Won't Fix

Won't Fix Episode 20: With Jeff Dunn, COO of the Digital Trust Council

Tue, 03 Nov 2026 07:00:00 -0500

Jeff Dunn is the COO of the nonprofit Digital Trust Council, and is a long-time trust & safety leader, advocate and mentor. He has been Hinge's VP, Trust & Safety and Chief Risk Officer, and spent 7+ years in Trust & Safety at Google, with earlier work at ICANN and Harvard on child protection, election integrity and platform operations.

He co-founded the Trust & Safety Network, which provides free resources for the people who keep everyone safer online.

Chapter Timestamps:

00:00 Introduction

5:01 Building a stronger and more consistent trust-and-safety community

8:44 Safety as a business-growth driver, not merely risk mitigation

13:53 Dating-app safety: moving beyond verification toward proactive prevention

16:42 How scammers behave on dating platforms and how product design can help

20:00 Cross-platform scams and the need for industry signal sharing

25:09 AI for online-to-offline safety—and the privacy trade-off

27:31 DoorDash example: obvious signals and the business value of trust

29:38 AI-enabled voice fraud, targeted impersonation, and media literacy

33:21 Location data: essential for safety but valuable to scammers

34:58 User reports, offline incidents, and human review on dating platforms

38:33 Regulation, transparency, and competing on measurable safety outcomes

44:24 Trust-and-safety careers: salary trends and the return of liberal-arts skill

Resources & Links:

Jeff Dunn (https://www.linkedin.com/in/jeffmdunn/)

Digital Trust Council (https://digitaltrustcouncil.com)

Trust and Safety Network (https://www.linkedin.com/company/trust-safety-network/home/ and https://trustsafety.net)

Rob Leathern (https://www.linkedin.com/in/leathern/)

Won't Fix Episode 19: With Author Becky Holmes

Fri, 16 Oct 2026 07:00:00 -0400

Somewhere out there, Keanu Reeves is desperately in love with you. So is Jason Statham. And a brave peacekeeping soldier who just needs a few gift cards to get home.

Of course, none of them are real. Keanu Reeves isn’t even on social media. But that hasn’t stopped scammers from impersonating him again and again.

My guest today has had more of these online romances than anyone alive. Becky Holmes joined Twitter during lockdown, started stringing scammers along for laughs, and built a following of more than a hundred thousand people under the name Death to Spinach. Then victims began reaching out, people who’d lost their savings, their friendships, and sometimes far more. And the joke turned into a mission.

Her book, Keanu Reeves Is Not in Love With You: The Murky World of Online Romance Fraud, is laugh-out-loud funny and heartbreaking, often on the same page. It takes on the scammers, the scripts and the shame that keeps victims silent. Her follow-up, The Future of Fraud, came out this spring.

Chapter Timestamps:

00:00 Intro

2:37 Why Keanu Reeves and other celebrities are impersonated

4:16 How celebrity fraudsters persuade victims to send money

8:28 Scam-baiting, scripted responses, and an absurd Brad Pitt exchange

12:14 Platform responsibility and the UK reimbursement debate

14:56 Victim stories: financial ruin, isolation, and secrecy

19:02 Changing the language around fraud victims

21:23 Male victims, sextortion, and underreporting

23:28 The harm caused by stolen identities and images

27:12 Scam networks as a professional industry

Resources & Links:

Rob Leathern (https://www.linkedin.com/in/leathern/)

Keanu Reeves Is Not in Love With You: The Murky World of Online Romance Fraud

(https://www.amazon.com/dp/B0D7SHMNB4)

The Future of Fraud (https://www.amazon.com/Future-Fraud-FUTURES-Becky-Holmes-ebook/dp/B0FJD3WBJR/ref=books_amazonstores_desktop_nis_default)

Becky Holmes on X (https://x.com/deathtospinach?lang=en)

Won't Fix Episode 18: With Jon Leibowitz Former Chairman, FTC

Fri, 09 Oct 2026 07:00:00 -0400

My guest Jon Leibowitz spent nearly a decade at the Federal Trade Commission, and four years running it — as Chairman from 2009 to 2013, right through the wreckage of the financial crisis.

During Jon’s chairmanship (March 2009 to February 2013), the FTC's enforcement centered on "last dollar" frauds preying on Recession-battered consumers: coordinated national sweeps against mortgage-rescue and foreclosure-relief scams (leading to the 2010 MARS Rule banning advance fees), and a landmark $108 million settlement with Countrywide over mishandling struggling borrowers. It hit deceptive marketers hard — the roughly $359 million Jesse Willms "free trial" negative-option case, a $163 million scareware judgment against fake-virus-pop-up operators, the 2011 fake-news-site sweep over bogus acai-berry weight-loss claims and phony Oprah and Rachael Ray endorsements, and a 2012 international crackdown on India-based tech-support scam boiler rooms.

On the robocall front, it brought cases like the Cash Grant Institute and the auto-warranty scheme (the telemarketer who surrendered his Mercedes) and launched the public Robocall Challenge contest. Beyond fraud, his FTC also built the agency's modern privacy agenda — landmark settlements with Google and Facebook and a record $22.5 million penalty against Google over Safari tracking — and stayed active on antitrust and competition alongside all of it.

After the FTC, he went into private practice at Davis Polk, testified before Congress more times than he can probably count, and today he chairs the National Consumers League — one of the oldest consumer advocacy groups in the country.

But here's what makes this conversation timely. The scams he chased fifteen years ago never died. They got faster, cheaper, and — thanks to AI — a whole lot more convincing.

Chapter Timestamps:

00:00 Intro

2:33 FTC career and current work

4:03 Old scams, new technology, and the rise of AI-enabled fraud

5:30 From the “spam king” to large-scale online deception

6:51 Fraud supply chains, overseas actors, and cross-border enforcement

9:52 AI deepfakes and the persuasive power of modern scams

11:21 Affiliate marketing, robocalls, and weakened FTC monetary remedies

14:42 State attorneys general and platform cooperation

17:48 - Shared intelligence and the multi-provider nature of scams

18:23 AI fraud’s scale and fabricated “evidence”

20:33 Long-form fake media and recurring-subscription traps

23:39 Domain authentication and the failure of voluntary privacy standards

27:03 Reporting, independent evaluation, and regulatory balance

33:02 Trust in the internet and FTC rules against impersonation and fake reviews

34:53 Business verification and the trade-off between friction and safety

37:14 A $0 trial that becomes $34.90 per month

39:58 Closing: protecting reality while preserving innovation

Resources & Links:

Rob Leathern: (https://www.linkedin.com/in/leathern/)

Jon Leibowitz: (https://www.linkedin.com/in/jon-leibowitz-14091679/)

