Psychic Mail Fraud Scheme Enabled by One of the World's Largest Data Firms

(MUSIC INTRO)

[00:00:01] Bob: This week on The Perfect Scam.

[00:00:03] Clayton Gerber: They appeared to be very personalized, like the letter was written directly to you, like this was a friend writing you, and many people wrote back. There would be thousands of Christmas cards that would come in from victims who were writing Christmas cards because Maria Duval was on their Christmas card list. 

[00:00:19] Bob: That's awful. That just shows the extent of the, the quote unquote personal relationship they thought they had with this person. 

(MUSIC SEGUE)

[00:00:31] Bob: Welcome back to The Perfect Scam. I’m your host, Bob Sullivan. Sometimes justice takes years, even decades. Five years ago we brought you the story of psychic Maria Duval, who many believed was a famous French clairvoyant who had helped solve many crimes. She claimed to have even helped track down Bridgitte Bardot's missing dog. Well criminals using her name and image blanketed America, the whole world really, but letters promising a good future in exchange for regular 30- or 40-dollar payments and threatening disaster for those who ignored the solicitations. The scale of the fraud is hard to fathom. Federal investigators figure roughly 1 in 300 Americans were victims of this scam. The US Postal Inspection Service finally put a stop to the letters in 2014, but even when we did the story back in 2018, the ringleader was still on the run. But things have changed, so today we'll check in on the story to see how the fight for justice is going, and maybe more important, to understand how technology played a big role in why the Maria Duval letter scam was able to ensnare so many people. And to talk about how to prevent that from happening now.

[00:01:57] I remember a story, one of my inspectors came back after he had done a round traveling around Penn--, Pennsylvania talking to victims. And he took pictures inside the, the individual and took pictures inside the house. He had all of the pictures from all of the mailings taped on up on the wall running down the hallway from all of the mailings he had received from Maria Duval. All of the little trinkets and mass-produced junk that was on a bookshelf all in one spot, um, he couldn't afford his medicine, couldn't afford his utilities, and he was sitting there with a piece of rope tied around his waist in a knot as a belt because he couldn't afford a belt. But he was writing $40 checks like crazy to Maria Duval. And that really affected my inspector. He, he has reminded me of this victim over and over and over again over the years, and that's one of 7,000 victims.

[00:02:50] Bob: That's Clayton Gerber, talking to us five years ago about his efforts then to stop Maria Duval, or whoever it was, from stealing money from vulnerable people. At the time, Clayton had already been chasing after the scam for nearly 10 years. Clayton works for the Postal Inspection Service, a law enforcement agency many of you may not be familiar with.

[00:03:14] Clayton Gerber: The Postal Inspection Service is a federal law enforcement agency like the ATF, Secret Service, FBI, IRS. We have full powers of investigation, arrests, search warrants like any other federal agency, but we focus on crimes that either attack the US mail or the Postal Service, or they use the US mail to facilitate the crime. So think robbery, burglary, homicide of letter carriers, and think white powders, bombs, drugs in the mail, and then I focus mostly on fraud cases, investigations where somebody is defrauded through the mail.

[00:03:52] Bob: I think one thing people might not be aware of is that that is a very uh wide jurisdiction because a lot of crimes, even if mail doesn't play a central role, it plays some side role, right?

[00:04:05] Clayton Gerber: That's true. The mail is involved in almost any financial investigation because ultimately you can get your bank statement in the mail. So that is a mailing and furtherance of the crime if they'd taken money out of your bank account or the records are in your bank account. So it, it, it's a very broad jurisdiction, covers almost any kind of a fraud involving money.

[00:04:26] Bob: Some of you might not be familiar with the name Maria Duval, but there was a time it seemed like every American was getting mail from her.

[00:04:36] Clayton Gerber: So Maria Duval is a fictitious name of a woman in Paris or outside of Paris, in the south of France, I guess. And she advertised herself as a psychic who, in theory, helped law enforcement and people doing psychic readings, but law enforcement solving unsolved murders and things like that going back decades and decades ago. And I guess she was of some note in France for these uh, various psychic services that she could provide, and whether or not you believed them to be true is mostly irrelevant. She was recruited by some fraudsters who wanted to use her name, her photo, her likeness to advertise psychic services by mail. They would, they wanted to generate solicitations, mail them out to people, pretend to be Maria Duval, and say I am Maria Duval, a world-renowned psychic. I have had a specific vision about you, recipient of this letter, and I know good things are going to come your way or bad things are going to come your way, and I can tell you what they are, or I can prevent them from happening. I can cause them to happen, prevent them from happening. All you need to do is pay some small amount of money; 20, 30, 40 dollars, and these good things or bad things will, will come true or not come true. So these fraudsters who wanted to use her likeness paid her a little bit of money to get her, use her photo and her likeness, and uh they started mailing these solicitations out. And it was a franchise business. They sold the rights to this business in different parts of the globe, and these solicitations were translated in various languages.

[00:06:28] Bob: The mysterious letters first started making appearance in US mailboxes during the 1990s, and 20 years later, they were still generating cash for Team Maria Duval. Letters really manipulated the recipients because they seemed so real, and they seemed like they were coming from a friend.

