A Cautionary Tale about Scams

A Cautionary Tale about Scams: a reader relates:

My question is what can I do about this to help: My daughter is a college-educated professional woman living in NYC. She’s savvy about using technology and uses an iPhone. Unfortunately, she fell victim to a scam while at an airport waiting to board a plane. She received a phone call from “Bank of America” saying that someone was trying to access her account and steal money. They advised her to transfer her money into a crypto account to protect it, and that they would send US Marshalls to her home to help protect her. They had enough information to scare her and were able to convince her to transfer a large sum of money just before she boarded the flight. Upon arriving home, she was worried that someone would show up at her apartment and so she’s temporarily moved in with a friend. She’s afraid to turn on her iPhone thinking it got hacked because she was using the airport Wi-fi. Do you think her iPhone got hacked and what should she do now?

This is a cautionary tale for people of all generations, young to old. The short answers to your questions are:

1. What can she do: Not much, report the crime and be much more wary in the future.
2. What can you do: Help her learn about the many scams that are out there to help her protect herself.
3. Was her iPhone hacked: Highly unlikely. More likely the scammer simply gleaned information off the internet about her, and/or overheard her using her iPhone at the airport, or looked over her shoulder at the iPhone screen. Actual iPhone hacking is not a trivial affair, and certainly not something that can happen just by using public Wi-fi.

She should immediately report the crime (yes, it is a crime) to the authorities, but almost certainly her money is gone forever. She should visit https://consumer.ftc.gov/. Halfway down the page is “How to Avoid Cryptocurrency Scams, and at the bottom of the page is this list under How to Report Cryptocurrency Scams: Report Fraud and Other Suspicious Activity Involving Cryptocurrency to:

• the FTC at ReportFraud.ftc.gov
• the Commodity Futures Trading Commission (CFTC) at CFTC.gov/complaint
• the U.S. Securities and Exchange Commission (SEC) at sec.gov/tcr
• the Internet Crime Complaint Center (IC3) at ic3.gov/Home/FileComplaint
• the cryptocurrency exchange company you used to send the money

The only good news is that almost certainly her iPhone was not hacked, she need not worry about someone showing up at her apartment, and she is only out money (which is horrible, but replaceable). This was a successful scam – the scammer had some snippets of information about her, enough to scare her into doing something that she would otherwise not do. Fear does have a tendency to paralyze us and the scammers use psychology to manipulate us. Hopefully, she will learn this tough lesson and not fall victim to future scam attempts.

Using public Wi-fi has some risks, but more likely someone nearby at the airport was either listening to her conversations on the iPhone, was looking over her shoulder at her iPhone screen, or that it was just a random scam call that happened to be while she was at the airport. It’s fairly easy for a scammer to find out things about you from social media, from the dark web, or from casual observance, even at a distance. Her iPhone screen may have shown a Bank of America app icon, she might have been talking to a friend about coming home to NYC or posted that on social media (as well as her traveling status), and her iPhone number is easily obtainable from many sources. That’s all a scammer needs to mount an attack like what she experienced.

Age doesn’t matter, smart or not, any walk of life – we are all susceptible to well-publicized psychological triggers that scammers use to perpetrate their crimes. This wasn’t the case, but for money transfers from a US bank to another US bank, there are regulations that would allow her to reverse the financial transaction. Transfers to foreign banks and cryptocurrencies have no such protections – that’s why scammers prefer them.

What you can do is reassure her that she is safe: tell her that her iPhone is safe, and she should take this lesson to heart and adopt a very wary approach to all incoming communications going forward. NB: A legitimate financial institution is never going to contact you and ask you to transfer funds. The FTC site specifically notes:

Scammers impersonate well-known companies. These come in waves, and scammers might say they’re from Amazon, Microsoft, FedEx, your bank, or many others. They’ll text, call, email, or send messages on social media — or maybe put a pop-up alert on your computer. They might say there’s fraud on your account, or your money is at risk — and to fix it, you need to buy crypto and send it to them. But that’s a scam. If you click the link in any message, answer the call, or call back the number on the pop-up, you’ll be connected to a scammer.

Out of an abundance of caution, your daughter (heck, everyone) should also:

1. Use a good password manager to keep her passwords strong and unique across her digital life.
2. Change her critical passwords – her email account, her bank and credit card accounts, and her online shopping accounts. Make sure each of those are unique passwords and strong (e.g., long, at least 15 random characters).
3. Consider a credit monitoring service, such as from Equifax, Experian or TransUnion, and be sure to turn on both fraud monitoring and credit lock services.

The above is gleaned from my article Safe Digital Life, which might be worth a read for your daughter.