112: Dirty Coms

Episode Summary

Executive Summary: The episode is a guided tour through underground online crime communities (“comms”) focused on youth-driven fraud, phishing, account theft, SIM swapping, and NFT/crypto scams. Through Drew’s firsthand account, it shows how teenagers monetize Roblox, gift cards, social accounts, and crypto by combining OSINT, breached databases, social engineering, and insider access, while also emphasizing the growing need for digital hygiene and privacy.

Main Topics: Youth-first internet and lack of digital mentorship (Priority: 5/5): The host frames the internet as a first-generation environment where younger users are often teaching older users, leaving kids without inherited safety norms and making them vulnerable to online risks. Roblox monetization and early scam training (Priority: 5/5): Drew describes how Roblox/Robux funnels kids toward survey-and-ad scams, fake ad servers, and gaming the ecosystem to make money, illustrating how minors are drawn into fraud by small incentives. Gift card phishing and account marketplaces (Priority: 5/5): The episode details fake gift-card balance sites, Google Ads manipulation, and OG Users-style forums where usernames and accounts are bought, sold, swapped, and stolen as commodities. SIM swapping and crypto theft pipelines (Priority: 5/5): A major section explains the step-by-step process criminals use to identify targets, obtain phone-number control, bypass 2FA, and drain Coinbase and other crypto accounts using holders, activators, and insiders. Infighting, extortion, and operational security failures (Priority: 4/5): Drew recounts being doxxed, extorted, and sent retaliatory package boxes, highlighting how criminal communities prey on each other and how poor OPSEC can expose identity and family members. NFT/Discord scams and social-engineering at scale (Priority: 4/5): The transcript covers NFT launch scams, fake mint sites, Discord token theft, bot-faked communities, and influencer-enabled exit scams, showing how hype events are weaponized. Security lessons and future implications (Priority: 5/5): The episode closes with advice to avoid password reuse, separate identities, reduce exposed personal data, and treat online security seriously as the internet becomes more dangerous and sophisticated.

Key Arguments: The internet is still in an early generation, so there is no mature cultural equivalent of elders warning kids about online dangers. Teenagers are not just victims of the internet; many are active participants in a criminal economy built around account theft, phishing, and crypto fraud. Simple public information, reused passwords, and breached databases can be chained together into high-value attacks. SIM swapping is a mature criminal business with roles, prices, and logistics, not just a one-off scam. Cryptocurrency and NFTs are attractive targets because they are liquid, high-value, and often protected by weak human habits rather than strong security. Criminal communities are intensely competitive and predatory; members scam, extort, and dox one another as much as outsiders. Better security habits, awareness, and sharing defensive knowledge are necessary because attackers systematically exploit convenience and trust.

Data Points: Internet maturity: ~30 years since AOL brought millions online - Used to argue the internet lacks an older generation of experienced users Roblox age: Age 13 - Drew starts his story playing Roblox and seeking discounted Robux Ad-server revenue ratio: $6 cost for about $50 worth of income - Profit margin from running kid-focused Robux ad funnels Roblox community scale: 200,000 kids on the website - Size of the ad-driven Robux site Drew’s friend helped run Early earnings: $1,000 to $2,000 - Drew’s reported earnings at the peak of the Robux/ad scheme Forum rank: 700th user - Drew says he joined OG Users very early Username flip profit: $200 bought / $350 sold - Example of buying and reselling a desirable username Sim swap insider payout: About $10,000 per swap - What insiders/managers may be paid to assist SIM swaps Telegram/tablet window: 10 minutes - T-Mobile tablet access must be used quickly before deactivation T-Mobile swap price: About $5,000 per exploit - Current price point Drew cites for a T-Mobile remote Fraud-victim swap price: $7,500 - Higher price when the target has added protections or is flagged as fraud risk Verizon swap price: Upwards of $50,000 - Described as the hardest carrier to compromise AT&T swap price: $2,000 to $3,000 - Drew says their protection is weaker and prices are falling Coinbase disclosure bug: About one month - A historical bug allegedly allowed balance checks with only username/password Ledger breach timing: 2020 breach, posted five months later - Ledger customer data was later used for cross-referencing targets Exchange 2FA gap: 6,000 Coinbase customers - Bleeping Computer referenced wallets drained due to a 2FA flaw Turpin theft: $23 million - Michael Turpin crypto theft via SIM swap and related social engineering Turpin lawsuit award: $75 million - Court awarded Turpin damages in suit against the hacker Joel Ortiz sentence: 10 years - First convicted SIM swapper mentioned in the episode Ortiz victims: 40 people - Police said he scammed multiple victims Ortiz haul: $7 million - Estimated amount stolen by Joel Ortiz NFT drain example: $40,000 in Ethereum - Wallet drained after user entered seed phrase on a fake site

Pivotal Quotes: "The internet doesn't have an older generation." — Jack Rhysider: Opening framing for why online safety knowledge is still developing "Don't be doxable." — Drew: Core OPSEC lesson drawn from his experience in underground communities "You either die a hero or you live long enough to become a villain." — Drew: Used during discussion of criminal community dynamics and how participants rationalize behavior

Implications: The episode warns that online crime is increasingly organized, youth-driven, and data-intensive. For listeners, the takeaway is stronger OPSEC, password discipline, privacy awareness, and skepticism toward links, downloads, and social-engineering cues.