[00:06:50] Clayton Gerber: Well, they're highly personalized. These would be printed via mail merge so your name would appear throughout. These were multipage letters, six or eight or 10 pages long. They would have graphics, they would have changes of font, they would have marginal notes to make it look like if you didn't have great vision, your, if your, if your, your eyesight wasn't great, it would look like somebody had written a handwritten note on the side of it. They, they appeared to be very personalized, like the letter was written directly to you, like this was a friend writing you, and many people wrote back. They would write back personalized letters around the holidays. There would be thousands of Christmas cards that would come in from victims who were writing Christmas cards because Maria Duval was on their Christmas card list.

[00:07:36] Bob: I'm sorry, they sent Christmas cards to Maria Duval, that just hit me between the eyes. That's awful.

[00:07:43] Clayton Gerber: Yes, actually after we shut the scheme down, we got Christmas cards to the mailboxes, we were seizing all of the mail coming into the mailboxes and got Christmas cards for 2 or 3 years after the scheme was shut down because Maria Duval was still on people's Christmas card list, for, for several years.

[00:07:59] That, that, I mean that just shows the extent of the, the quote unquote personal relationship they thought they had with this person.

[00:08:07] Clayton Gerber: Indeed, I think that's part of the, the ongoing nature of the scheme. It was a highly personalized relationship or what the victims thought was a highly personalized relationship.

[00:08:18] Bob: I read somewhere that there were fake coffee stains on the letters, so it looked like a real person's hand had touched this letter. Is that right?

[00:08:23] Clayton Gerber: That's true, yes. They were marginal notes, some of them looked like they might have had a Post-It note stuck on it, things that looked like stains and spills, yes. They would have extra inserts on little scraps of paper that were mass produced, but it would look like she was putting some personal little note in the envelope with it for you.

[00:08:43] Bob: But it wasn't a personal relationship. It was fraud. Massive fraud.

[00:08:51] Clayton Gerber: The ask was always for money. The ask was always for 20, 30, 40 dollars. In return, you may get some sort of tiny trinket, some sort of little talisman, some sort of newsletter. You always got another solicitation. You always got another letter that was a personalized plea asking for more money. And there was an escalation of some 60, 70, 80 different letters. It was a progression. You paid on letter one, you got letter two. You paid on letter two, you got letter three. And it was always an ask for money.

[00:09:23] Bob: But somewhere inside people thought if I sent this woman $40, my life would be better.

[00:09:29] Clayton Gerber: Well that was always the promise. The promise was always good things are going to come your way, stick with me, good things are going to come your way, and I can cause that to happen.

[00:09:38] Bob: Of course, Maria Duval couldn't do any of these things, and in fact, the woman's real name wasn't even Maria Duval. We'll get to that, but she had nothing to do with these letters anyway.

[00:09:51] Clayton Gerber: And they sold the rights to North America, to Canada and the United States, to an individual by the name of Patrice Runner, who operated the scheme out of Montreal and hired employees to operate the scheme out of Montreal and they printed these solicitations by the hundreds of thousands, by the millions a year, and mailed them out to Americans and Canadians for years, for decades.

[00:10:14] Bob: It went on so long that the Canadian operator had to do a lot to boost Maria Duval's brand to a new generation of victims.

[00:10:24] Clayton Gerber: They made some YouTube videos that were probably on infomercials originally, and then made their way to YouTube. There were some other news articles, some Wikipedia entry articles and things like that to maybe polish her brand, to maybe give her some degree of, of veracity with Americans. Really what you would get is you'd get; you'd get dozens and dozens of these solicitations in your mailbox over and over and over again. You get enough of them; you believe them to be true.

[00:10:52] Bob: The letters began landing on Clayton Gerber's desk about 15 years ago. And he began a years' long effort to stop them.

[00:11:02] Clayton Gerber: So the Maria Duval scheme be--, came to the attention of postal inspectors several times. We have lots of complaints in our complaint system over the time, and the Postal Inspection Service filed an administrative action against the scheme back in 2007, '08, time period, '06, '07, '08 time period, so we have administrative authority to stop mail delivery to fraudsters. And we did that and we negotiated a settlement and the individuals agreed to cease operations. In fact, one of the people that we sued at that time was Patrice Runner way back then, because he was one of the people running the scheme.

[00:11:41] Bob: And they just went right on doing it under different cover names, that kind of thing, right?

[00:11:46] Clayton Gerber: Correct. They hired some high-priced lawyers to, to argue with us. They negotiated to have Patrice Runner's name removed saying he had nothing to do with the business, he had left the business, he was disassociated from the business. And they negotiated the settlement, agreed to stop, but in reality, they just changed the name of their business, kept the name Maria Duval, but changed the business name that they were operating, and mailed out more solicitations than ever as soon as they signed the settlement and kept going.

[00:12:15] Bob: And kept going and kept going until the number of letters sent and the number of victims became staggering.

[00:12:23] Clayton Gerber: So for the 10 years immediately preceding when we shut the scheme down, there was about 1.4 million US, unique US victims, and about $225 million dollars in losses to US victims. And the same proportion to Canadian victims for this operation. So that's essentially, 1 out of every 300 man, woman, and child in America. You know every--… you see 300 people walking down the street. One of them was a victim.

[00:12:54] Bob: I mean that's a scale I, I can't, I don't even know what to map that to. Is there another fraud that, that that, that I can compare that to?

[00:13:03] Clayton Gerber: Um, I, I don't know another fraud that has that many victims, that many unique victims. I've certainly investigated large-scale frauds with tens of thousands of victims. This is the only scheme we have, individual scheme where we have over a million unique victims that we can identify with precision.

[00:13:22] Bob: Why were the Maria Duval letters so effective that they literally broke records for number of scam victims? Well it turns out its operator, Patrice Runner, was an early adopter of research methods.

[00:13:38] Clayton Gerber: Patrice Runner, when he was operating the scheme would conduct what they called AB testing. He would take one of his solicitations and he would change the verbiage, change the text a little bit between one version and another version, and he would mail out 50,000 with one version, and 50,000 with the second version. And he would see who would pay more on how many, which, which version, A or B, would get more responders to it, and that was the new version they were going to use. So they were constantly refining their message. And they have nothing but time on their hands and the ability to do that to refine these messages to be very convincing.

[00:14:18] Bob: And Patrice Runner was an early adopter of technology, which gave him a secret evil weapon. The letters he sent were intimately personalized beyond anything else victims had seen at the time.

[00:14:32] Clayton Gerber: It was all mail merge technology. You were on a mailing list and they, at sort of first touch, one of the first letters, they ask you for your date of birth, and then they would index that in their database, so then they could give you horoscopes for your Zodiac sign. Because they knew your date of birth because you had given that to them years earlier with the first letter, so they could personalize at different times. They might ask you for a name of a loved one so that they could refer back to that at different times that would make them highly personalized. That was how the scheme worked. You, you needed, the, the scammers needed names of consumers of Americans to mail these to. They constantly needed an endless supply of new people to mail these letters to, cause you mail out a million solicitations, maybe only 5,000 would respond. You'd mail those 5,000 a second letter. You needed another million names to get your next 5,000 responses. And the names would come from mailing lists that you could, you could get from data brokers.

[00:15:37] Bob: Patrice Runner always needed a list of that next 1 million potential victims, and he knew where to get it; from data brokers.

[00:15:48] Clayton Gerber: The Maria Duval scheme used a variety of different list brokers and data brokers. One of the largest companies they used was a company by the name of Epsilon Data Management, which was a large uh corporation that operated a data cooperative to provide you lists of consumers that you could market to.

[00:16:09] Bob: And what do we know about Epsilon and who they are?

[00:16:14] Clayton Gerber: So Ep--, Epsilon is a multinational corporation, their American branch, their American arm of the operation operated out of Denver, although they had some employees distributed around the country. And they were hired by, you know, large consumer facing companies; think every Fortune 500 company that needs to market to Americans, and they would all want to get mailing lists or lists of potential consumers that they could market to. If they want to mail a coupon, try out our new detergent, here's a coupon in the mail, and you go to data brokers to get that list of people who would be interested in your detergent, or whatever product you're selling.

[00:17:00] Bob: In this case, the people behind the Maria Duval scam, weren't looking to mail a well-timed coupon to consumers. They wanted to send a well-timed scam to victims.

[00:17:12] Bob: Did the people behind the Maria Duval scam, did they go to Epsilon looking for a specific kind of consumer?

[00:17:20] Clayton Gerber: So the operators of the Maria Duval scam wanted anyone who was going to pay money, but that is a unique set of people. Epsilon offered a few products available to their customers. They offered a product that was a Look Alike product, and they offered a second product that as a Shop Alike product. A Look Alike product would mean that we, Epsilon, can rent you a list of people who look like your current customers, and when I say look like, I don't mean they have the same facial features, I mean they are the same age range, the same demographic, the same income stream, so they are, their demographic, their entire demographic makeup was very similar to your current consumer base, your current customer base. So what you would do if you joined this cooperative, what the, the operators of the Maria Duval scheme would do is they would take their list of consumers, their list of victims that they were already paying for the Maria Duval fraud scheme, already sending money in. And they would send that to Epsilon, and Epsilon would ingest all those names and addresses and they would say, we know all of these 50,000 people that have paid you in the past month or two months, and they look like this. They are Americans with a $25,000 or more income, they live in rural zip codes, they buy, or they are approximately this age, and we have an extra 5 million people in our database that fit this same demographic and we can rent those lists, those names to you. So they would receive your consumer base, your victims that you were already victimizing, they would profile them, figure out what they looked like in terms of demographics, and then they would rent you lists of people who looked alike, who had the same demographics for you to market to. So that was one product they offered. The second product that Epsilon offered was a Shop Alike product which they would, in that case, take your list of victims that you were already getting money from, or your consumers you were already getting money from, and they would ingest them into their database and say, well we know these people, we know Suzy Jones, and we know David, David Smith, and we have an entire consumer profile for them. Suzy Jones buys Preparation H, and she buys these, this wine, and she buys these, this type of cereal, and they know exactly the things that she purchases because people use loyalty club cards when they go shopping today and that tracks what you buy. And so Epsilon would analyze the buying habits of your existing customers, and then they would say, okay, we have 5 million more names of people who shop just like that, and they have the same buying habits as your consumers, and we will rent those names to you. So they have two different products, one was a demographic product, and one was sort of a consumer shopping product, and you could rent lists from either or both, depending on how you were classified by Epsilon, as a customer of Epsilon.

[00:20:40] Bob: But this company was going to Epsilon saying, we have this list of people we already know who are victims of our scam. We want to find more people like them because we think those people will also be victims of our scam. They'll be good targets, right?

[00:20:53] Clayton Gerber: Correct.

[00:20:55] Bob: To be clear, Epsilon was not in the dark about what Patrice Runner and his staff were doing with the lists of people they were renting.

[00:21:04] Clayton Gerber: The operators of the Maria Duval scam had to give Epsilon copies of the solicitation. They said, here's the letters we're sending out to them, you categorize them, and that way you know that our victims purchase our fraudy letters, our scam letters, and that would be part of that consumer's profile in the Epsilon database. So then that would be part of the profile they were building about you. Now you keep in mind, Epsilon had a profile on almost every single American, right, that was their business. Their business model was to know who every American was, to know their demographic information, to know what they would buy, so that they could rent your name, your address, your phone number, your email address to whichever company you were most susceptible to buy from.

[00:21:46] Bob: So Epsilon couldn't plead ignorance. Epsilon knew what it was doing when it was renting these lists to the Maria Duval scam, right?

[00:21:53] Clayton Gerber: They had a compliance program where they reviewed what you were selling. And it went through their management structure to sign off and say, yes, we're going to take on this customer. So at some level, Epsilon management agreed to bring on the Maria Duval scheme as a customer, they reviewed what solicitations Maria Duval, the Maria Duval scheme was mailing out, and they accepted it as a customer and agreed to sell lists to them.

[00:22:16] Bob: So Patrice Runner and the rest of the people behind the Maria Duval scam could send these finely tuned, highly personal letters with language that was AB tested to people handpicked to be vulnerable. That's why the scam worked so well. And that's why Patrice Runner lived so well for so long.

[00:22:37] Clayton Gerber: He started in Montreal, but this was very lucrative for him, and Patrice Runner over the span of this scheme was able to jet set around the world and live wherever he wanted while his employees would run the business for him. So he moved from Montreal to Vancouver, from Vancouver to Costa Rica, from Costa Rica to Switzerland, Switzerland to Germany, Germany to France, France to Ibiza, and he just spent the money that came in and lived a very lavish lifestyle jet-setting around the world.

[00:23:09] Bob: But eventually, Runner couldn't stay ahead of Clayton Gerber and the other investigators at the Postal Inspection Service.

[00:23:16] Clayton Gerber: So we investigated in conjunction with the Department of Justice, and a injunction was issued out of federal court in the sort of later half of 2014 that shut the scheme down. It was a court order that ordered the scheme to shut down. It closed all their bank accounts. It was served on their printing houses that prevented them from printing the letters, and it essentially made it impossible for the business to engage in mailing these letters, receiving the letters. We also filed an injunction against the company that would slice open the payment envelopes as they would come in, so we shut down the infrastructure that was necessary to, to mail these letters and receive the payment, which essentially stopped the flow of money to them.

[00:24:02] Bob: So the letters stopped, the scam stopped, but Runner was still on the run, even four years later when we first told you about Maria Duval.

[00:24:13] Clayton Gerber: So the scheme was run on a day-to-day basis by a few people who worked in an office in Montreal. And we, well it took us a few years to identify them with precision and build all of our evidence against them and we informed them through their lawyers we were going to charge them, and they agreed to cooperate. It took us a few years to do that. The scheme had been shut down, it was no longer operating, but we, we were going to charge them criminally with a crime, and they agreed to cooperate, they agreed to help us go after the, the organizer/leader, Patrice Runner, who was ultimately responsible. So we indicted him. We understood he was living in, in Ibiza, in Spain, and we submitted an extradition request. The Spanish authorities identified him, brought him to court, told him the charges against him, said that we were seeking his extradition, and they released him pending formal extradition. That's a fairly standard procedure. His life was very different then. No money was coming in, and his wife he was living with at the time, separated from him and kicked him out, and he was living in a tent on the beach in Ibiza, essentially homeless. The Spanish authorities couldn't find him because he was homeless at the time with no fixed address, and he had no money left.

[00:25:30] Bob: And after all that, Runner slipped through their fingers for a couple of more years until...

[00:25:28] Clayton Gerber: But ultimately, about six months into the pandemic in 2020, in about the middle of 2020, they found him in a hotel room, and they arrested him and at that time they had ordered his extradition that he be sent to the United States. It takes a little bit of time, but they called us right around Thanksgiving of 2020 and said we have 30 days to go get him from Spain. This was, of course, in the middle of the pandemic before vaccines were in place, and we had 30 days to identify international flights, for which there were very few, to go pick up Mr. Runner from Spain and bring him to the United States to stand trial.

[00:26:14] Bob: So Clayton Gerber is almost 15 years into this investigation, and he finally has his man, but there's a global pandemic and basically no one is allowed to fly, to travel in and out of the country unless there is a big exception.

[00:26:31] Bob: Okay, so you and a bunch of other people have basically been looking for this person for decades. You finally have him, and it's the dead-set middle of the pandemic, and you can't really fly. That sounds awful.

[00:26:41] Clayton Gerber: It was a challenge. It was very short notice. It was the holidays, it was, I think they called us the week of Thanksgiving, maybe the week after Thanksgiving and said we have 30 days to go get him, and that was myself and my team. We, we sort of dusted ourselves off and figured out what we were going to do. We managed to arrange flights and we flew to Spain, and the Spanish authorities turned him over to us, and we flew back to the United States on a mostly empty jet. There was almost no one who was authorized to travel. In fact, Spain was not issuing visas to travel to Spain. They gave us a special use visa for this occasion.

[00:27:18] Bob: Wow.

[00:27:19] Clayton Gerber: Um, I think we were the only Americans on the flight heading to Spain. You had to be a Spanish citizen to, to get there.

[00:27:28] Bob: So you picked him up personally.

[00:27:30] Clayton Gerber: I personally was present picking him up, myself and two other members of my team.

[00:27:34] Bob: What did you think when you first laid eyes on him?

[00:27:37] Clayton Gerber: Well, I've been doing this for a few years, so I'm, I'm never terribly surprised. You know Mr. Runner was a mild-mannered guy, pretty meek. I think he had been in, in prison, in jail in Spain for about 6 months at that time, detained. And that sort of humbled him a good bit. But he comes to the United States by himself with the clothes on his back, and that's what he gets. And he, he, he felt like he was going to land in the United States, make a phone call, have a lawyer, and get out of jail and be free to fight these charges at his discretion. And I had to explain to him that he has no ties to the United States, no one who could assure his bond, no one who could take him into their custody to ensure that he would show up, and that he was likely going to stay in jail waiting trial. And that's what happened. He sat in jail for almost three years waiting his trial date.

[00:28:36] Bob: But he gets on the plane with you and he still thinks he's going to get away with it?

[00:28:41] Clayton Gerber: Well, he thought he would, I think he thought he could talk his way out of it. Most fraudsters do. Most fraudsters think they can talk their way out of it.

[00:28:50] Bob: The wheels of justice turn very slowly during the pandemic. But his case finally goes to trial in the summer of, of this year, nearly 30 years after the first Maria Duval letters appeared, and on June 16th, 2023, he's found guilty of 14 counts of mail and wire fraud.

[00:29:10] Clayton Gerber: He's still in jail awaiting sentencing. His sentencing guidelines are high because his loss numbers are high. The federal guidelines are based on your loss numbers predominantly. Also targeting vulnerable victims. Uh he specifically asked for victims over the age of 60, over the age of 70. That was his target victim pool that he wanted if he could get it.

[00:29:31] Bob: So has justice been done in the Maria Duval case?

[00:29:37] Clayton Gerber: I'd like to think so. In conjunction with this, we, we've been able to pay back hundreds of thousands of victims a lot of money. We've been able to provide restitution and remission payments to hundreds of thousands of victims in this scheme because we've collected money through our investigations. So besides Mr. Runner facing a lot of time in jail, a lot of victims have gotten their money back. And I think that we have heard from enough of them that the money came you know at a, at a time when they really needed it or it was very helpful for them, I think is a, another component of justice besides putting people in jail.

[00:30:14 Bob: So one of the happy updates we can bring you from this story is that investigators were able to find a pot of money with which they could reimburse victims. And that pot of money came from an unexpected place.

[00:30:28] Bob: But that must be one of the really bright moments in what you do when you get to send money back to a victim and, and here, wow, this is such a crucial thing for me right now.

[00:30:38] Clayton Gerber: It's really fantastic. It's very rare in a criminal investigation that we are able to find the money. So this case is a little bit unusual that we, we have also settled our investigation with Epsilon, and that company had a lot of money. And we, uh, negotiated with Epsilon. They paid $127½ million into a fund to pay victims back, to reimburse victims, to compensate victims for their loss. And we have worked with a claims administrator who is making those payments and reimbursing victims based on the data we have, based on the datasets we have, based on the loss numbers, and we've been mailing checks out for over two years now to victims of the scheme, which is really uh, unusual and fantastic.

[00:31:25] Bob: And, and you said mailing, does that mean these checks are still going out?

[00:31:29] Clayton Gerber: They are still going out to this day. They go out in waves based on our analysis and the claims administrator's analysis of data, of loss data that we have, of people's checks that they have paid out of the, the databases that Patrice Runner and his company would maintain of who was a paying victim. And um, so they go out in waves. We're, we're just about done, we've just about exhausted our ability to pay this money back to the victims, so we're, we're about to wind down all of that, that restitution.

[00:31:59] Bob: So there's a bit of a happy ending. But it comes with a big warning for the future because Epsilon is hardly alone. The use of data to fine-tune scams, well that continues.

[00:32:12] Clayton Gerber: Epsilon and data brokers like Epsilon, can weaponize these schemes in ways that never could have been done before. They, they have an ability for the fraudster to focus their marketing with laser precision on the most susceptible victims. And normal companies that sell widgets want that ability to be able to market to customers who want to buy their widgets. But fraudsters want it as well, and Epsilon and these data brokers have figured out a way through data optimization and analysis to, to essentially weaponize this data and, and use it against our American consumers. And they are the first line of defense in terms of who they rent or sell this data to, and there are really no guardrails as to who they sell the data to, and they're in the business of selling data. The more data they sell, the more money that they make.

[00:33:10] Bob: And they can make money even by selling to people who intend to hurt vulnerable Americans. For the most part, there's nothing illegal about that.

