IT Horror Stories: Real Threats, Real People, Real Consequences - Feat. Jack Smith

Michael Routhier
Jun 30
10 min read

The following is a lightly edited transcript of the Tech 4 Grown-Ups podcast episode featuring Jack Smith, host of the IT Horror Stories Podcast and 30-year IT industry veteran. Some filler words and crosstalk have been removed for readability. The full audio

episode is available below.

Tech 4 Grown-Ups podcast cover for IT Horror Stories with Jack Smith — featuring a cracked marble Stoic bust dissolving into digital circuitry alongside a silhouetted figure facing a wall of glowing vintage televisions — Michael Routhier sits down with Jack Smith, 30-year IT veteran and host of the IT Horror Stories Podcast, for a conversation about voice cloning, AI scams, and the threats targeting people 55 and over.

Michael: Today's episode is different because we are joined by a special guest. He has spent many years in the IT world and brings a wealth of information and expertise. He is also the host of a phenomenal podcast called IT Horror Stories. Please join me in welcoming Mr. Jack Smith. Welcome, Jack. I'm so glad to have you here today.

Jack: Very happy to be here. Always happy to share my knowledge and specifically my opinion on everything.

Michael: Jack, let me start by thanking you for taking the time to be with us today. Now, you've spent 30 years in IT, and I think a lot of people hear that and picture someone in a server room. What I'd like is for you to tell the audience who you actually are and what those 30 years really looked like on the ground.

Jack: I started in the late '90s in what they then just called IT, that's everything with a power plug. My first job was installing Windows 95 on desktop machines. I've been in multiple-thousand-square-foot refrigerated server rooms all by myself, with those aisles and aisles of cabinets. Way too cold. In the end, you find yourself huddling at the back of a few machines where the warm air comes out, just to survive.

In the last 15 to 20 years, I moved into project management; budgets, scheduling, making sure things get done. And because of my technical background, I can tell when people are telling me something that isn't quite right. I've literally been up on rooftops in Paris and down to mining pits in Texas. Everything in between.

Michael: At some point in those 30 years, you decided to build your own website and I understand the internet found you pretty quickly, but not in a good way.

Jack: We started a new company, a website announcing our services. We put up the site, created a new phone number, and that number was online for four or five days. Suddenly the phone starts ringing. Okay, great, we got a customer. You pick it up, it's a robocall. Completely localized, in our local languages, using local banks and local payment systems; "To validate your 8,000 euro transfer, please press nine". Four days after we published the number.

Michael: Just to be clear for the audience, you hadn't even promoted the site yet.

Jack: Zero promotion. I think I'd just added it to Google Search Console. Maybe a small LinkedIn announcement. No ad campaigns. And we still get calls, I had one this morning.

Jack: Once your number gets on the list…

Jack: It spreads. Those number lists get passed around, and everyone who has a go at the list will call you.

Michael: In your experience, what are the scams and digital threats that are working best right now against people in the 55-and-over age group? And why is this group specifically targeted?

Jack: The why is this; it's a generation literally on the edge, on the border between the offline world and the online world. We've grown up in the offline world and are adapting to the online one. In the offline world, when you see a salesman face to face, you can read his face, read his reactions. On the phone you can't. But he sounded good. That's the danger.

Michael: That leads perfectly into voice cloning. We're at a point now where a criminal can clone your child's voice within three seconds of audio from a social media video and call that child's grandmother saying they're in trouble. How real is this threat, and how local has it gotten?

Jack: The threat is very real. If you look at your Facebook profile and post a video, "Hi, I'm at this festival", and in there you have your family relations tagged, people with bad intentions find the names. They find the phone number or just try one. They have your voice, they can simulate it, and then an automated system calls Mom or Grandma and says; "Hey, I'm stuck at this festival. I need $500. I'm stuck. Please help me".

It takes under a minute of effort, and it's fully automated. There is zero human interaction anymore. Even the criminals are automating their process.

Michael: And some of these organizations are actual organized crime with serious financial backing.

