Jennifer Clark took in a few miniature goats during the COVID-19 pandemic to help some people out.
Word got around fast.
“Next thing I knew, I had people tying animals to my fence, whole herds of 10 to 20 goats,” she said. “And then someone called me about a miniature highland cow, and I said I’d take him.”
Now she has a nonprofit rescue farm full of cute miniatures — horses, cows, donkeys and the friendly goats that she’s known for. Those give her rescue, J&J’s Second Chance Small Holdings, its more well-known moniker, The Goat Ladies.
As with any nonprofit rescue, money to run it has proven to be the hard part.
“I go through 100 tons of hay in a year,” Clark told Cowboy State Daily. “It’s been a lot of fun, but it’s been hard work.”
That led her to start a for-profit business that takes these rescued animals to office parties and birthday celebrations, helping defray some of the costs.
However, she’s also been applying for all sorts of grants and looking for donations from supporters.
That’s why when she got an email from a supporter claiming that someone wanted to donate part of an estate to “The Goat Ladies,” she was so elated.
Which also was when Clark nearly became one of the many Americans who have fallen for a scam that’s been collaring an increasing number of people in Wyoming and the U.S.
Business email scams have ballooned into a $55 billion dark web industry that’s consuming more money than Wyoming’s entire annual economic output, the FBI reports.
These con artists aren’t just after big banks and big businesses these days. They’re targeting small nonprofits, individuals and even cute furry animals like those Clark cares for through her rescue operation.
They Hit You In A Weak Moment
After her near brush with a variant of the Nigerian prince scam, Clark said she could finally see how so many people fall prey to these kinds of scams.
They’ve not only gotten much more sophisticated, but can land when people are in weak moments and struggling, or just trying to do something they believe in, making them think their efforts have finally paid off.
“I was so hoping maybe it was someone who was honestly seeing all the things we’ve been doing and goes, ‘Oh yeah, I want to give you some of my estate,’” she said. “It really was one of those big hopes, and that’s why it drew me in at all.”
Clark, however, was able to quickly recognize the signs of a scam in her email scammer’s responses.
“They really had me going for about 10 minutes,” she said.
After that, Clark got mad and decided she would pull a little reverse scam on them to at least waste their time like they had wasted hers.
“I was careful and didn’t give them any personal information,” she said. “But I wanted to see just how far they would go, because I’m kind of rotten that way.”
The con artist ultimately grew so frustrated with Clark that he or she told her they were cancelling the check that was promised to her.
That had Clark laughing at them just a little, because she knows that if someone’s an executor for an estate, he couldn’t legally just cancel the check.
“If someone’s an executor, if the deceased says that check goes to a particular organization or person, they would have to come and issue that check regardless,” Clark said.
And they certainly wouldn’t require the recipient buy a gift card to a gaming company first.'
J&J’s Second Chance Small Holdings in Albany County is a Wyoming nonprofit that was targed by a sophisticated email scam. (Courtesy J&J’s Second Chance Small Holdings via Facebook)
Wyoming Leads The Way
Clark credits Wyoming’s homegrown Cybersecurity Competition for Small Businesses for her newfound savvy in dealing with scam emails.
She felt like she had a pretty good handle on it before, but the program has really given her extra insight into a criminal landscape that’s constantly changing and adapting as new technology and opportunities appear.
The program is an annual event that helps businesses and nonprofits of all shapes and sizes fight back against these International con artists who have been trying to milk Americans for all that they’re worth — and then some if they just can.
Wyoming’s program has earned national and international acclaim, being the only one of its kind.
“It’s a wonderful course and it really opened my eyes to a lot,” Clark said.
Since taking the course, Clark has seen that the onslaught is not just coming through emails. It’s everywhere. Text messages, social media — any digital avenue that people use.
Big Banks Are Rich Targets
That’s something Sheridan Bank Senior VP of IT Neeriemer has noticed, too. He’s also seen that the level of threat has continued to escalate, not just in numbers, but in sophistication.
He estimates his bank is receiving upward of 2,000 emails a month seeking to hook someone in at the bank and turn them into a huge payday.