Steve Martin scam video website: https://assist.saeculums.com/

Cases from Jon's era:

Sanford Wallace "Spam King" (CD-ROM tray) — FTC release: https://search.ftc.gov/news-events/news/press-releases/2004/10/ftc-cracks-down-spyware-operation — The FTC's 2004 complaint describes spyware that popped open CD-ROM trays and then flashed a "FINAL WARNING!!" pushing paid fixes. Nice follow-up detail: a court later ordered Wallace to give up $4,089,500, from selling the "fix" at roughly $30 a copy.
Scareware $163M judgment (Kristy Ross): https://www.ftc.gov/node/47528 — Useful context for listeners: a co-defendant and his father had to give up $8.2 million under a 2011 settlement, which is a good contrast with the giant headline number.
2012 international tech-support crackdown: https://www.ftc.gov/news-events/news/press-releases/2012/10/ftc-halts-massive-tech-support-scams — This is the press conference Jon describes; one of the six operations found victims by buying Google ads that appeared when people searched for their computer company's support number, which echoes your toll-free-number point.
Jesse Willms $359M settlement: https://www.ftc.gov/news-events/news/press-releases/2012/02/ftc-halts-deceptive-practices-marketer-who-collected-359-million-using-bogus-free-trial-offers
The Atlantic, "The Dark Lord of the Internet" (Willms profile, 2014): https://www.theatlantic.com/magazine/archive/2014/01/the-dark-lord-of-the-internet/355726/
Fake news sites / acai sweep (2011): https://www.ftc.gov/news-events/news/press-releases/2011/04/ftc-seeks-halt-10-operators-fake-news-sites-making-deceptive-claims-about-acai-berry-weight-loss
Central Coast Nutraceuticals (fake Oprah / Rachael Ray endorsements): https://www.ftc.gov/news-events/news/press-releases/2012/01/internet-marketers-acai-berry-weight-loss-pills-colon-cleansers-pay-15-million-settle-ftc-charges
AMG Capital Management v. FTC (SCOTUSblog case page): https://www.scotusblog.com/case-files/cases/amg-capital-management-llc-v-federal-trade-commission/ — The ruling came down April 22, 2021, unanimously, holding that the FTC can't get restitution or disgorgement under Section 13(b).
Impersonation Rule taking effect (FTC): https://ftc.gov/news-events/news/press-releases/2024/04/ftc-announces-impersonation-rule-goes-effect-today — It lets the FTC go straight to federal court to get money back for victims and seek civil penalties.
Fake reviews and testimonials rule (FTC, Aug 2024): https://www.ftc.gov/news-events/news/press-releases/2024/08/federal-trade-commission-announces-final-rule-banning-fake-reviews-testimonials — This directly covers fake celebrity testimonials and AI-generated reviews.
Click-to-cancel vacated (law-firm explainer): https://www.fenwick.com/insights/publications/eighth-circuit-vacates-ftcs-click-to-cancel-rule — The Eighth Circuit struck it down on July 8, 2025 because the FTC skipped a required preliminary regulatory analysis.

InfoHawk funding announcement:

https://finance.yahoo.com/sectors/technology/articles/infohawk-raises-2-25m-pre-123400630.html

Won't Fix Episode 17: With Dave Willner, Co-Founder of Zentropi

Fri, 25 Sep 2026 07:00:00 -0400

My guest today is Dave Willner, cofounder of Zentropi and a fixture in the Trust and Safety world.

In 2008, he was a young Facebook employee who sat down to replace a one-page list of banned content — it said, roughly, no Hitler and no naked people — with the first real set of community standards the internet had ever seen. The rules he wrote are still the foundation of how Meta governs content shared by billions of people.

He went on to build community policy at Airbnb, and then joined OpenAI in early 2022, before ChatGPT existed, to figure out how to stop an image generator from producing bad things.

Now he's co-founded a company called Zentropi, with Samidh Chakrabarti, which is built on the idea that moderation at scale was never actually impossible — we just didn't have the right tools.

In This Episode:

Human moderation suffers from high turnover, trauma, and inconsistent judgment—problems small, tailored language models solve by strictly enforcing written rules.

Specialized small models can run circles around massive frontier models on speed and cost, making real-time classification financially viable.

Written policies and labeled datasets are two sides of the same coin; when an AI disagrees with a human label, it usually exposes a vague policy rather than a model error. Running moderation models locally on your own servers cuts per-check costs, dodges European privacy paperwork, and keeps user data in-house.

Bad actors are using AI to scale exploits at high speeds, forcing safety teams to adopt AI defenses immediately just to keep up.

A single global moderation rule doesn't work—dating apps, teen platforms, and social feeds require custom enforcement thresholds based on their specific risks.

Using the same LLM to draft a policy, generate test cases, and grade itself creates lazy evaluation loops that hide major safety blind spots.

Giving open-weights AI tools to volunteer moderators on Reddit or Discord lets small teams govern massive communities without burning out.

Chapter Timestamps:

00:00 Intro

3:21 Dave Willner’s trust-and-safety background and the origins of Zentropi

7:04 Zentropi’s specialized moderation models and policy-optimization tools

11:15 Why human moderation is inconsistent and difficult to measure

15:45 The limits of human judgment and the case for automated moderation

21:09 Imperfect language, model precision, and faster adaptation to abuse

24:43 Shared moderation infrastructure versus platform-specific policies

28:46 Why small specialized models can outperform larger general models operationally

32:26 Local deployment, privacy, and trust-and-safety resource constraints

34:16 Customer economics and real-time video moderation

38:09 The danger of “slop” policies and weak AI evaluations

44:10 AI moderation as a tool for decentralized community governance

47:06 The adversarial threat landscape and urgency of AI-enabled defense

Resources & Links:

Zentropi (https://zentropi.ai/)

Dave Willner (https://www.linkedin.com/in/davewillner/)

Rob Leathern (https://www.linkedin.com/in/leathern/)

Won't Fix Episode 16: With John Canfield, Founder & CEO of BlueArc

Thu, 17 Sep 2026 07:00:00 -0400

The question "is this business real, and should I believe what it's telling me" isn't new. It's about as old as American commerce. What's changed is that you can now spin up a company, a website, and a merchant account before lunch, and there's no correspondent in town to write you up.

My guest has spent his career on the modern version of that problem. John Canfield built risk and verification systems at eBay, at WePay (acquired by JPMorgan Chase) and at Google, where he led the Ads verification and transparency initiative. He's now co-founder and CEO of BlueArc, which uses AI to verify business customers.

Some themes:

1. How verification became paperwork The Bank Secrecy Act, then post-9/11 customer identification rules, hard-coded KYC as document collection — optimized for what an examiner could inspect, not what would catch a bad actor. When did "compliant" and "works" come apart?

2. Identity versus credibility He led Google Ads verification in 2020 and now argues that approach won't stop scams: identity answers who's speaking, credibility answers whether to believe them. Platforms spent a decade saying claim-level review couldn't scale, so why now?

3. Flipping the economics — who actually pays If the goal is no added friction for legitimate businesses, and if platforms can charge for deeper review, what then?

4. FTC v. Genesis Tech (filed June 2026, N.D. Cal.): we talked about this case, where the FTC alleges a network of 15 corporations and 8 individuals ran deceptive subscription apps through a shifting web of Cyprus and Delaware shell companies, continually registering new entities and merchant accounts to outrun fraud monitoring — with linked PayPal accounts processing close to $700M in the twelve months ending September 2025. Per the FTC’s standard, a practice is deceptive if it's likely to mislead a consumer acting reasonably in the circumstances and is material to their decision — no intent and no actual victims required, and net impression governs, so an ad that is literally true in every sentence can still be unlawful.

Chapter Timestamps:

00:00 Introduction

1:21 Jon Canfield’s trust-and-safety background and BlueArc’s mission

3:34 Why business verification differs from verifying individuals

5:36 The missing business graph behind platform risk decisions

7:20 Legal entities are not enough: domains as a business identity layer

11:32 Balancing low-friction verification with domain control and vouching

16:36 Verification does not equal credible advertising claims

19:08 Risk-based claim credibility, transparency, and the limits of black-box enforcement

23:24 AI-enabled advertiser engagement and remediation

27:00 Proportional friction: local flower ads versus high-risk miracle claims

30:56 Scam economics and why advertisers may need to fund deep validation

34:16 Shared third-party validation and BlueArc’s next priorities

39:19 FTC material misrepresentation as a scalable policy framework

42:38 Know Your Agent: AI shopping agents, authorization, and scam resilience

46:02 Review-site integrity and adversarial manipulation

Resources & Links:

Rob Leathern (https://www.linkedin.com/in/leathern/)

John Canfield (https://www.linkedin.com/in/johncanfieldbayarea/)

BlueArc (https://bluearc.ai/)

Won't Fix Episode 15: With Alexios Mantzarlis, Co-Founder of Indicator

Fri, 11 Sep 2026 07:00:00 -0400

Alexios Mantzarlis has spent his career on the unglamorous side of the internet. He founded the Italian fact-checking site Pagella Politica, then led the International Fact-Checking Network, then spent several years at Google building an adversarial red team focused on content risks from generative AI. In 2024 he became the founding director of Cornell Tech's Security, Trust, and Safety Initiative, a role he left in June 2026 to go full-time on Indicator, the independent publication he co-founded with Craig Silverman to investigate digital deception. He now runs it from Rome.

If there's a through-line, it's that the cheapest new technology always finds the oldest scams first. In the past year alone, Alexios has written about a North Korean hiring scam; an AI-generated podcast network pumping out 11,000 episodes a day; an AI bot that became the single largest contributor to Community Notes on X; Grokipedia citing a neo-Nazi forum as a source; face-swap apps in the Apple and Google stores; "cheater buster" websites selling fabricated infidelity reports; TikTok content farms; AI avatars impersonating real journalists; lookalike ticket sites and thousands of ads for nonconsensual nude generators that Meta has kept running despite a year of documentation.

We talked about his latest investigation: roughly 8,000 Reels featuring AI-generated women posing as fired Costco, Aldi, and Home Depot employees, leaking "insider secrets." The videos funneled to survey sites promising a $750 gift card that didn't exist. Alexios and Benjamin Shultz traced the whole thing back to a single affiliate account and to a scam pipeline where AI generates the video, the captions, and the landing pages.

Chapter Timestamps:

00:00 Introduction

2:20 Alexios’s path from platform trust and safety to independent reporting

4:36 Why public investigations can drive platform action

8:09 Fact-checking and Community Notes

11:33 The AI-generated retailer gift-card scam

14:57 AI used throughout the fraud pipeline

17:36 Recommendation feeds and reduced source context amplify scam reach

22:34 Affiliate IDs reveal the scam’s business model and coordination

27:20 Responsibility across the infrastructure chain

30:50 Journalism and trust and safety staffing

33:30 Transparency, EU ad data, and pro-speech accountability

35:47 AI bots in Community Notes and monetization-driven misinformation

41:29 Sources, sustainability, and Indicator’s next investigative tools

47:51 Closing warning against dismantling trust and safety

Resources & Links:

Rob Leathern (https://www.linkedin.com/in/leathern/)

Alexios on Indicator (https://indicator.media/authors/alexios-mantzarlis)

Alexios Mantzarlis (https://www.linkedin.com/in/mantzarlis/)

Some of Alexios's pieces:

AI-generated Costco employees — https://indicator.media/p/ai-generated-costco-employees-got-over-100-million-views-on-facebook-and-instagram
Meta ran at least 11,000 ads for AI nudifiers this year (Sep 3, 2026) — https://indicator.media/p/meta-ran-at-least-11-000-ads-for-ai-nudifiers-this-year-many-from-easily-detectable-repeat-offenders
How to red team an AI tool for safety — https://indicator.media/p/how-to-red-team-an-ai-tool-for-safety
Latvia's "man drought" and passport-bro content — https://indicator.media/p/how-tabloid-claims-about-latvia-s-man-drought-fueled-a-misleading-social-media-frenzy-and-polluted-g
What I learned running an adversarial test on an AI text detector — https://indicator.media/p/what-i-learned-running-an-adversarial-test-on-an-ai-text-detector
This AI-generated podcast network publishes 11,000 episodes a day — https://indicator.media/p/this-ai-generated-podcast-network-publishes-11-000-episodes-a-day-it-s-also-ripping-off-media-outlet
An AI bot is now the top contributor to Community Notes on X — https://indicator.media/p/an-ai-bot-is-now-the-top-contributor-to-community-notes-on-x

Won't Fix Episode 14: With Ajit Varma, Head of Firefox at Mozilla

Thu, 27 Aug 2026 07:00:00 -0400

My guest, Ajit Varma, is Head of Firefox at Mozilla, where he leads Firefox strategy and product. He joined Mozilla in late 2024, from Meta, where he worked on monetization and business messaging for WhatsApp. He's also worked at Google and various startups in his 20 years of product leadership in Silicon Valley, and is based in the Bay Area.

We talked about trust as a business strategy — Mozilla's bet that in an era of data harvesting and opaque algorithms, being the browser people can actually verify is worth more than scale. That means no in-house AI model, a choice of LLMs in Firefox, a master switch to turn AI off entirely, and revenue that doesn't depend on watching you.

Ajit covered the nuances of data brokers, prompt injection and the tradeoffs between safety and privacy. From there, what a browser even is once it reads pages and acts on your behalf rather than just fetching them — model choice, shipping deliberately slower than the competition, and the parts nobody has solved yet.

On agents: what consent means when software acts as you and spends your money, his argument that agents could route around the platforms taking a 30% cut, and where the next middleman forms if they do.

And finally, who pays for the open web when agents do the reading — including Mozilla's own advertising business, its privacy-preserving ad infrastructure, and whether people will pay directly for software they trust.

Chapter Timestamps:

00:00 Introduction

3:18 Mozilla's Mission: The Open Internet and Nonprofit Structure

5:11 Becoming the Most Trusted Software Company

9:51 AI as New Gatekeepers and Firefox's Response

16:19 Privacy, Felt Privacy, and User Awareness

19:59 AI Agents, Browser Automation, and the Human Element

24:02 Job Applications, Agent Spam, and Asymmetric Information

27:33 Advertising, the Open Web, and Data Brokers

32:42 Firefox's Approach to Ad Blocking and Tracker Transparency

43:41 Mozilla's Revenue Model and the Google Search Deal

Resources & Links:

Ajit Varma (https://www.linkedin.com/in/ajitvarma/)

Firefox (https://www.firefox.com/)

Rob Leathern (https://www.linkedin.com/in/leathern/)

Won't Fix Episode 13: With Alan Chapell of The Monopoly Report

Tue, 18 Aug 2026 07:00:00 -0400

Rob Leathern speaks to privacy attorney and host of The Monopoly Report Podcast, Alan Chapell, about residential proxies, privacy and podcasting. Hear how free smart TV apps might be sharing your home IP address with strangers, and see just how broken online consent forms really are.

Alan explains why current data broker laws miss these proxy networks entirely and how coming age verification rules could rewrite the open web.

In This Episode:

Free smart TV apps quietly bundle code that rents your home internet connection to strangers, creating vulnerabilities that look suspiciously like security exploits.
Online consent breaks down with bandwidth sharing, when endless disclaimers mean nothing as consumers may have no easy way to turn the access off.
State data broker laws miss the mark by hunting legacy data vendors while ignoring massive proxy networks, credit card companies, and telecom giants.
AI companies pushing to scrape the entire web without limits could accidentally hand ad verification firms the ultimate legal shield against platform lawsuits.
Strict age check laws could spark an arms race with clever teenagers that could end with governments requiring real ID just to browse the web.

Chapter Timestamps:

00:00 Introduction

5:32 Residential Proxies: The "Ethically Sourced IP" Question and the LG TV Case

9:48 Legitimate Uses vs. Harmful Behaviors of Residential Proxy Networks

12:50 Data Broker Laws, Enforcement Gaps, and KYC

14:40 Consent Problems: Revocation, Age Verification, and the LG TV Example

16:56 Adware Parallels: History, Opt-Outs, and Financial Incentives

23:31 Age Verification: A Looming Internet-Wide Challenge

25:39 Scraping, Antitrust, and AI Companies

29:40 Podcast Strategy, Guest Selection, and Speaking Recklessly

41:53 Regulators, Historical Knowledge Gaps, and Industry Dynamics

Resources & Links:

Rob Leathern (https://www.linkedin.com/in/leathern/)

Alan Chapell (https://www.linkedin.com/in/alan-chapell-90711b/)

The Monopoly Report (https://monopoly-report.com/)

The Chapell Regulatory Insider (https://chapellreport.substack.com/)

Won't Fix Episode 12: With Jeff Allen Co-founder & CRO of the Integrity Institute

Fri, 07 Aug 2026 07:00:00 -0400

Jeff Allen is the Co-founder and Chief Research Officer of the Integrity Institute, started in 2021. A physicist and astronomer by training, moved into data science in 2013, and has since worked all three sides of the platform-publisher relationship: for publishers chasing platform traffic, for the platforms themselves, and for political organizations navigating both.

At Facebook he worked on systemic problems in the Facebook and Instagram public content ecosystems.

Along with Spencer Gurley, Jeff Allen and the Institute recently published the July 2026 report which Ofcom commissioned — Fraudulent Advertising and Account Integrity: Expert Insights on Best Practice, which fed directly into Ofcom's draft Fraudulent Advertising Codes (published 10 July, consultation closes 2 October).

In This Episode:

Short-term ad revenue pits platform profits against user safety, making external regulation necessary to preserve long-term industry trust.
Regulators need technical guidance from experts independent of Big Tech funding to build safety policies that can survive court challenges.
Bad actors are using generative AI to quickly spin up realistic, multi-step scam sites that slip right past standard automated filters.
Effective oversight requires a two-step system: platform self-reporting backed by independent audits from verified researchers.
Scammers actively reverse engineer enforcement limits, making off-site damage and delayed user reporting persistent challenges.

Chapter Timestamps:

00:00 Introduction to Jeff Allen and the Integrity Institute

1:46 The Integrity Institute's Mission and Approach

3:29 The Scale of Online Scams and Fraudulent Advertising

4:54 Regulatory Landscape and Ofcom's Role

6:15 Development of the Ofcom Report

10:33 Congressional Understanding and Regulatory Progress

12:04 Media Coverage Challenges in Advertising

15:02 Incentive Alignment and Regulatory Approach

18:52 Data Access Challenges and Solutions

21:40 Internal vs External Research Challenges

24:07 The Sales Challenge in Data Science

28:50 Specific Transparency Metrics and Market Impact

32:46 Guidelines Disclosure and Adversarial Dynamics

35:15 The "Three Slide Rule" and Off-Platform Harm

40:17 Evolution of Fraudulent Content Creation

43:23 Researcher Access and Data Requests

45:25 Educational Needs and Trust and Safety Curriculum

Resources & Links:

Integrity Institute (https://www.integrityinstitute.org/)

Integrity Institute Report (https://www.integrityinstitute.org/research/response-to-ofcoms-request-for-research-on-fraudulent-advertising-and-account-integrity)

Rob's Notes (https://robleathern.substack.com/p/robs-notes-47-on-ofcoms-fraudulent)

Jeff Allen (https://www.linkedin.com/in/jeff-allen-scientist/)

Ofcom (https://www.ofcom.org.uk/)

Rob Leathern (https://www.linkedin.com/in/leathern/)

Won't Fix Episode 11: With Independent Researcher & Consultant Ben Edelman

Fri, 24 Jul 2026 07:00:00 -0400

Ben Edelman has spent two decades catching online fraud that hides in plain sight — combining software engineering, law, and economics to prove misconduct empirically rather than take companies at their word. In this conversation we get into the Phia shopping-plugin scandal, how it relates to Honey and Paypal that he covered after Megalag broke the issue on YouTube, the mechanics of affiliate fraud, and his recent investigation into AppLovin's apparent app install deals with mobile carriers.

