How I got scammed out of $50k
thecut.com
thecut.com
But I think it's more likely that there are techniques scammers can use to incrementally build trust, and that the rest of us would be wise to watch out for such techniques being used against us.
Quote: If it was a scam, I couldn’t see the angle. It had occurred to me that the whole story might be made up or an elaborate mistake. But no one had asked me for money or told me to buy crypto; they’d only encouraged me not to share my banking information. They hadn’t asked for my personal details; they already knew them. I hadn’t been told to click on anything.
The writer had carried on entire conversations with Krista and Calvin which lacked a scam angle. This wore the writer down to where she was more receptive to the stories being told to her. This is a warning to the rest of us to keep our guard up even after such conversations.
When I posed this theory to Saul Kassin, a psychology professor at John Jay College of Criminal Justice who studies coerced confessions, he agreed. “If someone is trying to get you to be compliant, they do it incrementally, in a series of small steps that take you farther and farther from what you know to be true,” he said. “It’s not about breaking the will. They were altering the sense of reality.”
>"How much money do you have in your bank account?"
These scammers were good and had finesse, and the incremental approach is 100% effective. This one also plays on the "know your customer" horror stories that people have likely heard about accounts being frozen.
One has to stop every now and then to find the big picture and ask questions like why money in a bank account has to come into play, or to note that getting more detailed and in-depth are often signs of spinning a tale vs. telling the truth. That's also hard to do when you're probably in panic mode.
The callback from the spoofed phone number is very good, but also revealing. The fact that they called the victim and not vice versa, or that the call came from the main number are all clues that something is amiss.
> “It’s a government number,” he said, almost indignant. “It cannot be spoofed.”
This is something that should be taught. I only know how easy this is because I worked on messaging/telephony apps and an occasional misconfiguration while testing resulted in me sending texts or initiating calls that appeared to be from a completely different number than the one I was trying to use.
The one thing I thought about in this article was that the bank is supposed to ask you those safety questions: why are you doing this, are you in trouble, this might be a scam, what will the money be used for. That might have pulled her out of this mistake. In the WaPo scenario the bank asked the victim those questions and she was told to lie and she did lie to them and lost even more money than this person.
> It was my brother, the lawyer, who pointed out that what I had experienced sounded a lot like a coerced confession. “I read enough transcripts of bad interrogations in law school to understand that anyone can be convinced that they have a very narrow set of terrible options,” he said.
On another occasion feds came to my house to investigate a neighbor. When I refused to talk they waited until I was shutting the door and stuck their fingers in to try and get me for assault as it closed. Thankfully I caught the door at the last millisecond and just stared at them blankly with the door cracked until they left.
Getting rid of qualified immunity for most law enforcement agents would be a good start.
This is a (mostly) effective way of immediately stopping an interrogation.
Yes, a police interrogation is even more intense than what the author experienced. But confessing to murder is also quite a bit more serious than handing somebody 50 grand in a box.
This alone, or knowing that the CIA does not investigate domestic fraud, would have stopped this.
I don't see that many people dunking on her. On the contrary, people do often tend to very carefully dance around the topic of preventative measures because they don't want to be seen as "victim blaming." It should be OK to say "here's what we can learn from this, about the tactics scammers use, about the technical issues like call spoofing, so that we can avoid being victims ourselves."
This is a terrible story and I feel for the person affected.
The lesson here is that there's no reason at al to answer any inbound phone call if it's not a personal contact.
There are only two reasons someone you don't know may be calling you:
- to sell you something
- to scam you
If it appears important like your bank or a government agency then call them back and do not answer. There is no upside and a potentially disastrous downside for trusting an inbound request of any kind.
Legislate that callers receiving a call without a valid caller ID will be allowed at least one month of bill payments returned and they'd make damn sure that they never routed calls without a caller ID. "Valid" would have to encompass things like 'foreign country of origin', I imagine. So, a call from a scam call center, that the local company allows to be routed, might only have "City, Country". But that would be enough to auto-block all non-domestic calls. Your home country's supplier can decide whether to route calls from a foreign peer, but I imagine that not being able to charge customers would be sufficient impetus?
A company routing more than X% of non-IDed calls could be subject to penalties against it's directors (a fine equal to a years income, and/or 5% of all assets, would probably be enough), just to sweeten things.
Why aren't we more militant with companies that enable antisocial/scam activities?
We also don't live in the days of AT&T having a monopoly anymore. Any change requires cooperation between different vendors, and ensuring a smooth rollout means allowing for a slow rollout. This is the telephone system after all, not some startup's barely-used product.
Plus the government has multiple arms and some of them don't want the changes to be made or not too quickly (surveillance, stings, etc.).
In other words, they have no idea where calls enter their network from; a corollary of which is they don't know which company to bill for any of the calls they terminate.
Companies purposefully allow false origins for call centres, and purposefully carry calls from spammers for financial reasons (they get paid). It's not a technical problem.
What you describe is an historic problem, not a technical inability to act.
Even though mobile-to-mobile and VoIP-to-VoIP calls carry subscriber information under the hood, other call pathways don't or require translation of the information. STIR/SHAKEN are designed to carry this information end-to-end but the need for backwards compatibility and the usual slowness of cross-vendor cooperation leave some gaps.
It is. Stop Caller ID.
Getting rid of something useful just because it doesn't work perfectly is dumb. It's replacing infrastructure maintenance and improvement with demolition.
Government always sends letters, can’t think of a time the IRS has ever called me. But they sure send me a lot of letters.
Yesterday I ordered an Uber to go from a hotel to the Airport. Immediately after connecting with a driver I get an inbound call from another state.
I'm the type that never answers inbound calls unless it's in my contact list and even then I might not answer and let them leave a VM or follow up with a text.
But I made an exception in this case due to the timing and my desire not to miss my flight. It was the Uber driver clarifying the pick-up spot.
This points to failed process on Uber's part. There is no reason an Uber driver should need to call their customer from their personal phone. The pick-up spot is prominently displayed on both the driver's and rider's apps. You can't miss it.
Same for delivery drivers. If the package requires an in-person signature, there should be a process for what to do if the customer is not available that does not involve the delivery driver calling from a personal phone.
Some drivers call proactively to avoid issues. I’ve had multiple calls from Uber drivers.
- someone from your immediate family lost their phone (or it ran out of battery) and they're calling you from a borrowed phone
- someone close to you had an accident and police / hospital is calling you about it
- a call from school about your kids
- someone you know changed their number
- delivery person has a package for you and wants to confirm you're home
- you bought something online but they ran out of stock and want to offer you a replacement
- etc.
When I am expecting a call from an unknown number, I begrudgingly answer the junk calls, knowing full well the next several weeks will be full of them.
My niece and nephew's school does text message updates. Informational communications from friends are by text or email (and can be confirmed via the mechanism not being used, or by arranging a call). I have never gotten a call for a delivery (it's all email and text if I've opted-in), and would treat one as a scam, even moreso if it is related to an online purchase. Legitimate emergency services have zero excuse for not displaying as such via caller ID.
I thought it was a scam so I was very vague.
The woman then went on to tell me my mom had had a stroke.
Unfortunately she was telling the truth.
So yeah, sometimes it's good to answer unknown callers.
> He told me to go to the FTC home page and look up the main phone number. “Now hang up the phone, and I will call you from that number right now.” I did as he said. The FTC number flashed on my screen, and I picked up. “How do I know you’re not just spoofing this?” I asked.
> “It’s a government number,” he said, almost indignant. “It cannot be spoofed.”
Completely insane that we continue to allow caller ID and number spoofing, it's so effective for these fraud scenarios.
One day a few months ago I woke up to a missed call from a verified number. I had been in a car crash the night before, and I was worried I missed a call from the driver's insurance company.
I called them back, and I was told that I was talking to a civil engineering firm; the receptionist was polite, but she sounded even more confused than I was. I had googled the number while I was on the phone, and yup, it belonged to a civie firm.
At the time I just assumed some engineer fat fingered my number by mistake, but I guess I missed a call from "Amazon" or "your insurance company" or some other nonsense. Funnily enough an insurance scam might have gotten me in the state I was in.
I was thinking about that the other day. I think 'incoming calls' is an idea that got badly implemented, or I'd even call it one of the worst features ever implemented.
Besides my friends and family (I normally text chat with them during day hours and calls after work), why would anyone unsolicitedly call me? I might be in a meeting or deep work; did that never occur to you? So, either I miss those calls or do not pick up.
