Episode Show Notes

							
			
JACK: I think that when I was a kid I was a good liar. Don’t ask me where it stemmed from; probably because I was always getting in trouble, and that — I learned that if I was a good enough liar that I could sometimes lie my way out of trouble. But I was reading this post on Reddit the other day, 

and so many memories came back to me. [Music] There was this post. Some dad was complaining about his son being a ding-dong. He’s like, my son, who’s fifteen, wanted to get some ice cream, so we gave him a few bucks and sent him to the store. It happened to be a buy-one-get-one-free sale, and we all knew that, too. So, he went, he bought some ice cream on his own, and he came back with just one tub of ice cream. The knucklehead didn’t get the free one. He just paid full price for a single tub of ice cream. The store clerk even told him, hey, there’s a sale. You know you can get a second one free. But my boy just said, well, I only want one, and refused the second one.



His dad on Reddit was all miffed about how his son could be so daft and ignore free ice cream. He even said, I know that as soon as the boy finishes his ice cream he’s gonna want another, so why didn’t he just get two? He knows that we all love ice cream, so why didn’t he get one for his mom or his dad? Why did he get just one ice cream and not the second free one? It was free ice cream. This Reddit post blew up. Everyone was piling on about how dumb this kid was, saying stuff like, in my state you could disown your child for far less. Someone else said this is probably because the kid doesn’t go buy things very often and doesn’t know how to handle money very well or deals. The dad wrote in the post that he was starting to feel worried because people were saying some real mean things about his son, but nobody was saying what I was thinking. I feel like I know exactly what happened here, because I was in the exact same situation when I was a teenager.



If you would have talked to my mom then, she would have been just like this worried dad. She would have told you that I’m the worst shopper in the world. Because I’m almost certain that what happened is he ate a full tub of ice cream on his way home and then lied and said he only bought one. I mean, it all adds up. The boy was hungry for ice cream before even leaving the house. There’s no way he’s gonna wait until he gets home to have his first bite. Grab a spoon at the store and start on your way home. Also imagine the look on his face when the clerk told him, you know you can get a second one for free, right? No way. Dang, this is my lucky day. So, he must have gotten two, and on his way home he started thinking, shoot, mom and dad don’t know I got two. They only gave me enough money to get one. So, if I come back with one, they won’t even know there was a second. So, if I could scarf this second tub down before I even get home, it would be glorious. No rules. No regulations. No speed bumps. Just eat a whole tub of ice cream as fast as I can. Challenge accepted.



I’ll tell you, teenage boys can crush a whole tub of ice cream real easy. They can make a dozen cookies vanish instantly. They have the power to inhale desserts like no one else can. The real tell here is that the dad on the Reddit post even said, we would never let him eat a whole tub in one sitting. That’s the thing; the boy had an unregulated container of ice cream, and he thought no one is gonna know. No one is gonna stop him from eating all this in one sitting. Let’s do it. So, he saw this as his big stroke of luck and secretly slurped it down, and then tried to lie about it when he got home by saying, no, no, I only got one, I swear. But little did he know the entirety of Reddit was gonna believe that lie. He’s probably okay with them calling him names and stuff, because being misunderstood isn’t as bad as being caught in your lies. But I see you, kid. I’ve been in that same situation before. I’ve been in that situation many times. Two cupcakes I bought at the bake sale became one. Two chocolate bars from the fundraiser became one. Yeah, of course two ice creams from the ice cream truck became one, too. My mom could never understand why I would sometimes pay extra for a single cupcake.



Intro: [Intro music] These are true stories from the dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries.



JACK: Imagine going to a high school baseball game in New Port Richey, which is near Tampa, Florida. You see one kid, a center-fielder, who’s absolutely tearing it up out there. He’s catching anything that comes his way. He’s got an arm like a rocket. He could hit anything thrown at him. He’s built like a tank but runs like the wind, and it just looks like he’s in a different league than the rest of those high school players on the baseball field. He’s eating them up. It’s like all the other kids are in a lower league than him, and they’re just all playing in slow motion compared to him. You can tell this kid is the star. That is Ricky Handschumacher.



RICKY: So, I played center field, but initially I was really known for getting on base, getting hits, and then stealing bases.



JACK: Stealing bases.



RICKY: Yeah.



JACK: Is this where all this starts? This is where all of it starts, stealing bases.



RICKY: Coincidentally, yeah.



JACK: But were computers interesting to you or not at all?



RICKY: No, I was your gamer, you know? Like I said, I wasn’t your average nerdy kinda guy who’s antisocial or anything. I was always out with my friends. I was always out on the streets playing sports; you know, football, baseball, basketball with all my friends. Like, Friday night and Saturday night I would go roller skating. So, I was never like, home, but I did have a passion for actual gaming.



JACK: Alright. So, let’s talk about gaming. What was your game of choice?



RICKY: Halo 3 was my primary game.



JACK: [Halo sound effects] In 2010, fifteen-year-old Ricky is up late on a school night. His headphones are tuned in as he plays Halo 3 on his Xbox that’s humming away. Ricky doesn’t want to disturb his mom, who’s sleeping in the other room. On his glowing TV screen he’s trying to escape what looks like a war zone. He’s destroying all the other players in the game.



RICKY: I was good. So, I was always playing MLG and Team Slayer and all the ranked playlists against the pros and everything like that. Then, of course, naturally once you get to that level, there’s people who cheat on there and stuff. I was a high rank, but cheaters get high ranks, too, naturally because they’re just cheating. So, it kept happening to me.



JACK: People would go up against Ricky and see that they can’t beat him, so they decided to cheat to win. He didn’t know what was happening at first.



RICKY: [Music] My screen would just go blank and then they would stop the attack when the game was over, which means they’d just win by default pretty much, ‘cause we can’t even move. Or if they hit you hard enough, we actually — our whole internet would just go out. I was with my mom. She’s like, why is the internet out? So, I had to play stupid. Like, I have no idea. I don’t know what’s happening.



JACK: I’ve been in a similar situation. I remember the days when we had a family computer, and I downloaded a lot of random stuff and installed it on there. Time and time again I would break our computer. I didn’t want to get in trouble, so I would try real hard to fix it before anyone noticed. Because of that, I got really good at detecting viruses and malware and fixing it on the family PC. But for Ricky, he was on an Xbox, and when he’d play, the internet would go down in the whole house, and it was just him and his mom living there. His dad left the picture a long time ago. But strangely, this pattern kept happening. When he would play Halo 3 against other players, the internet would go out. The game would disconnect, and then when he would finally get back on, he would see that he lost the match.



RICKY: It happened to me again and again, and I’m like, alright. Then through the — through word of mouth I was like, oh, if they’re DDoSing us, like, okay. So, I’m like, what the hell is that? I was getting DDoSed attacked over and over and over.



JACK: Alright, so they somehow discovered your IP and then they attacked your IP, and that was enough to knock you offline and lose the game.



RICKY: Yeah, and that’s kinda where it all started. Then curiosity — I was like, okay, how are they doing this?



JACK: Remember, outside of gaming Ricky is not a computer guy. He doesn’t know what’s going on at all. So, he just turns his Xbox off and jumps on the family PC and starts trying to look for answers.



RICKY: I started browsing some forums, and I was like, okay, it’s called DDoSing attacks. So, I started looking that up. I’m like, hm, okay, seems pretty simple. There’s a bunch of different kind of booters, like an IRC booter or a putty booter. You could just — or you could just go online to a website and use that booter, which was less powerful, but it would get the job done. I browsed the forums, found out what it was, downloaded the programs myself. So, I was like, okay, well, if they do it to me, I’m gonna do it back to them.



JACK: Eventually he gets to the bottom of it. He discovers a whole world of ddossers and booters and punters and griefers who use malware to attack other players in the game to make them lose so you can win. Ricky decided, well, hey, I want to win, too. I want to try. [Music] So, he downloads a tool. He says it was Cain & Abel, and decides to try to use it to attack other players. He started a match, ran the tool to disconnect another player, then bingo; he sees they just freeze in the game and he can easily kill them, and he wins the match with almost zero effort. This was way easier than actually playing by the rules.



RICKY: That’s kinda where I got introduced to that world.



JACK: Yeah, so, at that point you were really competitive in baseball, you were really competitive at Halo. I just wonder, ‘cause you had a sense of pride, of ranking up on your own and being competitive in sports — and where’d that sense of pride go with cheating?



