Site icon Easy Prey Podcast

5 Fraud Vulnerability Factors with Martina Dove

Easy Prey
“There are five fraud vulnerability factors: compliance, impulsivity, decision time, vigilance, and the belief in justice.” - Martina Dove Click To Tweet

Understanding our cognitive biases can help us realize that we sometimes are too trusting of emails, texts, or calls from someone we perceive to be an authority. Today’s guest is Martina Dove. Martina is a researcher with a fervent passion for fraud prevention. Her expertise focuses on persuasion, scam techniques, and individual characteristics that make people susceptible to fraud. She is passionate about fighting fraud by teaching people how to spot scammer techniques and has recently published a book on fraud psychology.

“Prevention is always better than intervention.” - Martina Dove Click To Tweet

Show Notes:

“Scams work because we are human. We can be persuaded.” - Martina Dove Click To Tweet

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review. 

Links and Resources:

Transcript:

Martina, thank you so much for coming on the Easy Prey Podcast today.

You're welcome.

Can you give myself and the audience a little bit of background about who you are and what you do?

I currently work as a user experience researcher for a monitoring observability company. My background is also in cybersecurity.

I wrote a book on fraud psychology, what scammers do to persuade us, and how they use persuasion to get us to comply with phishing emails or other scams and frauds. I am passionate about fraud prevention and telling victims that they shouldn't be silent when that happens.

That's great. What got you into fraud prevention?

I was doing my PhD, and I was really interested in doing cognitive bias called the Barnum effect. For those of you who don't know what that is, it's a cognitive bias that a lot of fake clairvoyants use, where you tell people something that is applicable to anybody in the general public, and it seems very true of you. That's how you build trust so anything you say afterwards will sound very amazingly true.

Also, as people, we like to hear positive things about ourselves, so the more flattery that the person can give you, the more you're going to feel good about them and trust them.

I was really interested in that cognitive bias, and I wanted to do something with it. It was really difficult to find an application in the real world apart from it's interesting. I had a lot of months when I was just mulling over how to apply that. Then, I read this really interesting article about how scammers use psychology in phishing emails.

I just had an idea that this could be something I could apply it to. I could test and go down that route. That's what I did. Interestingly, the two people that wrote that paper were the first two people that quoted my book. I came full circle on that.

That's really cool. Before we get into this, one of the things that I like to ask my guests is to destigmatize what it means to be a target or a victim of fraud and hopefully help people open up and talk about their experience. Have you ever been a victim of a scam or fraud?

Yeah. I walked into my PhD thinking people who get scammed are gullible. First of all, I want to say that through the interviews with some of the scam victims, I realized that that's not always the case. Sure, sometimes people don't pay attention and don't check details, but sometimes they do and they still get scammed. It just depends on how smart the scammer is.

One of the things that happened to me in terms of the scam, I was buying a mobile phone. I had a lot of money in my PayPal. I think I sold some old stuff, and I had a lot of money in my PayPal. I thought, “Well, I need a new phone. I'm going to buy it on eBay and just use my balance.”

I ended up purchasing a phone, which was supposed to be in your inbox. I didn't really think twice about it. It was advertised. I purchased it. When it didn't arrive, I immediately knew something bad had happened. I emailed the person who sold it to me, and I didn't get a reply.

Then I started investigating. I opened a case, and eventually, they gave me the money back so it wasn't even that exciting, traumatizing, or anything like that. But the feeling that you get when somebody deceives you is just awful.

I ended up looking into this seller, and they seem to be a legitimate person on eBay. I don't know if they got hacked or they just thought, “I'm just going on a scamming spree.” But they even had people come to the house to pick up things. I don't know what happened, but that night, they had several phones listed for sale.

People tend to do that. They tend to immediately think, “I shouldn't have been this stupid.” I think that stops them and prevents them from going to the police or maybe reporting it, or even sharing their experience, because people… Click To Tweet

I would blame myself, like you do. I should have checked what else they were selling, and maybe that would have given me a clue. People tend to do that. They tend to immediately think, “I shouldn't have been this stupid.” I think that stops them and prevents them from going to the police or maybe reporting it, or even sharing their experience, because people can be unkind.

