“You wake up one rainy morning and after checking on your accounts you find out that you’ve been ‘wiped-out’ by a cybercriminal. You’ve lost all of the money and assets that you’ve ever owned and you can’t get them back. What will you do?”
This was the thought experiment proposed by SavingNinja. The one thing he asked of participants was for a stream of consciousness outpouring of thoughts rather than a carefully polished article. Here goes…
Time to grow up
At the time the jail cell door slammed shut behind him, Leo was twenty-three years old.
Throughout his student days, Leo had always been smart and quick on the uptake.
The glacial pace of teaching at his schools had bored and frustrated him in equal measure.
Idle hands and unoccupied minds are a recipe for trouble. Boredom creates mischief. It has ever been thus.
As a teenager, Leo began skipping school and hanging out in the local snooker halls.
Throughout a misspent youth he continuously refined his game, and his patter, until he was reliably able to hustle any random student, tradesmen, pensioner, or unemployed person who fancied their chances of winning some easy money off a kid.
The school eventually noticed his absence and began harassing Leo’s already harried mother.
She attempted to force him to attend school, but as she worked two full-time minimum wage jobs just to keep them housed and fed, in practice Leo was left to his own devices much of the time.
Things came to a head when the time came for him to enrol in sixth form.
His mother wanted him to become the first person in his family to study at university. Her logic was simple: he was smart enough; degrees open doors; and graduates out-earn their less educated peers.
Leo couldn’t see the point. He had already taught himself to be a gifted computer programmer and started selling his services on an ad-hoc basis over the internet.
His long-suffering mother insisted if he wasn’t going to be studying then he had to pay his own way. She called in a favour to get him a job working at the local burger franchise.
Leo spent his days at work deep frying happy meal toys, and sabotaging veggie burgers with chicken nuggets. He was reprimanded a couple of times, but the duty manager felt sorry for Leo’s mother so no further action was taken.
That changed when he was caught spiking the thick-shake dispenser with bacon. He was fired on the spot! A story ran in the local newspaper, and life as Leo knew it was over.
Fleeing the nest
Given the demographic profile of the franchise’s grievously offended customer base, Leo’s mother swiftly despatched him overseas to live with his estranged father… for his own safety.
Leo’s father owned a successful business that had an eight-figure turnover. He quickly determined the best way to keep the son, who he had last seen as a toddler, out of trouble was to keep him busy.
Leo was put to work as a computer programmer in his father’s business, with employment conditions long on working hours and short on free time.
For the first time ever Leo was challenged by the tasks he was asked to perform.
He quickly settled into his new life. After a few months he bought an apartment and moved out of his father’s house… the old man barely suppressing a happy dance at his departure.
After a couple years, Leo started frequenting poker clubs on the weekends.
What goes up…
His natural intelligence and the people skills honed over several years hustling people, made him a natural.
The higher the stakes, the greater the thrill.
He won big.
He won often.
His winnings soon eclipsed his programmer salary.
Until he lost.
Leo doubled down and managed to recoup his losses.
His winning ways resumed.
For a time.
Then he lost again.
He borrowed a stake to try and reverse the damage.
Now he had a problem.
He had lost all his own money.
Worse still, he had lost the money lender’s money.
It would be fair to say the class of creditor who lends to poker players are unsympathetic about losses.
… must come down
Leo had observed some weaknesses in the financial controls of his father’s company. Several of the checks and balances relied more on personal integrity than separation of duties and “four eye” tests.
Of most relevance, the company naïvely permitted a single individual to generate purchase orders, validate invoices, and initiate payments. The sort of thing that gives auditors the heebie-jeebies.
Using basic social engineering, Leo tricked one of the accounting clerks into revealing their login details in order to “help” him diagnose a make-believe system issue.
He then used those credentials to hack into the company’s finance system.
Leo raised purchase orders to procure professional services from a fictitious company.
The fictitious company issued fake invoices for those imaginary professional services.
He then approved payments for those invoices.
Leo used most of the ill-gotten funds to clear down his gambling debt. He didn’t think his money lender would have actually followed through on the threat to break his legs, but he wasn’t certain.