Jack: Absolutely. And they are becoming more local. In the early days, you'd get a scam call and you knew immediately by the accent. Now I'm getting calls in French, Dutch, German, local people, actual humans, hired to run the scams. They sit at home, get a notification on their laptop that someone pressed one to talk to an operator, and they have a script in front of them. They do mock calls to practice sounding convincing, and then they go for it.

Michael: And the sad part is, with the way the job market and economy are, people are taking these jobs. You can't tell the difference because it sounds like the guy down the street.

Jack: It actually could be the guy down your street.

Michael: You mentioned that the banks are now being held liable in some European cases. Can you elaborate on that?

Jack: This is a very recent local case, not Europe-wide, but it is a legal precedent that will be looked at. The easy way out for a bank was to say, "You got scammed. It's your fault". And the money was gone.

There has now been a court ruling where the bank can no longer simply claim the victim was negligent. The bank has to actually prove negligence. They need to show they walked the customer through every step; the website, the account login, the PIN, the multi-factor authentication, and that they warned the customer properly. If the victim continued despite all that, then perhaps. But the automatic it's your fault declaration no longer applies in this case.

Initially, the bank has to repay the funds. After an investigation, if serious neglect is found, they may retrieve it back. I am not a lawyer, but I am not angry about this judgment.

Michael: The banks have forced people to use online banking without teaching them to use it. That creates a vulnerability. And now scammers have adapted, they send someone to your door.

Jack: Yes. They'll call and say, "Hi, Mrs. Jackson, this is your bank. We've found fraud on your card. We'll send someone over to collect it right away." Somebody shows up in an actual police uniform, takes your card, and asks you to verify your PIN code. They write it down, go to the nearest ATM, and drain the account.

The Dutch police actually have a website where they post pictures of these card collectors at ATMs and ask the public to identify them.

Michael: The moral of the story, if someone in a police uniform comes to your door, call the police department directly first.

Jack: And there's one good identifier; police officers don't wear sneakers. Look at the shoes.

Michael: Jack, I want you to share an IT horror story, something that happened to a real person that the audience can see themselves in.

Jack: This happened at a large multinational I was working at. We got a call from someone claiming to be the CEO. "Hi, I'm the CEO. I have a presentation, I've lost my password. Can you please reset it?" From a number nobody recognized.

Nobody knows the CEO's home number, so how do we verify? The team had an out-of-the-box solution: one of the guys in the office had run all the CEO's road shows and big demos. They asked him, "Do you have his home number?" He did. They verified it. It matched.

The lesson; you can fake a number making a call, but receiving calls on a spoofed number is a completely different matter. So if someone calls you, tell them you'll call them back on the number you have for them. If they're legitimate, they'll answer.

Michael: And if it's a spoofed number?

Jack: It won't receive the call. That's your answer right there.

Michael: If a 67-year-old woman who lives alone asked you for two or three things she could do starting tonight to meaningfully protect herself, what would you tell her?

Jack: When people with bad intentions call, they always create urgency; "My car broke down, I need money now. This is your bank, please approve your transfer". Always urgency. So when a call is very urgent, slow down. Ask personal questions. The bad actors don't have all the details.

Ask for the name of the dog or cat. Or introduce someone who doesn't exist. Say, "Hold on, let me just check with Uncle Bob". They don't know Uncle Bob doesn't exist. If they go along with it, you know.

It's a very old IT security testing method. We used to put one intentional mistake into a system, say, a printer in a specific office that wouldn't print from tray two. If someone came back and said everything was fine, we knew they hadn't actually tested it. Same principle. You put in something you know is wrong, and the person on the other side doesn't.

It's the same trick from Terminator 2, the Terminator calls the parents and gives the wrong name of the dog. Exactly that.

Michael: And the key reflex to control is the one that wants to immediately fix things for family.

Jack: Exactly. It's your caring reflex being exploited. Control that reflex long enough to ask: does this make sense? Is this an actual emergency? You're running through the woods and you hear something behind you, is it a bear or a cat? You don't know, so you run. The scammers are counting on that.

Michael: What do most IT professionals assume people already know that they absolutely do not, and that assumption ends up leaving people exposed?

Jack: Watch what you share about yourself online. People with bad intentions, or today, an AI system, will build a file on you. They'll know your family, your history, the name of your dog from your Instagram posts. There are examples where someone approached a random person on the street, asked their name, and within minutes an entire crew using search engines could tell them about their mother, their sister, their dog. It all matches.

Don't give them that information. I have an active social media profile myself, but I'm very careful what I put out there.

And most importantly, do not post pictures and information about your children. That is the primary hook. And that goes for grandchildren too. Grandparents take anything involving their grandchildren very seriously, and that is exactly where the vulnerability is.

Michael: Let's talk about AI specifically. Deepfakes, AI-generated phishing emails, voice cloning, fake videos. What's the AI-powered threat that most people aren't taking seriously enough right now?

Jack: It is perfectly possible today that you will receive a FaceTime call from an AI system that looks like your family. They've taken the pictures from social media, thrown them onto a model, they have the voice. It's automated. Zero human interaction. The AI will work through a list of numbers, and if someone presses one to talk to an operator, the person in the home office gets a notification on their laptop and says, "Hi, this is your bank speaking".

The word I keep coming back to is ridiculous. It is ridiculous how good it has become. The line between real and AI is getting blurred to the point that if something just looks okay, it usually isn't.

Michael: I don't want this to be only a fear episode. What can AI actually do for people 55 and over that is genuinely useful?

Jack: I call it my super Google. Instead of reading through seven pages of search results and five articles, I just say, "Summarize this for me." AI is the best intern in the world, it does a lot of work in a short amount of time. But you have to double-check everything it does. Don't take results blindly.

You can also use it for creative things. I use it for T-shirt ideas for my podcast. I don't ask it to make me a T-shirt, I say, "Give me five ideas for a T-shirt about the CEO calling". It lists ideas, I pick one, and I make the design. You can do the same for birthday cards, holiday cards, any creative project. Give it a theme, and it gives you options.

The problem is that companies are selling AI as a replacement for things and people, and that's not true. It's a helper. And today, AI does not have any moral values, it's the people using it who still need to have those.

Michael: Last question. If you had one message for the adults in this community, people who didn't grow up with this technology, who are doing their very best to navigate a world that keeps changing underneath them, what would it be?

Jack: I understand it's extremely difficult to keep up. Everything is going so fast. You get new apps thrown at you every few weeks from your bank, from the government, from the bus company. You really need the energy of a 15-year-old to manage it, and even I phase out when a new app lands on my phone. That's perfectly fine.

And if something goes wrong, don't blame yourself. You cannot help it. It goes so fast, and these people are so good at abusing every small loophole they find because they have the experience of abusing people, and you don't have the experience of being abused.

It is not your fault.

Michael: Jack, that is outstanding. Thank you so much for coming on and sharing not just your expertise, but your knowledge of who you are. Before we go, everyone, please check out Jack's podcast. Jack, tell them where to find you.

Jack: We are on all the major platforms; Spotify, Apple Music, YouTube, Deezer, and everything that uses those as a source. Our website is ithorrorstories.eu, that's EU for Europe, where we are located, and all the platforms and social media links are listed there. On social we focus on the tech-forward platforms; BlueSky, Mastodon, and LinkedIn. And if you don't have those, there's also Facebook and Instagram. All links are on the website, you don't need to write them down right now.

Michael: And one more thing, Jack is looking for stories from people who were working in technology in the 1970s and 1980s. If that's you, please reach out to him directly. Those are the stories that need to be captured before they're lost.

Stay sharp, stay loud. I'll see you in the next one.

🎙️ Listen to this episode: ➡️ [Tech 4 Grown-Ups Podcast — IT Horror Stories: Real Threats, Real People, Real Consequences] — [your RedCircle episode link]

🎙️ About Jack Smith & IT Horror Stories: