u/Syncplify

Americans lost $5.8 billion to crypto investment scams last year alone, and a raid in Sri Lanka this month shows exactly how these operations keep finding new places to hide.

37 Chinese nationals were arrested in Colombo carrying 147 phones and 100 SIM cards between them, all technically in the country as tourists, which is a lot of holiday reading material. It's the third bust in Sri Lanka in as many months, because as Thailand and Cambodia crack down harder, the gangs just pack up and relocate somewhere with looser visa rules and halfway decent internet.

The FBI's Internet Crime Report puts the damage at $5,8 billion across 41,000 complaints in 2024, and that's just the people who actually came forward - the real number is almost certainly much higher.

What makes the whole thing genuinely dark though is that many of the people doing the actual scamming are themselves victims, lured abroad with fake job offers, passports taken away, forced to hit daily targets under threat of violence, with the UN estimating around 220,000 people currently trapped in compounds in Cambodia and Myanmar alone.

Do you think there's any realistic way to actually stop this?

Source.

A new report from Cifas found that 13% of surveyed workers have either sold their company login details in the past year or personally know someone who has, which is already a pretty uncomfortable number, but it's not disgruntled junior employees feeling underpaid and overlooked doing it, it's the people at the top.

32% of senior managers, 36% of directors, 43% of C-suite executives, and a genuinely baffling 81% of business owners consider selling company credentials to be "justifiable," usually under the assumption that it's harmless one-time access - as if handing someone a working set of login details doesn't give them the exact same trusted access as any legitimate employee on the network.

And the timing couldn't be worse, because with economic pressure mounting, AI threatening jobs, and redundancies becoming more common, the temptation to make a quick payout by selling access to your employer's systems is only going to grow and most companies aren't built to catch it, especially when the person doing it is the one who's supposed to be setting the security culture in the first place.

Multi-factor authentication helps, but it's a bit of a band-aid when the person handing over the credentials is the CEO. At what point does this become something companies actually train for, or is "don't sell your login details" still somehow assumed to be common sense?

40% of ransomware attacks now come with physical threats to employees, and in the US that number jumps to 46%.

We're way past "pay up or we leak your data" at this point. A hospital got phone calls where strangers read nurses their home addresses down the line, and a security researcher had a threatening note left on his doorstep while he was actively helping a US government agency deal with an attack.

The playbook is simple and honestly kind of genius in a terrifying way, hackers stay hidden overseas and just hire local, post on a forum, offer some cash, and let someone else do the knocking. The FBI flagged a whole network for this last summer that's been tied to arson, kidnappings, even shootings.

What nobody seems to be talking about though is what this actually means for companies, because your HR database full of employee home addresses is no longer just a privacy liability - it's a physical safety problem, and I'd bet almost no incident response plan in existence covers the moment a staff member picks up the phone and a stranger calmly reads their address back to them.

If you work in security or IT, has this actually come up in any planning conversations at your company, or is everyone still treating this like a purely digital problem?