knucklehead didn't get the free one. He just paid full price for a single tub of ice cream. The store clerk even told him, hey, there's a sale. You know you can get a second one free. But my boy just said, well, I only want one, and refused the second one. His dad on Reddit was all miffed about how his son could be so daft and ignore free ice cream.

1:07He even said, I know that as soon as the boy finishes his ice cream, he's going to want another. So why didn't he just get two? He knows that we all love ice cream, so why didn't he get one for his mom or his dad? Why did he get just one ice cream and not the second free one? It was free ice cream. This Reddit post blew up. Everyone was piling on about how dumb this kid was, saying stuff like, in my state, you could disown your child for far less. Someone else said, this is probably because the kid doesn't go buy things very often and doesn't know how to handle money very well or deals.

1:40And the dad wrote in the post that he was starting to feel worried because people were saying some real mean things about his son. But nobody was saying what I was thinking. I feel like I know exactly what happened here because I was in the exact same situation when I was a teenager. If you would have talked to my mom then, she would have been just like this worried dad. She would have told you that I'm the worst shopper in the world. Because I'm almost certain that what happened is he ate a full tub of ice cream on his way home and then lied and said he only bought one.

2:12I mean, it all adds up. The boy was hungry for ice cream before even leaving the house. There's no way he's going to wait until he gets home to have his first bite. Grab a spoon at the store and start on your way home. And also, imagine the look on his face when the clerk told him, You know you can get a second one for free, right? No way. Dang, this is my lucky day. And so he must have gotten two and on his way home he started thinking, Shoot, mom and dad don't know I got two. They only gave me enough money to get one. So if I come back with one, they won't even know there was a second.

2:46So if I could scarf this second tub down before I even get home, it would be glorious. No rules, no regulations, no speed bumps. Just eat a whole tub of ice cream as fast as I can. Challenge accepted. And I'll tell you, teenage boys can crush a whole tub of ice cream real easy. They can make a dozen cookies vanish instantly. They have the power to inhale desserts like no one else can. And the real tell here is that the dad on the Reddit post even said, We would never let him eat a whole tub in one sitting.

3:16And that's the thing. The boy had an unregulated container of ice cream. And he thought, No one is going to know. No one is going to stop him from eating all this in one sitting. Let's do it. So he saw this as his big stroke of luck and secretly slurped it down. And then tried to lie about it when he got home by saying, No, no, I only got one, I swear. But little did he know the entirety of Reddit was going to believe that lie. And he's probably okay with them calling him names and stuff because being misunderstood isn't as bad as being caught in your lies.

3:52But I see you, kid. I've been in that same situation before. I've been in that situation many times. Two cupcakes I bought at the bake sale became one. Two chocolate bars from the fundraiser became one. And yeah, of course, two ice creams from the ice cream truck became one too. And my mom could never understand why I would sometimes pay extra for a single cupcake.

4:22These are true stories from the dark side of the internet.

4:29I'm Jack Recider.

Sponsors and ads

4:32This is Darknet Diaries. This episode is sponsored by ThreatLocker. The weird part about modern cyber attacks is how normal they look. The attacker logs in from Chrome, uses PowerShell, runs a remote admin tool your IT team already trusts.

5:04There's no custom malware, no dramatic movie hacker moment, just normal tools used in the wrong way. That's part of why ThreatLocker exists. ThreatLocker helps organizations control what software can run, what it can do, and how systems communicate. If attackers get credentials or land on a machine, they'll have a much harder time moving through the environment. Because security teams are realizing something important. The problem isn't always unknown software anymore. Sometimes it's trusted software being used by the wrong person.

5:34If you want to see how ThreatLocker works, go to ThreatLocker.com slash Darknet and book a demo today. That's ThreatLocker.com slash Darknet to book a demo. This episode is sponsored by Doppel. Protecting yourself from attackers used to be as simple as deleting dodgy-looking emails. But with AI, the attack surface has outgrown the defense that legacy vendors provide. Doppel was founded in 2022 to give companies back control.

6:05Doppel is an AI-native social engineering defense platform. Doppel strengthens human risk management by training employees to recognize deception and provides digital risk protection across every channel. It even delivers agentic email security that doesn't just score the inbox, but takes down the attacker infrastructure behind the message. Those dodgy-looking emails have been replaced by bespoke and personalized texts, URLs, ads, and even social media connections. But Doppel can then turn these attacks your business receives

6:37to inform campaigns and security awareness training for your employees so that they know what to look out for. Doppel. Outpacing what's next in social engineering. Learn more at Doppel.com. That's spelled D-O-P-P-E-L. Doppel.com.

6:56Imagine going to a high school baseball game in Newport Ritchie, which is near Tampa, Florida. And you see one kid, a center fielder, who's absolutely tearing it up out there. He's catching anything that comes his way. He's got an arm like a rocket. He can hit anything thrown at him. He's built like a tank but runs like the wind. And it just looks like he's in a different league than the rest of those high school players on the baseball field. He's eating them up. It's like all the other kids are in a lower league than him. And they're just all playing in slow motion compared to him.

7:26You can tell this kid is the star.

Playing Halo and cheating

7:31That is Ricky Hanshoemaker. So I played center field, but initially I was really known for getting on base, getting hits, and then stealing bases. Stealing bases. Is this where all this starts? Is this where all of it starts? Stealing bases. Coincidentally, yeah. But were computers interesting to you or not at all? No, I was your gamer. Like I said, I wasn't like your average nerdy kind of guy who was like antisocial or anything. I was always out with my friends.

8:02I was always out on the streets playing sports, football, baseball, basketball with all my friends. Friday night and Saturday night, I would go roller skating. So I was never really home, but I did have a passion for actual gaming. All right. So let's talk about gaming. What was your game of choice? Halo 3 was my primary game. We're on the Samo Highway about the Easter boy. In 2010, 15-year-old Ricky is up late on a school night.

8:32His headphones are tuned in as he plays Halo 3 on his Xbox that's humming away. Ricky doesn't want to disturb his mom, who's sleeping in the other room. On his glowing TV screen, he's trying to escape what looks like a war zone.

8:48He's destroying all the other players in the game. I was good. So I was always playing MLG and Team Slayer and all the ranked playlists against the pros and everything like that. And then, of course, naturally, once you get to that level, there's people who cheat on there and stuff. And I was a high rank, but cheaters get high ranks too, naturally, because they're just cheating. So it kept happening to me. People would go up against Ricky and see that they can't beat him. So they decided to cheat to win. He didn't know what was happening at first.

9:19My screen would just go blank, and then they would stop the attack when the game was over, which means they just win by default, pretty much, because we can't even move. Or if they hit you hard enough, our whole internet would just go out. I was with my mom. She's like, why is the internet out? And so I had to play stupid. I have no idea. I don't know what's happening. I've been in a similar situation. I remember the days when we had a family computer, and I downloaded a lot of random stuff and installed it on there. And time and time again, I would break our computer.

9:51And I didn't want to get in trouble, so I would try real hard to fix it before anyone noticed. And because of that, I got really good at detecting viruses and malware and fixing it on the family PC. But for Ricky, he was on an Xbox. And when he'd play, the internet would go down in the whole house. And it was just him and his mom living there. His dad left the picture a long time ago. But strangely, this pattern kept happening. When he would play Halo 3 against other players, the internet would go out. The game would disconnect. And then when he would finally get back on,

10:23he would see that he lost the match. It happened to me again and again. And I'm like, all right. Then through word of mouth, I was like, oh, they're DDoSing us. Like, okay. So I'm like, what the hell is that? Like, I was getting DDoS attacked, like, over and over and over. All right. So they somehow discovered your IP, and then they attacked your IP, and that was enough to knock you offline and lose the game. Yeah. And that's kind of where it all started. Then, like, curiosity, I was like, okay, how are they doing this? Remember, outside of gaming, Ricky is not a computer guy.

10:54He doesn't know what's going on at all. So he just turns his Xbox off and jumps on the family PC and starts trying to look for answers. I started browsing some forums, and I was like, okay, it's called a DDoSing attack. So I started looking that up, and I'm like, hmm, okay. Seems pretty simple. Like, there's a bunch of different kind of, like, booters, like an IRC booter, a putty booter. Or you could just go online to a website and use that booter, which was, like, less powerful. But it would get the job done. I browsed the forums, found out what it was, downloaded the programs myself.

11:24So I was like, okay, well, if they do it to me, I'm going to do it back to them. Eventually, he gets to the bottom of it. He discovers a whole world of dossers and booters and punters and griefers who use malware to attack other players in the game to make them lose so you can win. Ricky decided, well, hey, I want to win too. I want to try. So he downloads a tool. He says it was can-enabled and decides to try to use it to attack other players. He started a match, ran the tool to disconnect another player,

11:56then bingo. He sees they just freeze in the game, and he can easily kill them, and he wins the match with almost zero effort. This was way easier than actually playing by the rules. That's kind of where I got introduced to that world. Yeah, so at that point, I mean, you were really competitive in baseball. You were really competitive at Halo. I just wonder, because you had a sense of pride of ranking up on your own and being competitive in sports, and where did that sense of pride go with cheating? I don't know. I just let it take over, pretty much.

12:26I was like, well, this is easier than actually trying. Yeah, but that's not the sportsman-like way. Yeah. I don't know. I just took the easy way out and got the advantage. Were you cheating in sports at all?

12:40No, that I was not cheating in.

12:44All right. I was naturally good. Well, you were naturally good at Halo, too. You were in MLG and all that stuff. Yeah. I don't know.

12:55And who would have thought that this innocent little victory in Halo was going to lead Ricky down a long, dark path? From here, he tried more Halo cheats like wall glitches, fast travel, reduced hitbox, and more. It was fun. This was the new game. Not to compete competitively in Halo, but to get around the game rules, to do things you weren't supposed to, to be a god in the game. It gave him a sense of power. He saw the game differently now. He stopped seeing things on the screen like Covenant and Banshees and Needlers.

13:26Now he was seeing bites and ones and zeros and the data behind the game, which gave him an incredible win streak. You know, the type of win streaks that you just have to take a screenshot of so that you can look back at from time to time and remember those matches. But even being a god can get boring after a while. And even though he was the winner in those screenshots of his, he would notice that some people seem to be even cooler than him somehow. Everyone looks the same in Halo 3. You're all the same player. Master Chief.

13:58It's just everyone has a slightly different color. But there's one thing that sets you apart from everyone else.

Stealing first gamer tags

14:04Your name. Specifically your gamer tag. These are special, actually. They're unique. There's only one person in the world with your gamer tag. Some people call themselves cool things like Shadow Strike or Nebula Storm or Blade of Odin. Fine. But what about that guy that's just called Wolf? How did he get that name? Wolf. Now that is freaking cool. Well, it's a first come, first serve kind of thing. So Wolf must have made that gamer tag a long time ago when Xbox Live was first created.

14:34When gamer tags first came out, they probably made the name in the first week or maybe even the first day, which makes them OG, right? But instead of original gangster, they're the original gamer. Ricky wanted one of these short, cool gamer tags. That would really set him apart from the other normies playing in the game by the rules. But all the good names were taken. So he goes back online into the hack forums and starts looking to see, how do you get one of these? And it turns out there's a whole underground marketplace of people buying and selling

15:05Xbox gamer tags, but not in the way you might think. See, a typical online market, you'll see people selling things that they've had for a long time or something that they bought from someone else or something they made, right? But this was an underground hack forums marketplace. It operates differently. These gamer tags weren't ones that sellers were sitting on for a while. No, all these gamer tags were stolen. When Ricky found that out, he leaned in closer. How do you steal a gamer tag?

15:36Well, there are a few ways, but the easiest is just to get someone's password and username and take over their account, change their password, and now that gamer tag is yours. But getting someone's password is tricky. Maybe an easier way to get it is to trick Microsoft that you're the actual owner of the account and you just lost the password. Ricky saw some people were doing that and decided to try it himself. There was a company called Zune, which is Microsoft's music app. And coming to find out what you could do is you could call up Zune and then halfway through the call,

16:10you just tell them your gamer tag that you're targeting and you say, okay, hey, my gamer tag is Jack. And then you just stop the conversation and be like, I have to go real fast. I'll call back. Before hanging up, though, Zune's support would give Ricky a reference number for the case that they were working on. And then he'd hang up and call a different number, Xbox support this time. And they'd say, how can I help you? And he'd say, oh, well, I was on a call, but it dropped. I have a reference number if you want to pull the case details up. Correct, yeah.

16:40You just simply say, oh, I have a reference number. Can you pull up my case? And then they would just give you the information right then and there. There was no questions asked. Interesting. So it's almost like a bypass of a verbal authentication. So then when you call Xbox and say, I have this reference number, then they give you the email address. And then you say, can you reset the password? Yeah, yeah. Here's my reference number, which would validate the account. And then you could just literally ask them, hey, what's the email that I have on file? And they'd read it off to you.

17:11How do you get the password? Okay, so back in the day, AOL and Yahoo were your most popular domains, which their proof of ownership of an account, of an email, was literally like AOL was like, your billing zip code would verify the account and they would be able to reset the password for you. Same with Yahoo. I think Yahoo was like security questions, which back in the day was terrible because people would, a lot of the time, chicken or pizza would be your favorite food that people would put and stuff like that. So they were pretty much takeable.

17:43See, that's the thing that amazes me about these teenage hackers. They see the world differently than us. Kind of like when you see motorcycles lane splitting. You ever get stuck on a highway and there's bumper to bumper traffic and you're standing still in your car and a motorcycle comes zooming past you right in between the two lanes and you're like, come on! And the motorcycle rider just looks back at you like you're a chump waiting in traffic like everyone else and they just whiz by like there's no cars on the highway at all. These teenage hackers find ways through roadblocks that we just don't see.

18:16Like you don't need someone's password when the password reset question is, what's your favorite food? And you put pizza up there and now anyone can just write pizza on there and they could reset your password for you. And it's like, come on, what's the point of passwords if they could just be bypassed so easy? And sometimes it would try to validate it's really you by asking for your zip code. Well, if you have their email address, it's not too hard to use some kind of people search tool online to look to see what someone's zip code is. You and I don't think like that though, but Ricky does.

18:46He's the kind of guy that looks at us like weird chumps for choosing an easy password recovery question. This was all happening in 2012. And Ricky was 16 years old when he stole his first gamertag. He found the one he wanted, Wolverine. Yeah, that sounds cool. He wasn't an X-Men fan. He just liked the sound of it. So he called up Zune Support, which is a Microsoft product, and is like, I have a problem with my account. They ask him for his email address associated with the account. He says, well, I don't know.

19:17Can you just look at my Xbox gamertag? And they said, you know what? That works. What's your gamertag? Ricky says, Wolverine. Zune Support says, ah, yes, I see your account, sir. What can I help you with? Ricky says, okay, well, the problem is that when I, you know what? Actually, hold on. Something just came up. Can I call you right back? And Zune Support says, yeah, sure. Do you want a reference number for when you call back? It'll be easier for us to find your details. And Ricky says, yes. Yes, I do want that. And he hangs up. And then he calls Xbox Support this time and tells them,

19:49I was on with support, but I got disconnected. Can you look up my case if I give you a reference number? And they said, yeah, go ahead. And he reads the number to them and they see his details. Xbox Support's mode of operation then was that if someone had a reference number, they must have already verified they are the account holder. So they ask him, what's the problem? How can I help you? And Ricky says, I just forgot what email address I used for this account. He makes up some story about why he can't remember. He happened to be a good liar. Maybe it was that he got a new computer and didn't have those details on his new one.

20:22And Xbox Support thinks, you know what? This is a harmless request. Sure, your email address is blah, blah, blah at AOL.com. Great, he says. That's all I wanted. And he hangs up. Now he has an email address associated with that gamer tag. All he needs now is the password. Trying to get the password for an Xbox account is tricky, though. So he has a better solution. Try to reset the password on AOL.com's email address. And once in there, he can reset the Xbox account and get control of that gamer tag.

20:55And this is where he uses different tricks to get into an AOL account by telling the website, I forgot my password, and it asking for his favorite food or zip code to verify it's him. And from there, bingo. He can now access the email account and reset the password for that Microsoft gamer tag and get into it. This is how he became Wolverine. I just thought it was cool, like a cool alias to have. And that was like the first one I ever took. So I was like, you know what? That's what it is.

21:26So Wolverine. Yeah. So that's my alias. Ricky didn't have steel claws like Wolverine did. His weapons were his keyboard and telephone. And once Ricky got his first taste of stealing a gamer tag, he wanted more. He went back to that marketplace on Hackforms where people were selling gamer tags. People were selling things like Gang or Spirit or Booty or Boss for a few hundred bucks each. Ricky started stealing gamer tags and then selling them for money on the site. For Bitcoin specifically.

21:57He started making some money off this. Not bad money either. A couple good gamer tags might sell for around $1,000. But many were just a few hundred bucks. And he'd play with them too, just to dunk on people. He'd log in with a stolen gamer tag. Totally pwn some other players in Halo 3 by knocking them offline with some DDoS attack. And then just laugh at it all. But sometimes, people would report him for abuse. And this would bring the party to a screeching halt. And I thought it was funny just to hit them offline and stuff like that. But eventually you just get banned.

22:28Like back then. Xbox was big on just banning your accounts and stuff for DDoS attacks. So I would just get banned over and over. Which then led to my consoles being banned. So I was always at GameStop and whatnot. Just trading in consoles for new consoles and selling my banned consoles and stuff like that. He told me this happened over a dozen times. And he would just keep selling banned Xboxes at the same GameStop. And then go to another one across town and buy another. And I just can't believe that they didn't catch on to him for constantly selling them banned Xboxes.

23:01They would plug it in to make sure it turned on. Which was fine with me. But they never checked, like, connected to Xbox Live and stuff like that. And he would do this again and again. So I would typically trade it in at one store and then go to a different GameStop and then buy the new console. I've probably went through at least 10, maybe closer to 20. You would think after a while that Ricky would be like, all right, all right, enough of this getting banned. I'll stop attacking people. But if there's some reason he was just so addicted to it that he would not stop attacking people and just kept getting reported for abuse again and again and again.

23:39Like, you would think after five times, it's like, okay, I'm tired of going down and getting a new Xbox. But no, Ricky, he would just keep doing it. Now, eventually, he graduated to stealing something even more valuable. It wasn't just gamertags anymore. His attention turned to Instagram handles. I was always just the old school Halo guy, like, Xbox guy. Like, I didn't want to transition into Instagram. I just stuck to what I know. And then just one day, like, a couple of my people were like, yo, like, why are you not doing Instagram?

24:11Like, it's the new wave. Like, so they kind of persuaded me. And they were like, listen, here's like, here's an AOL email address. Like, it's for the Instagram at bro, just like B-R-O. Nobody can take it. And I'm like, dude, it's an AOL. Like, what do you mean nobody can take it? At the time, Ricky felt like he could steal any Xbox gamertag he wanted. So what do you mean you can't steal this Instagram name, bro? It's tied to an AOL address account. Those are easy to get into. But this idea sparked something in Ricky. If he could get any gamertag he wanted, then how different would it be to get Instagram names?

24:46It's the same social engineering techniques that he figured out how to recover someone's password. But there's just way more money in it. With the Instagram bro, like, how nobody could get it that was, like, trying to get it. It's because it was linked. It was an adult account on AOL. But it had, like, it was, like, the parent account. And under the parent account, it had other accounts. And it was one of those emails under the parent account. That's why nobody could get it. And I was able to realize that. I realized it.

25:16Once I reset the main email, and I was like, yo, like, this isn't my email. Like, you have other accounts under that email. So once I was able to match everything up, I was like, yo, it's that specific one. I don't remember the exact email. But I was like, it's that one. I reset it, and the Instagram was right there. Funny story, though. The security question on it. I remember this conversation for the, probably if you're ever, I'll remember this. The lady was like, the security question is your favorite mythical creature. And I was like, you know, I put something random.

25:48I apologize. I don't remember what it was. She's like, okay, well, it's big and hairy. As you can guess, I guessed Bigfoot. She started laughing. And she goes, no, it's another word for Bigfoot. But I said, Sasquatch. She goes, yeah, that's right. Gave me the password reset. Man, I absolutely hate how easy this is for him. That customer service person really failed at keeping our accounts safe. I hope they got fired for giving Ricky this Instagram account, bro, because that's ridiculous.

26:21And that's how he got it. The way he'd steal an Instagram account is that he would get access to it, and he would log into it, and then he would have a second browser open with a brand new, fresh Instagram account that he just made. And he would change the username of the stolen one to something else. And then he would quickly switch to his fresh account and change its username to this stolen username. That way, the person, when they figure out that their Instagram account got stolen and they recover it, they still have all their DMs and their followers and all that.

26:51It's just that their name was changed because Ricky stole it. I would genuinely let them just keep their account. I don't want to mess with their pictures and take down their Instagram and close the account or anything. They can keep that. I got what I wanted, and that was it. A stolen Xbox handle might get you a few hundred dollars, but a good verified Instagram handle can go for a few thousand dollars. When Ricky stole the Instagram account, bro, he says he sold it for $8,000. People were paying him in crypto, Bitcoin, Ethereum, and Ricky was liking this.

27:24In an afternoon, he could steal a few accounts that would earn him maybe $10,000. This would become his main focus. All the ins and outs of how to steal accounts and how to sell them. He learned verified accounts, sold more than non-verified. He was stealing usernames left and right. Of course, Ricky wasn't the only guy doing this. In fact, he wasn't even discovering how any of this stuff worked. He was just learning from others who were doing the same thing.

Sim swapping and credentials

27:47There was this one sim swapper that Ricky met online named Joseph Harris, who I interviewed a while back. If you want to hear Joseph's story, you can listen to that episode. It's episode 118 called Hot Swaps. So me and Joseph were kind of in the same world, taking usernames and whatnot like that. We never really talked or anything. I knew him, he knew me type of thing. But then I ended up stealing a couple of his PlayStation names that he had. And he asked for them back, and I was just like, fuck off, pretty much. And then he was like, okay.

28:19And then I felt bad, and we talked. But I never gave him back. But we talked, and then we became friends. Even though you never gave him back, he became friends. Yeah. This is a strange world that he's in, where you earn respect for being a great liar. You earn respect for stealing things. Even if you steal things from other forum members, their reaction is like, oh, man, he caught me out. I should have secured my username better. Man, he's good. Him and Joseph became friends. And they would swap strategies for stealing usernames.

28:52And they would help each other out. But what makes all this so scary to me is that I don't even think Ricky was particularly good at computers. You have someone with very little computer skills that can just come at us and steal our stuff so easily. And it was really hard for victims to do anything. Instagram customer support is always overwhelmed. And I bet so is Microsoft. And they often side with the thief by telling them, yeah, there's nothing we could do to help you get it back. It takes a lot of effort to recover a stolen username. So victims often would just give up and stop trying.

29:23And they'd feel helpless in all this. And it just makes me wonder, how can I even protect myself when the company who keeps my stuff safe has these flaws? I mean, think about it like this. Suppose I go and stay at a hotel, and I leave my valuables in the room, and I leave for the day. I'm assuming my stuff is nice and safe behind a locked door. But we've seen stories where criminals will target a guest in a hotel, and they'll go to the front desk and say, oh, sorry, I'm staying in room 1020, and I locked myself out. Can I get a new key to get in? And the front desk sees these situations happen every day

29:56where a guest gets locked out of the room, and they want to help the guest. So if a criminal is posing as a guest, and they're convincing enough, they'll likely get the key. And it might play out like this. The front desk will ask for a photo ID, of course. But if you say, oh, yeah, you know what? I left it in the room. I was going to the pool, and I didn't bring anything. And that's the problem. I left everything in the room. And that's a real scenario that happens all the time. So the hotel is used to this kind of thing. So the hotel front desk might say, well, can you give me some more details about yourself?

30:26What's your phone number, email address, full name? And if you can verify those things, you are absolutely getting the key to that room. And who would be good at doing such a crime? Liars would be. Someone who can lie to the front desk person's face to get the room key, which it sounds like Ricky must have been a really good liar to convince so many customer support reps to give him the information he wants so that he can get into an account. And it just makes me wonder, how do you protect yourself

30:56when a company that has your stuff doesn't have good security controls to protect their customers? So Ricky's progressing through this scene, making a few hundred dollars with each Xbox gamer tag he steals, and then moving up to a few thousand dollars for each Instagram name he steals. But he started having trouble getting into some email accounts. Like some he just could not get into because his social engineering skills just didn't work there, or his password recovery tricks just didn't work, especially when two-factor authentication was on for some email accounts. So he told a friend, do you know more ways to get into email accounts?

31:29And that's when his friend told him about SIM swapping.

31:35Then as security and stuff escalated, that's when SIM swapping became a thing. So if we couldn't get it through the password reset or anything, through a security question, we could just SIM swap them. You've probably legally SIM swapped yourself a few times. Anytime you get a new phone and you have to move your number to the new phone you get, well, that's a SIM swap. That's all it is. Moving a mobile number to a new device. But what Ricky wanted to do was pose as the customer and convince the carrier

32:05that he just got a new phone and he wants to move his number to this new phone. I went into SIM swapping more in depth with episode 112 called Dirty Coms, which, by the way, just took the lead for the most downloaded episode of mine. It has now achieved 1.2 million downloads. And if you haven't listened to episode 112, you should absolutely go do it. But basically, what Ricky learned is that he can call the mobile provider and trick them into moving someone else's phone number to his phone. And if he can get that, then he can get into their email account, say something like, oh, I forgot my password.

32:35And it'll text them a code to generate a new password. And he can read those texts now. And from there, he can reset the password to the inbox and look at it and start rummaging through it looking for usernames and gamer tags to steal. Once I had the target that I was going for, usually I had their name or something or their email. And I needed the number or address or something. I would just usually typically call up Amazon, PayPal, or eBay. And I was going to get their information from one of those three companies as long as they had that on file

33:06or that person used like one of the three. And like social engineering, I would just be able to get the person's information. Okay. So you call up Amazon and what information do you have? What information are you looking for? I'm specifically probably targeting the number. You want the phone number? Yeah. Associated with an email address? Yeah. So if I knew like you had Jack on Instagram and I had your name, I would be able to call up as you.

33:37I'll probably, at this point, I'm probably going to have a little bit about you. Maybe like an email address or something. And I would just see if you had any three of those accounts, PayPal, Amazon, eBay. If you had one of them, I was going to call them up as you. I would say like, hey, my name is Jack. Like I need help verifying my account or something like that. Or if it was eBay, I think I would say I need help with an order. And then they'd be like, okay, what order? And once I verified them in the name and the email and file, what I would do is like,

34:08oh, like mid conversation, be like, oh, by the way, what's my number ending in whatever your number ended in? Because we would be able to see like the last two digits or something. And they would just read off the number. I'm not going to say there wasn't people who like haven't gotten away. Like I couldn't find them or something or I just gave up because it was too hard and on to the next. But 90 something percent of the time, like it was successful. That's such a hard number to believe because nobody's taken my Instagram yet. And I know people

34:39would love to have that feather in their hat to hack Jack.

34:43Yeah. I mean, from personal experience, I like what you guys do. But this was also back in 2015 or so. And if you had the username Jack and somebody came and asked me for that handle, I was probably going to get it. It's real interesting to me how Ricky pieces all this together, isn't it? I mean, he's grabbing at a single digit of a phone number from this place or that place. He's grabbing at just a few digits

35:14of a social security number from here or there. And then he's connecting it all together to get a more complete detail view of his victims. Like, for instance, he might go to Amazon not knowing if this target of his has an Amazon account or not. And he would say, hey, I forgot my password. And the website would say, okay, what's your email address? And he would put in the email address and then it would say, all right, well, we just texted you a code which ends in these two digits, three, four, or whatever. And he's just like, great,

35:44that's all I wanted to know. The last two digits of the phone number associated to this account. Like, you might think, what's the big deal if someone knows one of my social security numbers, right, or the last two digits of my phone number? This is why. This is why right here. Because people like Ricky are grabbing at every little detail to steal things from you so that it's just enough information that they can social engineer someone to give them the rest of the information. And they are persistent and clever and incentivized. I mean, how many times have you been asked to provide only the last four digits

36:15of your social security number to get something done? So the goal here was that Ricky needed to convince the mobile provider he's actually the customer. And they would ask him to prove it by providing things like a social security number or personal details. And Ricky would be able to get this kind of information off you because he had access to a people search database that for three bucks he could enter in whatever little info he had on you and they would give him back a ton of details. Which drives me nuts that we're so relaxed about our personal data

36:45and just give it to anyone who asks nicely. Because our lack of care about our own personal data translates to a lack of care for other companies to keep our personal data private. And that translates to criminals like Ricky who are exploiting our lack of care for his personal gain. We should be way more protective of who we're giving our private information to. All you have to do is put your name in the search and it would show me all your addresses and stuff. That's how I would be able to buy the correct social

37:15because let's say your name is a very common name or something but I can match up your docs like your address and stuff on the page. That's how I know what social to buy.

37:27So I'm not just blowing through everybody named John Doe and there's a hundred of them. I would just specifically target the one that had the correct docs and buy their social for three dollars call up AT&T, Verizon or T-Mobile or Sprint and give them the last four of the social to verify the account and just sim swap them.

37:47Okay. Is it that simple? You could call up this place and say hey I got up a new phone number. Back then yeah. Okay. And then can we verify that it's actually you? Okay. What information do you need? Well let's have your social. Okay. Here it is. Let's have your phone number. Okay here it is. That's all we need sir. Yeah. That was it. And then they would ask for the new IMEI and the new SIM card number and I had a burner phone and that was it. I'd get the text and I'd be in and out.

38:18When Ricky started sim swapping in 2015 he was going after video game accounts and social media usernames. And this is when his efforts really kicked into gear. He was taking over dozens of phone numbers and stealing lots of usernames. But after a while he started to connect some dots and his friends did too. All these usernames he was selling made his Bitcoin wallet keep getting bigger

Targeting crypto wallets

38:40and bigger. And at the time in 2016 Bitcoin was on this massive bull run rising steadily and quickly which meant a lot of people were getting into Bitcoin. And if you went anywhere online back then you would definitely hear someone talking about Bitcoin. It's called Bitcoin but it isn't really a coin. It's an intangible thing. It's a logarithmic number. Bitcoin has outperformed every other investment around. Trading never ceases. Every 10 minutes Bitcoin's heart

39:11beats. And transactions are processed. The exchanges never close. Social media and YouTube was going nuts about cryptocurrencies. If you were holding Bitcoin then in six months your money would have doubled. And it was rising exponentially. It would have doubled again four months after that and then doubled again three months after that. A lot of people were jumping in fast, investing, holding and surprisingly telling everyone else what they're holding. I personally I own Bitcoin in my hedge fund. I own Bitcoin in my fund. I own Bitcoin in my private account.

39:43It is a huge deal. I will show you my trend trading strategy for crypto. Ricky had Bitcoin and Ethereum himself. So he was watching videos like this and he was seeing this new surge of holders come onto the scene and he understood crypto enough to be familiar with how it all worked, how it's stored, how to transfer it, how to secure it. See, Bitcoin is electronic money. To transfer it it's really no harder than just sending an email and when it's sent

40:13there's no way to undo it. So Ricky and his online friends got the idea that instead of hacking into people's stuff to steal something to then sell it to turn it into Bitcoin, why not just hack into their crypto wallets directly and just steal it? Because after a while social media handles and gamertags just weren't enough. It was time to go bigger. Something with greater payouts and an even greater risk. It was time to target people's crypto wallets. Well you would sim swap them to get what?

40:45A username? Yeah. Like I said if we couldn't take the email or something but we had the number on file we would just sim swap it and then reset the email. And that was the whole point to the sim swap to access their email account by saying I forgot my password and it would text them a code to reset it and once he got into the email account it was suddenly a high stakes mad dash kind of moment and typically it was a group effort. A few of his close friends would also be part of this. Once the phone number was moved over to his new phone suddenly everyone

41:16was engaged. First they'd crack into the email address then that username and password would get shared to the group and his crew would start looting the inbox looking for anything crypto related to try to see where their bitcoin was stored. If we're in your Gmail like we're searching inbox if we're in your iCloud we're searching like pictures text pads like drafts and stuff like that for Gmail like specifically a lot of people save passwords on Gmail so we're gonna like check all those passwords and see if they work.

41:46I will say there was one time that me and a couple friends we were able to get into an account so he had a blockchain account and we were like okay let's go so we went into the blockchain reset the password we're in it had mid seven figures in it and he had a password to send the money out and we could never find that password so we never like we never took anything but we're sitting there

42:16looking at we're looking at that much money and we never got it people will typically store their crypto in one of two places either on an exchange or in their own private wallet and if it's on an exchange well that would quickly be discovered because he's in their inbox and so he's just searching for every major exchange to see if that person has an account there and if they found an email like welcome to Coinbase then they'd know this email address has a Coinbase account and they'd just go into Coinbase and say I forgot my password and they'd say

42:46no problem we'll email you a recovery link and they would recover the password and boom he would get into Coinbase and then have full control of someone else's money and if the person is storing it in a private wallet then to get access to that you would need the private key for that wallet or a seed phrase which is what's used to generate the private key Ricky and his team understood what these keys and phrases look like and so he would look for them in the inbox because these are things that you never want to lose if you're holding crypto a lot of people

43:17will just email themselves the private keys so surprisingly searching for private key or seed phrase resulted in finding crypto wallets but sometimes people would take screenshots of these things and store them on their iCloud or Google Photos account you know for safekeeping surely no one has access to your photos right well this crew would rummage through those photos looking for anything that looked like a photo of a password or a key or a wallet anything sensitive like that and eventually they would find

43:49a crypto wallet and drain it the people that would that were in the email would do that and then they would send it out to like one of our fresh wallets that we all had and then from there split it however many ways yeah from there then you split it separately we're a group so we always split everything but like I'm busy I'm working like they have to just wait for me to be ready because I typically had the burner phone Ricky doesn't remember the first crypto heist he did he says it was probably something low like probably under $20,000 and if you split that four ways

44:19it's way less right because he was in this crew and Ricky had a certain skill set that complimented his crew mine was probably doxing the person finding the information I had the burner phones and this was the beginning of Ricky's crypto heist spreet we're gonna take a quick ad break here but stay with us because when we come back I'm gonna introduce you to his mother this episode is sponsored by Delete Me have you ever thought I should really be doing something to protect myself

44:49from stalkers scammers and hackers but you're not sure what here's what you do go to join deleteme.com slash darknetdiaries and enter code DD20 and you'll get 20% off Delete Me a few years ago I signed up and ever since then Delete Me has been busy scouring the internet from my name and giving me reports on what they found and deleted stuff take control of your data and keep your private life private by signing up for Delete Me now at a special discount just for my listeners get 20% off your Delete Me plan when you go to

45:19www.joindeleteme.com slash darknetdiaries and use promo code DD20 at checkout the only way to get 20% off is to go to www.joindeleteme.com slash darknetdiaries and enter code DD20 at checkout that's www.joindeleteme.com slash darknetdiaries code DD20 While researching this episode

Mark's midnight attack

45:48I met this guy named Mark My name is Mark Reitzman and I'm pretty much a lifelong tech guy And I sat down with him to listen to his story His story takes place at the same time Ricky was doing all this stuff At the time you know I was working on something in the crypto space I had been interviewed a couple times so I was interviewed on a couple YouTube channels I had you know my name and persona on the website that I was developing at the time And there was this night in 2018 that permanently burned

46:19into Mark's memory He remembers driving through the Arizona desert on his way to visit his dad And I was actually talking to my father and then all of a sudden the line's dead But Mark doesn't freak out He's driving through the Arizona desert far from civilization The reception isn't great out there so he's thinking you know what maybe I'm just out of range of the towers I was sitting there on the dashboard so I could see the front of the phone it said it was like a network disconnect error and an SOS at the top How strange

46:50But he can't do anything now There's no cell service to call customer support even if he wanted And he's still driving to his dad's house Maybe it'll start working when he gets there Mark concentrates on the road in front of him His headlights carve out a small bubble of light on the road About ten minutes go by and still his phone isn't connected to anything Panic starts to sink in He knew about sim-swapping attacks and now his thoughts were starting to eat him up What if someone targeted him?

47:20His heart started racing But this can't happen to Mark He was smart about this He put safeguards in place for this exact attack It is not possible to sim-swap him He thought about this and he was ready I knew that it could happen But I thought I had set up my account profile with the carrier to where if I wanted to make a change on my account I would have to go into a store physically and have my driver's license and my passport Yeah So he set up

47:51his account to require two forms of ID and he had to be present in the store for it to happen There was no way to change his number over the phone But despite putting those safeguards in place his thoughts were still racing about what if what if it did happen There was no one around to help and he had no working cell phone He was all alone on the road with his thoughts Maybe it's just a network connection issue Maybe the bill didn't get paid Maybe the credit card got marked as stolen

48:21What is it? What's wrong? A little over an hour goes by with no connection and he finally arrives at his dad's house As soon as I got close to my parents' house the wifi kicks in and 6 password resets went right up my phone So that's when I knew that it was an actual nightmare You know my dad opens the door he wants to greet me you know give me a hug and I'm like I got an emergency I hadn't seen him in you know two years and it was panicked

48:51So as soon as I got my mobile phone working you know now I have to go deal with all the accounts like the email they got into to make sure they didn't set up some CC where it's like every email I send out you know they get a copy without me knowing So when you see that now your suspicion is confirmed and so I imagine your heart sank Oh yeah I mean I still have PTSD over it today six accounts one attack it all happened

49:22so fast all while Mark was stuck behind the wheel in the middle of the desert unable to do a thing about it by the time he made it to his dad's house he called the carrier to try to find out what happened Hey I think something's wrong I think my mobile account got stolen away The person on the line jumps into liability mode and wonders if Mark is the one lying Well how am I I called you on my phone I was in such a panic that I rushed inside the house and called you from my cell phone so how am I even able to call you Good points says the carrier Mark quickly starts

49:52trying to recover his account He knew he had been SIM swapped He knew his accounts were taken over by someone else He knew people were trying to steal money from him right now there was no time to say hi to dad He rolls up his sleeves and gets busy trying to get control of his accounts again Lucky for him he was able to get his phone reconnected rather quickly but the hackers had an hour head start so he's racing to do damage control He did a password reset on his email He got back in He looked to see what emails came in There were password resets for a few accounts It was a bank account

50:22It was two crypto accounts two cloud accounts and an email account and so I have to reset them and check the details One was his Coinbase account Someone changed the password on it That's where he kept his Bitcoin It's not good to see that someone got access to his Coinbase wallet He resets the password there and gets into it to see what happened The only thing I had at that point was Bitcoin It's the only thing I cared about I wasn't doing anything else It was pure Bitcoin so they just

50:53took the 2.2 Bitcoin away Dang, they stole all of it It was everything he had That wasn't worth a lot of money at the time but still they got him for everything and it all happened so fast Mark was mortified It's like coming to your house just to see the place ransacked your valuables stolen Suddenly you feel so vulnerable you feel defenseless you don't know if they're coming back or what's next At that point my mobile service is working but then every time I went to sleep I'm thinking are they going to

51:23sim swap me an hour later and then poured it back at 4am and so for about 60 to 90 days every day I woke up whether it was 3 in the morning 6, 7 in the morning I would look at my phone and see if it had LTE and I didn't use Wi-Fi for about 90 days because I was afraid that would mask it where I'd wake up and I've got Twitter updates email updates whatever comes in on the phone over data I might get tricked

51:54and thinking that the voice and the SMS is still working Mark became obsessed with trying to find out who did this to him he called the mobile provider over and over again seeking answers but they refused to tell him anything all he wanted to know was what employee or what store authorized this sim swap because he put those protections in place so how did all that get ignored but they were protecting their employees by not saying which employee did it or how it happened or what department did it or what store but after a lot

52:25of persistence and a lucky break he traced it back to an employee at a third party phone store in Memphis Tennessee you know the ones that say like they're authorized resellers of a mobile provider nowhere near where Mark lived it happened to be that employee's last day at work and it looks like someone paid them to sim swap a few phone numbers before leaving so while it says very clearly in Mark's account do not sim swap this customer unless they show two types of photo ID and are there in person the employee

52:56had enough privileges in the system to simply type yeah I saw both IDs and he was here in person and he was able to conduct the sim swap because at the end of the day that's all this really is it's a confirmation on a computer somewhere that you saw both IDs Mark says that's as far as he got with his investigation he doesn't know where his money went or who actually stole it just because the guy in the store did the sim swap doesn't mean that he's the one who stole the crypto he just got paid his cut for doing the swap which is known as an innie an insider

53:27to help you get someone else's phone number and while this absolutely terrified Mark and infuriated him he didn't feel like it was a big enough loss for him to open an investigation and go to court even if he somehow recovered his bitcoin it would cost way more in lawyer fees and it just wouldn't be worth it so he let it go the thieves got away cleanly with his 2.2 bitcoin and it's been over a decade now since this attack and still Mark can't fully shake this like every time he flies he gets a little worried

53:57that his phone service is going to be disconnected for a few hours like a 20 hour trip to Asia is pure agony for him after being a victim like this I mean I still have PTSD over it today like not to take away from real PTSD but sort of this digital PTSD of you know not knowing like every time I wake up it's like okay I'm going to log into my computer log in you know open up my phone and you know fortunately everything has been safe since then but yeah

54:27I mean it was painful I was very angry for months I couldn't sleep for months but despite this being a traumatizing moment for Mark he used it as sort of an origin story of his own he was so sick of mobile providers being pointless at protecting us against sim swaps that he started his own service to stop people who try to hijack phone numbers like this his company is called Ifani it's a mobile carrier that resells AT&T and Verizon service with one big difference extra protection against sim swap attacks and as we heard from Ricky Hanshoemaker

54:58the social engineering starts long before the phone call even starts as he told me he found many of his targets because they were just too public about their crypto someone would post on Twitter excited that their coin is going up or spoke on a panel about investing in certain coins and then posting that to YouTube or they would share tips on what to invest and how to store your coins it's all an attacker needs to hone in on their targets the more they know about what accounts you have or what coins you have or what software you use and the more they can use that to craft an attack

55:28just for you I always tell people the number one rule about having crypto is don't tell anyone you have crypto because even if your digital security is tip top I've heard stories about people getting drugged or robbed at gunpoint to get someone's crypto it's brutal out there and for Mark all that became a very painful lesson that he still thinks about nearly a decade after his attack with crypto like my wife knows that when I'm going to do anything with crypto it's like stay 30 feet away from me

55:59I don't want any distractions I don't want anybody asking me a question and I'm just really very conscious now about the fact that most hacking you know a lot of people think that hackers are trying to hack into your laptop or they're trying to hack into you know the back end of your Android phone your iOS phone but the reality is that it's probably like 99% of hacking is hacking the human mind and it's trying to get you to make a mistake

56:29or a company somebody that works at a company that you rely on for them to make a mistake and it really just comes down to like hacking the mind we have no idea if Ricky actually hacked Mark or not he probably didn't but I wanted to talk with Mark because I wanted to get a feeling of what that scenario is like for the victim what does the sim swap look like from the other side and it sounds awful nobody should have their stuff stolen like that Ricky didn't just stop at one heist once he got a taste of the money that he could steal he was hooked

57:00he wanted to do this again and again and very quickly

Millions in stolen crypto

57:03the money started adding up in 2018 the year Mark was targeted Ricky Hanshoemaker and his crew got so good at this that they were bringing in millions of dollars from their victims we found the money we sent it out and a couple million here a couple hundred thousand there and you know it adds up these numbers are startling right you've had to you've had to be surprised by a first big hundred thousand dollar or a million dollar lick yeah when I started doing it all like actually sim swapping

57:34and crypto and stuff like late teenager maybe 20 and I was like damn dude like I'm making more like than people make in a lifetime or like more than their decade of a salary and I'm making that in 10 minutes Ricky said that he would sometimes pay an employee at a cell phone store a couple hundred bucks to help them do a sim swap an insider who could bypass

58:04the security protections just like what happened to Mark this insider he says didn't know exactly how much was being stolen in crypto they were just happy to get a few hundred bucks to change someone's phone number in the system but that was nothing compared to the lion share that Ricky and his crew would get from the heist so once I had a couple million I was like damn like my my moral compass checked in I'm like I'm like actually screwing people's lives up like I have my own kid like my kid's gonna be set for life

58:34like just just living life now but we just kept going it was like almost like an addiction at that point while all this was going on Ricky was living a double life he had just turned 18 he had just finished high school he did not get the baseball scholarship for college he did get a girlfriend and they had a kid together and he was still living at home with his mom and he had a 9 to 5 job for the county's park and recreation department you know to keep up with the ruse that he's got some normal job

59:04with a regular income but of course that job was boring compared to his online world where millions of dollars were passing through his fingers so like I was just like changing trash bags and stuff like that at a park sitting in a work truck so I had like all the time in the world to just be on my phone like talking to everybody on discord or skype or something like that and while I'm at work like we're just hitting targets for crypto I had no idea you have a boy that works for the city this is Debbie Ricky's mom

59:35he had a county job wasn't the best money but I was happy he had it he had good benefits he had retirement with it and he went to work every day she had no idea her son was living this double life bringing in anywhere from $100,000 to a million dollars from victims but having all this Bitcoin was pointless unless Ricky could spend it and this is where he had to be careful crypto exchanges require KYC which stands for know your customer they want your full name and picture of your idea before they will let you exchange cryptocurrency

1:00:06for cash so that wasn't going to work his Bitcoin wallet was likely marked as fraudulent and if he used an exchange and gave them his name then they would probably call the cops on him so he needed a new plan a way to cash out Bitcoin without using an exchange and basically he just found another person in the world who would do it like he would send them the Bitcoin and they would hand him cash and he met them through localbitcoins.com I had a guy in the Tampa area if I needed $20,000 cash or less I can go to him or if I needed more

1:00:37I had a guy that was in Miami and he never scammed me but I would send him the crypto and he would mail me the cash yeah let's talk about both of these right so when you go to meet someone how does this meet go down typically it was at like a McDonald's or something we would just go sit in the booth I would send him the Bitcoin we would wait for the confirmations and for him to get it in his account and he would give me the cash prior to that though we had like the deal locked in at like a certain amount because like you know Bitcoin would go up

1:01:07and down but I would typically just lock in the deal and I'd be okay we'll meet at 7 o'clock this is where we're going he would send me an address and I would just go there and then he'd just hand you an envelope yeah or just straight cash or envelope and whatnot but it was always like a public place like it was never like in a dark alley or anything crazy like that that's the classic way local Bitcoins worked you meet someone in person you send them the Bitcoin and they hand you the cash of course they'd take a percentage for doing this deal maybe they'd give Ricky 95% of the money and keep 5% for themselves

1:01:38for the trouble of having to launder these Bitcoins so you actually had a lot of people making decent money on local Bitcoins just buying crypto off people but eventually Ricky needed to cash out bigger and bigger amounts and this person he was working with wasn't able to cash out what he needed so Ricky had to find someone new and this new person was like send me the Bitcoin I'll send you the cash in the mail it typically would just come in like a vacuum sealed like clear envelope

1:02:09wrapped in like another envelope kind of thing sometimes it would be like inside of a book like a big like Harry Potter book or something like that and like the pages would be cut out and the money would be like in there and what's funny is like I lived with my mom so like packages are coming to the house but you know I'm 18 years old like she's not going through my mail so she would just take the envelope put it on my bed and she'd be like hey the mail came for you she had no idea what was inside of it alright so you're you're loading it up in crypto here

1:02:39things are coming in $100,000 million dollars at a time so you're leading a double life here you're living with your mom does she have any idea that you're doing any of this stuff involved with this

Mom's perspective and cops

1:02:50first of all she doesn't really understand like what the hell crypto was and she was like like Ricky like what are you doing like how do you have all this money like I was I bought like a $100,000 like F-254 truck I had jet skis I had side-by-sides I got a lot of toys and stuff like that it really got my attention when he came home with the truck I said what is going on I would just lie to her I was like yo like I invested back then and you know at the time when I started Bitcoin was a couple hundred dollars

1:03:22and now it's let's say $3,000 $6,000 so I made a lot just from that that little growth so I was able but that's what I told her meanwhile I'm stealing I'm stealing it but so she has really no idea like the severity of it so my mom like she believed me she believed what I was saying like there's no reason for her not to believe me he never gave me a reason not to believe what he was doing was wrong because he wasn't that kind of kid Ricky's crypto investment

1:03:52explanation wasn't a total lie he did have Bitcoin investments and Debbie didn't have any reason to question it after all her own mother Ricky's grandmother dabbled in Bitcoin too so she knew it was real Ricky also had a young kid at home and Debbie thought why would he do anything to throw his life away I was a single mom I you know I did the best I could growing up with him he was a very honest child never got in trouble never was in like the principal's office he didn't get in fights so when he came home with the truck I just said

1:04:23you know I don't know what you're doing or what's going on but that's not normal and all I know is if you get in trouble there's not much I can do I mean I didn't you know and I said you had at that time it was just his daughter and you know between the mom and my son being the parents to this child they were both younger and I was really involved with my granddaughter and I just said to him you know it's just not your life anymore you have a child

1:04:54involved here Debbie believed her son and was proud of him and had no reason to think he would lie to her in fact she thought Ricky's crypto savviness could actually help others at the time she worked as a nurse in the Pasco County jail and one day she overheard some sheriff's deputies yapping about crypto I assumed at this point my son was doing really good with crypto because that's what division I was getting and you know I kind of went into work and was saying yeah my son you know

1:05:24does crypto bitcoin and you know he's done really well and they've matured and I remember one of the deputies you know was really interested and he's like really and they were like oh we'd love to talk to him and I was like yeah he's doing really good with it and one of the guys one of the deputies wanted to get with him and speak with my son so next thing you know my mom is like having me call these police officers and they're coming to the house to ask me about crypto they're asking me about investing they're asking me like what do I think I just went along with it like yeah you know crypto is great like this is what I recommend

1:05:55or I recommend bitcoin or ethereum I think XRP was actually blowing up at that time too I think I made a lot off XRP actually like which not with Jilly but like I used my dirty money and put it into XRP and XRP blew up and I was telling them about that and they were they were loving it so they were just like okay cool like you know thanks for chatting like they had no idea I was stealing it and how are you feeling inside oh I'm nervous I'm like mom that's what I told her like yo never again like don't

1:06:26like don't tell people what I do and I said to Ricky and you let this deputy come to the house and like talk to you by 2018 the walls started closing in on Ricky he says he has a hunch of when it all started to unravel one night he was doing a sim swap a crypto heist with some other guys online his crew and one of the guys was a younger kid and this younger kid was posing as an AT&T employee trying to social engineer someone into doing the sim swap

1:06:56for him but little did this kid know his mother was listening through the door and she heard him trying to scam someone on the phone that kid's mom called the cops on her son and that kid got arrested in Michigan Ricky and his crew did not know this all they knew was that kid suddenly went missing that's strange but they had no idea he got arrested but then that kid came back out of the blue and really really really badly wanted to get in on the action again Ricky suspected

1:07:27that's really weird that this kid got a bunch of money from a crypto heist and then disappeared for a while and now really wants back in they kept that kid at arm's length but that didn't matter another one of Ricky's friends was arrested shortly after who was also present on that same call where the kid's mom overheard them Joel Ortiz was arrested for sim swapping and stealing millions of dollars in crypto from victims he pled guilty and a judge sentenced him to a decade behind bars prosecutors said that he was the first sim swapper

1:07:58to ever be sentenced to prison in the US and after hearing about Joel's arrest Ricky was worried that he might be next I've known Joel and I've talked to him and I've done stuff with him and stuff where it was like hold on like this is a huge red flag and I remember I was eating at Ford's garage when it happened when I found out that Joel got arrested so that's what kind of raised my suspicion I'm like oh shit like Joel got caught like after hearing

1:08:28Joel went down you would think that it would give you a spook of some kind and be like okay I'm gonna lay low for a couple weeks or clear some stuff or get rid of some of the evidence yeah but you didn't do any of that um no just a day after learning about Joel's arrest

The morning raid

1:08:55the dominoes started to fall there are moments in our life that stand out forever maybe it's when your first child is born or first kiss or playing a video game for the first time for Ricky that day was July 18th 2018 on that day Ricky was still living at home with his mom and he had broken up with his girlfriend that he had a child with but he had a new woman and a new child with her I think the baby was a few months old at that point and the day started just like any other day Ricky was getting ready to go to work at the Parks and Recreation Department and his girlfriend left the house just before him

1:09:25so that she could go to work I used to live by like a cul-de-sac area and when she went to work she's like hey there's a lot of cops in this cul-de-sac I was like okay come back like that's weird that's off to me so when she went around the block the other way she's like yo they're also on this side of the house like on this block I was like alright I'm pretty sure they're coming I walk outside to go just act like I'm going to work like I knew at that point that they were probably coming for me I could see them

1:09:56coming down the road and I was like just just try to play it off and I went to go get up on my truck and they were like don't go in your truck don't run don't run Ricky stayed still standing next to his truck as officers handcuffed him if you want to lean against your truck or something hang tight you have anything

1:10:26on you that might hurt us if we've got you down or whatever alright it just ain't done you understand right now you're just being detained this is body cam audio from Ricky's arrest by the Pasco County Sheriff's Office it's the very same Sheriff's Office where his mom Debbie worked as a nurse when they came here that day and you know they I guess it would be a raid the house but they were very you know doing the search warrant stuff but they did not like break down our doors they didn't do anything so now I kind of like get up out of my bed

1:10:57and I look into like the kitchen area and there's two cops cops standing in the doorway and they're like hey Debbie I need you to come out here they know you they might yeah they knew my name they knew everything now yeah I knew some of them from coming in and out of work I think I kept saying what is going on what is going on what is happening and when they finally tell you this is what we think is going on what was your reaction to that we have a my reaction to that was like well isn't Bitcoin

1:11:28isn't this legal like that was my first reaction like but I thought it was legal so I kind of like looked at him and he goes he was not those coins and the money that he was getting Debbie did not belong to him he was stealing them and that's when I really realized like oh okay so now what Debbie sat outside the front of the house with Ricky as deputies collected evidence some of Ricky's burner phones his iPhone his crypto wallets and some other SIM cards were taken

1:11:59they took my truck they took two side by sides they took a trailer I had to trailer and haul everything Ricky was taken away in the back of a squad car to jail potion four I have one male adult 10-12 nothing else is in your pockets no sir they drive off to jail the 25 minute ride is mostly quiet Ricky is alone with his thoughts but he does ask the officer behind the wheel

1:12:29what to expect do you know how all this all goes like do I see a judge and then you'll have advisers I will and that's that'll be done by video like chat or whatever that'll be today right should be I can't get over how calm Ricky sounds he had been cooking up these schemes for years to steal things from who knows how many victims starting with a few hundred dollars in gamer tags to millions of dollars in crypto wallets and it all came to an end

1:13:00here in the back of the squad car maybe he was feeling relief like his big secret's out he doesn't have to lie to his mom anymore or try to walk quietly in the shadows of his double life but sitting in the back of the car you have to wonder what else is going through his head what's gonna happen to me or what about my family or what about my money he quietly listens as the officer driving him to the jail spells out the next steps for him I would think it would be this afternoon and that's when they'll

1:13:32basically just announce what you're charged with and then you know whether you're gonna whether you're gonna retain your own attorney or whether you're asking for a public defender okay and then but that is again I don't know if you're being charged federally okay which makes it different so alright thank you yes sir Ricky was booked in the county jail his mom was so distraught though she didn't want to see her son in jail

1:14:03what mother would so she went down to jail to see if she could bail him out I just knew it had to be done I wasn't leaving him in jail did he go to the very jail you worked at oh yeah he sure did all my nursing staff friends they were like oh my god Debbie's son's here what's going on and then like the sergeant like they all knew like you know once I posted bond for him you know get him out of here yeah they did they did do a little bit of let's say courtesy you know I shouldn't say courtesy but they treated him

1:14:33knowing that he was my son let's move him along you know yeah that must have been embarrassing yeah a little bit embarrassing a little bit of shocking embarrassing the only thing I wasn't actually physically working there anymore I had just left like six months prior but I mean it was still fresh I had worked there for you know almost 10 years they said his bail was $110,000 the cost of a bail bond is usually 10-15% of the total amount Debbie ended up paying that

1:15:04to a bail bondsman to get him out she didn't even hesitate she just immediately was there for him prosecutors charged Ricky with grand theft and money laundering the case against him dragged on for four years he had to wear an ankle monitor during that whole time and follow a strict curfew he pled guilty to federal charges of computer misconduct and conspiracy to commit wire fraud

Prison sentence and reflection

1:15:27by the time he went before a judge for sentencing Ricky didn't know what to expect in the courtroom or how it would affect his family his mom and fiance were there during the sentencing it was horrible it was I think one of the saddest days of my life I mean I remember standing in front of that judge I just cried and said look at I know my son did wrong I know he did wrong believe me I can't believe he did all this but he's that's not my like that's not the kind of kid he is it was horrible what did the judge

1:15:57say to that she was a woman and I could almost feel her sympathy for me and getting it but the law is the law and I agree and the law is the law and my son broke the law and he had to pay his consequences and I let him know you did not just do this to yourself you did this to your whole family we are all suffering through this we're suffering more than you are the judge sentenced Ricky to four years in federal prison and ordered him

1:16:28to pay 7.6 million dollars in restitution which is what the courts accused him of stealing I knew it could have I knew it could have been worse and it should have been worse and I was thankful that I got the 48 months like I knew it was coming and I knew it had to happen because like all the havoc I caused and I was like you know I gotta deal with it I did what I did and now I gotta do it like I lost like I had to leave like everybody like my family my mom my grandparents

1:16:58my kid like everybody so your child was four or five months old when you went away correct and that's like super hard because like all those like I've always said like the money whatever like the money can't buy back those memories that I missed like there's nothing I could do like his first walk his first talk like stuff like that that money can't buy it was so hard going to see him in prison and having to leave knowing that

1:17:30my kid's in prison me and his fiance we went and saw Ricky at least once a month if not twice a month we'd pack up the car we'd leave early one morning get there we drove you know six hours whatever it was with two kids in the car me and her only no men nobody to help us and we drove down there and you know had to do what we had to do and then spend the night

1:18:00in a hotel I mean it was horrible embarrassing horrible a combo of everything so many criminal hacker stories go the same way there's a video game a cheat an underground community an exploit a payday and then the knock on the door they don't usually have the foresight to see how it will inevitably end what do those millions of dollars really buy you a couple of years of wealth that you can't really show anyone some screenshots of good old times

1:18:31the skills to find gaps in security through social engineering whatever it is the windfall is worth a lot less when you factor in what you lose that's the real cost no cryptocurrency can buy back lost time or memories with your children that's what Ricky learned what was the worst part of this whole experience the worst part was the victims because I mean they didn't deserve it like you know so that was the worst part

1:19:03like dealing with I was like doing terrible things but I guess you have a chance like in prison you're like dude like looking back on like the shit that you caused like I can only imagine if I was in their shoes with a kid like that could have been used for like my like their kids like college funds or retirement or you know whatever the case may have been that they had that much money for and like I just came by and took it all hmm I if it was me I think I would have been

1:19:34the saddest or the worst part of it was just not seeing my child in those early days in those early years did that have an effect on you yeah that that's like the second part of it like the first part was like how I ruined innocent people's lives the second part now is like I went to prison I affected more people than just myself like I lost like I had to leave like everybody like my family my mom my grandparents my kid

1:20:05like everybody they were devastated like I know they were devastated like and it hurt me knowing that I hurt them like that like my actions caused all that after serving just a little more than two years in prison Ricky got out early

After prison and prevention

1:20:17in 2024 and these days he's thinking a lot about the time he has now since his release he's tried to turn his story into something useful to reach out to the very gamers like him who may follow a darker path of social engineering he's spoken at anti-fraud events and security conferences like Black Hat and DEF CON and Ricky what would have made a difference to you as a teenager that would have stopped you going down this pathway probably like companies who could intervene like get you before it's too late if you had a chance

1:20:49to use your skills for good and like actually help companies and what not where they could be like hey like like we offer you you know a job said job into this world where you don't have to do what I was doing I agree with that the people in his bubble at that time were all criminals and they used their skills for bad but if he had more exposure to people mentors for instance who could show him that these hacking tricks he knows the cleverness of his social engineering skills and his OSINT skills can be used for good and here's how I think that kind of stuff

1:21:20does influence a lot of people to turn away from their life of crime and to find a new home to be a productive member of society and so he's trying to do that now he's trying to build a pen testing company with another former sim swapper named Joseph Harris one of the people Ricky met in the hacker forums and they're hoping to get this company up and running next year a big thank you

1:21:51to Ricky and Debbie Henshoemaker for sharing this story with us and also thanks to Mark Kreitzman for telling us about one of the worst days of his life you can learn more about what he's working on at ifani.com if you liked this episode go listen to our most popular episode we've ever made episode 112 called Dirty Combs which goes into more details about this whole underground world or listen to Joseph Harris's story which is episode 118 called Hot Swaps hey have you listened to my other podcast yet low it is wild a lot of feedback from people are saying I'll pass

1:22:22which is fine it's not for everyone but I'm getting even more feedback from people saying well here let me actually pull up one of the quotes that came in today the end of episode 1 left me speechless and someone else wrote it has moved me in a way that I did not think a podcast could I mean when is the last time you heard a show that moved you in a way that you didn't know was possible if you need that in your life open your podcast player and type in low L-O-W I made it as easy as possible to find go find it

1:22:53go listen to it and tell me what you think this show is created by me the ghost in the groceries Jack Recyder this episode was written and produced by the packet snacker Sean Powers assembled by the fridge freaker Tristan Ledger mixing by proximity sound theme music by the mysterious breakmaster cylinder alright question if you dug up a tomb that was in a pyramid does it become unencrypted this is Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries

1:23:23Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries Dark Knight Diaries