RICKY: I don’t know. I just let it take over, pretty much. I was like, well, this is easier than actually trying.



JACK: Yeah, but that’s not the sportsmanlike way.



RICKY: Yeah. I don’t know. I just took the easy way out and got the advantage.



JACK: Were you cheating in sports at all?



RICKY: No, that I was not cheating in.



JACK: Alright.



RICKY: No, I was naturally good.



JACK: Yeah, well, you were naturally good at Halo, too. You were in MLG and all that stuff.



RICKY: Yeah, I don’t know.



JACK: [Music] Who would have thought that this innocent little victory in Halo was going to lead Ricky down a long, dark path? From here he tried more Halo cheats like wall glitches, fast travel, reduced hitbox, and more. It was fun. This was the new game, not to compete competitively in Halo but to get around the game rules, to do things you weren’t supposed to, to be a god in the game. It gave him a sense of power. He saw the game differently now. He stopped seeing things on the screen like Covenant and Banshees and Needlers. Now he was seeing bytes and ones and zeros and the data behind the game, which gave him an incredible win streak. You know, the type of win streaks that you just have to take a screenshot of so that you can look back at from time to time and remember those matches. But even being a god can get boring after a while, and even though he was the winner in those screenshots of his, he would notice that some people seemed to be even cooler than him somehow.



Everyone looks the same in Halo 3. You’re all the same player, Master Chief. It’s just, everyone has a slightly different color. But there’s one thing that sets you apart from everyone else; your name, specifically your gamer tag. These are special, actually. They’re unique. There’s only one person in the world with your gamer tag. Some people call themselves cool things like Shadow Strike or Nebula Storm or Blade of Odin. Fine, but what about that guy that’s just called Wolf? How did he get that name, Wolf? Now that is fricking cool. Well, it’s a first-come, first-serve kinda thing. So, Wolf must have made that gamer tag a long time ago when Xbox Live was first created, when gamer tags first came out. They probably made the name in the first week or maybe even the first day, which makes them OG, right? But instead of Original Gangster, they’re the Original Gamer. Ricky wanted one of these short, cool gamer tags.



That would really set him apart from the other normies playing in the game by the rules, but all the good names were taken. So, he goes back online into the hack forums and starts looking to see, how do you get one of these? It turns out there’s a whole underground marketplace of people buying and selling Xbox gamer tags, but not in the way you might think. See, a typical online market, you’ll see people selling things that they’ve had for a long time or something that they’ve bought from someone else or something they made, right? But this was an underground hack forums marketplace. It operates differently. These gamer tags weren’t ones that sellers were sitting on for a while. No, all these gamer tags were stolen. When Ricky found that out, he leaned in closer. How do you steal a gamer tag? Well, there are a few ways, but the easiest is just to get someone’s password and username and take over their account, change their password, and now that gamer tag is yours. But getting someone’s password is tricky. Maybe an easier way to get it is to trick Microsoft that you’re the actual owner of the account and you just lost the password. Ricky saw some people were doing that and decided to try it himself.



RICKY: There was a company called Zune, which is like Microsoft’s music app. Come to find out what you could do is you could call up Zune, and then halfway through the call you just tell them your gamer tag that you’re targeting, and you say, okay, hey, my gamer tag is Jack. Then you just stop the conversation and be like, I have to go real fast. I’ll call back.



JACK: Before hanging up, though, Zune support would give Ricky a reference number for the case that they were working on. Then he’d hang up and call a different number, Xbox Support this time, and they’d say, how can I help you? He’d say, oh, well, I was on a call but it dropped. I have a reference number if you want to pull the case details up.



RICKY: Correct, yeah. You’d just simply say, yo, I have a reference number. Can you pull up my case? Then they would just give you the information right then and there. There was no questions asked.



JACK: Ah, interesting. So, it’s almost like a bypass of a verbal authentication. So, then when you call Xbox and say, I have this reference number, then they give you the e-mail address.



RICKY: Yep.



JACK: Then you say, can you reset the password?



RICKY: You would just be like, hey, yeah, here’s my reference number — validate the account. Then just — you could just literally ask them, hey, what’s the e-mail that I have on file? They’d read it off to you.



JACK: How do you get the password?



RICKY: Okay, so, back in the day AOL and Yahoo were your most popular domains. What’s their proof of ownership of an account of an e-mail, was literally — AOL was like, your billing zip code would verify the account, and then they would be able to reset the password for you. Same with Yahoo. I think Yahoo was security questions, which back in the day was terrible because people would — a lot of the time chicken or pizza would be your favorite food that people would put, and stuff like that. So, they were pretty much takeable.



JACK: See, that’s the thing that amazes me about these teenage hackers. They see the world differently than us, kinda like when you see motorcycles lane-splitting. You ever get stuck on a highway and there’s bumper-to-bumper traffic and you’re standing still in your car and a motorcycle comes zooming past you right in-between the two lanes? You’re like, come on. The motorcycle rider just looks back at you like you’re a chump waiting in traffic like everyone else. They just whiz by like there’s no cars on the highway at all. These teenage hackers find ways through roadblocks that we just don’t see. Like, you don’t need someone’s password when the password reset question is ‘What’s your favorite food?’ and you put ‘pizza’ up there. Now anyone can just write ‘pizza’ on there, and they could reset your password for you. It’s like, come on, what’s the point of passwords if they could just be bypassed so easy? Sometimes it would try to validate it’s really you by asking for your zip code.



Well, if you have their e-mail address, it’s not too hard to use some kind of people search tool online to look to see what someone’s zip code is. You and I don’t think like that, though, but Ricky does. He’s the kind of guy that looks at us like we’re chumps for choosing an easy password recovery question. This was all happening in 2012, and Ricky was sixteen years old when he stole his first gamer tag. [Music] He found the one he wanted, Wolverine. Yeah, that sounds cool. He wasn’t an X-Men fan; he just liked the sound of it. So, he called up Zune support, which is a Microsoft product, and is like, I have a problem with my account. They ask him for his e-mail address associated with the account. He says, well, I don’t know. Can you just look up my Xbox gamer tag? They said, you know what? That works. What’s your gamer tag? Ricky says, Wolverine. Zune support says, ah, yes, I see your account, sir. What can I help you with? Ricky says, okay, well, the problem is that when — you know what?



Actually hold on; something just came up. Can I call you right back? Zune support says, yeah, sure. Do you want a reference number for when you call back? It’ll be easier for us to find your details. Ricky says, yes, yes, I do want that. He hangs up, and then he calls Xbox Support this time, and tells them, I was on with support but I got disconnected. Can you look up my case if I give you a reference number? They said, yeah, go ahead. He reads the number to them, and they see his details. Xbox Support’s mode of operation then was that if someone had a reference number, they must have already verified they are the account holder. So, they ask him, what’s the problem? How can I help you? Ricky says, I just forgot what e-mail address I used for this account. He makes up some story about why he can’t remember. He happened to be a good liar. Maybe it was that he got a new computer and didn’t have those details on his new one. Xbox Support thinks, you know what?



This is a harmless request. Sure. Your e-mail address is blahblahblah@aol.com. Great, he says. That’s all I wanted, and he hangs up. Now he has an e-mail address associated with that gamer tag. All he needs now is the password. Trying to get the password for an Xbox account is tricky, though. So, he has a better solution; try to reset the password on aol.com’s e-mail address. Once in there, he can reset the Xbox account and get control of that gamer tag. This is where he uses different tricks to get into an AOL account, by telling the website, I forgot my password, and it asking for his favorite food or zip code to verify it’s him. From there, bingo. He can now access the e-mail account and reset the password for that Microsoft gamer tag and get into it. This is how he became Wolverine.



RICKY: Yeah, I thought it was cool, like a cool alias to have, and that was the first one I ever took. So, I was like, you know what? That’s what it is.



JACK: So, Wolverine.



RICKY: Yeah. So, that’s my alias.