In This Episode:

How Ben got into fraud investigation, and what keeps him motivated
Phia's "cookie stuffing": how a browser extension can claim affiliate credit for sales it didn't drive
Whether Phia's "December bug" oopsy explanation holds up, and Phia's earlier 2025 privacy “mistake”
The Honey/Paypal parallels, typosquatting and the broader toolkit of affiliate-fraud techniques
MegaLag vs. the mainstream media: how independent investigators break stories now
AppLovin's nonconsensual install investigation he wants state AGs to look at
What meaningful accountability looks like, and his advice to founders building in this space

Links & Resources:

Ben Edelman's AppLovin investigation: https://www.benedelman.org/applovin-nonconsensual-installs/
Ben Edelman's site (full archive of his research): https://www.benedelman.org
Ben's list of "Investors supporting spyware": https://www.benedelman.org/spyware/investors/
Edge Shopping Stand-Down Violations: https://www.benedelman.org/edge-shopping-standdown/
Phia forced clicks and stand-down violations: https://www.benedelman.org/phia-forced-clicks/
Honey stand-down violations and concealment: https://www.benedelman.org/honey-detecting-testers/
Adware investors page:https://www.benedelman.org/spyware/investors/
"Spontaneous Deregulation: How to Compete with Platforms that Ignore the Rules" (HBR article about intentional rule-breaking as a business strategy): https://www.benedelman.org/publications/hbr-spontaneous-deregulation-apr2016.pdf
Rob Leathern (https://www.linkedin.com/in/leathern/)

Chapter Timestamps:

00:00 Introduction and Background on Online Fraud Investigation

1:36 The Origins: Gator Adware and Early Ad Fraud (2001)

3:10 The Dark Chapter of VC-Funded Adware

4:54 Transition to Independent Investigation Work

6:07 FIA Investigation: Two Types of Violations

7:31 Understanding Forced Clicks Through Analogies

9:50 Debunking FIA's "Recent Bug" Defense

12:50 FIA's Previous Screenshot Controversy

14:18 The Current "Dumb Tech Cycle" and Screenshot Overuse

16:20 Recurring Patterns: From Gator to Modern Shopping Plugins

21:11 Startup vs. Public Company Misconduct Patterns

24:40 PayPal's Due Diligence and Ongoing Modifications

27:24 Media Resources and Technical Expertise

30:17 Typo squatting and Google's Role

31:36 The Ad Tech Attention Gap

33:34 AppLovin Investigation: Install Helpers and Carrier Partnerships

34:21 Wall Street Journal's Surprising Rejection

40:28 Carrier Billing and Historical Context

44:42 Advice for Founders: The Temptation and Risk of Cheating

Won't Fix Episode 10: With Lindsay Kaye & Will Herbig of HUMAN Security

Fri, 17 Jul 2026 06:00:00 -0400

On July 7, 2026, HUMAN’s Satori team exposed NewsJunkie, a massive, coordinated connected television (CTV) device-spoofing operation that generated up to two billion invalid bid requests per day, per seller.

In this episode of Won’t Fix, we go inside the investigation with Lindsay Kaye (VP of Threat Intelligence) and Will Herbig (Senior Director of Media Research) from HUMAN Security to break down how this sophisticated fraud was uncovered.

We then zoom out and the conversation to talk about the connected TV ecosystem in general and how AI and automation are changing the security threat landscape in general.

Resources & Links:

HUMAN Security Website: https://www.humansecurity.com/
The Full NewsJunkie Report: https://www.humansecurity.com/learn/resources/human-disrupts-ctv-device-spoofing-newsjunkie/
Lindsay’s Book (Dissecting the Dark Web, No Starch Press): https://nostarch.com/dissecting-the-dark-web
Rob Leathern (https://www.linkedin.com/in/leathern/)

Chapter Timestamps:

00:00 Introduction

1:13 Team Backgrounds and Roles at Human Security

3:31 Understanding the News Junkie Operation Structure

5:27 Key Anomalies That Exposed the Fraud

8:32 Scale and Impact of Invalid Traffic

10:14 Evolution and Persistence of the Operation

14:15 Residential Proxies and Infrastructure Connections

20:24 AI-Generated Fake Business Identities

23:44 Disruption Strategies and Industry Response

26:48 Systemic Gaps and Supply Chain Compliance Issues

31:48 Device Attestation and Technical Solutions

34:41 AI's Impact on the Security Landscape

41:33 Investigation Methodology and Future Outlook

Won't Fix Episode 9: With Juliet Shen, Cofounder & HOP at ROOST

Tue, 07 Jul 2026 06:00:00 -0400

Juliet Shen is cofounder and Head of Product at ROOST (Robust Open Online Safety Tools), a nonprofit building open-source trust-and-safety infrastructure for platforms of every size. She has done anti-abuse product work at Google and Grindr, and was the first trust-and-safety product manager at Snap, where she helped launch early cross-platform efforts to combat child exploitation. ROOST's website is https://roost.tools.

Across her career, Juliet kept running into the same maddening pattern: every trust-and-safety team, at every platform, quietly rebuilding the same rules engines, review queues, and reporting pipelines from scratch, behind closed doors, and at enormous cost. ROOST is a bet that online safety should be shared, open infrastructure rather than proprietary secret sauce, available free to any platform or site that needs it. We talk about that, and a lot more.

Key Highlights:

Every tech company shouldn't have to build their trust and safety tools from scratch behind closed doors. It’s an expensive waste of time when open-source infrastructure could solve the exact same foundational problems for everyone.
PMs and engineers need to step up and lead in the trust and safety space. They are the ones who can actually bridge the gap and get policy, operations, engineering, and legal teams talking to each other.
AI is great for knocking out the easy, baseline moderation tasks. But when a situation is highly nuanced or something the AI hasn't seen in its training data, you still absolutely need human judgment.
As social media breaks apart into decentralized networks, a one-size-fits-all safety system won't work anymore. We need modular tools that let platforms look at who the user is, how they're behaving, and what they're posting as separate pieces of the puzzle.
Good moderation is often less about analyzing the post itself and more about knowing exactly who is behind the account or the app. Right now, our lack of solid identity verification is a massive blind spot for digital safety.