[00:33:19] Clayton Gerber: Well, I think data brokers are in the business of selling data. And they will sell data to whomever is willing to buy it. And there is not a, a good guardrail, there's not good guidelines as to who they should be selling data to, who they shouldn't be, what their obligation is to find out what you're going to use that data for or what you're not going to use that data for. In the Epsilon example, Epsilon had seen the Maria Duval solicitations. They insisted on getting copies of the solicitation and reviewing them. They clearly knew the data that they were selling was going to be used to mail these solicitations out. And that's what ultimately made them culpable for their conduct. But there are plenty of data brokers in this landscape that sell lists and data, and they don't ask any questions about what you're going to use the data for, how you're going to use it, what you're marketing, who you're going to market... they know who you're going to market to, because they're selling you the names, but what you're going to market and what the results are going to be, and they don't ask those questions. They don't make any money by asking those questions, they make money by selling data and for some businesses, this could be a collateral business. So think durable medical equipment. So the motorized scooters that you see that older Americans might need for mobility and to get around and walkers and knee braces and that kind of durable medical equipment that, that millions of Americans buy and need as they get older. Well the sellers of durable medical equipment, they make their money selling durable medical equipment, but they can also make money by selling the list of people who buy durable medical equipment. And that's a sort of extra revenue stream for those companies to sell their data. Now it just so happens that the overwhelming majority of the people who need durable medical equipment are older Americans who have, have medical problems. They need motorized scooters, they need knee braces, they need walkers, and so by selling those lists as an extra revenue stream, those durable medical equipment companies are, are selling a very targeted list of often older Americans who are, have limited mobility or, or the like, and that can be for a fraudster a very valuable list to obtain. And the durable medical equipment does that sale of data and lists as sort of a collateral sale, an extra revenue stream. They don't even think twice about it, and they don't have any regulations or guidelines that tell them what they can and can't do. So their data, they're their customers, they choose to sell that data, it's generally viewed in the United States as a private matter between that durable medical company and their customer who bought a scooter or a knee brace from.

[00:36:19] Bob: And so they'll, they'll sell to, to anyone and there, there might be legitimate reasons for someone to buy such data I suppose, um, but there, there is nothing to stop someone who would say, a lot of people who buy dur--, durable medical equipment might also be susceptible to certain kinds of scams, that's a great list for us to start with, right? There's nothing to stop that.

[00:36:40] Clayton Gerber: Exactly right. And I, we have investigations where the fraudsters are purposely buying durable medical equipment lists; that is the, their, their current preferred list to acquire.

[00:36:54] Bob: So there's Clayton Gerber, Federal Investigator, telling you that criminals favorite data broker list to buy right now is a list of Americans who need medical equipment like motorized scooters for getting around. If that's not enough to make your blood boil, wait until you hear what my next guest has to say about data brokers. He's Alistair Simmons, who's part of a group studying the data broker industry at Duke University. I asked him to clarify just what is a data broker.

[00:37:25] Alistair Simmons: A data broker is a third-party company that specializes in collecting people's information, aggregating it, and reselling it. A lot of data brokers do this, not by directly collecting information from consumers themselves, but in collecting that data from apps in other services or mailing lists that people input their data to, and then store all of this information in large databases, create particular lists with that they market to third party clients. A lot of these lists can be about businesses or employees and companies. They can be about families, but they can also be about extremely sensitive topics such as elderly Americans with mental disabilities or victims of domestic abuse. So there's a vast variety of lists that data brokers sell. Some of them are extremely concerning, and the bottom line is, there's no way to regulate or ensure that data brokers aren't selling information that can be used to target and harm people in the future.

[00:38:41] Bob: The Duke Research Group is also working with policymakers on efforts to put guardrails around the data broker industry. I should tell you that I'm a Visiting Scholar at Duke, and sometimes I provide a little bit of advice to this research.

[00:38:54] Alistair Simmons: I think that this topic is very interesting because it combines an intersection of the privacy violations in which data brokers have against most American consumers. And then the tangible harms that come from scams and elder fraud that particularly target vulnerable populations within the US. So this area is of particular concern for me because I'm interested in understanding how we can use technology to protect people and how technology makes people vulnerable. And I think one of the biggest risks and harms that data brokers present is the opportunity for malicious or harmful actors to use personal data to target elderly and vulnerable Americans.

[00:39:43] Bob: But how does a list, like a list of people who buy mobility devices, help a criminal run a scam?

[00:39:50] Alistair Simmons: This personal information that data brokers provide allows scammers to craft a narrative that is personalized a lot of the time or seems personal to the victim and makes them more likely to believe it. It's a lot easier for a scammer to take advantage of somebody once the person already believes that who they're talking to is legitimate or understands their life and recognizes them. This recognizability, where you can make references to past events in someone's life or pretend like you're a professional service, allows scammers to develop a level of trust with victims that can result in victims losing money. Scammers are able to develop this rapport with victims because data brokers provide information about the victims beforehand, so scammers come into the situation prepared to take advantage of an individual while an individual or a victim doesn't know that their information is out there and that they're vulnerable to these acts of deception.

[00:41:16] Bob: That makes so much sense that it's easier to build a rapport and say hey, I, you know, I see you're from north--, northern Virginia. I am, too. I see that you're Catholic. I am, too. I see that you're a movie fan. I am, too. Right that's, if you're armed with all this information about someone, it's easier to build that rapport and build that trust, right?

[00:41:33] Alistair Simmons: Exactly.

[00:41:35] Bob: Alistair and his group are researching really sensitive topics.

[00:41:40] Bob: I, I think most people will listen to this and they're, they'll be shocked to find out that somewhere in the world I can buy a list of people who are facing cognitive decline, is that true?

[00:41:51] Alistair Simmons: It's definitely true. The--, it's a very murky and unregulated industry which a lot of people don't interact with because they're not out to find this data, which is why my research focusing on identifying how data brokers are selling this information has surprised me so much because this whole industry is operating a lot of the time behind the scenes, and they're selling data on people who don't know that their information is out there and being sold.

[00:42:26] Bob: So let me try to put a fine point on it. That if I am a professional criminal who seeks people who are vulnerable, I can go somewhere and buy a list of likely victims for my crime.

[00:42:38] Alistair Simmons: Exactly.

[00:42:41] Bob: That, that's just astonishing.

[00:42:42] Alistair Simmons: You can tailor a list to have potential victims, and you can select attributes that you're interested in targeting. So if you know that somebody is religious and you want to do a religious scam, you can buy a list of people that meet your demographic about a specific religion that you want to target.

[00:43:03] Bob: Alistair has written about the Epsilon case for a legal service known as Lawfare, and he found some even more disturbing things reading the federal lawsuits.

[00:43:13] Alistair Simmons: Another important thing to note is that Epsilon sell lists of victims who had already been scammed once. This shows that Epsilon reconstructed lists based off of previous victims to target them consecutively and ensure large financial losses on people who had already been taken advantage of. This allowed scammers to wreak havoc on people who had already shown that they were vulnerable.

[00:43:41] Bob: Alistair came to the conclusion in his research that data brokers can't be trusted to police themselves.

[00:43:49] Alistair Simmons: So the research on data brokers has also included two other data brokers, KBM, the finance department, and Marcromark. Both of them, which is interesting, this is consistent throughout all three data brokers that they have conducted due diligent re--, reviews or executives within the company knew about the data brokers selling information to scammers, but they continued to do it anyway. So some of my research has focused on how internal compliance measures within data broker companies do not protect against data brokers selling information to scammers simply because they have a financial interest in selling these large lists of vulnerable Americans and they can collect data from scammers about successful scams that can be used for future lists.

[00:44:48] Bob: So while the Maria Duval scam might sound a little like old news, past can be prolonged.

[00:44:57] Bob: I think one thing that's important about this story, the Maria Duval incident um, took place over decades, and you know it was really shut down 5 or 6 years ago, and they've just finally prosecuted uh the, the main person. Um, but that story can seem like it's in the past, but do we still live in a world where something like the Maria Duval crime can happen again?

[00:45:19] Alistair Simmons: Definitely. I think we live in a world where scams and these forms of fraud will become even more deceptive and widespread. My new research has focused on the use of AI deep fakes and imposter scams and how artificial intelligence has made it possible to create synthetic versions of someone's voice and impersonate people in distress situations. As this technology becomes more accurate, and more accessible and data brokers will continue to sell personal information on family members and the structures of families, it will become very easy for scammers to imitate somebody within your family or a loved one to take advantage of you since they know that you will act irrationally to help and protect somebody you love.

[00:46:18] Bob: Alistair is calling for new rules about how data can be bought and sold.

[00:46:23] Alistair Simmons: I think there needs to be much stronger protections on what type of data can be collected and sold on Americans in general, but particularly vulnerable, elderly groups, because there is no limitation on what data brokers can sell right now, and it is clear that there are financial societal harms that come from the sale of these lists. I think it's very important that there becomes some mandatory form of compliance about how data brokers can check to verify whether their list can be used for harm and if they are, they should not be allowed to be sold. So this can come from a form of auditing where third parties would audit what information data brokers are selling, and if it's determined that this information is potentially harmful, data brokers shouldn't be able to sell it.

[00:47:30] Bob: And I know, I think most people listening to this story again will be surprised that, that even any of this is happening, and these algorithms can basically give criminals, you know, laser focus in, in who they send emails and texts and letters to.

[00:47:46] Alistair Simmons: It's, it's a dark world where algorithms are trained on being able to identify victims for crimes, and then once these victims are identified, the algorithms use that as training sets to target new victims. So it's this reinforcing cycle which is extremely concerning because it's scammers on the front-end taking advantage of individual, vulnerable Americans, but then on the back end, it's this large, algorithmic database system that data brokers run which is perpetually being retrained to target more effectively the most vulnerable members of society. I think that's extremely concerning because this system will just become more and more powerful as technology advances, and more data becomes available, meaning that it is extremely important that we take action now, not only to protect ourselves, but to ensure that this form of systematic targeting isn't allowed in our society.

[00:48:58] Bob: Clayton Gerber really agrees that action must be taken to rein in this kind of technology-enhanced, criminal activity. But deciding how to do that isn't easy.

[00:49:11] Bob: What should be done about data brokers who are making information available that allows people to essentially weaponize algorithms against victims?

[00:49:20] Clayton Gerber: Well, that's a very tough question. I think that given what I have seen, we need some commonsense regulation. We need some commonsense guardrails and bumpers. This is not an industry that's going to police itself, but I think every industry wants to believe they're going to police themselves, but I think that the fraudsters are very good, the criminals are very good at exploiting whatever guardrail you might put up. Now that doesn't mean that the government regulation can put up perfect guardrails. But I think that it is important to know how these, this data is being used for the data broker. One of the things data brokers typically do is they put in seed names in their lists. So if I'm Epsilon and I'm providing you a list of 10,000 names, I can put in 2 or 3 names that are names that I control, addresses I control, so I can see what is going to come to me, what is going to come as a result of me renting that list. And those kinds of things where you then, you recognize, record, you pay attention and say okay, they use this list, I use this name only for this list, what do they market to see if they've represented themselves accurately. I think those are commonsense things that should exist so that these data brokers fulfill their role as the first line of defense to keep this, this very powerful data from being used for, for bad things.

[00:50:46] Bob: And somehow making them responsible for the, the end result of the data that they sell?

[00:50:50] Clayton Gerber: Well I think they have an obligation to ensure that they are not facilitating these crimes, facilitating these schemes. And there's a, there's a way to do that. There's a way that they can do that and have visibility and see what's going on. Uh, and it's not that expensive. It is not that difficult.

[00:51:09] Bob: It is difficult for consumers to act to protect themselves because there are so many companies out there collecting and selling our data.

[00:51:19] Clayton Gerber: You can't escape these data brokers. I, I, I guess what I would say is that you can do your best to limit your data footprint, to try to stop using club cards and membership cards and the like, but it, the data is out there and it is pervasive. You can't interface in today's economy, without leaving some sort of a consumer trail that exists. So you can try to limit it as much as you can to make yourself a less precise target. The more data they have, the more precision they have about you. But you can't eliminate it.

[00:51:58] Bob: So, do what you can within reason. Limit the data you share with companies. And there's one more lesson Clayton wants to share with The Perfect Scam listeners about the Maria Duval story; we live in a digital age where so much communication takes place on screens and emails and texts and so on, but old-fashioned letters on real paper, well they still have an important place. They still get attention. Criminals know this and take advantage of it.

[00:52:28] Clayton Gerber: I don't think email carries the weight that a letter does. You get a letter in the mail with a stamp on it, and it's a physical object that you hold in your hand. The act of slicing open that letter, the act of unfolding the paper, there is something tangible, genuine, real; because it came in the mail, you give it greater weight. And I think if you just think to yourself about what you get in the mail, in the envelopes and the letters you get in the mail versus what you get in your email inbox, I think that you are automatically suspect of the emails that you get if it's from someone you don't know. And in fact, I think the email providers recognize that. Many, many of the email providers already segregate your emails for you without you doing anything into emails that are promotional emails, emails that are social emails versus those that are your, your primary email, or you should sort of pay attention to. Like the email providers already do that meting out for you. You don't even have to look at the promotional ones or the social ones if you don't want to. So there, there is a, is a belief of genuineness, a belief of authenticity that comes around with a letter, and I don't think that that's unique to older Americans. My, my sons get a letter in the mail from their grandmother, and when I tell them you got a letter in the mail, they light up, they get so excited. They have this, it's like a gift that they get.

[00:54:06] Bob: You know as you're talking, I'm sitting here thinking, maybe letters are even more powerful now because they're even more rare than they used to be.

[00:54:13] Clayton Gerber: Well it's a personal connection that's tangible, that you, you're, you're standing there holding it in your hand. It's not just your phone that you pull out of your pocket every 10 seconds, unlock, and see if you've got a next text message. And I think that people use the mail in the most important times of their life. They use it to express condolence; they use it to express joy and congratulation. They use it to announce a wedding or the birth of, of a new member of the family. They use the mail to do those important things, and so you get your most important communication that way. You get your legal documents that way. You get your financial documents that way. It is weighted to be more important in the way that we use it.

[00:54:55] Bob: The Maria Duval scam was successful in part because it seemed so real to victims. And the letters arrived in real envelopes on real paper, so be aware; don't believe everything that lands in your mailbox. But speaking of real, I promised you an update on the real Maria Duval, the French psychic whose name was licensed for this worldwide scam. Well, two reports from CNN, Blake Ellis and Melanie Hicken, well they tracked her down. She was actually born Maria Carolina Gamba, but by the time the reporters found her and interviewed her at her home in France, she was suffering from cognitive decline. But they were able to speak with family members who say she had nothing to do with the fraudulent letters, that she made very little money selling the use of her name. Her granddaughter, who was stunned to find out her grandmother was involved in any of this, even began her own investigation. In the end, no one knows really how much the real Maria Duval made from this Maria Duval scam, perhaps the largest scam in history. So it seems some questions may never be answered.

(MUSIC SEGUE)

[00:56:17] Bob: If you have been targeted by a scam or fraud, you are not alone. Call the AARP Fraud Watch Network Helpline at 877-908-3360. Their trained fraud specialists can provide you with free support and guidance on what to do next. Our email address at The Perfect Scam is: theperfectscampodcast@aarp.org, and we want to hear from you. If you've been the victim of a scam or you know someone who has, and you'd like us to tell their story, write to us or just send us some feedback. That address again is: theperfectscampodcast@aarp.org. Thank you to our team of scambusters; Associate Producer, Annalea Embree; Researcher, Sarah Binney; Executive Producer, Julie Getz; and our Audio Engineer and Sound Designer, Julio Gonzalez. Be sure to find us on Apple Podcasts, Spotify, or wherever you listen to podcasts. For AARP's The Perfect Scam, I'm Bob Sullivan.

(MUSIC OUTRO)

END OF TRANSCRIPT