Some scammers are just dumb. One of them called me on a weekend and said - "This is border police". DumbF*k, there's no border police.
Sometimes you are forced to risk it.
That said banks can be pretty bad at avoiding scam-like messaging and promoting bad habbits.
Personally I ignore almost unknown calls and voicemails and do not do any online shopping. Those few that I respond back to I'll say I can't verify who you are (people search sites & google search) are you a scammer/spammer?
My bank will lock me out of online banking if they want something from me. That will get me driving to the bank to fix the issue in person. Anything less than that will be procrastinated into oblivion.
The woman went to the bank and withdrew $50k in cash. The article makes no mention of the bank warning or asking any questions. Banks and Tellers absolutely need to be taught to warn people of these scams. It has saved many people in the past by just simply raising awareness.
When I withdraw a lot of cash, my standard answer is "to put under my mattress".
I don't want to tell a random teller what I'm doing with my money.
However, there are probably so many SAR's that they would only be useful as a data point on an investigation triggered by something else, or if you get them frequently.
Also, if over $10k they are automatically required to file a CTR on that, but I bet those are even less likely to trigger anything by themselves.
It was pretty obvious from the start it was an attempt at a scam - my bank never uses a robocall when they call to tell me they've blocked transactions, but this was a 'press 2 to talk to our customer service', but they still went with the 'we have blocked them because they are suspicious'. I guess they're happy to point out that scams and such exist, because it plays into your paranoia that maybe you ARE being scammed by someone else, and increases your trust in the caller if they're warning you.
DON'T PRESS OR SAY ANYTHING. Don't answer, or if you answer by mistake, just hang up.
>>The woman behind the thick glass window raised her eyebrows, disappeared into a back room, came back with a large metal box of $100 bills, and counted them out with a machine. Then she pushed the stacks of bills through the slot along with a sheet of paper warning me against scams. I thanked her and left.
Giving you a generic warning slip isn't the same as "telling you to be aware of scams" -- most people lump that into generic background noise.
When I brought it up as politely as I could, she paused and look concerned but then assured me that they were gifts for her grand kids graduations. I pushed back gently that she should call the police if someone asked her to buy those, but she nervously laughed and reiterated the graduation gifts line.
I have no idea the outcome, but I do know it was in March and that here in America her grand kids almost certainly have iPhones. Really upsetting.
My best friend's mom recently passed. She had Stage 4 breast cancer and somehow survived for a decade in that condition. My friend's dad has always been "out there" in a sense, but now has full on dementia.
While cleaning out their old office, we came across Apple Pay gift cards, all with their code revealed, stored in an envelope. $2500 worth, from people with very little to begin with.
His Dad, with his dementia, had no idea what it was about, and his Mom is gone. We can only conclude that they were scammed. His Mom was a very sharp woman, but somehow it still happened. Very sad indeed.
The article, about half way in, indeed does say the bank teller which counted out the $50k warned her of scams. It is in this paragraph:
> When I reached the bank, I told the guard I needed to make a large cash withdrawal and she sent me upstairs. Michael was on speakerphone in my pocket. I asked the teller for $50,000. The woman behind the thick glass window raised her eyebrows, disappeared into a back room, came back with a large metal box of $100 bills, and counted them out with a machine. Then she pushed the stacks of bills through the slot along with a sheet of paper warning me against scams. I thanked her and left.
Note the second half of the second to last sentence: "along with a sheet of paper warning me against scams".
The person being scammed ignored the bank's scam warning.
Never trust someone who calls you with extreme, urgent bad news. Use validated, known means of contact for whoever they pretend to represent and validate.
How many people know what [insert federal agency] credentials look like?
I have a friend who is one of the 2k IRS Criminal Investigation Division agents in the entire country. He's full-blown armed federal agent a la FBI, etc.
He tells me it's very common that when he goes out to do an "interview" people say he's not real and they're calling the police, slamming the door in his face.
The local cops show up, check him out, and then go back to the door with him. In his area he (of course) personally knows many local cops and they'll show up laughing "Oh another one, huh?". It doesn't bother him at all and I seriously doubt a scammer/impersonator would stand around waiting for the police to show up and then have the gall to try to con /them/.
Additionally, they have undercover vehicles (of course) but when he goes out for interviews like this it's in the classic "Oh yeah that's a cop car" vehicle with US Government license plates.
I've refused to give away basic ip addresses to the police because they couldn't verify their identity and she handed over her life savings to a stranger in an unmarked car.
I wish she at least could explain her reasoning afterwards. Her husband's disappointment must be immense and that's a tricky thing to mend.
I had a psych teacher who shared an anecdote of how she spent a few 100 on Venetian glassware key-rings to gift everyone due to a combination of those techniques, despite knowing and teaching them for years. Knowing something is manipulation and how it works doesn’t make one immune to it. It made no sense to the teacher why she fell for it. She couldn’t really explain it either, except for that is how the techniques work. It uses how your brain functions to shortcut your ability to think rationally, and get you to do something you normally wouldn’t, and that seems obvious in hindsight. You could compare it to hacking someone’s thoughts, except there’s no way to fix vulnerabilities with a software update.
If she would have been able to talk with her husband, the police or just had an hour to clear her head she likely would have seen the scam.
The suggestibility details in the story don't add up. She attempts to verify the CIA agent, is told to check an incoming number, knows that incoming numbers can be forged, but buys that government numbers can't be? There are too many places in this story where we're asked to let the author have it both ways: she knows something is wrong, specifically, but is going along anyways.
It's not at all clear why she couldn't call the police; it's just stated, at one point early in the article, that she concluded that she couldn't. What's the rationale for that one? The scammer might be in the local police department? Like Agent Koutris in Season 2 of the Wire?
I'm also hung up in the scammers showing up, in person, in a Mercedes. They have not in fact hacked this person's whole life (that isn't really a thing), so they don't know that the police haven't been contacted. But they're showing up, at her house, in a car probably worth more than the $50k that they're hoping to collect. Here I have just a basic Bayesian problem: the Venn diagram of people who can cough up $50k who won't contact the police, such that the handoff is a setup, is slim. It's not that it's impossible; it could happen. But the base rate is very low. As a strategy, that is a very effective way to lose a white Mercedes SUV.
I'm registering a prediction that another shoe is going to drop on this story.
Two pieces of corroborating information that are gettable:
* The police report that she says was filed on October 31 is a public record subject to FOIA.
* The handout her bank gave her about "not getting scammed" when she withdrew the 500 $100 bills should be available to anyone who asks.
I think the Internet is hypnotized by the debate about how dumb you have to be to get taken by a scam like this. Smart people get taken by these kinds of scams all the time. The story is directionally and importantly true. But I think it's almost certainly false. I've got a FOIA out for the police report.
Someone should roll into a Citi or Chase and try to pull 50k out on no notice next week. I bet they freak out. One person I talked to was told they had to give advanced notice to take $15k out. And pay attention to the timeline given on this story! Everything had to have taken place between the hours of 2:00PM EST (when she got the call) and 5:00PM EST (when all the banks in Brooklyn close). At 6:00PM EST she's home giving the money to the guy in the SUV, who she's not allowed to look at, because he's UC. On Halloween. And the scammers picked the day to do this on. Come on.
> That morning — it was October 31 — I dressed my toddler in a pizza costume for Halloween and kissed him good-bye before school. I wrote some work emails. At about 12:30 p.m., my phone buzzed. The caller ID said it was Amazon. I answered...
> I met the SUV at the curb and put the money in the back seat. It was 6:06 p.m. Even if I’d tried to see who was driving, the windows were tinted and it was dusk. He maybe wore a baseball cap. When I turned around, I could see the backlit faces of my husband and son watching from our apartment nine stories above. As I walked back inside, Michael texted me a photo of a Treasury check made out to me for $50,000 and told me a hard copy would be hand-delivered to me in the morning.
The amount of convoluted bullshit that the "CIA" and "FTC" investigators fed her, I automatically assumed that developed over the course of a week at minimum, as do many Nigerian prince/pig-butchering scams in which the scammer ends up geting to know the victim's personal life (and sources of funding) as well as an actual close friend.
