Root Causes 638: Catfishing

Hosted by

Fellow

Original broadcast date

July 8, 2026

Tim shares his very personal experience with would-be catfishers and we talk about how AI is set to change the catfishing attack.

Podcast transcript

TCTim CallanAlright. So, Jason, sometimes you and I drop little things that hint at our personal lives - tell little anecdotes, mention things about our past and our experience and something like that. This one's gonna get way deep into my personal life, but it's just so interesting and fascinating that I just really want to share what I've been observing with the podcast audience.

Jason SorokoSo, Tim's digital haircut was fairly personal. Are you saying you're gonna get more personal?

TCTim CallanIt's gonna get more personal than my haircut. I need a haircut, by the way, but I'll get one when I get home. I have fairly recently returned to the dating pool. And the ways that I used to meet people the first time around, it was friends of friends, meet them at work, meet them at school. Well, I'm not in school

Jason SorokoTim, I'm gonna pause you right there. And I'm gonna let you take a breath. And all I'm gonna say is this: I'm fascinated - so is our audience. But why, on the Root Causes podcast, are we talking about this? And I'll tell you what: you mentioned a few things. One is trust. You talked about how organizations of people that family, friends, colleagues who, through chains of trust, could introduce relationships of trust. You also mentioned this idea that you are attesting yourself onto a platform online where people don't have trust, don't know each other, and therefore there's identity ambiguity.

TCTim CallanThere's absolutely an online identity aspect to this, for sure.

Jason SorokoSo we are talking about identity, trust, and social engineering.

TCTim CallanAbsolutely. That's why it's on this podcast. And it's a social engineering exercise - I mean, it's got the word "phishing" right in it. And just in case anybody doesn't know, what catfishing means is going to an online social media platform, pretending to be somebody you're not, for the explicit purpose of creating a personal relationship with the promise of romantic connection - ultimately for purposes of getting some kind of fraudulent monetary theft out of the target. And catfishing itself is not new, but my firsthand experiences with it are new, and I think I have some interesting observations about how to make it very, very current.

Jason SorokoI am all ears, Tim.

TCTim CallanSo, I mean, I don't have any notes, so I'm going off the top of my head. It didn't occur to me at all that this would be part of this adventure until I encountered my first catfisher - and I didn't even realize it at first. So they pretend to be real people, and they've got photos and they've got profiles, and they'll chat with you and all this stuff. And you go along until the conversation wends its way around to "I'm in distress, I'm in trouble, I need money for this thing."

Jason SorokoSo how do you read that?

TCTim CallanHaving lived in this world a long time, I immediately... and it's funny, I'm gonna use this word, I hope that's okay - I, like, literally was like, "This is a weird conversation. This lady's kind of a weird conversationalist. She's not very good at this online chat thing." I just attributed it to "this person isn't very good at this online chat thing." And then the ask came, and I was like, "Oh, shit - I'm being catfished." And it was this light-bulb moment. I had no idea. And I was like, "Oh, that's what's going on." And then, of course, I was interested - then I was like, "Okay, tell me more. Let's reel it in a little, let's see what they do." And it became really fascinating.

Jason SorokoSo, okay - so the light bulb went off, which is an interesting moment in itself.

TCTim CallanAnd I think it has a lot to do with this money thing. And I hadn't thought in those terms. And this is one of the things they say about social media: this is why people who are trained not to fall for phishing will fall for SMS phishing, because the context is different. So I would be Mr. "I can spot a phishing email a million miles away" but in this different context, I wasn't looking for that. Now that I am, I actually can kind of smell them.

Jason SorokoVery interesting.

