John Poulin

My wife calls me, panicked. The call is from her number, and her voice is unmistakable- that’s my wife. ‘Babe, our son is hurt. He got in a bike wreck. I’m at the emergency room but they won’t take our insurance and I need cash to get him help. Please send me 3000 dollars as soon as you can, he’s really not doing well.’ Me- ‘Wow, that’s scary. Tell me our passphrase and then I’ll send the money.’ Her (it) - ‘What? What passphrase? This is your wife, our son is hurt. Send the money now!!’ Me- ‘I’ll call you back. I don’t believe that this is my wife. If it is, I’m sorry, but we discussed this.’ The number? Spoofed. Easy to do and there’s no way to tell if a phone number is being spoofed aside from hanging up and calling back to confirm. The voice? AI generated. Easily done. A few seconds of audio is all it takes to create a realistic audio deepfake. What can you do? 1) Create a family safe word or passphrase. Ours is definitely not ‘Keep Going’ although we considered it. Discuss the passphrase far away from phones or any recording device. This is as analog as possible. Don’t forget that the trigger for the passphrase is just as important as the phrase itself. So instead of asking ‘what’s the safe word?’ have a separate triggering question. For example, you could say ‘I’m eating banana cream pie’ and this would trigger your spouse to respond ‘purple velvet pillows’ if that’s the safe word. Make it fun, silly, and easy to remember. And DON’T WRITE IT DOWN. 2) Cognitive security is an essential skill in 2026. Assume every image and video you see online is fake until proven otherwise. Expect scams and spammers, and be pleasantly surprised when it’s not. 3) Figure out a backup communication option with people who you absolutely need to be able to reach. Don’t just rely on a phone number for communication. Have redundant, ideally encrypted methods of communication with family. What did I miss? I think (hope) Nikita is wrong on the timeframe- agentic bots like Claude bot are impressive but not quite ready to flood the phone lines in just 90 days. But I think it’s going to be a huge problem by the end of the year. I already get dozens of increasingly realistic spam calls and texts daily- it’s only going to get more annoying. Have a plan to keep your family and your finances safe!

Thank you! 🙏🏽 When I try to access support, I have to provide my email, and a verification code is sent to the email associated with the account. I was able to trigger one email using that flow, but there are a few problems with this method: 1. It is not instant, it takes 45+ minutes to trigger the email; 2. The verification code in the email is only valid for 20 minutes. Because the email took so long to receive, I had to dive into a block of meetings for the day, and I missed the 20-minute window to use the code. When I tried to re-trigger the email yesterday and today, it did not work. Another avenue was to go through the Hubot support chat, but that only linked me to the same blog article that linked the Hubot chat, so it was just a circular process. I have included screenshots in case they're helpful not just to support, but also product dev teams. I love GitHub, I am all for good security posture, but I think this experience could be better!