“The bad guys are just getting smarter and smarter,” Neeriemer told Cowboy State Daily. “They have more tools at their disposal. And with new technologies like AI, I mean, it used to be you could tell a scam email because it was poorly worded and had bad sentence structure. That’s not the case anymore.”
Emails that Neeeriemer is seeing these days tend to be well put together and the sites they direct people to look much more realistic.
“They tend to anchor on things that we do every day as businesspeople,” he said. “And by we, I mean the larger business community, not just banks. So it would be, for example, the way that invoices are delivered.”
Many invoices are delivered by email these days and require accessing an online portal.
“All of that structure is just creating opportunities for bad guys,” Neeriemer said. “And then when you click the link, it takes you to a site that looks very official but is (fake). So, what you’re actually doing when you log into that site is giving your credentials to whoever the attacker is.”
Now That I’m Here …
Once in someone’s account, Neeriemer said, the hacker often doesn’t do anything untoward right away.
“If I’m in your email as a bad guy, I will sit and lurk for a little bit,” he said. “I’ll just kind watch the emails flow in and out, see who you are communicating with and those sorts of things. And most of us trust emails from people we expect them from, or that we regularly communicate with, so the bad guy will try to leverage that trust relationship.”
One of the most stunning examples Neeriemer has witnessed involved a potential $50,000-plus payday. A real estate agent’s account had been hacked, and the bad guy was asking the bank to send the final settlement amounts on what sounded like a reasonable pretext.
The banker, correctly, kept telling the real estate agent that they couldn’t reveal that information to anyone but the customer.
Not only was the bad guy deleting the banker’s replies so the real estate agent wouldn’t realize he’d been compromised, but he was also bringing in other people to the conversation, seeking a work-around.
“The bad guy was engineering replies to the buyer saying, ‘Hey, we’re trying to work out this settlement information,’” Neeriemer said.
If the homeowner had provided that information and the banker hadn’t figured out something was wrong as quickly, that could have been one American’s dream home completely evaporating with the disappearing money.
“It was people within the process working the process the way it’s been designed, to verbally verify the information before actually transmitting it that made it fall apart,” Neeriemer said. “Ultimately, I believe the goal was to redirect the down payment for the house.
“Just think about how tragic that would have been for the buyer had it not been identified. That’s probably their life savings that they’re looking to spend on their dream house.”
And Now There’s AI
Things like that have Neeriemer and others in the corporate world constantly watching the cyber landscape for new threats, because the terrain and the level of threats are escalating all the time.
A recent deepfake in Hong Kong is a case in point.
“The long and short of it is that there was one real person on this call in a Zoom chat,” Neeriemer said. “The one real person was the person they wanted to initiate the financial transaction. Everyone else on the call, including the CFO, was AI.”
Because of the CFO’s realistic virtual appearance, along with all the other seemingly real faces on the call, the unfortunate employee was ultimately convinced to make 15 transfers totaling $200 million Hong Kong dollars to five Hong Kong bank accounts.
That amount comes out to a payday of about $25 million in U.S. dollars.
“These are the sorts of things that keep us up at night,” Neeriemer said. “And being a small institution, I think, is somewhat of an advantage in that I can pick up a phone and make a phone call or there’s going to be rumblings of something going, where everyone’s aware before a Zoom call like that. But it’s still frightening.”
The incident already has Neeriemer considering what else needs to change in his company’s protocols to catch this type of deepfake, where a person’s bosses are making a realistic appearance, talking and sounding like themselves, on a virtual reality Zoom chat.
There will be conversations as well, Neeriemer said, to consider what sorts of things need to change in light of such technology.
Among those changes will undoubtedly be aspects of corporate culture itself. Employees have to feel empowered to say, “Wait a minute,” instead of asking “How high?” when someone who looks and talks just like their boss seems to be ordering them to do something.
“Banks are a rich target for more than just the pure financial part of it, too,” Neeriemer added. “Banks hold a lot of information. You think about the information you have to share when you take out a mortgage. It’s everything that would be required from someone to commit fraud or take out loans in you name.”
Renée Jean can be reached at renee@cowboystatedaily.com.