Truthfully, while I was doing my research, I actually found a factor in my scale that I developed for fraud vulnerability. One of the factors is something called belief in justice. It was comprised of things that people believed wouldn't happen to them. People believe that the police would solve that problem if it happened to them. People believe this happens to other people who are gullible, and that's not them. I think all of us, to some degree, want to believe that about ourselves.

You can't really control a lot of your environment or what happens to you. If a scammer is very good or if they can spoof an email, there's literally no way of telling whether it's a scam or a legitimate email. It was a good experience on understanding how much anger, disappointment, and self-blame come through just a simple scam, let alone a more complicated one.

You can't really control a lot of your environment or what happens to you. If a scammer is very good or if they can spoof an email, there's literally no way of telling whether it's a scam or a legitimate email. -Martina Dove Click To Tweet

It's interesting because even if you buy a legitimate product and it doesn't turn out to be exactly what you wanted, you still feel that emotional, “Gosh darn it; they took advantage of me, and I didn't get what I wanted.” All the more so when someone has really done something despicable.

I'm really curious. Can we talk about the fraud vulnerability factors?

As a part of my PhD, I developed a measure. It was the first of its kind in terms of that it was targeted at scams specifically and frauds. I came up with five factors. The first one was compliance. The second one was impulsivity. The third one was decision time. The fourth one was vigilance. And the fifth one was that belief in justice if we believe that the world is a just place.

That's a cognitive bias as well. We believe that the world is just because we need to be able to feel like we have control over it. You'll see that a lot with certain victims and scam victims in particular, but also with victims of sexual violence. If we can explain why that happened to them, then we feel better because if we don't do those things, we won't be a victim, which is like an illusion of control.

Basically, compliance is mostly when people may even understand that something's not right, but they are just unable to say no. They go along with it because they're just not strong enough to stand up and say no.

Impulsivity is self-explanatory: people that just impulsively do things, that maybe don't really think through it.

Decision time is the opposite of impulsivity. It's that people who take the time to make decisions and rationalize are more vigilant, read terms and conditions, and dive into details would be a little bit more protected.

And vigilance?

Vigilance is basically the same. You're a little bit more cynical. You may not believe everything people tell you so you double-check and so on.

About the compliance one, is this the kind of people who like to follow rules and processes?

It's complicated. It's not either or. It's a scale, so it's a spectrum. In terms of the scams, those are usually the people who find it hard to say no. A lot of scammers do bargain on that. Especially in the olden days, scammers would just go door to door. That is more important when you're in a face-to-face situation or sometimes in a longer-term scam.

Now we have pig-butchering scams that go on for a while or romance scams where a scammer may be putting pressure on you, and you're just going to find it really difficult to say no.

Stuff like that, stuff where you go along with stuff because you're just uncomfortable being more assertive, and so on. But for somebody who follows rules a little bit more, there's definitely a persuasion technique called authority, and people who believe in authority are a little bit more likely to fall for that because they just have more of an impulse to follow rules, to be respectful, and not question authority figures.

That makes sense. On the justice one, are you saying that people who have a worldview more of there's justice in the world and if someone does bad, someone will catch them versus someone who's it's just a free-for-all, and I've got to watch out for myself?

Believing justice as a cognitive bias is literally people trying and finding justifications for why things happen. When you hear people say, “Karma will get you,” that's not always true. Bad things happen to good people, and nothing happens to bad people because they've done that. It's just our way of rationalizing why something happened. It's for us to feel good about the world because if we believe the world is a bad place and people are bad, we wouldn't be able to function.

In terms of what I found in my study, it's people who believe that only gullible people fall for scams and that scammers are always prosecuted. It's that feeling that this wouldn't happen to me because I'm smart. If it happened to me, I'd be protected, I'd get my money back, where a lot of the time, this is not the case.

What are some of the persuasion techniques that the scammers are using if they sense that someone is more impulsive or obviously pushing someone to make a decision quickly? What are some of the things that they're going to do to try to move us in a direction we don't want to go?

The biggest one is the visceral influence, evoking a visceral influence. Those are the primal drives, such as hunger, thirst, a sexual kind of excitement, or just excitement in general, very strong emotions. Fear and pain can be one, exploiting those visceral influences.

The reason why they are very influential is that when we are under visceral influence, we temporarily lose reason. It's more difficult to recall any logical thinking and any advice that we might have heard because all we're thinking about is that state we're in of excitement or fear.

You see a lot of phishing emails either evoke fear, like your account has been compromised, or sextortion, like you're going to be found out for whatever things you've done. Then you have excitement, like greed where, “Hey, you won a prize. You can get a big win,” or something like that.

A lot of them focus on that. You also have miracle cures that purport to cure painful conditions or cancer, something you're afraid of that's also painful, and you want to get rid of it. I think that's the biggest one, and a lot of scams either evoke some kind of visceral influence and then have other techniques that work in conjunction with it.

For example, a lot of the time, scarcity is another technique, where they will emphasize scarcity in terms of, “Hey, you can't get anywhere else,” or, “This deal expires tomorrow.” It's for only a short time, with time limits and scarcity.

The reason for that is because when you evoke a visceral influence, people get more impulsive in that moment, but if you leave it for a day or two, it goes down, and you become more rational. They pair it up with this time scarcity and techniques to get you to act in the moment. They want you to be in that state where you're focusing just on these peripheral things rather than the real questions. Those are the frequent ones.

Authority is another one. You see letters from the IRS and from the police. People generally trust the government, the people in power. You'll see a lot of old-fashioned advance fee fraud using a position of trust—pastor, doctor, lawyer, somebody from the bank. Those are the professionals we trust. They are in a position where they should be looking out for our own interests. That's the authority one.

Then, you have social proof, fake reviews, fake testimonials on social media supporting these fake products, and stuff like that. As humans, we look at others to define our reality, so that's a big one. Evoking social norms as well. A lot of charity scams evoke social norms. We like to feel helpful. We like to help others. We've been brought up to be helpful and kind to our friends and family. That's exploited a lot in charity scams, or when a scammer hacks into your Facebook account and sends emails to your friends.

A lot of charity scams evoke social norms. We like to feel helpful. We like to help others. We've been brought up to be helpful and kind to our friends and family. -Martina Dove Click To Tweet

It's funny. Last night, I was scrolling through LinkedIn. I try to avoid Facebook. I was scrolling through LinkedIn. I didn't grab a screenshot, so I don't remember his name, but he was sharing a story of a scam. He was just telling it as if it had happened to him, not that it really did.

The person had received an email saying, “Hi, this is so-and-so from this particular law firm. There has been an allegation of misconduct at your workplace, and your name got brought up. I'd like to discuss this with you. I'd like to set up a phone appointment with you a week from now.” He's like, “OK.”

It's a little bit emotional. It's scary. This sounds legal. He thought, “You know what? This seems a little suspicious. Let me go digging into it.” He looks for this lawyer's website and finds the lawyer's website. I was just thinking through some of the factors that you are talking about here. It’s like, “Oh, check, check, check, check.”

He finds a page on the website, “Here are all the successful cases that I've won. I got this verdict, this verdict, and this verdict,” and they all have an attached document. He ended up downloading one of the documents, and lo and behold, the document was malware.

It was really interesting because, in some sense, I can see a lot of the normal factors of a scam there. The things that people would normally say, “Don't click on links,” avoiding all these things. Well, he avoided all of those things, but they moved him off to a different platform where he did those things and ultimately downloaded an infected document.

I was like, wow, someone really went a long way to get someone to get their computer compromised as opposed to, “Click on this link for a million dollars.” I saw there's the authority, there's the social proof, then I want to do the right thing if there’s a lawsuit. It's just interesting to see all those things played out in something that I just saw the other night.

That's really interesting. I've been seeing a lot more of that. As we're becoming a little bit more aware, we're sharing our stories, and we're sharing advice, I think scammers are always one step ahead.

I remember somebody said to me, “Aren't you worried that your book is going to be a manual for scammers?” I'm like, “No, because they're always one step ahead. By the time I actually can write something, it's already been done.” This is a prime example. I've seen a lot of newer scams. They don't have some of the same things. They still need that visceral influence to get you going. It's really interesting how he was bargaining on the fact that this person is going to go on the website and check the information because that's what we're telling people: double-check and don't click anything.