JACK: Ricky didn’t have steel claws like Wolverine did. His weapons were his keyboard and telephone. Once Ricky got his first taste of stealing a gamer tag, he wanted more. He went back to that marketplace on hack forums where people were selling gamer tags. People were selling things like Gang or Spirit or Booty or Boss for a few hundred bucks each. Ricky started stealing gamer tags and then selling them for money on the site, for Bitcoin specifically. He started making some money off this, not bad money, either. A couple good gamer tags might sell for around $1,000. But many were just a few hundred bucks. He’d play with them, too, just to dunk on people. He’d log in with a stolen gamer tag, totally pwn some other players in Halo 3 by knocking them offline with some DDoS attack, and then just laugh at it all. But sometimes people would report him for abuse, and this would bring the party to a screeching halt.



RICKY: I thought it was funny just to hit them offline and stuff like that. But eventually you just get banned. Like, back then Xbox was big on just banning your accounts and stuff for DDoS attacks. So, I would just get banned over and over, which then led to my consoles being banned. So, I was always at GameStop and whatnot just trading in consoles for new consoles and selling my banned consoles and stuff like that.



JACK: He told me this happened over a dozen times, and he would just keep selling banned Xboxes at the same GameStop, and then go to another one across town and buy another. I just can’t believe that they didn’t catch on to him for constantly selling them banned Xboxes.



RICKY: They would plug it in to make sure it turned on, which was fine with me, but they never checked like — connected to Xbox Live and stuff like that.



JACK: He would do this again and again.



RICKY: So, I would typically trade it in at one store and then go to a different GameStop and then buy the new console. I’ve probably went through at least ten, maybe closer to twenty.



JACK: You would think after a while that Ricky would be like, alright, alright, enough of this getting banned. I’ll stop attacking people. But for some reason he was just so addicted to it that he would not stop attacking people and just kept getting reported for abuse again and again and again. You would think after five times, it’s like, okay, I’m tired of going down to get a new Xbox, but not Ricky. He would just keep doing it. Now, eventually he graduated to stealing something even more malleable. It wasn’t just gamer tags anymore. [Music] His attention turned to Instagram handles.



RICKY: I was always the old-school Halo guy, like Xbox guy. Like, I didn’t want to transition into Instagram. I just stuck to what I know. Then just one day, a couple of my people were like, yo, why are you not doing Instagram? It’s a new wave. So, they kinda persuaded me. They were like, listen, here’s an AOL e-mail address. It’s for the Instagram @bro, just like B-R-O. Nobody can take it. I’m like, dude, it’s an AOL. What do you mean nobody can take it?



JACK: At the time, Ricky felt like he could steal any Xbox gamer tag he wanted. So, what do you mean you can’t steal this Instagram name @bro? It’s tied to an AOL address account. Those are easy to get into. But this idea sparked something in Ricky. If he could get any gamer tag he wanted, then how different would it be to get Instagram names? It’s the same social engineering techniques that he figured out how to recover someone’s password, but there’s just way more money in it.



RICKY: With the Instagram @bro, how nobody could get it that was trying to get it, it’s because it was linked — it was an adult account on AOL, but it had — it was like the parent account, and under the parent account it had other accounts. It was one of those e-mails under the parent account. That’s why nobody could get it. I was able to realize that. I realized it. Once I reset the main e-mail, and I was like, yo, this isn’t my e-mail — like, you have other accounts under that e-mail. So, once I was able to match everything up, I was like, yo, it’s that specific one. I don’t remember the exact e-mail. But I was like, it’s that one. I reset it, and the Instagram was right there. Funny story, though; the security question on it — I remember this conversation. Probably forever I’ll remember this. The lady was like, the security question is your favorite mythical creature. I was like, you know, I put something random. I apologize. I don’t remember what it was. She’s like, okay, well, it’s big and hairy. As you can guess, I guessed Bigfoot. She started laughing and she goes, no, it’s another word for Bigfoot. I said, sasquatch. She goes, yeah, that’s right. Gave me the password reset.



JACK: Man, I absolutely hate how easy this is for him. That customer service person really failed at keeping our accounts safe. I hope they got fired for giving Ricky this Instagram account @bro, because that’s ridiculous, and that’s how he got it. The way he’d steal an Instagram account is that he would get access to it, and he would log into it, and then he would have a second browser open with a brand-new, fresh Instagram account that he just made. He would change the username of the stolen one to something else, and then he would quickly switch to his fresh account and change its username to the stolen username. That way the person, when they figure out that their Instagram account got stolen and they recover it, they still have all their DMs and their followers and all that. It’s just that their name was changed ‘cause Ricky stole it.



RICKY: I would genuinely let them just keep their account. Like, I don’t want to mess with their pictures and take down their Instagram and close the account or anything. Like, they can keep that. I got what I wanted and that was it.



JACK: A stolen Xbox handle might get you a few hundred dollars, but a good verified Instagram handle can go for a few thousand dollars. When Ricky stole the Instagram account @bro, he says he sold it for $8,000. People were paying him in crypto, Bitcoin, Ethereum, and Ricky was liking this. In an afternoon he could steal a few accounts that would earn him maybe ten grand. This would become his main focus, all the ins and outs of how to steal accounts and how to sell them. He learned verified accounts sold more than non-verified. He was stealing usernames left and right. Of course, Ricky wasn’t the only guy doing this. In fact, he wasn’t even discovering how any of this stuff worked. He was just learning from others who were doing the same thing. There was this one SIM-swapper that Ricky met online named Joseph Harris, who I interviewed a while back. If you want to hear Joseph’s story, you can listen to that episode. It’s Episode 118, called Hot Swaps.



RICKY: So, me and Joseph were kind of in the same world, you know, taking usernames and whatnot like that. We never really talked or anything. Like, I knew him, he knew me, type of thing. But then I ended up stealing a couple of his PlayStation names that he had. He asked for them back and I was just like, fuck off, pretty much. Then he was like, okay. Then I felt bad, and we talked, but I never gave them back. But we talked and we became friends.



JACK: Even though you never gave them back, you became friends.



RICKY: Yeah.



JACK: This is a strange world that he’s in, where you earn respect for being a great liar. You earn respect for stealing things. Even if you steal things from other forum members, their reaction is like, oh man, he caught me out. I should have secured my username better. Man, he’s good. Him and Joseph became friends, and they would swap strategies for stealing usernames, and they would help each other out. But what makes all this so scary to me is that I don’t even think Ricky was particularly good at computers. You have someone with very little computer skills that can just come at us and steal our stuff so easily. It was really hard for victims to do anything. Instagram customer support is always overwhelmed, and I bet so is Microsoft, and they often side with the thief by telling them, yeah, there’s nothing we could do to help you get it back. It takes a lot of effort to recover a stolen username. So, victims often would just give up and stop trying, and they’d feel helpless in all this.



It just makes me wonder, how can I even protect myself when the company who keeps my stuff safe has these flaws? I mean, think about it like this. Suppose I go and stay at a hotel and I leave my valuables in the room and I leave for the day. I’m assuming my stuff is nice and safe behind a locked door. But we’ve seen stories where criminals will target a guest in a hotel, and they’ll go to the front desk and say, oh, sorry, I’m staying in Room 1020 and I locked myself out. Can I get a new key to get in? The front desk sees these situations happen every day where a guest gets locked out of the room, and they want to help the guest. So, if a criminal is posing as a guest and they’re convincing enough, they’ll likely get the key. It might play out like this; the front desk will ask for a photo ID, of course, but if you say, oh yeah, you know what? I left it in the room. I was going to the pool and I didn’t bring anything, and that’s the problem. I left everything in the room.



That’s a real scenario that happens all the time. So, the hotel is used to this kinda thing. So, the hotel front desk might say, well, can you give me some more details about yourself? Like, what’s your phone number, e-mail address, full name. If you can verify those things, you are absolutely getting the key to that room. And who would be good at doing such a crime? Liars would be, someone who can lie to the front desk person’s face to get the room key, which it sounds like Ricky must have been a really good liar to convince so many customer support reps to give him the information he wants so that he can get into an account. It just makes me wonder, how do you protect yourself when a company that has your stuff doesn’t have good security controls to protect their customers?



So, Ricky’s progressing through this scene, making a few hundred dollars with each Xbox gamer tag he steals, and then moving up to a few thousand dollars for each Instagram name he steals. But he started having trouble getting into some e-mail accounts. Like, some he just could not get into because his social engineering skills just didn’t work there or his password recovery tricks just didn’t work, especially when two-factor authentication was on for some e-mail accounts. So, he told a friend, do you know more ways to get into e-mail accounts? That’s when his friend told him about SIM-swapping.