Withdrawing $50,000 in cash from your bank in a single day between taking your kid to school and then trick-or-treating is impressive enough under any circumstance. But I can't imagine hearing and processing all that bullshit (nevermind believing it!) in a single day
That said, the part that caught me was that the bank was happy to hand her 50k... ? With just a paper about scams? IDK, I wrote an 8k cashier's check awhile back and the manager came out to make sure I wasn't sending it to a Nigerian Price.
Her bank must do a lot of cash volume to not blink at 50k taken out mid-day with no questions asked.
Anyone who calls me out of the blue is a huge red flag, I don't engage with them other than asking what they are calling about, if it sounds like something real then I hang up and call back through the public listed number of whoever they claim to be.
It makes for good content. The story will go viral, and she'll likely get compensation (and more) with the help of real government authorities or generous donors.
In a just world her phone provider would be liable for the stolen money, along with all the other stolen money as a result of spoofed caller ID.
It is absolutely batshit insane that this is still an issue. Fucking fix it. Yes I am aware of STIR/SHAKEN, it should have been completed 20 years ago.
Her son, husband were brought into the mix so I see how anyone could have fallen for this scam.
We all seem smart until we’re unreasonable. I don’t expect I’m stupid, but if someone threatens my kid, I probably get real dumb.
But if I don’t have cash, I don’t have cash. So the solution is to have failsafes so if we start getting cash to put into a box, someone questions us and convinces us that handing $50k into the window of a car driving by is a bad idea.
This person is brave for writing about how stupid they are.
Which has its own set of problems. Various mechanisms to hold and transfer large amounts of cash largely anonymously have already largely gone by the wayside (e.g. bearer bonds). Read some spy or financial novels for a few decades ago sometime.
Second, they transferred her to an investigator with the FTC? Then they transferred her to someone with the CIA? Then that CIA agent said, "Withdraw 50,000 in cash, put it in a shoe box, and put it in a car that pulls up in front of your house."???
I know we aren't supposed to blame the victim, but Charlotte Cowles has no business being a "financial advice columnist".
All this ego-stroking(this would never happen to me, this is all her fault for being stupid and naïve) is frankly just asinine and immature. Hell, if you really think that, you're probably a prime target. This could happen to anyone.
Instead of victim blaming, which only makes it harder for people to share stories like this, we should be humble and constructive.
> The Day I Put $50,000 in a Shoe Box and Handed It to a Stranger I never thought I was the kind of person to fall for a scam.
JFC, the best kind of Rube, the one who isn't even self aware at all.
My 70 year old parents became suspicious when their bank (lolno) asked them to wire $30K to cover fake legal fees, how do you fall for this shit?
Instead of victim blaming it's important to spread awareness of how this happens in the first place: answering inbound requests: phone, email, social media, etc. Best not to answer cold contacts of any kind.
They knew about number spoofing but ignored it when told. They knew about checking with an attorney, but didn’t do so. So many points at which they could have stopped this and didn’t. They aren’t nearly as sophisticated as they claim in the opening.
Also, in general, you should already have cash stashed away, outside of a bank, in case this or a million other things actually happen. Your assets can be frozen without warning or evidence against you. Going to the bank to withdraw large sums because some guy on the phone claiming to be an authority says so is always stupid.
"The vast majority of people are far less intelligent / sophisticated than their own normal when stressed."
Do you believe yourself to be immune to this sort of behavior?
I disagree - most people would never fall for this obvious scam.
The account reads less like a scam, and more her being bullied and strong armed into handing over money.
I would have eagerly given them my banking information, but I was panicking so badly I accidentally dropped and broke my only phone (this was was long enough ago that it was a landline handset). I eventually got on my neighbor's landline, called the student loan administration... and found out my loans were up to date, and I'd been the target, and nearly the victim, of a scam that would have cleaned out my bank account.
The panic was a key element, and everything about the call from word choice to tone, was designed to encourage it.
But how would that have allowed:
> would have cleaned out my bank account
?
Literally what happened is "Hi it's me the CIA, give us your money."
And she did.
This layered approach is key to the tactic. People are much less resistant to manipulation than they think, as is obvious in the current political craziness.
There are plenty of scams where someone calls unannounced, but the idea that they are going to have willing Enemy of the State style targets with such predictability that they can have people on the ground doing cash pick ups, and also never getting caught, is simply less credible than like any number of alternatives IMO.