The remainder of the money purchased entry into a high stakes poker tournament. Leo intending to win, create fake credit notes to reverse the fictitious invoices, and repay his father’s company.
He lost big.
He lost it all.
It turned out there were more financial controls than Leo was aware of!
In a spectacular display of bad luck and poor planning, the accounts clerk happened to be playing tennis with Leo’s father at the exact moment he was supposedly entering the false financial records.
A couple of days later Leo was arrested at work, charged with fraud and embezzlement.
His father fired then disowned him.
Leo’s long-suffering mother refused to speak to him.
His bank accounts were frozen, while the under-resourced police department painstakingly investigated the possibility that Leo may have exploited the financial control vulnerabilities to launder funds on behalf of his money lender.
With his bank accounts frozen, Leo couldn’t afford to hire competent legal representation.
Nor could he make bail.
He was remanded in custody pending trial, many months later.
Friends, family and former colleagues all turned their backs on him. A lifetime of behaving like a selfish obnoxious tool came home to roost.
Leo’s court-appointed lawyer offered little help with his criminal charges, and refused to help at all with his civil issues. Leo’s limited understanding of his legal rights was mostly gleaned from Law & Order reruns.
Prison doesn’t make the bills go away
As a homeowner, Leo had numerous financial obligations.
Local council taxes
All of his creditors were displeased that their bills went unpaid and their demands unanswered.
They sent increasingly irate letters to his empty apartment, detailing all manner of penalties and threats.
Prisoners on remand had limited access to a pay phone and no access to the internet.
They were restricted to calling up to 10 pre-approved phone numbers, and only via collect calls. Already out of pocket creditors were not amenable to accommodate this restriction, even if Leo been inclined to attempt to negotiate with them.
The utility company and credit card providers sold their unpaid bills to debt collectors, who attempted to seize and sell Leo’s personal belongings to recoup their investment.
His mortgage lender foreclosed on his mortgage, repossessed his apartment, and evicted him.
As is their wont, the lender sold the property for a fraction of its market value, just enough to clear the outstanding mortgage.
Of all his creditors, his local council was the most aggressive. They pushed Leo into bankruptcy, the filing fee for which ended up being donated by a charity for prison inmates.
By the time his trial was eventually scheduled to commence Leo was broke and homeless.
As a cost-saving measure the budget conscious prosecutor offered a 12-month custodial sentence in return for a guilty plea. The evidence against him was as compelling as his court-appointed lawyer was incompetent.
Leo took the deal.
Twelve months later Leo had paid his debt to society. He left prison thinner, wiser, and harder.
Upon release, he was immediately detained by the immigration authorities and deported back to the United Kingdom.
A cold rainy London morning greeted Leo’s arrival at Heathrow airport. His only possessions were the suit he had been arrested in nearly two years earlier, and a bill for his airfare.
His finances had been “wiped out” by a cybercriminal. Himself.
All his money and assets were gone.
What does a bankrupt, homeless, unemployed computer programmer with a criminal record do next?
Restart, and go freelancing!
All but the most secret-squirrel of background checks don’t extend beyond domestic shores.
The majority of prospective employers don’t bother checking overseas references.
In the United Kingdom, Leo had no criminal record.
Nor was he a bankrupt.
He would even pass the “good character” requirements to work in financial services, providing he kept his mouth shut. Evidence of past misdeeds was several time zones away!
Leo started going by his middle name, to avoid being associated with the fast food scandal of his youth.
He made up a resume full of international contracts, emphasising his hands-on experience with financial controls, information security, and assessing risk.
Leo worked through an umbrella company. He used their long-established trading history, insurance coverage, and VAT registration to provide credibility.
Rising from the ashes
It has been more than ten years since Leo returned to the United Kingdom. He is still freelancing, and still playing poker, though he no longer gambles with other people’s money.
The only time his nefarious past almost came to light was when a client insisted he visit their office in the country he had been deported from.
A country he was forever barred from returning.
A suspiciously timed bout of “appendicitis” solved that problem.
His experience taught him that if you can’t be good, then be good at it.
To hear some alternative points of view check out the other responses to SavingNinja’s thought experiment: