The last few weeks I had you watching the big machinery. Government bounties. Fraud that runs on its own with no human at the wheel. The industrial end of the business.

This week it comes home to the kitchen table.

Four cases crossed my desk. Small cases. The kind that take down one person at a time on an ordinary afternoon. A retiree in Alabama, somebody's mother in a group chat, a man who believed he was finally talking to his bank. Different scripts, different countries, different tools. But they rhyme, and once you hear it you can't stop hearing it. Not one of them asked for a password.

They went for the face, the voice. the friends, the nerve. The parts of a person nobody thought to guard, because for 30 years they weren't worth stealing.

A password was only ever a fact about you, and a fact can be changed. Breached, reset, forgotten by Friday. You cannot reset your face. I told you that back in No. 109, and I'll say it plainer now. The industry sold your face as the one key a thief couldn't copy, and the thieves spent the same decade learning that a face is just a picture a computer agrees to trust. Pictures travel folks.

Times are getting crazy, folks. Let me walk you through the week.

Don't Press the Birdie

Start in Mobile, Alabama, with a retiree named Gary Hilburn who lives on Social Security.

The phone rings, it's Publishers Clearing House. He's won five thousand dollars a week for life. Now Gary's nobody's fool, and when the nice man asks for account numbers, he says no. Good instinct, but it doesn't save him.

Because the nice man has another way. Just enter these numbers into your phone. Now find the little red woodpecker in your apps and give it a tap. The woodpecker was a remote access app. Gary tapped it.

"Don't press the birdie," Gary said afterward. "When I pressed the birdie, they took over my phone."

Here's what pressing it bought them. While a FaceTime call was live, the man on the other end, calling himself John King and working out of Jamaica, took a screenshot of Gary's face off the video. Then he opened Gary's Wells Fargo app, which was sitting there ready to unlock for one specific face, and showed it that face. The app did what it was built to do. $20,000 out of savings. $1,300 and change out of checking. Gone inside a single phone call.

The PCH opener isn't lazy, it's engineered. It's old, it's famous, it's older than the internet, so it reads as safe. And the prize is an anesthetic. A man being congratulated doesn't feel like a man being robbed, so by the time the birdie comes up he's happy and off balance and taking instructions from a friend.

The face is where you should feel the floor move. His bank offered him convenience, unlock with a look, and convenience is a door that swings both ways. The same camera that recognizes Gary lets in anyone holding a good enough Gary. Liveness checks are supposed to reject a flat photo, sure. A live man's face on a FaceTime call isn't flat. It blinks. It's him.

A red woodpecker, by the way. Of all the icons to hide a bank heist behind, they went with Woody.

I don't know what Gary does with his mornings now, or whether he answers the phone at all. FOX10 in Mobile aired his warning in April. He's still out the money, and that app is back in the store under a different bird by now.

Seven Dollars for Your Face

So where does a crook get a face that blinks on command? He buys it wholesale. And some of you are the ones selling.

There's a gig making the rounds on Telegram, Reddit, LinkedIn, the regular job boards. They call it a Face Motion Video Project. Seven dollars a clip. You record yourself turning your head, touching your nose to little dots on the screen, once in bright light, once in the dark, once outside. A few minutes of your face from every angle, running the exact motions a liveness check asks for. Seven bucks, direct deposit.

There's a premium tier. Read 300 sentences out loud, pass a KYC check first, $60.00, US English speakers only.

This is the supply side of the Gary Hilburn story. Somebody has to farm the raw material, and they've dressed the harvest up as a microtask so it feels like beer money instead of what it is, which is you personally notarizing a deepfake of yourself.

Look at who's buying. One outfit is a Delaware company that pulled a $1.74 million dollar EU innovation grant last August and drops Oracle, AWS, and Uber as former clients. Another is a California LLC wired back to an accounting firm in Nepal. They recruit hardest across the Global South, India, Nigeria, Pakistan, Egypt, Morocco, Vietnam, wherever seven dollars stretches further and nobody's going to ask hard questions.

And here's the tell that these people know precisely what they're holding. The US voice work will take an English speaker from any state except four: Illinois, Texas, Washington and Colorado. The four states with the strongest biometric privacy laws in the country. A real research vendor doesn't carve out exactly the four jurisdictions where your face has legal protection. A broker who knows the cargo is radioactive does.

I couldn't tell from the listings whether the Delaware operation understands where its data ends up or just makes a point of not asking. Doesn't matter much to you either way. The faces leave the building.

That's the trade on the table. Your one unchangeable password, gone, for the price of a gallon of gasoline: seven dollars.

Vote for My Friend

They don't always need your face. Sometimes all they need is for your friends to believe a message came from you.

A text message lands from somebody you actually know. Their kid's in a dance competition, or it's a dog show, or some school fundraiser, and would you click and cast a vote. It's your buddy asking for ten seconds, so you click. The link runs through addresses that look like real WhatsApp links and drops you on a page that walks you through a couple of verification steps. Familiar steps. The same ones you'd see linking WhatsApp to a laptop.

Only the device you just linked is his. You added a stranger to your own WhatsApp, and WhatsApp did exactly what it's designed to do.

This is the clean one. There's no malware in it. Nothing for a scanner to catch, nothing to remove, because nobody broke anything. He used a real feature the way the manual says to use it. Malwarebytes caught the pattern, and the line in their writeup that ought to bother you is this: no login happened, no password reset email went out, no failed-login alert fired. Every alarm you've trained yourself to watch for stayed quiet. Your phone never noticed a thing.

And now he reads all of it. Every thread, every photo you've sent, the family group chat, the works. Then he becomes you. He forwards that same vote-for-my-friend message to your whole contact list, because it lands a lot harder coming from you than it ever did coming from a stranger. That's the engine. You're the next link in the chain, and so is whoever clicks after you.

The trick was never technical. The trick is that "vote for my friend" is too small to check. Nobody phones their buddy to confirm a dog-show ballot. The ask is trivial on purpose, because verification costs effort and nobody spends effort on something this size. Malwarebytes now ranks messaging scams like this the third most common way fraud gets delivered, behind websites and email.

The Arrest That Isn't

When they can't lift your face and they can't borrow your friends, they come for the last thing you've got: your judgment. They frighten it right out of you.

The call opens with your credit card turning up in a crime. American Express, or Wells Fargo. A $3,000 gun bought in your name, or a whole account opened under it. That's bad enough to hold you on the line. Then it gets worse, on purpose. The charge is linked to child exploitation. To laundering money for a trafficking ring. In the space of one sentence you stopped being a victim and became a suspect, and now a second voice joins the call, FBI, or a detective, and the investigation is real and you are standing in the middle of it.

Then they build the cage. Check in three times a day over Webex. Do not walk into a police station or we arrest you the moment you do. Keep the video on, tell nobody.

India already named this thing. Over there they call it digital arrest, and last year it pulled more than two billion dollars out of Indian victims, the third biggest fraud category in the country. It's crossing the water. Government impersonation broke into the top five internet crimes in America last year, and the fresh reports started piling up in the two weeks before I sat down to write this.

Carry one fact and you're inoculated. Digital arrest is not real. It does not exist. No American police force arrests you by video call and holds you on Webex. No bank on this earth transfers you to the FBI. The entire production is theater from the first ring, and the reason it holds people for days isn't stupidity, it's shame. They pick child exploitation on purpose, because they know that's the one accusation you won't pick up the phone and discuss with your daughter. The charge is built to isolate you, and isolation is the whole con. A man alone with a terrifying voice makes terrible decisions. A man who hangs up and calls his kid makes none.

Field Manual

Four cons, six habits. Not one of them takes longer than the con would have.