RICKY: [Music] Then as security and stuff escalated, that’s when simming, like SIM-swapping, became a thing. So, if we couldn’t get it through the password reset or anything, through a security question, we could just SIM-swap them.



JACK: You’ve probably legally SIM-swapped yourself a few times. Any time you get a new phone and you have to move your number to the new phone you get, well, that’s a SIM-swap. That’s all it is, moving a mobile number to a new device. But what Ricky wanted to do was pose as the customer and convince the carrier that he just got a new phone and he wants to move his number to this new phone. I went into SIM-swapping more in depth with Episode 112, called Dirty Coms, which by the way just took the lead for the most downloaded episode of mine. It has now achieved 1.2 million downloads, and if you haven’t listened to Episode 112, you should absolutely go do it. But basically what Ricky learned is that he can call the mobile provider and trick them into moving someone else’s phone number to his phone, and if he can get that, then he can get into their e-mail account, say something like, oh, I forgot my password, and it’ll text them a code to generate a new password. He can read those texts now. From there, he can reset the password to the inbox and look at it and start rummaging through it looking for usernames and gamer tags to steal.



RICKY: Once I had the target that I was going for — like, usually I had their name or something or their e-mail and I needed the number or address or something — I would just usually typically call up Amazon, PayPal, or eBay. Those were like — I was gonna get their information from one of those three companies as long as they had that on file or that person used one of the three. Social engineering — I would just be able to get the pertinent information.



JACK: Okay, so, you called Amazon, and what information do you have, what information are you looking for?



RICKY: I’m specifically probably targeting the number.



JACK: You want the phone number.



RICKY: Yeah.



JACK: Associated with an e-mail address?



RICKY: Yeah, so if I knew you had @Jack on Instagram and I had your name, I would be able to call up as you. I’ll probably — at this point I’m probably gonna have a little bit about you, maybe the e-mail address or something. I would just see if you had any three of those accounts; PayPal, Amazon, eBay. If you had one of them, I was gonna call them up as you. I would say, hey, my name is Jack. I need help verifying my account or something like that. Or if it was eBay, I think I would say I need help with an order. Then they’d be like, okay, what order? Once I verified them, the name and the e-mail on file, what I would do is be like, oh — like make conversation; be like, oh, by the way, what’s my number ending in whatever your number ended in? Because they would be able to see the last two digits or something. They would just read off the number. I’m not gonna say there wasn’t people who haven’t gotten away, like I couldn’t find them or something or I just gave up because it was too hard and on to the next. But 90-something percent of the time it was successful.



JACK: That’s such a hard number to believe, because nobody’s taken my Instagram yet, and I know people would love to have that feather in their hat, to hack Jack.



RICKY: Yeah, I mean, from personal experience, I like what you guys do, but this was also back in 2015 or so, and if you had the username @Jack and somebody came and asked me for that handle, I was probably gonna get it.



JACK: It’s real interesting to me how Ricky pieces all this together, isn’t it? I mean, he’s grabbing at a single digit of a phone number from this place or that place. He’s grabbing at just a few digits of a social security number from here or there, and then he’s connecting it all together to get a more complete detail view of his victims. Like, for instance, he might go to Amazon not knowing if this target of his has an Amazon account or not, and he would say, hey, I forgot my password. The website would say, okay, what’s your e-mail address? He would put in the e-mail address, and then it would say, alright, well, we just texted you a code which ends in these two digits, 34 or whatever. He’s just like, great. That’s all I wanted to know, the last two digits of the phone number associated to this account. You might think, what’s the big deal if someone knows one of my social security numbers, right, or the last two digits of my phone number? This is why. This is why right here, because people like Ricky are grabbing at every little detail to steal things from you so that it’s just enough information that they could social engineer someone to give them the rest of the information.



They are persistent and clever and incentivized. I mean, how many times have you been asked to provide only the last four digits of your social security number to get something done? So, the goal here was that Ricky needed to convince the mobile provider he’s actually the customer. They would ask him to prove it by providing things like a social security number or personal details, and Ricky would be able to get this kind of information off you because he had access to a people search database that for three bucks he could enter in whatever little info he had on you, and it would give him back a ton of details, which drives me nuts that we’re so relaxed about our personal data and just give it to anyone who asks nicely, because our lack of care about our own personal data translates to a lack of care for other companies to keep our personal data private, and that translates to criminals like Ricky who are exploiting our lack of care for his personal gain. We should be way more protective of who we’re giving our private information to.



RICKY: All you had to do was put your name in the search, and it would show me all your addresses and stuff. That’s how I would be able to buy the correct social, because let’s say your name is like a very common name or something. But I can match up your dox, like your address and stuff, on the page. That’s how I know what social to buy. So, I’m not just blowing through everybody named John Doe, and there’s a hundred of them. I would just specifically target the one that had the correct dox and buy their social for $3, call up AT&T, Verizon, or T-Mobile or Sprint, and give them the last four of the social to verify the account, and just SIM-swap them.



JACK: Okay, is it that simple? You could call up this place and say, hey, I got a new phone number?



RICKY: Back then, yeah.



JACK: Okay. Then can we verify who — that it’s actually you? Okay, what information do you need? Well, let’s have your social. Okay, here it is. Do you have your phone number? Okay, here it is. That’s all we need, sir.



RICKY: Yeah, that was it. Then they would ask for the new IMEI and the new SIM card number. I had a burner phone, and that was it. I’d get the text and I’d be in and out.



JACK: [Music] When Ricky started SIM-swapping in 2015, he was going after video game accounts and social media usernames. This is when his efforts really kicked into gear. He was taking over dozens of phone numbers and stealing lots of usernames. But after a while he started to connect some dots, and his friends did, too. All these usernames he was selling made his Bitcoin wallet keep getting bigger and bigger. At the time, in 2016, Bitcoin was on this massive bull run, rising steadily and quickly, which meant a lot of people were getting into Bitcoin. If you went anywhere online back then, you would definitely hear someone talking about Bitcoin.



SPEAKER 1: It’s called Bitcoin, but it isn’t really a coin, okay? It’s an intangible thing. It’s a logarithmic number.



SPEAKER 2: Bitcoin has outperformed every other investment around.



SPEAKER 3: Trading never ceases. Every ten minutes Bitcoin’s heart beats [snaps fingers] and transactions are processed. The exchanges never close.



JACK: Social media and YouTube was going nuts about cryptocurrencies. If you were holding Bitcoin then, in six months your money would have doubled, and it was rising exponentially. It would have doubled again four months after that and then doubled again three months after that. A lot of people were jumping in fast, investing, holding, and surprisingly telling everyone else what they’re holding.



SPEAKER 4: I personally — I own Bitcoin in my hedge fund. I own Bitcoin in my fund. I own Bitcoin in my private account. It is a huge deal.



SPEAKER 5: I will show you my trend trading strategy for crypto.



JACK: Ricky had Bitcoin and Ethereum himself, so he was watching videos like this, and he was seeing this new surge of holders come onto the scene. He understood crypto enough to be familiar with how it all worked, how it’s stored, how to transfer it, how to secure it. See, Bitcoin is electronic money. To transfer it, it’s really no harder than just sending an e-mail. When it’s sent, there’s no way to undo it. So, Ricky and his online friends got the idea that instead of hacking into people’s stuff to steal something to then sell it to turn it into Bitcoin, why not just hack into their crypto wallets directly and just steal it? Because after a while, social media handles and gamer tags just weren’t enough. It was time to go bigger, something with greater payouts and an even greater risk. It was time to target people’s crypto wallets. [To Ricky] Well, you would SIM-swap them to get what, a username?



RICKY: Yeah. Like I said, if we couldn’t take the e-mail or something but we had the number on file, we would just SIM-swap it and then reset the e-mail.



JACK: [Music] That was the whole point to the SIM-swap, to access their e-mail account, by saying I forgot my password, and it would text them a code to reset it. Once he got into the e-mail account, it was suddenly a high-stakes, mad dash kind of moment. Typically it was a group effort. A few of his close friends would also be part of this. Once the phone number was moved over to his new phone, suddenly everyone was engaged. First they’d crack into the e-mail address, then that username and password would get shared to the group, and his crew would start looting the inbox, looking for anything crypto-related to try to see where their Bitcoin was stored.



