After sentencing one of the "Capitol Hill rioters" to 41 months in prison, a judge added that anyone with Facebook and Instagram posts like his would be "well advised" to just plead guilty right away. "You couldn't have beat this if you went to trial on the evidence that I saw."

And other rioters are now learning the same thing, reports the Associated Press: Earlier this month, U.S. District Judge Amy Jackson read aloud some of Russell Peterson's posts about the riot before she sentenced the Pennsylvania man to 30 days imprisonment. "Overall I had fun lol," Peterson posted on Facebook. The judge told Peterson that his posts made it "extraordinarily difficult" for her to show him leniency....

Among the biggest takeaways so far from the Justice Department's prosecution of the insurrection is how large a role social media has played, with much of the most damning evidence coming from rioters' own words and videos. FBI agents have identified scores of rioters from public posts and records subpoenaed from social media platforms. Prosecutors use the posts to build cases. Judge now are citing defendants' words and images as factors weighing in favor of tougher sentences.

As of Friday, more than 50 people have been sentenced for federal crimes related to the insurrection. In at least 28 of those cases, prosecutors factored a defendant's social media posts into their requests for stricter sentences, according to an Associated Press review of court records....

Prosecutors also have accused a few defendants of trying to destroy evidence by deleting posts.

"Russian hackers have stolen and published the personal data of tens of thousands of employees..." reports the Australian Financial Review.

Government officials have confirmed the breach — part of a ransomware attack — and say the stolen data may even include info on the country's premier, according to an Australian public broadcaster: The government said the records of at least 38,000 employees, but potentially up to 80,000 workers, have been accessed in a cyber-attack on external payroll software provider Frontier Software. The data includes names, dates of birth, tax file numbers, home addresses, bank account details, remuneration and superannuation contributions... Treasurer Rob Lucas said politicians, including Premier Steven Marshall, could be among those affected.
The treasurer added the breach potentially impacted "The highest of the high to the lowest of the low and all of the rest of us in between." Except for schoolteachers, and the Department of Education, who did not use Frontier's software.

The website publishing the 3.75 gigabytes of data claimed it was just 10% of the total amount, according to the Australian Financial Review, which "understands Russian organised crime group Conti, which claimed credit for launching the cyberattack on Queensland's energy network CS Energy, published the information." Australian Payroll Association chief executive Tracy Angwin said the hack was a wake-up call to employers using remotely accessed payroll systems to ensure they were secure...

Frontier Software said the hacker responsible for the incident was known to employ a "double extortion" strategy, which included encrypting systems and stealing the data.
In another report, Bleeping Computer describes Conti as "a long-lived Ransomware as a Service operation" that "still manages to evade prosecution even after high-profile incidents against vital national resources such as Ireland's Department of Health." The gang is believed to be behind the recent revival of the notorious Emotet botnet, which could lead to a massive new wave of ransomware infections. This week, Conti took responsibility for the attack against Nordic Choice Hotels, a Scandinavian hotel chain with 200 properties.
Thanks to Macfox (Slashdot reader #50,100) for tipping us off to the news.

In a bold bid to turn digital crooks away from a life of crime, Microsoft is offering a 50 percent discount on its Office suite to some people using pirated versions. The Verge reports: Ghacks reports that a new message in the Office ribbon bar is appearing on pirated Office apps, tempting people with a 50 percent discount on a genuine Microsoft 365 subscription. The message links to an official Microsoft website that claims "pirated software exposes your PC to security threats." Microsoft warns Office pirates that they run the risk of running into viruses, malware, data loss, identify theft, and the inability to receive critical updates. The discount brings the price of a Microsoft 365 Family subscription down to just $49.99 for the first year, or $34.99 for a year of Microsoft 365 Personal.

Alphabet's Google is suing two Russian nationals it claims are part of a criminal enterprise that has silently infiltrated more than a million computers and devices around the world, creating "a modern technological and borderless incarnation of organized crime." From a report: In a complaint being unsealed Tuesday in the U.S. District Court for the Southern District of New York, Google names two defendants, Dmitry Starovikov and Alexander Filippov, as well as 15 unnamed individuals. Google claims the defendants have created a âoebotnetâ known as Glupteba, to use for illicit purposes, including the theft and unauthorized use of Google users' login and account information. A botnet is a network of internet-connected devices that have been infected with malware. When summoned together, they can do the bidding of a hacker, often with the devices' owners not realizing their machines have been hijacked. A swarm of devices can jam traffic at websites, run malware to steal login credentials, sell fraudulent credit cards online and grant unauthorized access to other cyber criminals. The Glupteba botnet stands out from others because of its "technical sophistication," using blockchain technology to protect itself from disruption, Google said in the complaint. At any moment, the power of the Glupteba botnet could be used in a powerful ransomware attack or distributed denial of service attack, Google said.