Chapter Timestamps:

00:00 Introduction

1:34 Career Journey and the Problem of Redundant Tool Building

5:30 The Role of Product Managers in Trust and Safety Teams

7:34 Impact of LLMs on Trust and Safety Operations

11:27 Focus Areas and Child Safety Priority

12:55 The ABC Framework and Actor Trust Challenges

16:54 Community Building and TrustCon Participation

19:13 Signal Sharing vs Tool Sharing Philosophy

22:43 Open Source Approach and Scaling Challenges

23:59 Future Roadmap and Research Partnerships

28:52 Reviewer Well-being and Mental Health Considerations

32:00 Centralized vs Decentralized Moderation Models

37:15 Government Role and Open Source Support

39:52 Success Metrics and Measurement Challenges

42:50 Standards, Testing, and Future Directions

Resources & Links:

Rob Leathern (https://www.linkedin.com/in/leathern/)

Juliet Shen (https://www.linkedin.com/in/julietshen/)

ROOST (https://roost.tools)

Won't Fix Episode 8: With Dave Kleidermacher of Google

Tue, 30 Jun 2026 06:00:00 -0400

Dave Kleidermacher is a vice president of engineering at Google, leading engineering for Android security and privacy. His scope encompasses Android and the Made-by-Google world — Pixel, Nest, Fitbit, and the Play Store.

We talked about Android's answer to scams: smarter defenses that use AI as a shield (on-device detection that catches scams as they unfold), and a deeper structural pivot to "Actor Trust" — establishing provable, cryptographic confidence in who or what a source is rather than forever trying to detect bad things.

Dave has been steeped in these topics for a long time so we get into a bunch of great territory, and I think you’ll really enjoy the conversation.

Key Highlights:

Consumer platforms must pivot from traditional vulnerability exploitation defenses to fighting scams and fraud, which make up 99% of actual practical threats facing users today.
The future of mobile authentication lies in reversing security asymmetry through "actor trust" cryptographically verifying the source device rather than relying on human intuition.
Big Tech players like Apple and Google need to publish a transparent, accountability driven joint priority roadmap to accelerate cross-platform security for critical defenses like caller verification.
Mobile network operators remain a critical structural weak point in consumer safety due to privacy-invasive habits like silent third party app installations and outdated location-tracking protocols.

Chapter Timestamps:

00:00 Introduction and Background

3:01 The Shift from Vulnerability Threats to Scam Prevention ‎

6:01 Real-time Voice Spoofing Capabilities and Demonstrations ‎

8:19 Platform Defense Strategies and the Whack-a-Mole Problem ‎

11:00 Actor Trust and Cryptographic Verification Approach ‎

15:37 Google's Security Key Success and Developer Ecosystem Verification ‎

17:35 RCS Standards and Industry Collaboration Challenges ‎

27:19 Business Caller Verification and Stir Shaken Limitations ‎

31:59 Privacy-Security Balance and Binary Transparency ‎

41:30 Consumer Role and Stakeholder Responsibilities ‎

43:27 Future AI Landscape and Industry Recommendations ‎

49:47 Advertising Technology and Platform Accountability ‎

Resources & Links:

Rob Leathern (https://www.linkedin.com/in/leathern/)

Dave Kleidermacher (https://www.linkedin.com/in/davekleidermacher/)

Won’t Fix Episode 7: With Jeremy Philip Galen of Charlemagne Labs

Fri, 19 Jun 2026 06:00:00 -0400

My guest today is Jeremy Galen, founder of Charlemagne Labs. Jeremy spent twelve years at Meta working in privacy, safety, and security — most recently five years as a product manager in trust and safety, focused on machine-learning content enforcement, account access, impersonation, and plagiarism.

He left to start Charlemagne Labs, a New York startup building what he calls a "digital bodyguard" — an on-device AI assistant, Agent Charley, that steps in before a worker clicks a dangerous link or pastes sensitive data into a chatbot.

The company's research recently landed in Meta's safety report for its frontier model, Muse Spark, where Charlemagne's benchmark measured how capable leading AI models are at multi-turn social engineering. His core argument is that the old "think before you click" model of security is broken, and that risky digital behavior should be treated less like a moral failure and more like a public-health and system-design problem.

Learn more about Jeremy and the company at https://charlemagnelabs.ai/

Listeners who sign up for the Pro plan can get 6 months for free if they use the promo code ROB2026.

Key Highlights:

Selling consumer security software is a non-viable market because consumers buy what they want, while businesses buy what they need.
The open internet operates as an active battlefield where users face direct threat vectors from sophisticated foreign adversaries.
Falling for social engineering scams is entirely situational, rather than a reflection of an individual's intelligence.
Real-time, automated AI interventions are far more effective at enforcing digital hygiene than relying on static digital literacy training.
Over 90% of modern cybersecurity incidents originate from human risk vectors where an individual is directly targeted or manipulated.

Chapter Timestamps:

00:00 Introduction and Guest Background

1:02 Career Transition and Startup Journey

2:33 Consumer vs. Business Security Market Analysis

3:56 Personal Motivation and Scam Prevalence

5:09 Social Engineering Sophistication and Victim Blaming

8:01 Big Tech vs. Startup Challenges

13:59 Fundraising Reality and Survivor Bias

18:05 Digital Hygiene and AI-Powered Protection

22:06 Privacy-First Architecture and Local Models

28:18 Democratizing Security and Luxury Concerns

31:59 Meta Collaboration and Industry Standards

35:16 Founder Advice and Problem Selection

38:08 Company Information and Target Market

Resources & Links:

Rob Leathern (https://www.linkedin.com/in/leathern/)

Won't Fix Episode 6: With Tate Jarrow, Founder & CEO of Rebound

Fri, 05 Jun 2026 06:00:00 -0400

Tate Jarrow is the Founder and CEO of Rebound (https://trustrebound.com), a consumer anti-scam company. Before founding Rebound, Tate was an Army infantry officer and Airborne Ranger, and then a Special Agent at the U.S. Secret Service.

At Google, he helped start a company called Beacon through the Area 120 incubator, which was then acquired into Google One.

Key Highlights:

What Rebound is building: "Antivirus but for scams" — software that sits on a user's device across macOS, Windows, iOS, and Android, sees what the user sees, and alerts when it detects an inbound scam. Currently in alpha, heading into paid beta within the month, with general availability targeted for summer.
Why now: Normal people have zero real defense against scams. Law enforcement don't have resources for individual cases, and platforms are hard to reach for recovery. Existing consumer cybersecurity is rooted in 20-year-old problems (antivirus, credit monitoring) and isn't built for AI-powered, personalized, scaled attacks.
“You can't arrest your way out of cybercrime”: Cyber criminals run transnational organizations as businesses with P&Ls, so the real lever is changing the economics.
Google: Tate started in legal/investigations chasing cybercrime actors on Google platforms, got frustrated by the gap between business incentive and what could actually be done. Two of his Area 120 teammates are now on the Rebound team.
Scam overconfidence: Tate shares that a GASA study found the #1 predictor of being scammed is confidence that you can spot one — overconfidence is the actual risk factor. Every demographic gets hit.
Regulation and data: US regulation is 20 years behind. The real risk now is social engineering powered by leaked addresses, phones, emails, and contacts. He wants companies held accountable for the social engineering risk they create, not just PII in the narrow legacy sense.
"Caring guardians": People in tech are the de facto security help desk for their parents, friends, and families. Rebound is building features so a tech-savvy family member can have visibility into risk across the people they care about — plus in-app trust verification (one-click identity check) for the "is this actually my friend messaging me?" problem.