RICKY: If we’re in your Gmail, we’re searching the inbox. If we’re in your iCloud, we’re searching pictures, text pads, drafts and stuff like that. For Gmail specifically, a lot of people will save passwords on Gmail. So, we’re gonna check all those passwords and then see if they work. I will say there was one time that me and a couple friends, we were able to get into an account. So, he had a blockchain account. We were like, okay, let’s go. So, we went into the blockchain, reset the password. We’re in. It had mid seven figures in it. He had a password to send the money out, and we could never find that password. So, we never took anything. We’re sitting there looking at — we’re looking at that much money, and we never got it.



JACK: People will typically store their crypto in one of two places, either on an exchange or in their own private wallet. If it’s on an exchange, well, that would quickly be discovered, because he’s in their inbox. So, he’s just searching for every major exchange to see if that person has an account there. If they found an e-mail like Welcome to Coinbase, then they’d know this e-mail address has a Coinbase account, and they’d just go into Coinbase and say, I forgot my password. They’d say, no problem. We’ll e-mail you a recovery link, and they would recover the password. Boom, he would get into Coinbase and then have full control of someone else’s money. If the person is storing it in a private wallet, then to get access to that you would need the private key for that wallet or a seed phrase, which is what’s used to generate the private key.



Ricky and his team understood what these keys and phrases looked like. So, he would look for them in the inbox. Because these are things that you never want to lose if you’re holding crypto. A lot of people will just e-mail themselves the private keys. So, surprisingly, searching for ‘private key’ or ‘seed phrase’ resulted in finding crypto wallets. But sometimes people would take screenshots of these things and store them on their iCloud or Google Photos account. You know, for safe keeping. Surely no one has access to your photos, right? Well, this crew would rummage through those photos, looking for anything that looked like a photo of a password or a key or a wallet, anything sensitive like that. Eventually they would find a crypto wallet and drain it.



RICKY: The people that would — that were in the e-mail would do that, and then they would send it out to one of our fresh wallets that we all had.



JACK: And then from there split it however many ways.



RICKY: Yeah. From there, then you split it separately. We’re a group, so we always split everything. But like, I’m busy, I’m working. They have to just wait for me to be ready, ‘cause I typically had the burner phone.



JACK: Ricky doesn’t remember the first crypto heist he did. He says it was probably something low, like probably under $20,000. If you split that four ways, it’s way less, right? Because he was in this crew, and Ricky had a certain skill set that complimented his crew.



RICKY: Mine was probably doxxing the person, finding the information. I had the burner phones.



JACK: This was the beginning of Ricky’s crypto heist spree. We’re gonna take a quick ad break here, but stay with us, because when we come back, I’m gonna introduce you to his mother. While researching this episode, I met this guy named Mark.



MARK: My name is Mark Kreitzman, and I’m pretty much a lifelong tech guy.



JACK: When I sat down with him to listen to his story, his story takes place at the same time Ricky was doing all this stuff.



MARK: At the time I was working on something in the crypto space. I had been interviewed a couple times, so I was interviewed on a couple YouTube channels. I had my name and persona on the website that I was developing at the time.



JACK: [Music] There was this night in 2018 that permanently burned into Mark’s memory. He remembers driving through the Arizona desert on his way to visit his dad.



MARK: I was actually talking to my father, and then all of a sudden the line is dead.



JACK: But Mark doesn’t freak out. He’s driving through the Arizona desert, far from civilization. The reception isn’t great out there, so he’s thinking, you know what? Maybe I’m just out of range of the towers.



MARK: I was sitting there on my — on the dashboard, so I could see the front of the phone. It said — it was like a network disconnect error, and an SOS at the top.



JACK: How strange. But he can’t do anything now. There’s no cell service to call customer support even if he wanted, and he’s still driving to his dad’s house. Maybe it’ll start working when he gets there. Mark concentrates on the road in front of him. His headlights carve out a small bubble of light on the road. About ten minutes go by, and still his phone isn’t connected to anything. Panic starts to sink in. He knew about SIM-swapping attacks, and now his thoughts were starting to eat him up. What if someone targeted him? His heart started racing. But this can’t happen to Mark. He was smart about this. He put safeguards in place for this exact attack. It is not possible to SIM-swap him. He thought about this and he was ready.



MARK: I knew that it could happen, and — but I thought — I had set up my account profile with the carrier to where if I wanted to make a change on my account, I would have to go into a store physically and have my driver’s license and my passport.



JACK: Yeah, so, he set up his account to require two forms of ID, and he had to be present in the store for it to happen. There was no way to change his number over the phone. But despite putting those safeguards in place, his thoughts were still racing about what if? What if it did happen? There was no one around to help, and he had no working cell phone. He was all alone on the road with his thoughts. Maybe it’s just a network connection issue. Maybe the bill didn’t get paid. Maybe the credit card got marked as stolen. What is it? What’s wrong? A little over an hour goes by with no connection, and he finally arrives at his dad’s house.



MARK: As soon as I got close to my parents’ house, the Wi-Fi kicks in and six password resets went right at my phone. So, that’s when I knew that it was an actual nightmare. My dad’s — opens the door. He wants to greet me, give me a hug, and I’m like, I got an emergency. I hadn’t seen him in two years. It was panic. So, as soon as I got my mobile phone working, now I have to go deal with all the accounts, like the e-mail they got into to make sure they didn’t set up some CC where it’s like, every e-mail I send out they get a copy without me knowing.



JACK: So, when you see that, now you — now your suspicion is confirmed. So, I imagine your heart sank.



MARK: [Music] Oh yeah, it was — I mean, I still have PTSD over it today.



JACK: Six accounts, one attack. It all happened so fast, all while Mark was stuck behind the wheel in the middle of the desert, unable to do a thing about it. By the time he made it to his dad’s house, he called the carrier to try to find out what happened.



MARK: Hey, I think something’s wrong. I think my mobile account got stolen away.



JACK: The person on the line jumps into liability mode and wonders if Mark is the one lying.



MARK: Well, how am I —? I called you on my phone. I was in such a panic that I rushed inside the house and called you from my cell phone, so how am I even able to call you?



JACK: Good point, says the carrier. Mark quickly starts trying to recover his account. He knew he had been SIM-swapped. He knew his accounts were taken over by someone else. He knew people were trying to steal money from him right now. There was no time to say hi to dad. He rolls up his sleeves and gets busy trying to get control of his accounts again. Lucky for him, he was able to get his phone reconnected rather quickly, but the hackers had an hour head start. So, he’s racing to do damage control. He did a password reset on his e-mail. He got back in. He looked to see what e-mails came in that were password resets for a few accounts.



MARK: It was a bank account, it was two crypto accounts, two cloud accounts, and an e-mail account. So, I have to reset them and check the details.



JACK: One was his Coinbase account. Someone changed the password on it. That’s where he kept his Bitcoin. It’s not good to see that someone got access to his Coinbase wallet. He resets the password there and gets into it to see what happened.



MARK: The only thing I had at that point was Bitcoin. It’s the only thing I cared about. I wasn’t doing anything else. It was pure Bitcoin. So, they just took the 2.2 Bitcoin away.



JACK: Dang, they stole all of it. It was everything he had. That wasn’t worth a lot of money at the time, but still, they got him for everything, and it all happened so fast. Mark was mortified. It’s like coming to your house just to see the place ransacked, your valuables stolen. Suddenly you feel so vulnerable. You feel defenceless. You don’t know if they’re coming back or what’s next.



MARK: At that point my mobile service is working, but then every time I went to sleep, I’m thinking, well, are they gonna SIM-swap me an hour later and then port it back at 4:00 a.m.? So, for about sixty to ninety days, every day I woke up, whether it was 3:00 in the morning, 6:00, 7:00 in the morning, I would look at my phone and see if it had LTE. I didn’t use Wi-Fi for about ninety days because I was afraid that would mask it, where I’d wake up and — I’ve got Twitter updates, e-mail updates, whatever comes in on the phone over data. I might get tricked in thinking that the voice and the SMS is still working.



JACK: [Music] Mark became obsessed with trying to find out who did this to him. He called the mobile provider over and over again seeking answers, but they refused to tell him anything. All he wanted to know was what employee, what store authorized this SIM-swap? Because he put those protections in place, so how did all that get ignored? But they were protecting their employees by not saying which employee did it or how it happened or what department did it or what store. But after a lot of persistence and a lucky break, he traced it back to an employee at a third-party phone store in Memphis, Tennessee — you know, the ones that say they’re authorized resellers of a mobile provider — nowhere near where Mark lived. It happened to be that employee’s last day at work, and it looks like someone paid them to SIM-swap a few phone numbers before leaving.