Exactly. It was totally exploiting all of those. Go to an independent source—Google—and see if the lawyer's real. “Oh, I found their website. It looks like it's real.” It really is exploiting the things that we tell people to do to not be scammed.

This is really interesting. I don't know if that exists in America for lawyers, but I think there should be a website. In Washington, for example, if I want to hire a contractor, I can go on a website and check their license, insurance, and what they registered to do. I wonder whether we should have that for every profession because how do you know that this is not a real lawyer?

I think the challenge for you, me, and everybody else is there probably are contractor licensing boards for X, Y, and Z, but only the contractors know about it and the lawyers who want to sue those contractors.

If I'm hiring a guy to do plumbing work, I'm not an expert in plumbing. I'm not going to know which is the right licensing board to figure out whether this is a legitimate plumber. He says he has insurance, but I don't know how to verify that. All those things.

Exactly. I just wonder, one of the things that people assume is if they have a website, it's real, but a good scammer will go a long way to support the story.

It's funny because one of the things that I will frequently tell people is there are lots of tools out there for you to find out how old the website is. When was the domain name first registered? Sometimes, I'll have someone report a scam to me and say, “Hey, they said they've been in business for five years,” and you go to one of these tools and look up how old the website is, and it was registered last week. I'm like, “Oh, no. Run for your life. If they say they've been around five years, but it's only been around a week, there's something fishy going on there.”

But there are definitely scammers out there that will buy old domain names, or they know they're going to be doing this five years from now, and so they've been registering domain names over the course of those years.

This is something that came out while I was interviewing some of the fraud victims. One of the persons who bought from a fake website said to me, “In the future, I will no longer trust any small companies I don't know.” It's really sad because there could be some amazing new company that's popped up.

I think the implication for society is really big. If you're a new business, you'll struggle just because we have scammers. Having said that, scammers can also clone a very established business, especially with engine optimization. How do you ever know that the first thing that pops up is the actual thing?

There's so many of it. I interviewed the head of the fraud department at Amazon. They have people selling counterfeit products. They work really hard to stop it. They've got good processes for returns and all that stuff, but it's hard. You can't just say, “Don't buy from a small business,” because that doesn't necessarily solve the problem.

I did have one question. You talked about that visceral influence and us becoming excited, and that shuts off one portion of the brain and turns on a different portion of the brain. Is there a way that we, at the moment, have the ability to switch that back to calm ourselves down and get ourselves out of the spot where we're making emotional decisions?

A lot can be said for personality. If you think of a human, no human will react the same as another human because it has lots of different components. I always say a fraud situation is complicated. It's not either or. I don't have any specific advice, but if you think about it, you're not going to be interested in everything that comes into your inbox. They have to get you at the right time.

With a job scam, you're only going to be vulnerable to a job scam when you're looking for a job, and you're desperate for your finances. Even if you see there's something dodgy, you may not have anything to lose because you're struggling financially, so you're going to go for it anyway.

Circumstances play a big role. Personality plays a big role. Some people are just more impulsive than others. It's the experience that teaches you to be less impulsive. For the majority of my life, I was a very impulsive person, but learning what I've learned about scams and having that experience as years go by, accruing that life experience, maybe you have negative situations because you were impulsive, you said something you shouldn't have without thinking, you accrue life experience.

Circumstances play a big role. Personality plays a big role. Some people are just more impulsive than others. It's the experience that teaches you to be less impulsive. -Martina Dove Click To Tweet

We are also born gullible, and we accrue life experience. We become a bit smarter. We become a little bit more impulsive as we age, too. It's really difficult to say; is there anything? Always delay decisions. That is always the best advice I can give you, but I also understand as a psychologist that when something is your personality trait, it's very difficult to go against yourself. Perhaps make a rule, like, “Hey, I don't make decisions on the spot.” Whenever you're in a situation to make a decision on the spot that's financial, just say, “I don't do that.”

