Scammers Gonna Scam.

The episode opens with light‑hearted banter about chickens and crows before diving into the serious subject of tax‑related scams. Host Dave Bittner shares listener feedback from Tim, an IRS Criminal Investigation special agent, who clarifies how the agency actually contacts taxpayers. Tim emphasizes that the IRS never initiates unsolicited tax payments via gift cards, Bitcoin, or phone calls, and that any in‑person encounter should occur at a public venue such as an IRS office. This correction sets the stage for listeners to distinguish legitimate government outreach from sophisticated social‑engineering attacks.

Tim’s detailed guidance provides a practical verification checklist for anyone approached by an alleged IRS representative. He advises meeting the agent at a neutral location—preferably a local IRS office, U.S. Attorney’s office, or library—and requesting to see official credentials, noting that agents cannot legally share badge photos electronically. The conversation also highlights that criminal‑investigation officers may appear at a taxpayer’s door, but only after documented investigative steps, not as a cold‑call surprise. By reinforcing these protocols, organizations can reduce the risk of falling for impersonation schemes that exploit the public’s fear of tax enforcement.

The second half of the show shifts to a technical deep‑dive on a long‑running SendGrid phishing campaign. Originally, attackers compromised legitimate SendGrid accounts lacking two‑factor authentication, sending fake login pages to harvest more credentials—a cycle dubbed “phishception.” Recent variants have adopted “rage bait” tactics, embedding polarizing political language—such as ICE support notices—to trigger emotional responses and higher click‑through rates. Security experts stress enabling 2FA on all email service providers, monitoring outbound traffic for unauthorized campaigns, and educating users about the dangers of gift‑card or cryptocurrency payments. Understanding this evolution equips businesses to defend against increasingly manipulative social‑engineering attacks.