When cybersleuths traced the millions of dollars American companies, hospitals and city governments have paid to online extortionists in ransom money, they made a telling discovery: At least some of it passed through one of the most prestigious business addresses in Moscow. From a report: The Biden administration has also zeroed in on the building, Federation Tower East, the tallest skyscraper in the Russian capital. The United States has targeted several companies in the tower as it seeks to penalize Russian ransomware gangs, which encrypt their victims' digital data and then demand payments to unscramble it. Those payments are typically made in cryptocurrencies, virtual currencies like Bitcoin, which the gangs then need to convert to standard currencies, like dollars, euros and rubles.

That this high-rise in Moscow's financial district has emerged as an apparent hub of such money laundering has convinced many security experts that the Russian authorities tolerate ransomware operators. The targets are almost exclusively outside Russia, they point out, and in at least one case documented in a U.S. sanctions announcement, the suspect was assisting a Russian espionage agency. "It says a lot," said Dmitry Smilyanets, a threat intelligence expert with the Massachusetts-based cybersecurity firm Recorded Future. "Russian law enforcement usually has an answer: 'There is no case open in Russian jurisdiction. There are no victims. How do you expect us to prosecute these honorable people?'" Recorded Future has counted about 50 cryptocurrency exchanges in Moscow City, a financial district in the capital, that in its assessment are engaged in illicit activity. Other exchanges in the district are not suspected of accepting cryptocurrencies linked to crime.

"We have identified a large-scale security breach..." the official announcement begins.

CNBC reports: Hackers have taken $196 million from crypto trading platform BitMart, a security firm said Saturday.

BitMart confirmed the hack in an official statement Saturday night, calling it "a large-scale security breach" and writing that hackers withdrew about $150 million in assets. However, blockchain security and data analytics firm Peckshield estimates that the loss is closer to $200 million. BitMart added in a statement that all withdrawals had been temporarily suspended until further notice and said a thorough security review was underway.

Peckshield was the first to notice the breach on Saturday, noting that one of BitMart's addresses showed a steady outflow of tens of millions of dollars to an address which [Ethereum analytics platform] Etherscan referred to as the "BitMart Hacker."

Peckshield estimated that BitMart lost around $100 million in various cryptocurrencies on the ethereum blockchain and another $96 million from coins on the binance smart chain. The hackers made off with a mix of more than 20 tokens, including binance coin, safemoon, and shiba inu.
This comes on the heels of a $120 million cryptocurrency heist from BadgerDAO.

Germany's incoming government is throwing its weight behind a ban on the use of biometric identification technologies such as facial recognition in public places. From a report: According to their coalition deal, the Social Democrats (SPD), Greens and liberal Free Democrats (FDP) want to "exclude" biometric recognition in public spaces as well as automated state scoring systems by AI through European law. "Biometric recognition in public spaces as well as automated state scoring systems by AI are to be excluded under European law," reads the coalition agreement, presented on Wednesday.

The EU's Artificial Intelligence Act, proposed in April, creates product safety rules for "high risk" AI that is likely to cause harm to humans. It also bans certain "unacceptable" AI uses, such as social scoring and restricts the use of remote biometric identification in public places from law enforcement, unless it is to fight serious crime, such as terrorism. The AI Act's prohibitions are some of the bill's most contentious articles, and many European countries have yet to decide what they think. Germany's support of a ban could rally other countries to the same view. Belgium and Slovakia have already expressed their support.

Two men have been indicted by a grand jury for running a massive YouTube Content ID scam that netted the pair more than $20m. TorrentFreak: Webster Batista Fernandez and Jose Teran managed to convince a YouTube partner that the pair owned the rights to 50,000+ tracks and then illegally monetized user uploads over a period of four years.

The government has introduced new legislation to protect smart devices in people's homes from being hacked. From a report: Recent research from consumer watchdog Which? suggested homes filled with smart devices could be exposed to more than 12,000 attacks in a single week. Default passwords for internet-connected devices will be banned, and firms which do not comply will face huge fines. One expert said that it was an important "first step". Cyber-criminals are increasingly targeting products from phones and smart TVs, to home speakers and internet-connected dishwashers. Hackers who can access one vulnerable device can then go on to access entire home networks and steal personal data.