Chapter Timestamps:

00:00 Introduction and Background

1:26 Rebound's Mission and Product Overview

3:39 Technical Implementation and Current Status

4:45 Motivation Behind Consumer Protection Focus

7:45 Google Journey and Area 120 Experience

14:59 Law Enforcement Perspective on Cybercrime

18:30 Evolution of Cybercriminal Organizations

21:07 Current State of Consumer Protection

30:04 Regulatory Environment and Government Role

37:25 Community Protection and Cross-Platform Challenges

43:00 Product Vision and Future Plans

Resources & Links:

Rebound (https://trustrebound.com)

Tate Jarrow (https://www.linkedin.com/in/tatejarrow/)

Rob Leathern (https://www.linkedin.com/in/leathern/)

Won't Fix Episode 5: With Platformocracy's Jonathan Bellack

Fri, 22 May 2026 06:00:00 -0400

Jonathan spent thirty years inside the machine — product leadership at DoubleClick, executive roles at Google, and a founding role at Harvard's Applied Social Media Lab. A year ago, Jonathan started writing Platformocracy, a newsletter with a simple, uncomfortable thesis: tech companies didn't set out to govern us, but they do now. Billions of people are subject to rules they didn't vote for, enforced by systems they can't see, with no meaningful right of appeal — built, in many cases, by people who genuinely wanted to do the right thing.

We talk about how that happened, what it looks like from the inside, and the question that may define the next five years: what happens when AI floods every platform with infinite synthetic content, and the only thing standing between us and the noise is an algorithm the noise was engineered to exploit?

Key Episode Takeaways:

The Governance Illusion: Tech platforms have evolved into unelected global governments that impose top-down rules on billions of users who have zero democratic input or meaningful right of appeal.
The Category Mistake: Treating platforms strictly as private businesses that can refuse service ignores the reality that they host deeply rooted human communities where "exiting" the platform means abandoning essential real-world relationships.
Decomposing Social Media: Effective regulation requires breaking "social media" down into three distinct product categories—media consumption, community networking, and creator relationships—because a blanket approach fails to address the unique harms of each.
Shifting the Regulatory Burden: Instead of forcing mass identity verification, regulators should require platforms to accept enhanced safety obligations and standardized parental controls if they choose to profit from serving children.
Inverted Safety Baselines: Unlike heavily regulated sectors like automotive or food hospitality, tech platforms operate on a model where they maximize user safety only up to the point that it threatens their profit margins.

Episode Highlights:

00:00 Introduction

1:43 The Challenge of Corporate vs. Community Framing

2:54 The Evolution from Community Management to Corporate Governance

20:48 Age Verification Concerns and Technical Challenges

24:47 Historical Context and Generational Perspectives

27:46 AI, Anonymous Accounts, and Platform Integrity

37:19 AI's Potential for Improved Parental Controls

42:40 Regulatory Approaches: Enhanced Obligations for Serving Children

45:18 Profit vs. Safety Standards in Tech Industry

50:43 Procedural vs. Substantive Law in Platform Governance

Links:

Read Jonathan's newsletter: https://www.platformocracy.com

Jonathan Bellack

Rob Leathern

Won't Fix Episode 4: With Indicator's Craig Silverman

Fri, 01 May 2026 06:00:00 -0400

Craig Silverman is an award-winning journalist who has spent more than 15 years researching and reporting on the manipulation of our information environment. He is currently the co-founder of Indicator, a media outlet dedicated to exposing digital deception and teaching digital investigative and OSINT (open-source intelligence) techniques.

Prior to launching Indicator, Craig was a national reporter at ProPublica, where he focused on investigating digital platforms and online manipulation. Before that, he served as the media editor for BuzzFeed News, where he pioneered innovative approaches to exposing digital disinformation and media manipulation.

Key Episode Takeaways:

The Industrialization of Deception: Digital manipulation has shifted from lone actors into a massive, industry backed by venture capital and brutal supply chains, including Southeast Asian "scam compounds" that merge human trafficking with high-tech fraud.
The "Manufactured Organic" Loophole: Brands are now using "clipping" and industrial-scale UGC campaigns to generate billions of views through paid creator networks that mimic authentic posts.
An Incentive to Cheat: The current digital economy creates a "race to the bottom" where deceptive or violative content often sees higher engagement and lower costs than honest ads.
Ad Revenue Cannibalization: By failing to police undisclosed marketing, social platforms are letting a shadow ad economy thrive that actively drains budgets away from their own official, trackable ad businesses.
Deterrence Through Public Examples: Instead of trying to automate everything, platforms could flip the script by making high-profile, public examples of agencies that openly brag about their deceptive tactics on social media.

Episode Highlights:

00:00 Introduction and Background of Craig Silverman

01:21 Early Collaboration and Scam Evolution

04:27 Indicator Media's Mission and Approach

08:29 Undisclosed Marketing and UGC Campaigns

13:21 Scale and Enforcement Challenges

20:51 Platform Cannibalization and Business Impact

28:29 AI Labeling Audit Results

34:15 Community-Based Detection and User Skills

39:17 Affiliate Marketing Case Study

46:48 Systemic Incentive Problems

49:13 Conclusion and Resources

Links:

Craig Silverman

Indicator

Rob Leathern

Won't Fix Episode 3: With KTLYST Labs' Assaf Kipnis

Fri, 24 Apr 2026 06:00:00 -0400

Assaf Kipnis spent years hunting financially motivated bad actors on Meta's e-crime team and in Google's Ads Trust & Safety org.

He now runs KTLYST Labs, where he's building the threat intelligence tooling he always wished existed inside big platforms. We get into the practical realities of scam fighting — what's actually changed in the AI era, what hasn't, and why so much of the industry's effort gets aimed at the wrong targets.

About the guest:

Assaf Kipnis is the founder of KTLYST Labs. Previously: Meta e-crime, Google Ads Trust & Safety, ElevenLabs, LinkedIn threat intel.

