[INTRO MUSIC]

ALEX GOLDMAN: From Gimlet, this is Reply All, I’m Alex Goldman.

PJ VOGT: And I’m PJ Vogt.

ALEX: And this week, we have a Super Tech Support.

[MUSIC — STUMPBOX]

ALEX: Super tech support is the segment on our show where someone writes in to us with a problem that is bigger than they can solve, and I try to solve it.

PJ: Because in your former life–

ALEX: Because in my former life I was a–

PJ: A tech support man.

ALEX: A tech supporter. 

PJ: Um, so what–so what do you have this week?

ALEX: We got an email from a woman named Lizzie.

 LIZZIE: Hi, this is Lizzie.

 ALEX: Hey, this is Alex Goldman, how ya doing?

 LIZZIE: I’m good, how are you?

ALEX: Lizzie’s in her 20s, works with teens at a nonprofit, and she told me that when she was on vacation over Labor Day, she had this very weird thing happen with her Snapchat.

ALEX: Where were you when you realized that something was wrong?

LIZZIE: I was in Asheville, North Carolina for Labor Day weekend vacation. I think, I think I was in the car, and I wanted to Snapchat something. I’m pretty sure that I wanted to Snapchat a brewery that I was passing and send it to my brother ’cause we had been there before. 

ALEX: So she tries to open Snapchat, and she's locked out of it. 

PJ: What do you mean locked out of it?

ALEX: She can't get into it. 

PJ: But like the app isn't working, or it’s like you've-been-banned-from-your-accounts not working?

ALEX: It's–the app is working fine, but she can't use it. 

PJ: OK.

ALEX: And she's like, “I’m on vacation. I'm gonna deal with this when I get home. It's not a big deal. I'll just send the password reset.” Right?

PJ: Yeah.

LIZZIE: So then I get home that night, um, back from Asheville, like 8 hours in the car. I'm exhausted. And then I see three emails come in from Snapchat. 

One email says, “Your account has been logged in by a user on an iPhone 8.” The next email says, “The password to your account has been changed.” The next email says, “The phone number associated with your account has been changed.”

ALEX: So how are you feeling when you see these three emails?

LIZZIE: Well so, um, I wasn't like, “Oh man, something has happened.” I was sort of like, “Oh wow, I guess I just gotta like reset my password.” But then at that very moment that I'm sort of starting to like process that, I get text messages.

ALEX: Lizzie gets these text messages–not through Snapchat, but through her phone. And the first one says, "Yo, if you try to touch Snapchat Lizard or do anything, you're fucked. I’m just warning you. I’ve got your nudes and IRLs. Just don’t do anything, we'll be fine. Smiley face. You understood?"

PJ: Jesus. Also what's an IRL?

ALEX: I assume that means her–

PJ: Like her information in real life? 

ALEX: –details, yeah.

PJ: Ugh.

ALEX: I mean did–were there nudes in your Snapchat account that could have been accessed by this person?

LIZZIE: I wish I could answer that definitively. Um… but I’m not certain. Snapchat has a feature called memories where it saves some of the photos that you send. 

ALEX: Right.

LIZZIE: Um…I’m not going to pretend that I’ve never sent a sensitive photo. 

ALEX: So Lizzie reports to Snapchat that her account’s been hacked, she’s getting threats from the person who took it and they actually get the account back to her pretty quickly. The problem is that when she gets it back, all of her contacts are deleted, and her archived photos are gone, which means she can't tell whether or not the hackers have the sensitive photos that they claim they do.

Almost as soon as she gets back into the account, she gets another message from the hacker which says, "Give it back 'else Imma smoke you."

PJ: Oh, Jesus. 

ALEX: And then she got one final message, which just said, "Bitch."

[MUSIC]

LIZZIE: I’m, I'm like, pretty scared. I’d been on vacation, um and so I like hadn't been alone in like five days and then I’m like alone for the first time, and I’m just kinda freaked out. 

ALEX: At this point, did you think this hacker knew everything about you?

LIZZIE: Umm-- I definitely was like feeling weird, and I like remember like maybe two days later, I like go to this yoga studio that's like two blocks from my house, and I just remember feeling like so nervous walking back from yoga. Um–

ALEX: Wh–why?

LIZZIE: I think just because I was like alone, and it was just very early in the morning. 

ALEX: So this like consumed you. You just felt exposed everywhere.

LIZZIE: Yeah, and actually I also made my roommate sleep in my bed with me. 

[MUSIC]

ALEX: So I told Lizzie I'd try and figure out who is behind this whole thing and just like help her get some piece of mind. 

ALEX: OK...so...I have a lot of work to do.

 LIZZIE: I’m anxious to hear what you learn.

 ALEX: Alright, thanks a lot.

 LIZZIE: OK, thank you.

 ALEX: Bye.

 LIZZIE: Bye. 

[MUSIC]

ALEX: Alright, so–

PJ: What have you got?

ALEX: Well, what I wanted to figure out was who it was who actually hacked Lizzie’s account, whether they actually had compromising photos of her, and just generally like get them to leave her alone.

PJ: OK, so what–so what happened?

ALEX: So first of all I got in touch Snapchat to see if the hackers really did have some kind of compromising photos of Lizzie or if they were just bluffing.

PJ: Uh huh. 

ALEX: And based on the information that we gave them–that Lizzie has a memories folder on her phone that doesn’t have any, any explicit photos or anything on it–they said it was extremely unlikely that the hackers have anything.

PJ: That’s great. 

ALEX: Yeah

ALEX: According to Snapchat, if you’d saved any explicit photos, they would have been in there. 

LIZZIE: It would be in that folder?

ALEX: Uh huh. So pretty sure he was just bullshitting you.

LIZZIE: Unreal. Love to see it. That’s great news.

ALEX: So, Lizzie was happy but she had the same questions that I had which was like–who had done this, why would they take her account, how did they get it, and like if they’re capable of getting their account what else are they capable of? What else of hers could they take? How much of a threat are they?

PJ: Yeah. Because it’s just like, she has no idea who she’s dealing with, actually.

ALEX: Right. And so, I started to look into these questions, and I ended up in a very strange world that I got very deep into. 

[MUSIC]

ALEX: So, just at very start, the first clue that I had was that the threats that Lizzie was getting were over iMessage. But they weren’t from a phone number, they were actually from an email address. And that email address was: o@xan.ax. Like “O” at “xanax.” 

PJ: Oh cute, OK. 

ALEX: Mhm. So, I was like alright, well–

PJ: This is a teen. 

ALEX: This is something–

PJ: I’m just–no, I’m just saying right now this is a teen. This is a teen who likes listening to Soundcloud rap. 

ALEX: What makes you so sure of that? 

PJ: I don’t know I just feel like–I feel like I associate Xanax with like teen Soundcloud rap. And while lots of people take Xanax, I feel like only a teen would make their user domain xanax. Do you know what I mean? Like xan.ax. 

ALEX: Yeah.

PJ: Did you try emailing them? 

ALEX: I did. But by the time that I emailed them the account had been deleted. Like it just bounced back. 

PJ: OK.

ALEX: So I went to the website xan.ax. And if you go there, this is what you see. 

PJ: Um, OK, so it’s like a bad tag of the word xanax–or xan dot ax actually, that looks like it was done in paint because like the–it looks like dripping graffiti but when you look at it the lines are straight like MS paint. And then it says, quote, in like normal font, “Maxime,” and then, oh my god. There’s like a link for Twitter, Instagram, Steam, Discord, Contact. So this person’s like, “Here’s how to reach me, now that I’ve done something illegal and creepy to you.” 

ALEX: Right. So I go to the Twitter of this specific person.

PJ: Yeah.

ALEX: And the Twitter account is twitter.com/hades.

PJ: Like hell?

ALEX: Yeah. Their instagram is instagram.com/fuck

PJ: Interesting.

ALEX: Steam account is steamcommunity.com/id/satan. And so at this point, I’m thinking this is a person who goes by the name Maxime, who just has like a bunch boutiquey usernames on different social media platforms that are probably really hard to get. And I think that’s why he would have targeted Lizzie, because her Snapchat handle is LIZARD.

PJ: L-I-Z-A-R-D.

ALEX: Mhm. She was a very early Snapchat adopter, and so she could get a cool handle.

PJ: So, so basically like Maxime was excited because her account name would just be like one more cool account name he would have, like a noun that didn’t have numbers after it. 

ALEX: Exactly. So at this point, OK, Maxime seems like a hacker. Hackers, in my experience, love to leave little easter eggs in the source code of their websites. Um, so–

PJ: That’s a thing? 

ALEX: Yeah. Oh yeah–

PJ: I didn’t know that. 

ALEX: So I, I used the developer mode in Chrome to look at the source code for the website, and in it I find right at the top it says xan.ax Maxime/Evan/Seb.

PJ: In the code? 

ALEX: Yes. 

PJ: Huh.

ALEX: So–

PJ: Evan/Seb

ALEX: I guess those are his friends.

PJ: Oooh, so it’s like maybe like a hacking crew. 

ALEX: Yeah it’s like a hacking team.

PJ: Very cool. 

ALEX: So–

PJ: I don’t think that’s cool.

ALEX: Evan has–

PJ: I think this is like the day that I turned into, it was my birthday on Sunday. 

ALEX: Yeah you aged out of like–

PJ: I really feel like I’m a curmudgeon (laughing) who hates skateboarding teenagers all of a sudden.

ALEX: So, the next thing I do is I follow the link that says Discord. And Discord is just a chatroom app where you can meet up with your friends.

PJ: Right. I don’t really use it. I have like one Discord that I don’t check very much. I guess I have two Discords that I don’t check very much. 

ALEX: You have two Discords? For what?

PJ: One’s, uh, with my Fortnite buddies. They’re both so nerdy. One’s with the people I play Fortnite with, to see if anyone on a given Saturday wants to game. 

ALEX: That’s pretty lame, yeah. 

PJ: Uh, and then the other one is like another one (laughing) that’s different people that play video games, where it’s just like, “Hey did anyone try the new Spiderman, is it good?” (sighs)

ALEX: I am on a Discord about good horror movies.

PJ: (laughs)

ALEX: I don’t really have a place to make fun of you about it.

PJ: That’s just like who these loser teenagers grow up into loser adults who judge loser teenagers but have the exact same interests. 

ALEX: Um, so I join Maxime’s Discord and there are enough people there that like they don’t notice me show up. 

PJ: Oh, there’s a lot of people. 

ALEX: There’s probably between 50 and 100. 

PJ: And is Maxime active on the Discord?

ALEX: Yeah he’s in there all the time. Basically, all he talks about are like the new Forza driving video game--

PJ: OK--

ALEX: Which he got a special, like steering wheel-shaped controller for.

PJ: Alright.

ALEX: Buying fancy clothes, like Gucci, and um, he has an Audemar Piguet, which is like a--

PJ: Sorry what, which one?

ALEX: Audemar Piguet.

PJ: What is that?

ALEX: They make uh, wristwatches.

PJ: OK. 

ALEX: Um, and he also talks about doing drugs a lot. And like 95 percent of the conversation on the server is just–it’s like, they’re all trying to be edge lords by like posting shocking photos, and like swearing all the time. I sound like an old man saying they swear all the time. 

PJ: They cuss flagrantly! But they’re just kids who are like trying to impress each other with their miscreant badness.

ALEX: Yeah. They’re, they’re like really mean to one another, and always calling each other names. And this is how everyone on it behaves. 

PJ: It’s like bad kid internet high school.

ALEX: Yeah basically. 

So I’m hanging out in this chatroom, trying to get as much information as I can but half of the stuff they are saying doesn’t even make any sense to me. It’s like they speak a dialect that I don’t totally understand. 

PJ: Lots of youth culture. 

ALEX: Um, I mean, beyond just normal youth culture. Like this was the first time I’d ever heard–seen anybody say “Weird flex, but okay”

PJ: What’s “weird flex, but okay”?

ALEX: Whenever someone does something where they’re like bragging about something, the best like offhanded response is, “Weird flex, but okay.”

PJ: That applies to a lot of things you brag about.

ALEX: Me?

PJ: Yeah. You’ll be like, “Oh, I got the first, uh,–”

ALEX: Whatever you’re about to say is just not true–

PJ: Like when you said you watched all the horror movies on some like streaming horror platform. 

ALEX: That wasn’t a flex that was more like a “I don’t have anything left to watch.” And it was Amazon. And I didn’t watch all of them, I just watched all the good ones so all that was left was the ones that were like definitely homemade and just uploaded by a weirdo. 

PJ: Weird flex but okay. (laughs) I feel like you just handed me–

ALEX: I’m so–I’m so mad because I set myself up. (PJ laughs) And as soon as you said it, I was like, “Oh, I just- I just like–I just like wound that up, and then I just let it go.” 

PJ: I felt like you being like, “Hey, they invented this new kind of thing you can poke people with. It’s like metal and it has a handle, just hold onto it for me.” (laughs)

ALEX: Such an asshole. But there are other things that these guys-- (PJ continues laughing). Alright get it out. Go ahead. Let me know when you’re done.

PJ: (laughing)

ALEX: God damn it. I hate this. 

PJ: OK. 

ALEX: Um, the other thing they were saying all the time is, “Do you guys want to h-v-h?” And I was like, “What could this possibly be, h-v-h.” And what it is, is they like to go play Counterstrike, and they like to turn on every single hack you can put on. 

PJ: Uh huh.

ALEX: And H-V-H is hacker vs. hacker. That’s how they play Counterstrike. 

PJ: I don’t know whether I’m impressed or annoyed by that. I honestly–like I can’t tell. There’s like a sound in my head, and I don’t know which one it is. 

ALEX: What–what does the sound sound like?

PJ: (makes noise) 

ALEX: Okay. So I’m watching this discord, and I think Maxime is sort of the leader of this gang that hacked Lizzie’s account. And I wanted to find out who he really was, and if he’s actually the person that threatened Lizzie. And I didn't want to just write him on Discord because I was fairly certain that he'd ban me." I saw him ban people all the time. Anytime I tried to join their voice chat, because they voice chat–they would use the voice chat function, because they didn’t know my handle they would just kick me out or just ban me from the server entirely and I’d have to start over. 

PJ: Got it. But you feel like if you could find out who he really is, and you like send him an email or whatever, there’s a way higher chance he’s gonna talk to you. 

ALEX: Right. And so I’m just watching these guys talk to one another, hoping that he will drop some information that helps me identify him in any way. And he doesn’t, but I start watching his Instagram and like I start getting a little bit of an idea of who he is as a person.

PJ: What does it look like? 

ALEX: He posts a picture of himself pretty early on.

PJ: Really? I guess that’s what people do on Instagram. It just feels like a security failure. 

ALEX: Right, the thing is that he posts a picture of himself that is obscured in such a way where you only see about two-thirds of his face. 

PJ: Can I see?

ALEX: Yeah. 

PJ: He’s like, he’s using like the Snapchat filter where you have like cute dog ears and a cute dog nose [ALEX: Mhm] and he’s like, he’s like a really young looking, like, boy. Like he’s got a round face and like pinkish cheeks. And like- like- like–he looks like, he’s probably older than this, but he looks like 16 or 17. 

ALEX: I’d guess that he’s probably more like 22. And then also on his Instagram, I find this little video that has a clue in it.