In 2017, for example, hackers stole data from a US casino via an internet-connected fish tank. There have also been reports of people accessing home webcams and speaking to family members. And poor security on a home wi-fi router could have been behind the uploading of illegal child abuse images from a home network that led to police accusing an innocent couple of the crime. While there are strict rules about protecting people from physical harm -- such as overheating, sharp components or electric shocks -- there are no such rules for cyber-breaches.

Buy now, pay later services aren't just popular among consumers. They're also proving to be a hit with criminals. From a report: Fraudulent activity is on the rise at some of the largest buy now, pay later (BNPL) platforms in the industry, which include Klarna, Afterpay and Affirm, according to fraud experts who spoke with CNBC. BNPL products let shoppers split the cost of their purchases over three or four months, often interest-free. They've become massively popular in the U.S. and Europe, and generated almost $100 billion in transactions globally in 2020 alone. "Criminals love buy now, pay later," Martin Rehak, CEO and co-founder of Czech fraud detection start-up Resistant AI, told CNBC. "You can already see crime on multiple levels." Criminal gangs are exploiting weaknesses in the application process for BNPL loans, experts say, using clever tactics to slip through undetected and steal items ranging from pizza and booze to video game consoles.

One of the vulnerabilities, Rehak says, is BNPL firms' reliance on data for approving new clients. Many companies in the industry don' conduct formal credit checks, instead using internal algorithms to determine creditworthiness based on the information they have available to them. Retailers working with BNPL platforms "categorize things differently," Rehak said, adding that this can lead to inconsistency. "There is always a way to exploit this and basically steal from you using someone else's mistake." For example, a partner merchant may run a special promotion event for alcohol but assign a vague category like "special event." This runs the risk of fraud falling through the cracks if an artificial intelligence system doesn't recognize the category and gives it a more generic label with low default risk. Rehak said many scammers are stealing people's identities or taking over their accounts to evade detection, making unsuspecting victims foot the bill. He declined to name any specific companies being targeted, however, saying Resistant AI counts a number of BNPL businesses as clients.

Tonight CNBC interviewed science fiction luminary Neal Stephenson about his new "geoengineering climate change thriller" — and about his coining of the original term "metaverse." Author Neal Stephenson shot to fame almost 30 years ago with the science-fiction novel "Snow Crash," which envisioned a future dominated by mega-corporations and organized crime, competing for dominance in both the real world and the "metaverse," a computer-generated world accessible through virtual reality headsets. Since then, he's written several more novels encompassing technology and history, including a trilogy set at the dawn of the scientific revolution, and has done work for various technology companies including Jeff Bezos' space travel company, Blue Origin, and augmented reality company Magic Leap.

His new novel, "Termination Shock," out November 16, focuses on the looming issue of our age — human-generated climate change, projecting a near future of extreme weather and social chaos. Against this setting, a maverick oilman decides to take matters into his own hands and builds the world's biggest gun to shoot canisters of sulfur dioxide into the air, echoing the effects of a volcanic eruption and temporarily cooling parts of the globe. Geopolitics, social media and Dutch royalty all play a part.

Stephenson acknowledges that geoengineering is a radical step, but suggests as the effects of climate change grow more destructive, the demand for radical solutions will grow.
In the interview Stephenson suggests one factor that might increase popular support for climate-change action: rising sea levels. "You can be as ideological as you want. But you can't argue with the fact that your house is full of water."

The interview also touches on how it was 1992 when Stephenson coined the word "metaverse," and now it's being claimed by major tech companies. "All I can do is kind of sit back and watch it in amazement," Stephenson tells CNBC: But, as many have noticed, "There's a pretty big gap between what Facebook is actually doing, like running Facebook and WhatsApp and Instagram, and the visions that they're talking about for the metaverse."
Neil Stephenson answered questions from Slashdot readers back in 2004...

Untraceable "ghost guns" assembled from parts bought online "can be ordered by gang members, felons and even children," writes the New York Times.

They call the guns "increasingly the lethal weapon of easy access around the U.S., but especially California," based on interviews with law enforcement officials in Los Angeles, Oakland, San Diego and San Francisco: Over the past 18 months, the officials said, ghost guns accounted for 25 to 50 percent of firearms recovered at crime scenes. The vast majority of suspects caught with them were legally prohibited from having guns. "I've been on the force for 30 years next month, and I've never seen anything like this," said Lt. Paul Phillips of the San Diego Police Department, who this year organized the force's first unit dedicated to homemade firearms. By the beginning of October, he said, the department had recovered almost 400 ghost guns, about double the total for all of 2020 with nearly three months to go in the year.

Law enforcement officials are not exactly sure why their use is taking off. But they believe it is basically a matter of a new, disruptive technology gradually gaining traction in a market, then rocketing up when buyers catch on. This isn't just happening on the West Coast. Since January 2016, about 25,000 privately made firearms have been confiscated by local and federal law enforcement agencies nationwide... There is a huge surfeit of supplies in circulation, enough to supply dealers who sell pre-assembled guns, via social media platforms or the dark web, for years. At the same time, the increasing availability of 3-D printers, which can create the plastic and metal components of guns, has opened a new backdoor source of illegal weapons for gangs and drug dealers who would otherwise have to steal them.

"This isn't going away," said Los Angeles city attorney, Mike Feuer...

Brian Muhammad, who works with at-risk young people in Stockton, said he recently asked a group of teenagers where they got their guns. "Did you drive to Vegas?" he asked, referring to Nevada's looser gun laws. They looked at him as if he were crazy.

"Who would do that?" one of them replied. "You order them in pieces using your phone."

New submitter Computershack shares a report from the BBC: A global police operation has dealt a devastating blow to one of the most prolific cyber-crime gangs in history. The co-ordinated action against the REvil gang was announced on Monday by Romanian police, the US Department of Justice (DOJ) and Europol. The raid, which took place both on and offline, led to the arrests of two alleged hackers in Romania and one accused cyber-criminal from Ukraine. REvil has been blamed for major hacks on global businesses in recent years. The US also announced that it had successfully retrieved more than $6 million in cryptocurrency from the gang in a so-called 'claw back' hacking operation.

An anonymous reader quotes a report from The Register: US-based Nvidia partner EVGA has reported that a shipment of GPUs it was sending to a distribution centre has been stolen from a truck. A forum post by EVGA product manager Jacob Freeman states "PLEASE TAKE NOTICE that on October 29, 2021, a shipment of EVGA GeForce RTX 30-Series Graphics Cards was stolen from a truck en route from San Francisco to our Southern California distribution center."

"These graphics cards are in high demand and each has an estimated retail value starting at $329.99 up to $1959.99 MSRP." Which probably explains the motivation for the crime -- either someone hopes to resell them or a crypto-miner has just built a cut-price rig. Freeman's post doesn't say how many GPUs were stolen, or if the truck was carrying anything else. He did, however, warn that buying stolen property is a crime, as is "concealing selling or withholding" purloined goods. He then appears to lay a trap of sorts by pointing out that attempts to register products that aren't stolen will succeed on this page which requires registration. Crooks are probably smart enough to use fake details when registering. Are they also smart enough to use a VPN and/or Tor to hide their tracks? EVGA has created the email address stopRTX30theft@evga.com in an attempt to find the culprits.

The U.S. Justice Department has charged a suspect from Ukraine and a Russian national over a July ransomware attack on an American company, according to indictments made in court filings on Monday, and has seized $6 million in ransom payments. From a report: The latest U.S. actions follow a slew of measures taken to combat ransomware that earlier this year hit big companies, including Colonial Pipeline, the largest fuel pipeline in the United States, and crippled fuel delivery for several days in the U.S. Southeast. Yaroslav Vasinskyi, a Ukrainian national arrested in Poland last month, will face U.S. charges for deploying ransomware known as REvil, which has been used in hacks that have cost U.S. firms millions of dollars, the court filing showed. REvil gained notoriety as the Russian group behind the ransomware attack against meatpacker JBS SA.

Andreas Kolbe is a former co-editor-in-chief of The Signpost, an online newspaper for (English-language) Wikipedia that's been published online since 2005 with contributions from Wikipedia editors. Kolbe has been contributing to it since 2006.

Last week he returned to the Signpost to share a cautionary tale. Its title? "A photo on Wikipedia can ruin your life."

Also a long-time Slashdot reader, Andreas Kolbe shares this summary with us: For more than two years, Wikipedia illustrated its article on New York serial killer Nathaniel White with the police photo of an African-American man from Florida who happened to have the same name. A Wikipedia user said he had found the picture on crimefeed.com, a "true crime" site associated with the Discovery Channel, which also used the same photo in a TV broadcast on the serial killer.

During the two-and-a-half years the Wikipedia article showed the picture of the wrong man, it was viewed over 125,000 times, including nearly 12,000 times on the day the TV program ran. The man whose picture was used said he received threats to his person from people who assumed he really was the killer, and took to dressing incognito.

His picture is now all over Google when people search for the serial killer.
"Friends and family contacted Plaintiff concerning the broadcast and asking Plaintiff if he actually murdered people in the state of New York," adds a legal complaint the man eventually filed against the Wikimedia Foundation. "Plaintiff assured these friends and family that even though he acknowledged his criminal past, he never murdered anyone nor has he ever been to the state of New York...."

Last month the legal director of the Wikimedia Foundation and a Legal Fellow co-authored a blog post pointing out the lawsuit "was filed months after Wikipedia editors proactively corrected the error at issue in September 2020." The blog post celebrates a judge's dismissal of the suit as "a victory for free knowledge," and acknowledges the protections afforded by Section 230 of the Communications Decency Act. "Our ability to maintain and grow the world's largest repository of free knowledge depends on robust legal immunity.... The Wikimedia Foundation applauds this ruling and remains committed to protecting global exchange of knowledge and freedom of expression across the internet."

But the blog post also argued that "the many members of our volunteer community are very effective at identifying and removing these inaccuracies when they do occur." Andreas Kolbe disagrees. "The photo was in the article for over two years," Kolbe writes on Signpost. "For a man to have his face presented to the world as that of a serial killer on a top-20 website, for such a significant amount of time, can hardly be described as indicative of 'very effective' quality control on the part of the community." The picture was only removed after a press report pointed out that Wikipedia had the wrong picture. This means the deletion was in all likelihood reactive rather than "proactive"...

The wrong photograph appears to have been removed by an unknown member of the public, an IP address that had never edited before and has not edited since. The volunteer community seems to have been completely unaware of the problem throughout...

It would seem more appropriate -

- to acknowledge that community processes failed Mr. White to a quite egregious degree, and
- to alert the community to the fact that its quality control processes are in need of improvement....

Surely Wikipedia's guidelines, policies and community practices for sourcing images, in particular images used to imply responsibility for specific crimes, would benefit from some strengthening, to ensure they actually depict the correct individual.
Pondering the dismissal of the lawsuit, Kolbe ultimately asks if there's a deeper moral question in a world where a man was "defamed on our global top-20 website with absolute impunity, without his having any realistic hope of redress for what happened to him." While to the best of my belief the error did not originate in Wikipedia, but was imported into Wikipedia from an unreliable external site, for more than two years any vigilante Googling Nathaniel White serial killer would have seen Mr. White's color picture prominently displayed in Google's knowledge graph panel (multiple copies of it still appear there at the time of writing). And along with it they would have found a prominent link to the serial killer's Wikipedia biography, again featuring Mr. White's image — providing what looked like encyclopedic confirmation that Mr. White of Florida was indeed guilty of sickening crimes...

On the very day the picture was removed from the article here, a video about the serial killer was uploaded to YouTube — complete with Mr. White's picture, citing Wikipedia. At the time of writing, the video's title page with Mr. White's color picture is the top Google image result in searches for the serial killer. All in all, seven of Google's top-fifteen image search results for Nathaniel White serial killer today feature Mr. White's image. Only two black-and-white photos show what seems to have been the real killer.
A comment on the Wikimedia Foundation blog adds, "What I'd much rather see is an acknowledgement that the community process failed Mr White to an extreme degree and that steps will be taken to prevent recurrence of such cases."

Slashdot reader FlatEric521 tipped us off to an interesting story (from the News Service of Florida): When police responded in 2018 to a call about a shattered window at a home in Orange County, they found a black Samsung smartphone near the broken window. A woman in the home identified the phone as belonging to an ex-boyfriend, Johnathan David Garcia, who was later charged with crimes including aggravated stalking.

But more than three years after the shattered window, the Florida Supreme Court is poised to hear arguments in the case and consider a decidedly 21st Century question: Should authorities be able to force Garcia to give them his passcode to the phone?

Attorney General Ashley Moody's office appealed to the Supreme Court last year after the 5th District Court of Appeal ruled that requiring Garcia to turn over the passcode would violate his constitutional right against being forced to provide self-incriminating information... The case has drawn briefs from civil-liberties and defense-attorney groups, who contend that Garcia's rights under the U.S. Constitution's 5th Amendment would be threatened if he is required to provide the passcode.

But Moody's office in a March brief warned of trouble for law enforcement if the Supreme Court sides with Garcia in an era when seemingly everybody has a cell phone. Police obtained a warrant to search Garcia's phone but could not do so without a passcode. "Modern encryption has shifted the balance between criminals and law enforcement in favor of crime by allowing criminals to hide evidence in areas the state physically cannot access," the brief said.

Tonight 70 countries around the world set their clocks back an hour — including most of the United States, Canada, the EU and the UK.

Yet "The practice has drawn complaints about its disruptive effects on sleep and schedules," reports UPI, adding that "The American Academy of Medicine has called for an end to Daylight Saving Time, citing growing research that shows its deleterious effects on health and safety." [U.S.] Lawmakers are also increasingly wondering whether Daylight Saving Time is a good idea. At least 350 bills and resolutions have been introduced in every state taking aim at Daylight Saving Time since 2015, according to the National Conference of State Legislatures. Over the last four years, 19 states have passed similar legislation providing year-round daylight saving time if Congress allowed such changes.

Members of Congress have introduced legislation making changes to Daylight Saving Time, to no avail.

U.S. Sen. Sheldon Whitehouse, (Democrat — Rhode Island), said in a video posted to Twitter on Friday that the upcoming switchover was one of his least favorite times of the year since it means darker afternoons. He touted his Sunshine Protection Act that would make Daylight Saving Time permanent.

"We can do a lot better for daylight for everyone who is up in the afternoon," he said.
Also supporting that change is Florida Republican Senator Marco Rubio. "We're about to once again do this annual craziness of changing the clock, falling back, springing forward," Newsweek quotes him as saying. "Let's go to permanent daylight saving time. The overwhelming majority of members of Congress approve and support it. Let's get it done. Let's get it passed so that we never have to do this stupid change again."

But currently in America it's the Department of Transportation which is in charge of the practice, reports USA Today, and the Department believes that the practice saves energy, prevents traffic accidents and curbs crime.

So, as the Washington Post reports, "It's that time of the year again. We change the clocks back and we whine about it."

One cybersecurity expert says the cyberattack on the Newfoundland and Labrador health-care system may be the worst in Canadian history, and has implications for national security. CBC News reports: David Shipley, the CEO of a cybersecurity firm in Fredericton, said he's seen similar breaches before, but usually on a smaller scale. "We've never seen a health-network takedown this large, ever," Shipley said in an interview with CBC News. "The severity of this is what really sets it apart." Discovered on Saturday morning, the cyberattack has delayed thousands of appointments and procedures this week, including almost all non-emergency appointments in the Eastern Health region. After refusing to confirm the cause of the disruption for days, Health Minister John Haggie said Wednesday the system has been victim of a cyberattack. Sources have told CBC News the security breach is a ransomware attack, a type of crime in which hackers gain control of a system and hand back the reins only when a ransom has been paid. [...]

Shipley said he normally argues against giving in to ransom demands but the provincial government might have to pay up in this instance since lives are at stake. The government has not confirmed there has been a ransom demand. On Thursday morning, staff at the Health Sciences Centre in St. John's were told the system used to manage patient health and financial information at the hospital is back online. The system -- called Meditech -- only has information from before last weekend, and will need to be updated. It isn't yet clear what the restoration of the system will mean for services at the hospital, or if the system is back online in other parts of the province.

The bots convincingly and effortlessly help hackers break into Coinbase, Amazon, PayPal, and bank accounts. From a report: The call came from PayPal's fraud prevention system. Someone had tried to use my PayPal account to spend $58.82, according to the automated voice on the line. PayPal needed to verify my identity to block the transfer. "In order to secure your account, please enter the code we have sent your mobile device now," the voice said. PayPal sometimes texts users a code in order to protect their account. After entering a string of six digits, the voice said, "Thank you, your account has been secured and this request has been blocked. Don't worry if any payment has been charged to your account: we will refund it within 24 to 48 hours. Your reference ID is 1549926. You may now hang up," the voice said.

But this call was actually from a hacker. The fraudster used a type of bot that drastically streamlines the process for hackers to trick victims into giving up their multi-factor authentication codes or one-time passwords (OTPs) for all sorts of services, letting them log in or authorize cash transfers. Various bots target Apple Pay, PayPal, Amazon, Coinbase, and a wide range of specific banks. Whereas fooling victims into handing over a login or verification code previously would often involve the hacker directly conversely with the victim, perhaps pretending to be the victim's bank in a phone call, these increasingly traded bots dramatically lower the barrier of entry for bypassing multi-factor authentication.