5 Fraud Vulnerability Factors with Martina Dove Click To Tweet

For example, one time I gave a talk to an elderly group of people in my area on how to say no at the door. I remember one of the people said to me, “I just feel like I'm being rude when I say no.” I said, “Fine, OK. I know this is difficult for you to then say no. Don't say no; say not right now.” I just said to them, “Look, if you have to lie, just say, ‘Hey, can you come back tomorrow when my son who is a police detective will be here? He'll be interested.’” I said a genuine person would come back, but the scammer won't be back. You're not saying no, you're just saying not right now. And then the next day, don't open the door. Do whatever you have to.

But it's sometimes really difficult. I see a lot of simplistic advice: “Just don't do it. Don't click on links. Why are you engaging?” But if you're an extrovert, you want to be talking to people who ping you on Facebook and sound interesting. I think we give advice from our own perspective, but people are complicated and come with their own circumstances, personalities, and knowledge. All of that makes a difference.

I've been able to be good at some times in my life on delaying decisions. I remember one time when there was a car that I really wanted to buy. I went to the dealership, and I saw it like, “Yeah, that's the one that I want.” I talked through things with the finance guy. “I'll come back tomorrow and let you know.” They're like, “No, it might be gone.”

All the techniques came out. I'm like, “You know what? It's a lot of money.” All those things came out. I was proud of myself at the moment. I was like, “No, I don't make decisions that are going to cost me over $1000. I just don't make those without sleeping on it. If the vehicle goes away and it's gone, it'll show up somewhere at some time.”

I'll go to another dealer.

I'll be able to get it from somebody else some other time. It was really hard at the moment to say no. I was just going to leave and, “Once I've thought about it, if I still want it, I'll be back tomorrow. Give me your card or call me tomorrow. I'm fine with that. But I'm not going to buy it from you today.”

You bring up a good point. These persuasion techniques have been around for centuries. Nothing has changed. They work because we're human, and we're still the same humans. They are used in sales and marketing. They're used by legitimate people for a reason or persuasion. It's just a shame the scammers are also using them. But whereas in a dealership you walk away with a car, maybe if you're dealing with a scammer, you wouldn't get that.

These persuasion techniques have been around for centuries. Nothing has changed. They work because we're human, and we're still the same humans. They are used in sales and marketing. They're used by legitimate people for a reason… Click To Tweet

It's all about the intent behind the transaction. Obviously, there are people that are going to take advantage of you when you're buying and selling cars and things like that. But in theory, if they're a reputable company, you're employing sales techniques and you will get the thing that you agreed to buy. When it's a scammer, you're not going to get what you think you're going to get, whether it's a relationship. They’ve got that, “Oh, crypto's going to bust out tomorrow, and you’ve got this eight-hour window. If you don't go in this window, you'll miss the boat.” That's unfortunate when those things manipulate us.

Is there anything else that affects our minds in the midst of scams that we've missed?

I have realized that when you groom the victim for a while, they are easier to persuade to give large sums of money. You see that it started with romance frauds, but now, pig butchering scams are doing that.

I just finalized a whole year's worth of conversation for the peekaboo train scam. One of the interesting things that I've noticed is the way that they manage the victim throughout the conversation. The conversation starts light, it's full of flattery, and it's really very friendly. And then as they start to introduce the idea of investment, they introduce it casually first, then more deliberately, and then they start persuading the victim to invest.

As the conversation progresses, you see how it's starting to turn negative but in such tiny shades. I guess it’s similar to domestic abuse. It never starts with a terrible thing. It starts with a little bit of control and a little bit more, then with physical violence, and then with verbal violence to physical violence.

I've noticed that pattern, and it's very important for people to know that when you're in that kind of conversation or relationship, you're obviously interested in this person, whether on a personal note, friendship-wise, or thinking you are getting into a business partnership, it's very important to note that there's something called the ego depletion. When we are exhausted from being torn down little by little, we are more likely to just comply.

You see police detectives use that technique when they're interrogating people. I don't know if you're a fan of The First 48, but on my first road trip to America, I watched that, and I got hooked. It's that going back and forth and coming in and asking the same questions and stuff. Eventually, the victim's just so tired. Whatever defense mechanism they had is depleted. This is where you get more compliance, and this is how fake confessions happen. It's not dissimilar in certain scams.

Some romance scams turned very abusive like emotional blackmail. “You don't love me if you don't comply. If you believe your family, then that means you don't love me.” And then you get into that negative thing, and all you're trying to do is please this person. That can be very potent. It happens in such small increments. If it happened overnight, you would realize and go, “Whoa, no thanks.” But it happens in such tiny increments that actually you're getting used to it little by little until you don't really notice there's anything wrong. I think that's very insidious. That's very, very dark.

Is there a way to break that cycle? Is it by having a wide range of friends, family, and people that you communicate with on a regular basis that will reset what is acceptable communication and treatment?

It's difficult. That grooming component of fraud is very difficult to break. It's something where by the time friends and family may notice you're being abused and that something's wrong, that victim may already be groomed and believe that nobody would understand what's going on between them and the scammer. Because they talk to the love interest and that scammer will say, “Look, nobody would understand why we want to get married so quickly or why we're in this relationship.”

It's very difficult. I don't have specific, good advice there, but if you're a family member of somebody who is going through a similar thing, either a longer-term investment scam or romance scam, coming in with as much empathy as you can muster, I know sometimes that's difficult. Typically, the family will come in and say, “Don't be so stupid; why are you doing this? Don't give them your money.” Trying to really understand where the victim is at is the best shot to actually snapping them out of it.

Trying to really understand where the victim is at is the best shot to actually snapping them out of it. -Martina Dove Click To Tweet

I do say to organizations that I've worked with and everybody: Prevention is always better than intervention, talking about it, and raising awareness of how scammers affect us and what that's going to impact.

When you're in ego depletion, when you're in that state of feeling so negative about the situation, you’re feeling guilty and stuff, and somebody's been blaming you for so many months, you can't process things clearly anymore. It affects your working memory. It affects all sorts of things. You can feel a little bit depressed as well. You enter a state where you're just not good. Doing anything you can to actually get outside opinion on a situation helps. But again, that's really difficult when you're in the middle of that. I would say if you're a family member of somebody like that, approach them with empathy rather than authority.

My guess is in a lot of cases, the person who's doing the grooming is already telling the person, “Your family is going to try to intervene. They're going to try to break us apart.” The family saying those things just now affirms everything that that person who was grooming said.

Yes. It's very bad.

That's awful. As we wrap up here, I know you wrote the book, The Psychology of Fraud, Persuasion and Scam Techniques. Where can people find that?

It's available everywhere. My publisher is Routledge. They're really good. They deliver for free, so you can order from them specifically. They usually have the best prices, too. They offer 20%–30% now and again for different things. You can get it from Amazon. It's online, and you can order it easily.

Are you still doing research in this area? Are you still active in this space?

Yes, I'm very active. I'm still trying to. Even though I work in the industry now, I'm active in writing. I write for several blogs. I also have a chapter coming out in a criminology textbook, specifically on grooming to deceive. Some of the intricacy that comes with that grooming and how I'm noticing, for example, sometimes the grooming may not necessarily even happen through lies.

If you think about the Tinder Swindler, he created a lifestyle that persuaded victims without him even having to say anything. There are very sophisticated scammers that plan this very well. That's coming out, hopefully sometime this year. Pretty soon, I think. I was told around April, maybe. That's going in the criminology textbook but will be available too. I write all the time.

If people want to find out where you're writing, how can they find out?

That's a good point. I write a lot of stuff for State of Security, which is a blog by a company called Tripwire that I work for. I still write a lot of stuff for them. I do have a website. I don't always update everything that I've written for different organizations and stuff, but I'm going to be better at it.

My website does list a lot of articles that I've written, and it does list my book. I'm going to list the textbook, and I'm hoping to publish some of the results of the analysis of the pig butchering scams too.

And what is the website?

It's just martinadove.com.

That's easy. It's nice when you have a unique name and you thought about buying the domain name. Unfortunately, my name is too common.

Yeah, I'm sorry.

It is what it is. Martina, thank you so much for coming on the podcast today.

You're welcome.

 

Exit mobile version