PJ: Okay. [boppy music plays] Interesting. I want to watch it again. [boppy music plays] Okay so he’s just like zooming in and out with his camera into what looks like–it looks like two ice cream scoops. It’s like, it like looks like two ice cream scoops, but it looks like they’re made out of like wrapping paper. 

ALEX: Those are two gigantic piles of Xanax. 

PJ: Oh, I am an older man now. (ALEX laughs) And there’s an American passport on the side.

ALEX: There’s a French passport. 

PJ: Oooh. An old man who’s never left his own country. OK, so he’s basically just bragging about all of the Xanax he has.

ALEX: Right. So, based on the information I have, I’m pretty sure that Maxime’s in his early-20s, I think he lives in France. He seems to really like drugs, he’s really into sad Soundcloud rap, and he’s also a musician himself hold on just a second. Here. Here’s one of his songs.

[MUSIC PLAYS]

PJ: That’s so bad.

ALEX: Kind of mean (laughs)

PJ: The music’s mean?

ALEX: No, you. 

PJ: The music’s totally hateful and mean. It’s like, I’m gonna prove my bonafides by just being like a really weird sad misogynist. It’s like, “Feel bad for me, I hate women” are the two messages that music just communicated.

ALEX: Yeah, totally. Like the partially obscured image of him, the sad Soundcloud song, like that’s basically all the information I have on Maxime to this point. And as for Seb and Evan, I know Seb’s in Stockholm, Evan is in the UK. I have a couple of social media accounts and email addresses for them. But that’s about it. 

So I’m in the Discord for a couple days and as I’m watching these guys I realize, like, they are talking about usernames in a quantity where they would never keep them just for themselves. Like, they’re getting way more Twitter accounts, Instagram accounts than they could ever possibly use, and a couple days into my stakeout of their Discord, I figure out why, when one of them drops a link to a website called OGUSERS.com.

PJ: OGUSERS.com?

ALEX: Yeah. So here [Alex shows PJ]

PJ: It looks like every hacker message board I’ve ever seen. Like it’s a black and gray message board and then like garish orange like message board chapter heading things. But just like, they’re always kind of unpleasant to look at and you have to squint at them and full of incomprehensible computer words.

ALEX: So, OGUsers is like an online marketplace where these guys buy, sell and trade valuable social media accounts. And what they’re looking for specifically are what they call OG handles, which are like cool handles that would be hard to get, like Lizard for example. And on this site you can get OGUsernames for pretty much any social media site. So like Instagram, Twitter, Snapchat, whatever. And if you get the right account, you can sell it for like a ton of money.

PJ: So how much money–give me like a valuable name and the amount of money.

ALEX: I saw “Antichrist” on Instagram sell for $4,000. 

PJ: Okay.

ALEX: Uh, Maxime sold it. 

PJ: Interesting. I wonder what is- there must be–the market can’t just be hackers selling to hackers. Like I wonder who is going to this place. You know what I mean?

ALEX: It’s actually kind of hard to know for sure. I’ve heard stories about actual non-hackers just wanting a really attractive account and buying it from this place, but I haven’t seen it. I did hear a story about a representative of Chris Brown contacting someone for an Instagram handle. 

PJ: Really?

ALEX: Yeah. 

ALEX: So people on OGUsers sell specific high value accounts. But then, they also sell accounts in bulk. Like they’ll get a bunch of, sort of, low value accounts, but they’ll have a bunch of them and they’ll sell them. You’ll see people actually selling the techniques they use to get the accounts. 

PJ: Oh, they’ll just literally just sell their methods. 

ALEX: Yeah. As a matter of fact, that’s exactly what they call them. And you see users saying, “I would really like x or y account.”

PJ: Got it–

ALEX: Like they–there are people who want specific accounts.

PJ: They’re like putting up bounties basically.

ALEX: Yeah. 

PJ: Ugh.

ALEX: So I still couldn’t figure out much about Maxime, but I wanted to know how he might have hacked Lizzie. And thanks to Joseph Cox, who’s a reporter at Motherboard who does a lot of stories about cybersecurity, I was able to get in touch with a guy who is a lot like Maxime. He hacks accounts and sells them to OGusers. In fact, he actually fronts a gang that’s pretty similar to Xan.ax. 

[RINGING]

 ALEX: Hello? 

 WORTHY: Hello. 

 ALEX: Thanks so much for taking the time to talk. I really appreciate it. 

 WORTHY: Uh huh. 

ALEX: He goes by Worthy, and um, I recorded a very long phone call with him.

PJ: He was happy to just talk about it.

ALEX: Oh yeah. Very happy to talk about it. 

PJ: Huh.

ALEX: And, to be clear, Worthy made a bunch of claims that I had no way of checking. Like, he said that he is extremely rich from this line of work.

WORTHY: You know, we run, we run a very, very high ring on the deep web pretty pretty big. I'm talking about like eight point seven million dollars we make a year.

ALEX: And he claims to have sold tons of OG handles, including one Instagram handle, uh the Instagram handle @car, for $70,000. 

PJ: OK.

ALEX: Yeah. So take everything he says with a grain of salt. But he told me that he and his fellow hackers actually have a pretty reliable method for how they usually get accounts. It’s called SIM Swapping.

PJ: OK. 

ALEX: So here’s how SIM Swapping works: You, PJ, have a phone number. I’m not going to say it on the radio even though that would be such a good troll. 

PJ: Do you have my number memorized? 

ALEX: 610.

PJ: OK. I think we’re done here. 

ALEX: Um. So, so, what they do is they find out that you have a valuable account and they find out your number. And they call the phone company and pretend to be you and say, “I’ve got a new phone that you need to transfer my phone number to.” So the phone company transfers your phone number to the hacker’s phone.

PJ: And then they have logins on all your apps? 

ALEX: They don’t have logins on all your apps. But since everybody uses two factor authentication on their phones–

PJ: Ahhhh! Then they go to instagram and they’re like “I forgot my password!” 

ALEX: Exactly. And then Instagram sends a password reset text to the phone number, which they’re now in control of, and just like that, they have your account. 

WORTHY: You know what OGUsers is right? 

ALEX: Oh, do I ever.

WORTHY: Yeah, so basically, OGs like that–OG handles, those are easy because it’s normal people like me and you. As long as I got the number, done. All I got to do is call T-Mobile, Verizon–any phone companies and you'll have it for about 24 hours before they notice, you know, it was obviously a fraud. But by the time you know that happens you've already swapped that OG handle, you've got it. It's yours. It’s done.

PJ: I mean, I don’t know if this is true, but there’s probably a lot of people at T-Mobile who are trusted to port a number. 

ALEX: Yeah like my experience at every phone store I’ve ever been to is that the people there are moving phone numbers from one phone to another all day every day. Like, anytime you buy a new phone, that’s what they’re doing. 

PJ: And what they don’t think is like, oh, somebody who comes in for this job might be illegally conspiring with a global ring of teen jerkwards, who are like plundering our customer accounts because they want like funkyshits at Instagram or whatever. 

ALEX: Right. 

WORTHY: So, I mean the SIM- the SIM–the SIM swapping community is getting, it’s getting larger because it’s getting easier. Like, it’s not challenging, at all.

ALEX: Worthy told me that he has this weird little ritual to destroy the evidence where after he SIM Swaps someone, he takes the SIM card that he used out of the phone, he tosses it in the microwave and he blows it up. 

ALEX: How many SIM cards are you microwaving a week? 

WORTHY: (laughs) A lot. I’ve probably went through 11 microwaves in probably a month. 

ALEX: I mean, I assume you use a diff microwave for your sim cards than you do for your food?

WORTHY: Yes. Yeah, so I mean, if you came in my front door, you know, I should be a whole lot better than this but as all hackers we all get fucking lazy, and it’s just, um, you know I got SIM–I got piles and piles of SIM cards laying on the desk, laying on the kitchen table. I’ve got even on the stove. 

ALEX: Can I also just say that Worthy made me very uncomfortable?

PJ: What do you mean?

ALEX: It just felt like he is an agent of chaos...like, not only does he sim swap for OG handles, he’ll try to get bitcoin, bank accounts. 

[MUSIC]

And he’ll go after ANYone just for the hell of it

WORTHY: Sometimes we target random people like me and you. We just target them just to see what they got, because we got their phone number. We can go, we can go on the deep web or any website, really, you know, and buy a list of phone numbers. And sometimes we do that, we’ll swap ’em, take ’em and see what they got. So it’s more of a, kind of, just pick your target. Just pick–you see a phone number online? Take it. That’s basically how it is. We go after everything. Anything that can make us a dollar, we take. 

ALEX: Over the course of this interview, Worthy told me a lot of crazy things — like, he told me that he’d gotten people’s houses sold out from under them, he told me that he got people’s cars repossessed, like he just said that he ruins people’s lives. And for all I know they were all lies, but it still freaked me out because it got me thinking that the Xanax crew. Like, they have the same tools, they could really wreak the same kind of havoc. They can do a lot more than just take usernames.

PJ: Does he like–is he somebody who would like know these guys? Or just like he’s in the same world?

ALEX: I-I actually asked him that. And he told me that he’d heard the name Xan.ax before but he didn’t know any of my guys. 

ALEX: But also, after talking to Worthy, I’m pretty confident that Lizzie wasn’t SIM swapped. 

PJ: Why?

ALEX: Because when someone is SIM swapped, it’s not just like, oh suddenly your account’s gone. It’s like, you look at your phone, and you have zero bars, it says no SIM. It’s like you–

PJ: Right, it’s like your phone before you set it up.

ALEX: Right. 

[MUSIC]

ALEX: So, this kind of leaves me where I started. Like, I don’t know how Lizzie’s account got hacked, I don’t know who the Xanax guys really are. But then this very small window opens up for me. 

So, I’d been watching Maxime and the Xanax crew for a couple weeks, on the Xanax Discord. And, um, they are voice chatting, but remember, every time they go into voice chat and I try and join the voice chat, it shows that there’s another person in it and they just, they just boot me out because they like don’t know who I am.

PJ: Right.

ALEX: And then one of their friends, decides to, um, hack, uh, Logan Paul’s Twitter. 

[MUSIC]

PJ: Woah.

ALEX: And one of the Tweets he sends out while he’s in that Twitter is, “Hey, join the Xanax Discord,” with a link to the Xanax Discord. 

PJ: That’s crazy. So all these like–’cause Logan Paul is like extremely YouTube famous and has a bajillion fans.

ALEX: Yeah millions of fans. And so Logan Paul’s fans flood the Xanax, uh, the Xanax Discord. And at first, I was like, oh this is much worse for me because they’re getting all this attention, they’re going to hide out. But in fact, it like was much better for me. It allowed me to like hide in the crowd, and they were kind of strutting around being so proud of how cool they are for being friends with the person who hacked Logan Paul. So they started op–they started having conversations in the public voice chat. 

PJ: Oh wow.

ALEX: And just, a bunch of people started joining it. And like, so I just started recording it.

PJ: Can I hear them?

ALEX: Sure.

ALEX: So the first person you'll hear in this is Maxime’s friend Seb and the second guy with the British accent that’s his friend Evan.

SEB: Remember when we played HvH, I thought like $100 bucks was a lot.

 EVAN: How much do you pay for @what?

 SEB: Like $1.2k

 EVAN: Steal.

 SEB: I pay like 2k for @loser though. 

 EVAN: Wait, do you have @loser on Twitter?

 SEB: Yeah. 

 EVAN: It matches you, bro. You’re a loser, lol. 

 SEB: No. I need a few more pair of Louboutins though. Like–

MAXIME: No you don’t they hurt. They hurt like fucking bitches, dude. I have one pair. 

ALEX: This is Maxime. 

PJ: This is Maxime talking right now?

ALEX: Yeah. Here, I’ll play it again.

MAXIME: No you don’t, they hurt. They hurt like fucking bitches, dude. I have one pair. I’m never buying them again.They hurt so fucking bad. You know I used to wear like uh the Yeezys, the fucking 350s like all the time. And then like, everyone in Paris started getting pairs because they’re like, like it’s not limited anymore. Like everyone has a fucking pair of fucking Yeezys. 

PJ: It’s crazy that I actually just get to hear his voice.

ALEX: I know.

PJ: He sounds like a French nihilist. 

MAXIME: I got so mad that I just like don’t wear them anymore.

PJ: The Yeezy’s stopped making me happy.

MAXIME: The Gucci Aces are like my favorite fucking pair of shoes.

SEB: They’re nice shoes.

MAXIME: I mean they’re really nice. 

PJ: So when they talk to each other, it’s the exact same as when they’re talking in the chat. 

ALEX: Yeah, basically. I mean, they spend a ton of time talking about buying expensive designer clothes and a lot of time just like humiliating each other in just like really unpleasant ways. And I feel like I got a better sense of who these guys were by listening to these conversations.

For example, I caught this one little moment of a conversation where they were talking about how a couple years ago, Maxime had told them he was going to commit suicide a bunch of times.

PJ: Really?

ALEX: Yeah. And, honestly, I find that the way they talk to Maxime about this pretty upsetting. Like, Maxime was talking to Seb at one point and Seb is like,

SEB: I remember when we all bullied like Maxime like when oh my god, dude. 

EVAN: That shit was so funny. 

SEB: That was so sad. We used to joke about you all the time when you were like retarded. 

MAXIME: Yeah you know that actually made me sad because like you guys were like my 

best friends at the time.

EVAN: But now we’re like, no no no, now we don’t bully you that much because you don’t do it. 

MAXIME: Yeah but like, back then, like I knew what I did was fucking retarded, and I regret it.

EVAN: You faked suicide 12 times. If that’s not dumb enough I don’t know. 

MAXIME: I mean no, sometimes I actually like tried, but like I know what I did was retarded, and I know I was a huge retard back then. Yeah. I regret it. 

EVAN: As long as you’re better now that’s fine, we don’t care. 

MAXIME: Yeah I’m better now that’s for sure but like just like that’s the past now. I don’t care about any of that. We went from being like poor fucking H-v-H-er to like rich fucking retards.

Evan: Yup pretty much.

PJ: That’s weird. That–that’s sad. 

ALEX: Yeah. And that’s all I learned because shortly after they kicked me out of the voice chat.

And so, at this point, I still don’t know if Maxime is actually the person who hacked and threatened Lizzie or who he really is beyond a few details. But I found someone who said they could help me figure it out.

[MUSIC -- Cellocell]

After the break, I find out just how huge a mess I’ve stumbled into. 

BREAK

[RINGING]

ALEX: Hello?

MICHAEL BAZZELL: Hello, this is Michael. 

ALEX: Hey Michael, this is Alex Goldman, how’re you doin?

MICHAEL: Alex, pleasure to talk to you...

ALEX: So, I got in touch with this guy named Michael Bazzell, who’s actually a listener who wrote in at one point to offer his services because he’s a cybersecurity expert. 

 ALEX: Can I get a level on your voice? What’d you have for breakfast?

MICHAEL: I had nothing for breakfast because I gave a keynote, and I never eat before a keynote.

ALEX: Uh, because of nerves?

MICHAEL: No, um, I think it’s just better on an empty stomach. I think I can speak clearer and I’m not holding back burp. 

ALEX: (laughs, coughs) I just choked on a little bit of trail mix I ate earlier, so, that’s another--

ALEX: He used to work on the FBI cybercrime task force. Now he’s a security consultant. He actually consulted on the first season of Mr. Robot.

PJ: Cool.

ALEX: And told me basically like–

PJ: Oh what a nerdy reaction to that piece of information. 

ALEX: Um, and what Michael said is that he has a bunch of databases on his computer and he can do searches that are way more advanced than I can do. And so, if I can give him the social media accounts and emails that I have for Maxime and his pals, he’ll look for them. 

ALEX: So how do we go about doing this? Like should I just give you the information 

right now over the phone? Should I email it–like should I email it to you?

MICHAEL: I’ve got one of my machines pulled up. If you have an email address, I’ll take a quick look and just see if the person’s even exposed or not. 

ALEX: Oh, let’s see here. Um. The one that I have that I’m kind of most interested in at the moment is, um, Maxime. M-A-X-I-M-E at Xan.Ax. 

MICHAEL: OK.

ALEX: So he runs Maxime’s xanax email address through the database.

MICHAEL: So I’m getting nothing back on that one at all. That one’s pretty much–which tells me it’s just not used publicly. It’s probably used for this thing. 

ALEX: Nothing comes up.

PJ: OK.

ALEX: Then we tried with Sebastian and Evan, also nothing. So Michael told me he’s going to try a bunch of other ways to identify these guys, but he thought it might take a few days because they are very good at covering their tracks.

And so I say to him like, "Look, at this point, I'm starting to get really nervous because I'm trying to expose a group of hackers–"

PJ: Who do not want to be exposed.

ALEX: Right.

PJ: Is their official position.

ALEX: And I'm actually starting to feel really afraid because I don't have any idea what this particular gang of kids are capable of. But what I do know is that Maxime is credited with a hack where 135,000 accounts were stolen. And so at the point I'm like, I'm poking a hornet's nest. I want to know how badly I am going to be stung. 

MICHAEL: Well I’m glad you’re at least thinking of that because if this comes out, and you uncover one of these, they’re going to unleash this fury on you. Um they’re going to doxx you, and they’re gonna probably try to post a home address or something like that, which maybe has happened to you before. So I would just prepare and accept that all that is going to happen, and then identify which of those things bother you the most, and do something to maybe help, you know, remedy that. 

ALEX: So I ask Michael to do the exact same kind of search that he’s going to do on the Xanax boys on me. Just to get a sense of how like vulnerable I would be. My assumption is like, he’ll find my address, he’ll find my phone number, and that won’t be great. But that’s what he’ll find.

PJ: And what did he find? 

MICHAEL: Am I clear to say anything that I find? 

ALEX: Yeah, yeah. Go ahead.

MICHAEL: Does the password GolGo13 mean anything? 

ALEX: It’s an old password. 

MICHAEL: G-o-l. OK. So that’s an old one. That’s good to know. Oh this is good. Golgol13!? Oh come on, you just added an exclamation point to your password?

ALEX: That’s still my old password.

MICHAEL: Okay. 

ALEX: So he finds my old password, and then things take a turn. 

[MUSIC]

He pops up my address in no time. And it, it just gets worse from there. 

MICHAEL: Your social ends in [bleeped], does that sound right?

ALEX: Yes.

MICHAEL: Okay. Did you have a driver’s license in Texas?

ALEX: Yes.

MICHAEL: Okay. Do you have a brother named Dylan? Is that your right family line?

ALEX: Yeah, that’s my brother. 

MICHAEL: Okay. And I found Sarah’s date of birth, [bleeped], and her social ending in 

[bleeped]. Father Mark, mother Mary? Does that sound right?

ALEX: Yup. 

ALEX: It is like getting punched in the stomach over and over again. 

PJ: Huh.

ALEX: It, it felt so bad. 

PJ: What else was he able to say?

ALEX: Like, I don’t know if you know this, but I have a second middle name.

PJ: You do?

ALEX: I do. 

PJ: Really?

ALEX: Yeah.

PJ: Michael Alex—

ALEX: Terebello 

PJ: No you don’t.

ALEX: I do.

PJ: Really?

ALEX: Yeah. But I don’t really use it–

PJ: Are you messing with me?

ALEX: No I’m not.

PJ: Terebello? 

ALEX: Yeah. 

PJ: You’re not messing with me.

ALEX: I’m not messing with you.

PJ: What? That is like–that is really, really the feeling of like, “Oh I thought–I didn’t realize like my clothes don’t cover my body in the back. And I wear the same clothes every single day.” 

MICHAEL: Where I would have went from here, which I did not do because I did not 

have your consent, I would have went to Annualcreditreport.com, said I was you, and 

requested your credit report because I have everything they need to give that to me 

online. 

ALEX: Cool (laughs). Okay, how long did all of this take you in total?

MICHAEL: Phase one, 11 minutes. Phase two, 20 minutes. Phase three, 18, 20 minutes. 

ALEX: So that’s roughly an hour. 

MICHAEL: And I’m not that good at this. So the people coming after you, they will do 

better. 

[MUSIC — TRAIN OF THOUGHT]

ALEX: So at this point, I’m very worried. And not just for myself, but for my wife and my kids. Because like all my information is out there—anything anyone would need to swat my house, which I’ve seen people from OGUSers do before, anything that people would need to sim swap me and get into my bank account.

PJ: Yeah.

ALEX: And so I asked Michael, “What do I have to do to keep this from happening?” And so he told me what I needed to do. And it is so much more involved than I ever could have imagined. Like, just for starters, I have to change my phone number

MICHAEL: Get a new phone number, and never use it for anything. Don’t even call your 

friends with it. Because let’s say that you call me with that new number and I put you in 

my contact list, and then I download some rogue android caller-ID app that shares my 

contact list with the world, well now all I have to do is search you through that app and I 

get your cell phone number. 

ALEX: Michael, can I just say this fucking sucks? I’ve had–

MICHAEL: It does.

ALEX: I’ve had that phone number for 13 years. I’ve had my email address for 18 years, 

probably. I think I got it in 2003 [MICHAEL: Yeah.] when I was in college, 2002. (sighs)

MICHAEL: It’s time to let it go, man. Now let me offer something you could do to make it less painful. You can take your current cell phone number and port it over to Google Voice and still own the number, still get your messages, still get your phone calls, you can still use that number, but it’s no longer tied right to your SIM card. 

ALEX: That’s smart. That’s a good idea.

PJ: So you have a new phone number?

ALEX: I have a new phone number, my old phone number is on Google Voice.

PJ: That’s why you’ve been texting me–when you text me now, it comes from an email address. 

ALEX: Yup.

PJ: (whispers) Weird. 

Like the basic problem with this whole system is we treat a phone number–the thing we give every single person–like it’s a really good password.

ALEX: Kind of.

PJ: The tech companies are like, “Your password has to have seven upper and lowercase things and be completely unique and blah blah blah, but if you forget it, we’ll just use your phone number.” 

ALEX: Right.

PJ: So your phone number is like your social security number now.

ALEX: Right. And we should be protecting it, not giving it out.

PJ: Okay, so you ported your phone number into oblivion. 

ALEX: Mhm. And that was actually just the first step. 

[MUSIC — HUNT 3]

He wanted me to have a password manager. He told me to get a separate email account for every account I create on any website.

PJ: (whispers) Jesus.

ALEX: He told me to, um, freeze my credit with all the credit report companies. He told me to get a YUBikey, which is basically like instead of two-factor authentication, where they send a thing to your phone–

PJ: It’s just a little thing you put in your computer.

ALEX: It’s just a little thing you put in your computer.

PJ: I have a YUBikey

ALEX: You do?

PJ: I do have a YUBikey, actually. 

ALEX: Wow. And then I got this program called Sudo, which gives me nine burner phone numbers that I can use to call people whenever I want.

PJ: And you live in a bunker underground now. 

ALEX: (laughs)

PJ: That is a crazy amount of stuff though. That is really excessive. Is his assumption that these kids are using this level of security hygiene?

ALEX: Yes. 

PJ: (sighs)

ALEX: And that’s not all that I did. He gave me a list of like 80 websites like Intellius and Whitepages, places that have my personal information on them and how to remove my personal information from them. 

ALEX: Hi, my name is Alex Goldman, and I’m calling because my tax records are listed on a website called nj tax records.net

ALEX: I actually had to call one of the websites, one person in particular, I had to go through old Whois records to find a person who had posted my tax info on their website.

PJ: And you were like, “Hey, could you knock that off just for me?”

ALEX: Yeah, and he was like, “Yeah, sure.” (laughs)

PJ: I hate the internet. OK.

ALEX: And then, um the last thing he told me was to go to my local police and tell them that I might get SWAT-ed. 

PJ: Did you do that?

ALEX: I did. So, it took me about two weeks to do all this stuff. I told Lizzie everything she needed to do, and then I called her just to check in.

LIZZIE: I’ve, I’ve changed my life–

ALEX: Tell me about it–

LIZZIE: I’ve made–I mean now I’m on my password manager, two factor authentication. All these- I’m–I’ve changed my ways. 

ALEX: But while we’re on the phone, Lizzie tells me that even though she got her Snapchat back, it’s totally sullied for her now. Like, a lot of the new contacts that were added when the account was hacked, they’ve been sending her stuff.  

 LIZZIE: I can’t use it. It feels like violated in my phone. I don’t like to go into the app. 

 ALEX: What do you mean? 

LIZZIE: Like, I had to actually block someone for sending me a lot, a lot, a lot of pictures of their penis. I mean it was like really actually became very vile and like many, many times a day. 

Alex: I’m sorry. That’s really gross. 

PJ: (sighs)

ALEX: So I was hopeful that Michael would get me good info on these Xanax guys and tell me who had taken Lizzie’s account in the first place. But Michael gets back to me and says he’s tried a ton of different tactics, but he really can’t find much.

PJ: That sucks. 

ALEX: Yeah. I mean, Michael worked on this for weeks, he brought in co-investigator, but you know, these hacker kids, they’re pros. So I was really disappointed. And I was at a loss for what to do next. Like, I felt like we were at a dead end.

But then, this little thing happened that threw everything up in the air.

MUSIC

ALEX: That’s after the break.

BREAK

ALEX: Welcome back to the show.

So, here’s what happened. We found a thread on an OGUsers copycat website called OGFlip, and it was a posting by Maxime’s friend Seb that said, “Hey, if anybody wants a one-character Xanax email address, you can have it.”

PJ: Mhm.

ALEX: For 50 bucks. 

PJ: Mhm.

ALEX: So like they have a side hustle of selling email addresses.

PJ: Just @xanax.com

ALEX: Xan.ax, right. So there’s a chance that o@xan.ax, the original email account, that originally threatened Lizzie was not Maxime or Evan or Sebastian.

PJ: It could have been just somebody from one of these messageboards who bought an email. 

ALEX: Right. And then one day, this user who’s constantly changing his username, so I’ll call him Charlie is trying to impress a girl by buying her the Snapchat “hedgehog.” 

PJ: Uh-huh.

ALEX: And out of nowhere, he types, “LOL Lizard, I pulled that.” 

PJ: (gasps) 

ALEX: I couldn’t believe it. 

PJ: Wow. Just like an out of nowhere confession from Charlie?

ALEX: Yeah, it was amazing. It was such a delight. 

PJ: What- what–what you were literally just sitting there watching the Discord?

ALEX: Mhm. So I just wanted to confirm that he was actually the person who did it.

PJ: Right.

ALEX: So, uh, I go to his OGUsers account. It says that he has the Snapchat Wild. And Lizzie had sent me a screenshot of all the new people that had been friended in the account since it had been stolen, and Wild was one of them. 

PJ: Seems good.

ALEX: And then not long after that, um, he posted a screenshot from within the Lizard account with Lizzie’s name on it. 

PJ: That feels very conclusive. 

ALEX: So I start looking through his conversations, and I notice that around 10 a.m. every morning, he starts talking about having to go to school–

PJ: OK–

ALEX: So I start to think like, oh, he’s on the west coast. And he’s in high school. 

PJ: Right. 

ALEX: So, on the Discord, Charlie’s like obnoxious and blustery, he totally blends in with the Xan.ax guys. But he also describes himself as like this shy, kind of lonely kid who doesn’t really talk to many people. He honestly seems kind of harmless. 

So, I talk to Lizzie, and I’m like, “Hey we’ve really narrowed it down. We think we know who he is. Like, what do you want at this point?” 

And she’s like, “Well you know who he is. I want an apology.” 

PJ: Hm.

ALEX: So–

PJ: I guess that is- that is kind of the–outside of the criminal justice system, it’s like the highest punishment you can extract on a high schooler is, like, you’re gonna sit down and write an apology. 

ALEX: And you’re gonna write it a hundred times.

PJ: Yeah. So she wants an apology in what form?

ALEX: Well in the intervening weeks, I’ve been sort of giving her progress updates on this.

PJ: Mhm–

ALEX: And I told her about the Discord–the Xanax Discord and the OGUsers Discord. And she started hanging out there and just watching people. (PJ laughs) So she’s in there herself. She knows what’s up with, with Discord. So I was like, “Why don’t we hop on Discord and see if we can get him on voice chat?”

ALEX: So Lizzie and I meet up at 11 p.m. Eastern on Discord [MUSIC] 8 p.m. Pacific Time [video chat noise]

ALEX: Hello can you hear me?

 LIZZIE: Hello? Can you hear me?

 ALEX: Yeah.

 LIZZIE: Excellent.

ALEX: Alright here we go. [typing] I said, “Yo, you pull Lizard on Snapchat?”

LIZZIE: Oh nice.

ALEX: He wrote back, “@LMAO.” And I said, “Is that a yes?” And he said, “That’s an LMAO”

ALEX: So I post a screenshot of him saying, “I pulled the Lizard account.”

ALEX: Alright.

 LIZZIE: You send it?

ALEX: He says, “Obviously a joke. All those Snaps were cracked. If you owned Lizard, you’re a big dumb. Your boy told me you didn’t even out two FA on. She just reverted with the revert link.”

PJ: He thinks you’re an angry contraband customer. 

ALEX: He thinks I’m an unhappy customer. 

PJ: Okay.

ALEX: And so I start asking him if he can hop on voice chat and he’s just like, “Eh I don’t know.” 

ALEX: I wrote, “So my name’s Alex, I’m a journalist. And the owner of Lizard is on the–is on Discord too, and I was wondering if you’d be willing to talk to her because she’s curious about what happened.” 

LIZZIE: Cool.

ALEX: Alright, bombs away, guys. 

SILENCE

 ALEX: Oh, he says, sure.

 LIZZIE: Oh, what?

[typing]

[discord voice chat noise] 

ALEX: You there?

CHARLIE: Hey, yeah. 

ALEX: Hey, how’s it going man?

CHARLIE: (snickers) Good.

ALEX: Lizzie, if you just wanna take it away, you have questions, why don’t you just go 

ahead and ask them?

LIZZIE: Uh, yeah. Why’d you want my account?

CHARLIE: Uh, your username was OG. Like, you know what that means?

LIZZIE: Yeah, I know what that means. 

CHARLIE: So, pretty much–

LIZZIE: Thank you. Why do you–why do you want all these OG handles?

CHARLIE: I don’t know. It’s kind of like a person buying designer clothes, but on the 

internet. It’s like a flex. [typing] But my friend, he pretty much cracked your Snapchat. He doesn’t like active Snapchats so he sold me the login for like, I don’t know, like 100 dollars. And I resold it for like 1.5k. 

LIZZIE: What?

CHARLIE: Yeah. [laughs]

ALEX: So Charlie tells us that he’s just the middleman. Like a friend of his steals Snapchat accounts in bulk, then he sold Charlie like seven or eight of them for relatively cheap. Lizard was one of them. And then, Charlie flipped the Lizard account to another guy for much more money.

PJ: Got it, OK.

ALEX: So he’s basically like I didn’t do anything wrong. 

ALEX: If you don’t mind me asking, like, how long have you been into OG accounts? 

How did you get into this? [video chat noise] Oh he’s gone. 

LIZZIE: Ugh, oh my God!

ALEX: And I’m like, that’s it? That’s all I get with this guy? I am definitely not getting Lizzie’s apology.

PJ: Yeah.

ALEX: And then he sent me a message that said, “My dad just walked in LMFAO” [PJ laughs] I can talk again in five or ten minutes. 

ALEX: We’re just waiting for him.

 LIZZIE: It felt like a real compliment when he told me that my handle was OG.

 ALEX: I can’t believe he said yes. [Discord video chat noise] Hey are you there?

 CHARLIE: Yeah.

So then Lizzie asked him about the threatening messages.

LIZZIE: Were you the one that was texting me?

CHARLIE: Someone was texting you?

LIZZIE: Yeah.

CHARLIE: That wasn’t me. That was probably the person I sold it to. 

LIZZIE: Like really messed up stuff. 

CHARLIE: What did they say? Did they do anything?

LIZZIE: No they were just threatening. 

CHARLIE: Yeah that was probably the person I sold it to.

ALEX: So I was like OK, so, you’re saying you’re not the person who threatened Lizzie, who threatened Lizzie? And what he said was like, I don’t want to tell you who I sold the account to. He is a bad guy. And he was like, something–something bad’s going to happen to me. Like I’m going to get doxxed, if I get doxxed, I could get swatted, like, that’s just bad.

PJ: Hm. Did you believe him?

ALEX: He seemed very, it was the most nervous this relatively laid back and kind of quiet guy got. 

PJ: Interesting.

ALEX: And we have like a very long, very circular conversation with this kid, where we’re just like, Lizzie’s asking him questions, I’m asking him questions. We’re like, “Why do you do this?” And he’s just like, “Money.” You know, he’s like, just really kind of blasé about it. 

ALEX: Even though you’re not doing it–even though you say you’re not doing anything 

illegal, you’re still part of an ecosystem that’s doing illegal shit. Like does it bug you at all 

that you do that stuff?

CHARLIE: Well, I mean like, she got it back, so.

ALEX: But that’s not the point, dude.

CHARLIE: I don’t feel as bad. But I do feel bad that people texted you, like I wouldn’t have done that. That’s pretty messed up. And that they deleted all your friends and pictures, like, I don’t, I don’t really like that. [typing]

LIZZIE: Have you ever thought about the people whose accounts are being hacked?

CHARLIE: Well, no not really. 

LIZZIE: Why did you agree to talk to us?

CHARLIE: I don’t know. I’m bored. 

ALEX: And he was like, he was like, “Why don’t I get the guy who actually stole the account and who sold it to me on the line?”

PJ: Woah. Was it just him talking in a higher voice?

ALEX: He brought this guy on the call who told me to call him Kevin. 

LIZZIE: Is your–is your friend on?

 ALEX: Yeah, he’s on but he’s muted.

 KEVIN: Hi, hello. (laughs) Yeah, I don’t know who’s talking. Hi. 

 ALEX: Hey, this Alex Goldman, I’m a reporter. 

 KEVIN: Yeah. 

ALEX: I told Kevin what happened, and he was like, I didn’t mean for that to happen. My deal is that me and two of my friends wrote a script that cracks Snapchats. We set it up to look for handles that were among the most common words in the English language because those would be more valuable to sell. 

KEVIN: And then I just used the top-500 password list and just happened to pop up. But I didn’t sell your account in the beginning because it was active. But then after like a month, I re-signed in, and it still worked with the same password so I just assumed you didn’t care or you didn’t use it. So then I sold the account.

PJ: And was she- did she- did like–was her password 1234 and had she not used it for a month?

ALEX: She–she hadn’t used it for a month and her password was–she hasn’t told me what her password is, but it was definitely among the thousand most common.

PJ: Okay. 

ALEX: Um.

PJ: So the thing he’s saying could actually be true. 

ALEX: Yeah, totally. 

PJ: Woah.

KEVIN: So, wait can I add you on Snapchat? Or is that like a big no-no.

LIZZIE: Um, absolutely not. Also, I don’t really use that violated Snapchat anymore.

KEVIN: So wait what? You don’t even use the Snapchat, and you’re making this big deal–?!

 CHARLIE: The person that I sold it to removed all her friends.

ALEX: Imagine, imagine that someone broke into your house rifled through all your stuff--

KEVIN: Yee.

ALEX: And- it- the it–and like afterward you’re just like, “I don’t want to go into that house anymore. Because…”

KEVIN: Wait wait wait. Wait so you’re comparing a Snapchat account to a house?

 ALEX: I’m comparing it to a violation of a person’s personal security.

KEVIN: Uh huh. 

ALEX: It sucks. It’s a shitty feeling to have someone break into your, your account.

KEVIN: Yeah. Terrible. But I don’t, I don’t understand how that–you’re making it way more serious than it actually is. It’s a social media account.

ALEX: I felt like he was just ignoring how scary these threats were to Lizzie. Like he was focusing on the wrong thing. 

PJ: Right. 

ALEX: So the four of us ended up talking for a long time. And Lizzie, she just started asking Kevin about himself. 

LIZZIE: What’s your job? I’m curious. 

KEVIN: What’s my job? I work as a cashier at a grocery store. 

LIZZIE: Hm.

KEVIN: I’m not a hypebeast or any of that crap. I would rather save my money than 

spend it on some shoes or a car or whatever–

ALEX: So you- so–so don’t have Yeezys?

KEVIN: No. Dude, do you know how much they are? They’re like- how–I don’t even 

know how much they are. They’re like $500+ right? 

CHARLIE: They’re like $1,000. 

KEVIN: Yeah, that’s crazy. Imagine that, dude. I go to Payless. 

ALEX: (laughs) Post your shoes man, post your shoes. 

KEVIN: Okay, hold on I got to–I got to take a photo (groans) give me a second. 

CHARLIE: Yeah.

KEVIN: Yo I’m uploading mine. We out here ballin’. Yo look at my–look at that. I think they’re like 13 dollars—

ALEX: Are those Asics?

KEVIN: No they’re Champion.

ALEX: How much were they?

KEVIN: I think, like, I think they’re like on sale for 14 or 15 bucks right now. 

CHARLIE: Ballin’.

KEVIN: Yo, I got two pairs (laughs).

ALEX: There was one moment where Kevin had just—just gone to do his laundry. He was like, “Hold on I’ll be right back I have to go do my laundry.” And then Charlie launched into this thing where he was like, “Yeah, you know, I feel—I feel like this,” and it was like the first moment where I was like, he seems kind of vulnerable. 

PJ: Yeah.

ALEX: How do you feel about talking to Lizzie for an hour? Does it make you feel any 

different about what you do?

CHARLIE: I mean, yeah, like, I kind of stopped the whole OG thing like after I sold all the 

Snapchats—

KEVIN: Hello? Yo, we back.

CHARLIE: Kind of gives me another reason–

KEVIN: Clothes is in washer.

CHARLIE: –to why I quit.

KEVIN: Hi.

ALEX: Say again?

KEVIN: Oh, my bad.

CHARLIE: So like, after I sold those Snapchats I kind of stopped like selling a lot of OG

usernames.

ALEX: Mhm.

CHARLIE: And like, I feel like this kind of gives me another perspective of like why I kind of stopped like. Like, it’s more than just money, like you’re affecting real people. And you don’t really think about that when you take people’s accounts. 

LIZZIE: I’m glad to hear you say that even if you don’t mean it.

ALEX: Toward the end of the call, I asked them both to apologize to Lizzie, but we basically just got some mealy-mouthed “I’m sorrys” that they clearly didn’t mean.

PJ: But like (voice deepens) “I’m sorry.” Like that sort of teenage monotone apology?

ALEX: Right, exactly. So it was kind of a bummer. 

ALEX: Alright guys, stop–stop breaking into people’s accounts, okay?

 KEVIN: Yeah, okay. Yes, sir. 

 ALEX: Alright.

 KEVIN: Wait wait wait. Can I like plug my bitcoin address?

 ALEX: Fuck no, bye. [discord video chat noise]

ALEX: I mean, I’m glad we got to talk to them and figure out what actually happened with Lizzie’s account, but it just sort of felt like, “That’s it? That’s all we get?” And then the next morning I wake up, I open up Discord, which is what I always do, ’cuz I wanted to, basically I wanted to see like if they had named me, and if there were going to be people harassing me. 

PJ: Yeah.

ALEX: And I had a message from, uh, Kevin which was like, “Hey. I wanted to get in touch. Um, I think Lizzie might have blocked me. I want to talk to her again.”

PJ: Huh.

ALEX: So I was like, “Okay cool. What time?” And he was like, “Let’s talk at 11:30. That’s when I get off my shift at the grocery store.” 

PJ: Uh-huh

[discord video chat noise]

ALEX: There you are.

LIZZIE: Hello?

ALEX: Hey how’s it going?

LIZZIE: Great, how are you?

ALEX: So Lizzie and I get back on the phone with him.

[discord video chat noise] 

 ALEX: Hey, can you hear me?

 KEVIN: Hello?

 ALEX: Hey, how’s it going?

 KEVIN: Hey, how you guys doing?

 LIZZIE: Hey.

 KEVIN: Hi.

ALEX: And he was like, he was like, a completely different person. 

KEVIN: Yeah last night after the call, I feel–I don’t know. It felt weird. I didn’t, I didn’t like how I introduced myself, and how I–how I talked to you guys. So I just wanted to come back and apologize for what I did, and how everything turned out. If, if I knew you were gonna get harassed or threatened or whatever happened, I obviously wouldn’t have taken your username. 

ALEX: And he was like, he was like, “Getting hacked sucks, I know. I didn’t think that anyone was using the account. Being threatened is awful. Not too long ago, I got doxxed.

 KEVIN: They contacted my big sister and my little sister and everyone. And I was 

just–yeah, scared.

ALEX: Can I ask you, what did it–what did it feel like that day that you got doxxed? Like, 

what were–what did it feel like just like walking around in the world?

KEVIN: Uh, I was still at my grocery store job. And um, I don’t know. I just–I was really 

paranoid. 

LIZZIE: Yeah. It is like, I mean it’s weird to like hear you say that. I just like remember looking around. Just like not knowing where in the world this person was, and like, [KEVIN: Mhm.] if- if- like–they could have figured out where I live. And like, it’s just, it’s just like hard not to get paranoid. It’s just like creepy like violation. 

KEVIN: They–they figured out everything about me. I actually just recently moved 

because–well not because of it, but um, I kind of pushed my mom into moving into a new apartment because of it. Because they found out where I lived and my old phone number and everything. And yeah, no, it was terrifying. They, they told me they were going to SWAT my high school and so on. So yeah. It was- it was–it was not fun at all. 

ALEX: I guess I’m won–I guess I’m wondering if this has changing–if this is going to change the way that you behave in the future–

KEVIN: How I do things?

ALEX: Yeah.

KEVIN: Uh, I don’t know. Honestly, I don’t want to sit here and lie to you and say it’s changed me. But um, I don’t think I’ll be cracking accounts anymore because I just don’t think it’s, it’s worth all the drama. Or not drama, but all the backlash if anything does happen. I don’t know how to phrase it. I don’t–I don’t mind, uh, exploiting like a big company like Snapchat. But I, I wouldn’t like SIM-swap someone. Or harass or threaten or doxx someone for–or extort them for money or anything like that. 

ALEX: And then (clears throat) he was like, “Look, do you have a bitcoin account?” And she was like, “Yeah.” 

 KEVIN: I sold the Snapchat for 100 so I’ll just send that directly back to you. So 

um, you can do whatever you want with that since it is rightfully yours.

ALEX: Lizzie, do you have your Bitcoin account number handy?

LIZZIE: Yeah.

ALEX: Do you want to drop it into–

KEVIN: Yeah, let me–

LIZZIE: It’s super long, right?

KEVIN: Yeah, yeah, yeah no. Post it. Yeah, yeah. It starts, uh, it’s usually with a three. You have coinbase, right?

LIZZIE: Yeah. 

KEVIN: Yeah, let me boot up my ledger. Okay. [typing] Alright I sent it. 

LIZZIE: Yup.

KEVIN: Got it?

LIZZIE: Yeah, thank you.

KEVIN: Cool. Yeah, of course. Yeah you can do whatever you want with that. If you wanted to donate it, go for it. And if you want to keep it and buy groceries go for it.

 LIZZIE: Awesome.

[MUSIC — SIMPLICITY]

KEVIN: Hey, uh, thanks for letting me, I mean, letting me talk again. 

ALEX: Yeah–

KEVIN: I knew I didn’t deserve it after last night ’cuz I was a complete jackass, but yeah thank you. I just, I just had to say sorry again. Yeah, have a good night, guys. 

ALEX: Take care.

LIZZIE: You too. 

KEVIN: Yeah I’ll see you later.

ALEX: Bye. 

KEVIN: Later bye.

[discord video chat noise]

ALEX: Oh my god, Lizzie. 

LIZZIE: Oh my god (laughing) that was so nice. And and he like lives with his mom, and he does the dishes, and he like, he’s like, yeah I’m just tryna, I don’t care about like exploiting large companies. I don’t know why that part is sweet. But it’s like, I don’t really take issue with that. 

ALEX: Well this has been like a real adventure. And I’m really–I appreciate you letting me go on it.

LIZZIE: Yeah this was wild. Thanks for your persistence.

ALEX: Alright, take care. 

LIZZIE: Bye.

ALEX: Bye. [discord video chat noise]

[MUSIC]

Reply All is hosted by PJ Vogt and me, Alex Goldman. Our show is produced by Sruthi Pinnamaneni, Phia Bennin, Damiano Marchetti, Anna Foley and Jessica Yung. Our show’s edited by Tim Howard. Our intern is Heather Schröering. We were mixed by Rick Kwan, fact-checking by Michelle Harris. 

Special thanks this week to Tim Rogers, Juliette Melton, Taila Gilbert, Elizabeth Patterson, Chris Messina, Gene Hwang, Phoebe Flanigan and Lorenzo Francheschi-Bicchierai of Motherboard. Lorenzo and Joseph Cox, who I mentioned in the story, are actually starting their own podcast called Cyber. The first episodes out next week, and it is about SIM Swapping. You should check it out. You can download it wherever you get your podcasts. 

Michael Bazzell also has a podcast called The Complete Privacy and Security Podcast. I will put a link to that in the show notes, as well as all of the things I did to protect myself in this episode. 

Matt Lieber is a video that you find so funny that you force your coworkers to watch it over and over and over again until they start enjoying it. 

One last thing, Lizzie donated the $100 she got from Kevin to an organization called Byte Back, which provides computer training and career preparation to underserved Washington D.C. metro area residents. There will be a link to their website in our shownotes. 

You can find more episodes of the show on iTunes, Spotify, or wherever you get your podcasts. Thanks for listening. We’ll see you soon.