Darknet Diaries EP 181: The Story of Ricky Handschumacher - From Gamer to Cybercriminal

This episode tells the story of Ricky Handschumacher, a talented high school baseball player from Florida who became involved in cybercrime as a teenager. Starting at age fifteen in 2010, Ricky was a competitive Halo 3 player who encountered cheaters using DDoS attacks to knock opponents offline and win matches. Rather than accepting defeat, Ricky researched how these attacks worked and began using tools like Cain & Abel to launch his own DDoS attacks against other players. This marked his entry into the hacking world, where he discovered that cheating was easier than competing legitimately. Despite his natural athletic talent and competitive spirit in baseball, Ricky chose the path of least resistance in gaming, which would eventually lead him down a much darker road. Ricky's criminal activities escalated from gaming cheats to stealing Xbox gamertags and Instagram usernames. He developed social engineering techniques to manipulate customer service representatives at companies like Microsoft, Zune, AOL, and Yahoo. His method involved calling support lines, obtaining reference numbers, and then using those to bypass security verification on subsequent calls. He would exploit weak password recovery systems that relied on easily guessable security questions like favorite foods or zip codes. Ricky stole his first gamertag, Wolverine, using these techniques and began selling stolen usernames on underground forums for hundreds to thousands of dollars in Bitcoin. He was particularly successful with Instagram handles, selling the username @bro for eight thousand dollars. His success came from his ability to lie convincingly and exploit the helpful nature of customer service representatives who were trained to assist customers rather than suspect fraud. As security measures improved and two-factor authentication became more common, Ricky learned about SIM-swapping, a technique where criminals convince mobile carriers to transfer a victim's phone number to a device controlled by the attacker. To execute SIM-swaps, Ricky would first gather personal information about his targets by calling companies like Amazon, PayPal, or eBay and social engineering representatives into revealing phone numbers or other details. He would purchase social security numbers from people search databases for as little as three dollars, then use this information to convince mobile carriers like AT&T, Verizon, or T-Mobile that he was the legitimate account holder requesting a number transfer to a new phone. Once he controlled the victim's phone number, he could intercept text messages containing password reset codes, allowing him to take over email accounts and other services protected by SMS-based two-factor authentication. The most serious phase of Ricky's criminal career involved stealing cryptocurrency directly from victims' wallets. Working with a crew of accomplices, Ricky would SIM-swap targets and gain access to their email accounts, then frantically search for anything crypto-related. They would look through Gmail saved passwords, iCloud photos, text files, and email drafts searching for private keys, seed phrases, or login credentials to cryptocurrency exchanges like Coinbase. Many victims had emailed themselves their private keys or taken screenshots of seed phrases for safekeeping, making them vulnerable to this type of attack. Once the crew found access to a crypto wallet, they would drain it and split the proceeds. Ricky recalls one instance where they accessed an account with mid-seven figures but couldn't find the withdrawal password, leaving them unable to steal the funds. The episode also features the story of Mark Kreitzman, a victim of SIM-swapping who was targeted in 2018 while driving through the Arizona desert. Despite taking precautions by requiring in-person verification with two forms of ID at his carrier store, Mark's phone suddenly lost service. By the time he reached his father's house and regained Wi-Fi connectivity, he discovered six password reset attempts across his accounts. The attackers had stolen 2.2 Bitcoin from his Coinbase account within the hour he was without service. Mark's story illustrates the devastating speed and effectiveness of these attacks, as well as the psychological trauma victims experience, with Mark stating he still has PTSD from the incident. His case demonstrates that even security-conscious individuals who implement protective measures can fall victim to social engineering attacks when customer service representatives fail to follow proper verification procedures.