What We Cover:

Why AI isn't reinventing scams — it's just adding a more convincing final layer to playbooks that have existed for years.
The asymmetry problem: bad actors run conferences, sell each other tools, and share playbooks on Telegram, while defenders can't share findings across teams at the same company.
A case study in what actually works — how changing product, policy, and operations together pushed a misinformation-for-profit ring off the platform in a week.
Why "accounts taken down" is a near-useless metric, and the "learned futility" it creates inside big trust & safety orgs.
The Swiss cheese model of abuse prevention, and why chasing a single silver-bullet solution keeps companies chasing their tail.
Where regulation has teeth (banking) and where it's mostly performative (social media), plus the cross-platform gap no one is addressing.
How AI is changing investigative work — compressing a week of open-source research into two hours — and why that makes entry-level talent pipelines a real concern.

Episode Highlights:

00:00 Intro

01:06 Professional Background and Career Journey ‎

03:47 AI's Role in Scaling Rather Than Changing Scams ‎

07:05 Adversary Collaboration vs. Defender Silos ‎

09:02 The Frame Rate Discovery Example ‎

10:26 KTLYST Labs and Operationalizing Threat Intelligence ‎

12:40 AI's Impact on Investigation Work ‎

15:15 Career Entry Points and AI's Impact on Junior Roles ‎

20:38 The NextTag Affiliate Program Attack ‎

23:00 The Misinformation Campaign Investigation ‎

27:52 The Limitations of Location-Based Solutions ‎

30:30 The Futility of Single-Solution Thinking ‎

33:47 The Reality of Platform Defense Goals ‎

34:50 Government Regulation and Enforcement Challenges ‎

40:31 The Problem with Takedown Metrics ‎

Links:

Assaf Kipnis

KTLYST Labs

Rob Leathern

Won't Fix Episode 2: With Project Brazen's Tom Wright

Thu, 16 Apr 2026 20:00:00 -0400

Investigative journalist Tom Wright (Project Brazen) joins Rob Leathern to discuss the staggering rise of Benjamin Mauerberger, a South African money launderer who utilized crypto exchanges and high-level political "state capture"; to fund a billionaire lifestyle of super yachts and private jets while evading an international dragnet.

Tom shares more about the dark underbelly of a $200 billion global scam industry where industrial-scale "pig-butchering" complexes in Southeast Asia target citizens around the world.

Key Episode Takeaways:

The "state capture" playbook enables global fugitives: Large-scale money launderers use their wealth to gain political protection, setting national digital policies and even attending cabinet meetings to integrate criminal proceeds into traditional banking systems.
Cryptocurrency serves as a high-speed financial superhighway: Modern fraud has moved beyond traditional banking into crypto "piping," allowing scammers to move value across borders with frictionless speed and scale.
A "double victimization" cycle defines the scam industry: The global fraud network relies on a brutal labor model where workers are often human trafficking victims lured by legitimate job offers only to be imprisoned and tortured within scam compounds.
Economic impact now rivals Fortune 500 revenues: Estimates suggest the US economy loses approximately $200 billion annually to these scams—a figure that exceeds the annual revenues of automotive giants like GM or Ford.
Jurisdictional arbitrage creates a "cat and mouse" regulatory game: Criminal entities constantly shift operations to less regulated territories, such as moving from the Seychelles to the Turks and Caicos, to evade tightening anti-money laundering oversight.
Reputational "whitewashing": Questionable financial entities attempt to gain mainstream legitimacy by sponsoring world-class athletes or prestigious events to obscure their underlying involvement in global money laundering networks.

Episode Highlights:

00:00 Intro

01:45 The Genesis of Billion Dollar Whale

04:47 Evolution from Traditional Fraud to Crypto-Enabled Scams

08:13 Mauerberger's Rise and Political Connections

10:35 Mauerberger's Flight and Current Status

15:48 The Crypto Money Laundering Operation

24:40 The Human Cost and Complexity of Scam Operations

27:14 Challenges in Reporting and Government Response

32:34 The Broader Implications and Future Outlook

Links:

Won't Fix Episode 1: With tofu's Jason Zoltak

Tue, 07 Apr 2026 17:00:00 -0400

In this first episode of Won't Fix, Rob Leathern talks to Jason Zoltak.

Jason is the founder and CEO of tofu, which is using AI and machine learning to fight fraud and deception in hiring and recruiting.

About Won't Fix: In software engineering, “won’t fix” describes a bug by acknowledging the issue but intentionally leaving it unsolved because addressing it is too costly, risky, or not worth the trade-offs.

Hear from the practitioners fighting phishing, deepfakes and bots, and learn about the broken systems and misaligned incentives that keep us all vulnerable.

Key Episode Takeaways:

The Identity Fraud Pivot: tofu shifted from an AI resume screening tool to a fraud detection platform after discovering that remote hiring has enabled a massive surge in sophisticated identity misrepresentation.
Near-Universal North Korean Infiltration: Virtually every company hiring for remote technical roles is now a target for North Korean IT workers, with some applicant pipelines reaching 80% fraud rates.
The Fragmentation Vulnerability: The lack of a "digital passport" and the break in verification when moving a candidate from LinkedIn to an internal ATS creates a massive security gap for fraudsters to exploit.
Shift in Security Ownership: Candidate fraud is transitioning from a Talent Acquisition burden to a CISO priority as companies realize recruiters lack the budget and expertise to fight organized cybercrime.
Economic Scalability of Fraud: Fraudsters aren't looking for long-term tenure; they use deepfakes and proxies to "job stack," collecting multiple salaries simultaneously for a few months before being caught.
The "Confirmation Bias" Trap: Once a candidate reaches the final interview stages, hiring managers and recruiters are psychologically prone to ignore red flags, making them vulnerable to sophisticated identity theft.

2:29 Jason's Background and tofu's Evolution

4:09 Discovering Candidate Fraud Through Direct Investigation

5:04 Market Response and Business Pivot Decision

6:35 Personal Motivation and AI Identity Challenges

8:17 Spectrum of Fraud vs. Embellishment in Hiring

10:25 Prevalence of North Korean IT Worker Infiltration

11:30 Evolution of Fraud Techniques and Identity Theft

13:18 Root Causes: Platform Disconnection and Identity Verification

15:26 Security vs. Talent Acquisition Budget and Responsibility Issues

17:36 LinkedIn Verification Challenges and Behavioral Incentives

19:20 Impact of Thin Digital Footprints on Legitimate Candidates

21:35 False Positive Management and Digital Footprint Requirements

24:16 Interview Process Fraud: Deepfakes and Proxy Detection

26:01 Sophisticated Deepfake Case Study and Technical Evidence

28:17 Economic Incentives and Scaling Strategies for Fraudsters

29:26 Corporate Espionage and Strategic Target Selection

32:15 Recruiter Incentive Conflicts and Trust Erosion

36:13 Critical Case Study: Final Round Interview Fraud Detection

37:28 Government Regulation vs. Private Sector Solutions

39:39 Upcoming Product Launches: ATS Reconnaissance and Continuous Monitoring