TCTim CallanI'll get into a little... it doesn't much matter. It was the chatting online, getting to the point where it's time to say, "Hey, do you wanna get a coffee?" And then suddenly it's, "Oh, I gotta go out of town, sorry - my mom is sick, I'll let you know." So that's the first caution right there and I didn't catch it. "Oh, sick mom, I'm so sorry for you." Then it was, "Oh, I took my mom to the hospital, it's really bad, she needs a surgery, and it's a real problem. And I need $2,200, and I just don't have it." And that's where I said, "Oh” we know what comes next: the ask." So at that point, now I'm trying to draw it out. So I said, "Oh, what are you gonna do?" "Oh, I just don't have it. I'm gonna have it at the end of the month, but she needs the surgery now." "Well, what are you gonna do?" "Well can you lend it to me, and I'll pay you back at the end of the month?" And I go: there you go. There's the hook. And at that point, everything else made sense - the inability to have the online conversation, the never being available for the scheduled phone calls. "Hey, let's have a phone call." "Okay, Tuesday night at nine." And then at 8:50 I get something: "Oh, I have a problem, I can't talk tonight." And all of a sudden it all comes clear. And so it was fascinating. And there are these pictures, but, they just ripped that off of somebody's Facebook - that's easy enough to do, that doesn't mean anything. And so some poor individual has their pictures stuck in this catfishing site, and they have no idea. And I have to imagine - these were people who are in my cohort, my region. They're not real people - these are pretend people who are in my geographic region, they were in my age band, they were in all of these other things. You've got to imagine that a bunch of these different profiles are being built for every possible target - and that someone, 20 years younger than me is getting a "20-years-younger" supposed bait. And it's still, from what I can tell, a very human-driven, individual thing. I think these are people that are sitting at keyboards doing this. Now, I will say the English is broken and poor, and originally I was attributing that to "someone's typing on their phone with two thumbs and they just suck at this." But no, I think they suck at English. So they're not native English speakers. You can imagine the countries they might be in, because the internet is everywhere and these pictures are easy - you just get some pictures from someone's Facebook. That's also why they won't talk on the phone, because it would be obvious. And this must work enough that this is a viable career for somebody. It works enough - it doesn't have to work a lot if you're living somewhere where the currency conversion ratio is very much to your favor. If you're living somewhere where it's much cheaper to live than North America or Europe, you don't have to glean as much money as you would if you were trying to do the same thing and you lived in New York City. And so that's probably where - certainly the ones I've encountered - are.

Jason SorokoI bet you the amount they asked for would have been, like, a fortune.

TCTim CallanAnd now let me give you the twist. So, like I said, I'm at the point now where I think I'm pretty good at smelling them. And I see these things and I go - I've learned, I think, what I need to learn, so I'm not indulging them anymore

Jason SorokoOh! We have moved to the new era in catfishing. I bet you the English is better.

TCTim CallanWell, and that's what I was thinking - because I had kind of been thinking, why is a human at the keyboard doing this at all? Why hasn't somebody just hooked this up to an AI prompt, so they can run it cheaper, all day every day, with better-quality results, without the broken English?

Jason SorokoCatfishingAsAService.com.

TCTim CallanCatfishing-as-a-Service. And so, when I saw this - and these images, and I won't get into why, but I'm pretty confident these were AI-generated. It's not because they had too many fingers or something

Jason SorokoThey're not. It could be a big problem - it's gonna be whack-a-mole.

TCTim CallanIt could really disrupt the quality of this whole very major part of a lot of people's lifestyle. Like, online dating is so popular for how to meet people. And if people wanna continue to meet people, and if the online dating experience gets essentially DDoS'd by bots -

Jason SorokoWhat are people gonna do? If the experience is gonna be that bad for everyone -

TCTim CallanThen eventually, the customer base is gonna go - they're just gonna say, "This is a waste of my time," and they're gonna stop doing it. And then what? It gets back to bars. Like, then what - oh my God, right? They're gonna, like, go meet people? In the world? Like, crazy - go out and leave your door? I mean, who would do that? So, it's just all interesting. Not my industry in any way, not my problem, but just a thing that I was seeing.

Jason SorokoAnd it ties into so much of what we talk about. I even figured another thing it ties into: you and I, on this podcast, declared - you cannot trust voice, face, any form of biometric.

TCTim CallanThank you - that was the thing I meant to say, and I forgot to say. Which is: right now the strategy is, I try to find ways to sneak out of having a voice conversation with you, because you'll realize I'm a dude from Vietnam. Or sneak out of having - even more so - a FaceTime conversation with you, because you're gonna see me. There are tools available today that will change your voice and your appearance in real time that are economically well within the reach of somebody who's in this line of business.

Jason SorokoTim, how long until those catfishers figure out that ElevenLabs exists and they can have a conversation with you? And you're gonna be like, "Man - not only is their picture awesome, but talk to this! I love that sultry voice."

TCTim CallanAnd you're a great conversationalist. And how is it that you know so much about postmodernism? Which happens to be the one thing I mentioned I care about.

Jason SorokoExactly. Oh, she's gonna weave her way right into your mind.

TCTim CallanAbsolutely. And so I had a friend, when I got asked for the $2,200 - a friend of mine (I told this joke with a smile) - a friend of mine, he goes, "What you should do is you should say: I have it. I'm happy to give it to you. I have a bag full of cash. Meet me at this Starbucks at this time." And I thought that was funny, but I said, "But I'm not gonna go sit at a Starbucks for no reason, knowing that the nonexistent person isn't gonna meet me." But that's what it's gonna come down to. I think it's gonna get to how do you prove you're real - it's going to be back to: I need to physically see you in meatspace before I know you're real.

Jason SorokoI can add one more thought to this, I'm glad we're doing this, what a great topic. Talk about the natural emotional response of a person to a person. And these sites that you're talking about play on that, because there's pictures and other things, and you have a response. What happens when even, like, 20% of it all is catfishing?

TCTim CallanWhat happens when it's 25? You get taught not to have that real human-connection response. Just like nowadays: if you and I see an article or a supposed picture or a video, and it seems far-fetched, instead of getting upset or outraged or elated, our first thought is skepticism. We go directly to skepticism first, and it kind of has to be proven to me that it's real before I can move into those other emotions. And then I have that much less of those, because the novelty of it is gone and I've already kind of gotten used to the idea. And so the impactfulness of a supposed news item or a video or a picture has just gone down - the emotional impact has gone down. You're absolutely right - I think the emotional impact of meeting a legitimate, real-world person, when you have to start by suspecting that they're not real... And this applies to probably more than online dating. It applies to anything where you're meeting someone and you have to ask yourself, "Is this real?"

Jason SorokoWhat happens if it starts to affect all of news? All of advertising? Where it's fake, fake, fake, fake, fake. Advertising and news is all about your emotions. What you're talking about is just another case. And here's where I'm gonna land on this one, Tim. My final thought or reaction to you: I have a feeling that the younger generations figured out this problem a while ago. In other words, we're landing on something that I think younger generations could have articulated even a while ago, in different words. We're thinking about it in systems thinking

TCTim CallanWhich is rough, because if you look at the statistics of it, the younger you are, the more likely you are to favor online connection sites over real-world connections - that'd be the trend. One of the "OK boomer" things is: I want to go to a room with other human beings and actually look at the human beings without a screen in the way. And, some 20-year-old will say, "OK, boomer." So that group - the "OK boomer" group - is the group that suffers from this the most. And we're just below that group. I'm not a boomer, but I'm a boomer in their eyes, so there you are - we all look the same, we're boomer-esque. I mean, no pithy conclusion, but I just think the whole thing is fascinating and interesting, and it is yet another one of these unforeseen consequences. When these technology changes happen, one of the things that always happens is we're surprised in the way it manifests itself in things that we never would have imagined. And I absolutely had never, in a million years - until I saw it with my eyes - considered that one of the consequences of AI was going to be a foundational change in the way that the catfishing attack works, and its consequences on the online dating world. And yet, I am now firmly convinced that that is an inevitable outcome of this. So there you go.

Jason SorokoAnd I will tell you, Tim, we recorded a lot of podcasts today. We're wrapping up, I'm burned out. And so we're breaking the fourth wall here, talking about the fact that we're going through a recording process, which is great. We had a great day. This was the longest podcast we did today, by the way. Well, we had fun. I'm also gonna say that it was maybe down the center of identity.

TCTim CallanIt was. Maybe more than anything else we recorded. It was. It's why I wanted to talk about it - it's fundamentally an online identity story.

Jason SorokoDeepfake.

TCTim CallanBoom, boom, boom. Exactly, the problem of "how do you know?" 100%.

Jason SorokoThank you so much for sharing.

TCTim CallanThanks, Jay.

Stay informed with expert insights

Subscribe to Root Causes for engaging discussions on PKI, digital security, and best practices for protecting your organization's critical assets. Don’t miss an episode!