So, while it says very clearly in Mark’s account ‘Do not SIM-swap this customer unless they show two types of photo ID and are there in person’, the employee had enough privileges in the system to simply type, yeah, I saw both IDs and he was here in person, and he was able to conduct the SIM-swap, because at the end of the day, that’s all this really is. It’s a confirmation on a computer somewhere that you saw both IDs. Mark says that’s as far as he got with his investigation. He doesn’t know where his money went or who actually stole it. Just because the guy in the store did the SIM-swap doesn’t mean that he’s the one who stole the crypto.



He just got paid his cut for doing the swap, which is known as an innie, an insider to help you get someone else’s phone number. While this absolutely terrified Mark and infuriated him, he didn’t feel like it was a big enough loss for him to open an investigation and go to court. Even if he somehow recovered his Bitcoin, it would cause way more in lawyer fees and it just wouldn’t be worth it. So, he let it go. The thieves got away cleanly with his 2.2 Bitcoin. It’s been over a decade now since this attack, and still Mark can’t fully shake this. Like, every time he flies, he gets a little worried that his phone service is going to be disconnected for a few hours. Like, a twenty-hour trip to Asia is pure agony for him after being a victim like this.



MARK: I mean, I still have PTSD over it today. Not to take away from real PTSD, but it’s sort of this digital PTSD of not knowing. Every time I wake up, it’s like, okay, I’m gonna log into my computer, log in, open up my phone, and of course everything has been safe since then. But yeah, it was painful. I was very angry for months. I couldn’t sleep for months.



JACK: But despite this being a traumatizing moment for Mark, he used it as sort of an origin story of his own. He was so sick of mobile providers being pointless at protecting us against SIM-swaps that he started his own service to stop people who try to hijack phone numbers like this. His company is called Efani. It’s a mobile carrier that resells AT&T and Verizon service with one big difference; extra protection against SIM-swap attacks. As we heard from Ricky Handschumacher, the social engineering starts long before the phone call even starts. As he told me, he found many of his targets because they were just too public about their crypto.



Someone would post on Twitter, excited that their coin is going up, or spoke on a panel about investing in certain coins and then posting that to YouTube, or they would share tips on what to invest and how to store your coins. It’s all an attacker needs to hone in on their targets. The more they know about what accounts you have or what coins you have or what software you use, then the more they can use that to craft an attack just for you. I always tell people the number-one rule about having crypto is don’t tell anyone you have crypto, because even if your digital security is tip top, I’ve heard stories about people getting drugged or robbed at gunpoint to get someone’s crypto. It’s brutal out there. For Mark, all that became a very painful lesson that he still thinks about nearly a decade after his attack.



MARK: With crypto, my wife knows that when I’m gonna do anything with crypto, it’s like, stay thirty feet away from me. I don’t want any distractions. I don’t want anybody asking me a question. I’m just really very conscious now about the fact that most hacking — a lot of people think that hackers are trying to hack into your laptop or they’re trying to hack into the back end of your Android phone, your iOS phone. But the reality is is that it’s probably like 99% of hacking is hacking the human mind, and it’s trying to get you to make a mistake or a company, somebody that works at a company that you rely on for them to make a mistake. It really just comes down to hacking the mind.



JACK: We have no idea if Ricky actually hacked Mark or not. He probably didn’t, but I wanted to talk with Mark because I wanted to get a feeling of what that scenario is like for the victim. What does the SIM-swap look like from the other side? It sounds awful. Nobody should have their stuff stolen like that. Ricky didn’t just stop at one heist. Once he got a taste of the money that he could steal, he was hooked. He wanted to do this again and again, and very quickly, the money started adding up. In 2018, the year Mark was targeted, Ricky Handschumacher and his crew got so good at this that they were bringing in millions of dollars from their victims.



RICKY: We found the money, we send it out, and — a couple million here, a couple hundred thousand there. It adds up.



JACK: These numbers are startling, right? You’ve had to be surprised by your first big hundred-thousand-dollar or million-dollar lick.



RICKY: Yeah. When I started doing it all, like actually SIM-swapping and crypto and stuff, like late teenager, maybe twenty — and I was like, damn, dude, I’m making more than people make in a lifetime, or more than their decade of a salary. I’m making that in ten minutes.



JACK: [Music] Ricky said that he would sometimes pay an employee at a cell phone store a couple hundred bucks to help them do a SIM-swap, an insider who could bypass the security protections, just like what happened to Mark. This insider, he says, didn’t know exactly how much was being stolen in crypto. They were just happy to get a few hundred bucks to change someone’s phone number in the system. But that was nothing compared to the lion’s share that Ricky and his crew would get from the heist.



RICKY: So, once I had a couple million, I was like, damn, my moral compass checked in. I’m like, actually screwing people’s lives up. I have my own kid. My kid’s gonna be set for life, like just living life now. But we just kept going. It was like — almost like an addiction at this point.



JACK: While all this was going on, Ricky was living a double life. He had just turned eighteen. He had just finished high school. He did not get the baseball scholarship for college. He did get a girlfriend, and they had a kid together, and he was still living at home with his mom. He had a 9:00 to 5:00 job for the county’s park and recreation department, you know, to keep up with the ruse that he’s got some normal job with a regular income. But of course, that job was boring compared to his online world, where millions of dollars were passing through his fingers.



RICKY: So, I was just changing trash bags and stuff like that at a park, sitting in a work truck. So, I had all the time in the world to just be on my phone, like talking to everybody on Discord or Skype or something like that. While I’m at work, we’re just hitting targets for crypto.



DEBBIE: I had no idea, a boy that works for the city.



JACK: This is Debbie, Ricky’s mom.



DEBBIE: He had a county job. It wasn’t the best money, but I was happy he had it. He had good benefits, he had retirement with it, and he went to work every day.



JACK: She had no idea her son was living this double life, bringing in anywhere from $100,000 to a million dollars from victims. But having all this Bitcoin was pointless unless Ricky could spend it, and this is where he had to be careful. Crypto exchanges require KYC, which stands for ‘know your customer’. They want your full name and picture of your ID before they will let you exchange cryptocurrency for cash. So, that wasn’t going to work. His Bitcoin wallet was likely marked as fraudulent, and if he used an exchange and gave them his name, then they would probably call the cops on him. So, he needed a new plan, a way to cash out Bitcoin without using an exchange, and basically he just found another person in the world who would do it. Like, he would send them the Bitcoin and they would hand him cash. He met them through localbitcoins.com.



RICKY: I had a guy in the Tampa area. If I needed $20,000 cash or less, I can go to him, or if I needed more, I had a guy that was in Miami, and he never scammed me, but I would send him the crypto and he would mail me the cash.



JACK: Yeah, let’s talk about both of these, right? So, when you go to meet someone, how does this meet go down?



RICKY: Typically it was at a McDonald’s or something. We would just go sit in the booth. I would send him the Bitcoin. We would wait for the confirmations and for him to get it in his account, and he would give me the cash. Prior to that, though, we had the deal locked in at a certain amount, ‘cause Bitcoin would go up and down. But I would typically just lock in the deal, and I’d be — okay, we’ll meet at 7:00. This is where we’re going. He would send me an address, and I would just go there.



JACK: And then he’d just hand you an envelope?



RICKY: Yeah, or just straight cash or an envelope and whatnot. But it was always a public place. It was never in a dark alley or anything crazy like that.



JACK: That’s the classic way LocalBitcoins worked; you meet someone in person, you send them the Bitcoin, and they hand you the cash. Of course, they’d take a percentage for doing this deal. Maybe they’d give Ricky 95% of the money and keep 5% for themselves for the trouble of having to launder these Bitcoins. So, he actually had a lot of people making decent money on LocalBitcoins just buying crypto off people. But eventually Ricky needed to cash out bigger and bigger amounts, and this person he was working with wasn’t able to cash out what he needed, so Ricky had to find someone new, and this new person was like, send me the Bitcoin; I’ll send you the cash in the mail.



RICKY: It typically would just come in a vacuum-sealed, clear envelope wrapped in another envelope kinda thing. Sometimes it would be inside of a book, like a big Harry Potter book or something like that, and the pages would be cut out and the money would be in there. What’s funny is I lived with my mom, so packages are coming to the house, but I’m eighteen years old. She’s not going through my mail. So, she would just take the envelope, put it on my bed, and she’d be like, hey, the mail came for you. She had no idea what was inside of it.



JACK: Alright, so you’re loading it up in crypto here. Things are coming in, $100,000, $1 million at a time. So, you’re leading a double life here. You’re living with your mom. Does she have any idea that you’re doing any of this stuff, involved with this?



RICKY: First of all, she doesn’t really understand what the hell crypto was, and she was like, Ricky, what are you doing? How do you have all this money? I bought a $100,000 F-250 Ford truck, I had jet skis, I had side-by-sides. I had a lot of toys and stuff like that.



DEBBIE: It really got my attention when he came home with the truck. I said, what is going on?



RICKY: I would just lie to her. Like, yo, I invested back then. At the time when I started, Bitcoin was a couple hundred dollars, and now it’s, let’s say, $3,000, $6,000. So, I made a lot just from that, that little growth. So, I was able — but that’s what I told her. Meanwhile I’m stealing it, but — so, she has really no idea the severity of it. So, my mom, she believed me. She believed that I was saying there’s no reason for her not to believe me.



DEBBIE: He never gave me a reason not to believe what he was doing was wrong, ‘cause he wasn’t that kinda kid.



JACK: Ricky’s crypto investment explanation wasn’t a total lie. He did have Bitcoin investments, and Debbie didn’t have any reason to question it. After all, her own mother, Ricky’s grandmother, dabbled in Bitcoin, too, so she knew it was real. Ricky also had a young kid at home, and Debbie thought why would he do anything to throw his life away?



DEBBIE: I was a single mom. I did the best I could growing up with him. He was a very honest child, never got in trouble, never was in the principal’s office. He didn’t get in fights. So, when he came home with the truck, I just said, I don’t know what you’re doing or what’s going on, but that’s not normal, and all I know is if you get in trouble, there’s not much I can do. I mean, I — and I said — at that time it was just his daughter, and between the mom and my son being the parents to this child, they were both younger, and I was fairly involved with my granddaughter. I just said to him, it’s just not your life anymore. You have a child involved here.



JACK: Debbie believed her son and was proud of him, and had no reason to think he would lie to her. In fact, she thought Ricky’s crypto savviness could actually help others. At the time she worked as a nurse in the Pasco County Jail, and one day she overheard some sheriff’s deputies yapping about crypto.



DEBBIE: I assumed at this point my son was doing really good with crypto, ‘cause that’s what — the vision I was getting. I kinda went into work and was saying, yeah, my son does crypto, Bitcoin, and he’s done really well, and they’ve matured. I remember one of the deputies was really interested. He’s like, really?



RICKY: They were like, oh, we’d love to talk to him.



DEBBIE: I was like, yeah, he’s doing really good with it. One of the guys, one of the deputies, wanted to get with him and speak with my son.



RICKY: So, next thing you know my mom is having me call these police officers and they’re coming to the house to ask me about crypto. They’re asking me about investing. They’re asking me like, what do I think? I just went along with it. Like, yeah, crypto’s great. This is what I recommend. I recommend Bitcoin or Ethereum. I think XRP was actually blowing up at that time, too. I think I made a lot off XRP, actually, which — not legitly, but I used my dirty money and put it into XRP, and XRP blew up. I was telling them about that, and they were loving it. So, they were just like, okay, cool, thanks for chatting. They had no idea I was stealing it.



JACK: And how were you feeling inside?



RICKY: Oh, I’m nervous. I’m like, mom — that’s when I told her. Like, yo, never again. Don’t tell people what I do.



DEBBIE: [Music] I said to Ricky, and you let this deputy come to the house and talk to you?



JACK: By 2018 the walls started closing in on Ricky. He says he has a hunch of when it all started to unravel. One night he was doing a SIM-swap, a crypto heist with some other guys online, his crew. One of the guys was a younger kid, and this younger kid was posing as an AT&T employee trying to social engineer someone into doing the SIM-swap for him. But little did this kid know, his mother was listening through the door, and she heard him trying to scam someone on the phone. That kid’s mom called the cops on her son, and that kid got arrested in Michigan. Ricky and his crew did not know this. All they knew was that kid suddenly went missing. That’s strange. But they had no idea he got arrested. But then that kid came back out of the blue and really, really, really badly wanted to get in on the action again.



Ricky suspected that’s really weird that this kid got a bunch of money from a crypto heist and then disappeared for a while and now really wants back in. They kept that kid at arm’s length, but that didn’t matter. Another one of Ricky’s friends was arrested shortly after, who was also present on that same call where the kid’s mom overheard them. Joel Ortiz was arrested for SIM-swapping and stealing millions of dollars in crypto from victims. He pled guilty, and a judge sentenced him to a decade behind bars. Prosecutors said that he was the first SIM-swapper to ever be sentenced to prison in the US, and after hearing about Joel’s arrest, Ricky was worried that he might be next.



RICKY: I’ve known Joel. I’ve talked with him and I’ve done stuff with him and stuff where it was like, hold on, this is a huge red flag. I remember I was eating at Ford’s Garage when it happened when I found out that Joel got arrested. So, that’s what kinda raised my suspicion. I’m like, oh shit, Joel got caught.



JACK: After hearing Joel went down, you would think that it would give you a spook of some kind and be like, okay, I’m gonna lay low for a couple weeks or clear some stuff or get rid of some evidence.



RICKY: Yeah.



JACK: But you didn’t do any of that.



RICKY: Um…no.



JACK: Just a day after learning about Joel’s arrest, the dominoes started to fall. There are moments in our life that stand out forever. Maybe it’s when your first child is born or first kiss or playing a video game for the first time. For Ricky, that day was July 18, 2018. On that day, Ricky was still living at home with his mom, and he had broken up with his girlfriend that he had a child with, but he had a new woman and a new child with her. I think the baby was a few months old at that point. The day started just like any other day. Ricky was getting ready to go to work at the parks and recreation department, and his girlfriend left the house just before him so that she could go to work.



RICKY: I used to live by a cul-de-sac area. [Music] When she went to work, she’s like, hey, there’s a lot of cops in this cul-de-sac. I was like, okay, come back. Like, that’s weird. That’s off to me. So, when she went around the block the other way, she’s like, yo, they’re also on this side of the house, like on this block. I was like, alright, I’m pretty sure they’re coming. I walk outside to go — just act like I’m going to work. Like, I knew at that point that they were probably coming for me. I could see them coming down the road. I was like, just try to play it off. I went to go get up in my truck, and they were like, don’t go in your truck. Don’t run, don’t run.



JACK: Ricky stayed still, standing next to his truck as officers handcuffed him.



OFFICER: You wanna lean against your truck or something?



RICKY: Yeah, if — whatever. I mean, just whatever. [Background talk]



OFFICER: You have anything on you that might hurt us if we pat you down or whatever? Alright. Just hang tight. You understand right now you’re just being detained.



JACK: This is body cam audio from Ricky’s arrest by the Pasco County Sheriff’s Office. It’s the very same sheriff’s office where his mom Debbie worked as a nurse.



DEBBIE: When they came here that day — and, you know, they — I guess it would be to raid the house, but they were very — doing the search warrant stuff, but they did not break down our doors. They didn’t do anything. So, now I kinda get up out of my bed and I look into the kitchen area, and there’s two cops standing in the doorway. They’re like, hey, Debbie. I need you to come out here.



JACK: They know you?



DEBBIE: Yeah, they knew my name, they knew everything. Now, yeah, I knew some of them from coming in and out of work. I think I kept saying, what is going on? What is going on? What is happening?



JACK: And when they finally tell you this is what we think is going on, what was your reaction to that?



DEBBIE: We have — my reaction to that was, well, isn’t Bitcoin — isn’t this legal? That was my first reaction; but I thought it was legal. So, I kinda looked at him and he goes, he was not — those coins and the money that he was getting, Debbie, did not belong to him. He was stealing them. That’s when I really realized like, oh, okay. So, now what?



JACK: Debbie sat outside the front of the house with Ricky as deputies collected evidence. Some of Ricky’s burner phones, his iPhone, his crypto wallets, and some other SIM cards were taken.



RICKY: They took my truck, they took two side-by-sides, they took a trailer I had, the trailer I haul everything.



JACK: Ricky was taken away in the back of a squad car to jail.



OFFICER: … I have one male adult, 1012. Nothing else is in your pockets?



RICKY: No, sir.



JACK: They drive off to jail. The twenty-five minute ride is mostly quiet. Ricky is alone with his thoughts, but he does ask the officer behind the wheel what to expect.



RICKY: Do you know how all this all goes? Like, do I see a judge and then…?



OFFICER: You’ll have advisors.



RICKY: I will? Okay.



OFFICER: That’ll be done by video, on chat or whatever.



RICKY: That’ll be today, right?



OFFICER: Should be.



JACK: I can’t get over how calm Ricky sounds. He had been cooking up these schemes for years to steal things from who knows how many victims, starting with a few hundred dollars in gamer tags to millions of dollars in crypto wallets, and it all came to an end here in the back of the squad car. Maybe he was feeling relief, like his big secret’s out. He doesn’t have to lie to his mom anymore or try to walk quietly in the shadows of his double life. But sitting in the back of the car, you have to wonder what else is going through his head. What’s gonna happen to me, and what about my family? What about my money? But he quietly listens as the officer driving him to the jail spells out the next steps for him.



OFFICER: I would think it would be this afternoon. That’s when they’ll basically just announce what you’re charged with, and then whether you’re gonna retain your own attorney or whether you’re asking for a public defender.



RICKY: Okay.



OFFICER: And then — but that is — again, I don’t know if you’re being charged federally.



RICKY: Okay.



OFFICER: Which makes it different, so…



RICKY: Alright, thank you sir.



JACK: Ricky was booked in the county jail. His mom was so distraught, though. She didn’t want to see her son in jail. What mother would? So, she went down to jail to see if she could bail him out.



DEBBIE: I just — it had to be done. I wasn’t leaving him in jail.



JACK: Did he go to the very jail you worked at?



DEBBIE: Oh yeah, he sure did. All my nursing staff, friends, they were all like, oh my god, Debbie’s son is here. What’s going on? Then the sergeant — they all knew once I posted bond for him, get him outta here. Yeah, they did do a little bit of, let’s say, courtesy. I shouldn’t say courtesy, but they treated him knowing that he was my son. Like, let’s move him along. You know?



JACK: Yeah, that must have been embarrassing.



DEBBIE: But yeah. Yeah, a little bit embarrassing, a little bit of shocking, embarrassing. The only thing — and I wasn’t actually physically working there anymore. I had just left like six months prior. But I mean, it was still fresh. I had worked there for almost ten years.



JACK: They said his bail was $110,000. The cost of a bail bond is usually 10% to 15% of the total amount. Debbie ended up paying that to a bail bondsman to get him out. She didn’t even hesitate. She just immediately was there for him. Prosecutors charged Ricky with grand theft and money laundering. The case against him dragged on for four years. He had to wear an ankle monitor during that whole time and follow a strict curfew. He pled guilty to federal charges of computer misconduct and conspiracy to commit wire fraud. By the time he went before a judge for sentencing, Ricky didn’t know what to expect in the courtroom or how it would affect his family. His mom and fiancé were there during the sentencing.



DEBBIE: It was horrible. It was I think one of the saddest days of my life. I remember standing in front of that judge. I just cried and said, look, I know my son did wrong. I know he did wrong, believe me. I can’t believe he did all this, but he’s — that’s not my — that’s not the kind of kid he is. It was horrible.



JACK: What did the judge say to that?



DEBBIE: She was a woman, and I could almost feel her sympathy for me and getting it, but the law is the law, and I agree. The law is the law, and my son broke the law, and he had to pay his consequences. I let him know you did not just do this to yourself. You did this to your whole family. We’re all suffering through this. We’re suffering more than you are.



JACK: The judge sentenced Ricky to four years in federal prison and ordered him to pay $7.6 million in restitution, which is what the courts accused him of stealing.



RICKY: I knew it could have been worse and it should have been worse, and I was thankful that I got the forty-eight months. Like, I knew it was coming. I knew it had to happen because all the havoc I caused. I was like, you know, I gotta deal with it. I did what I did and now I gotta do it. I lost — I had to leave everybody, my family, my mom, my grandparents, my kid, everybody.



JACK: Okay, so your child was four or five months old when you went away.



RICKY: Correct, and that’s super hard because all those — I’ve always said the money, whatever, the money can’t buy back those memories that I missed. Like, there’s nothing I could do; his first walk, his first talk, stuff like that, that money can’t buy.



DEBBIE: It was so hard coming to see him in prison and having to leave knowing that my kid’s in prison. Me and his fiancé, we went and saw Ricky at least once a month if not twice a month. We’d pack up the car, we’d leave early one morning, get there. We drove six hours, whatever it was, with two kids in the car, me and her only. No men, nobody to help us. We drove down there and had to do what we had to do, and then spend the night in a hotel. It was horrible, embarrassing, horrible, a combo of everything.



JACK: So many criminal hacker stories go the same way. There’s a video game, a cheat, an underground community, an exploit, a payday, and then the knock on the door. They don’t usually have the foresight to see how it will inevitably end. What do those millions of dollars really buy you? A couple of years of wealth that you can’t really show anyone? Some screenshots of good old times? The skills to find gaps in security through social engineering? Whatever it is, the windfall was worth a lot less when you factor in what you lose. That’s the real cost. No cryptocurrency can buy back lost time or memories with your children. That’s what Ricky learned. [To Ricky] What was the worst part of this whole experience?



RICKY: The worst part was the victims, because they didn’t deserve it. So, that was the worst part, dealing with — I was doing terrible things. But I guess you have a chance in prison; you’re like, dude — looking back on the shit that you caused — I can only imagine if I was in there and she was with a kid. That could have been used for my — their kids’ college funds or retirement or whatever the case may have been that they had that much money for, and I just came by and took it all.



JACK: If it was me, I think I would have been — the saddest or the worst part of it was just not seeing my child in those early day — in those early years. Did that have an affect on you?



RICKY: Yeah, that’s the second part of it. The first part was how I ruined innocent people’s lives. The second part now is I went to prison, I affected more people than just myself. I lost — I had to leave everybody, like my family, my mom, my grandparents, my kid, everybody. They were devastated. I know they were devastated, and it hurt me knowing that I hurt them like that. Like, my actions caused all that.



JACK: After serving just a little more than two years in prison, Ricky got out early in 2024. These days he’s thinking a lot about the time he has now. Since his release he’s tried to turn his story into something useful, to reach out to the very gamers like him who may follow a darker path of social engineering. He’s spoken at anti-fraud events and security conferences like Black Hat and DEF CON.



SPEAKER 6: Ricky, what would have made a difference to you as a teenager that would have stopped you going down this pathway?



RICKY: Probably companies who could intervene, like get you before you’re — it’s too late. If you had a chance to use your skills for good and after you help companies and whatnot, where they could be like, hey, we offer you a job, said job, into this world where you don’t have to do what I was doing.



JACK: I agree with that. The people in his bubble at that time were all criminals, and they used their skills for bad. But if he had more exposure to people, mentors, for instance, who could show him that these hacking tricks he knows, the cleverness of his social engineering skills and his OSINT skills, can be used for good and here’s how, I think that kind of stuff does influence a lot of people to turn away from their life of crime and to find a new home, to be a productive member of society. So, he’s trying to do that now. He’s trying to build a pen testing company with another former SIM-swapper named Joseph Harris, one of the people Ricky met in the hacker forums. They’re hoping to get this company up and running next year.



Someone else wrote, “it has moved me in a way that I did not think a podcast could.” I mean, when is the last time you heard a show that moved you in a way that you didn’t know was possible? If you need that in your life, open your podcast player and type in LOW, L-O-W. I made it as easy as possible to find. Go find it, go listen to it, and tell me what you think. This show is created by me, the ghost in the groceries, Jack Rhysider. This episode was written and produced by the packet-snacker, Sean Powers, assembled by the fridge phreaker, Tristan Ledger, mixing by Proximity Sound, theme music by the mysterious Breakmaster Cylinder. Alright, question; if you dug up a tomb that was in a pyramid, does it become unencrypted? This is Darknet Diaries.
Transcription performed by LeahTranscribes