There are some – many? – things about which I am a touch head-in-the-clouds, but identity theft is not one of them. I mean, I was the victim of a major hacking just a few years ago. My entire purse was stolen in 2015, and my car was broken into earlier this year, resulting in the theft of all of the personal information I had compiled in anticipation of a trip to the passport office (yes, like all of it).
As a result of these incidents, I am a password ninja, am on a first-name basis with the peeps at Experian, have an FBI agent’s personal number in my contacts list, and pay a truly unconscionable amount of money to Lifelock every month so that my social security number (and my kids’ numbers) don’t get used for any nefarious purposes.
In other words: I am not an idiot about such matters. And yet? I almost just fell victim to a virtual scam again…via a phone call.
I swear to you: The people who run these scams are THAT GOOD. Which is why I’m writing about what just happened, despite the fact that it makes me feel super face-palm-y. I had all my little “is this fake?” alarm bells pinging during the call, and yet the people I was on the phone with were convincing and thorough enough that I stayed on the line for a solid half hour before I finally determined that the call was a scam, and hung up (and called the police, and Lifelock, and my banks and credit cards).
What these people said to me sounds absolutely insane in retrospect – like, hellooooo obvious scam – but that’s the point: It wasn’t what they said, it was how they said it. The really good ones, apparently, know how to give you enough information that they sound legit. They know how to scare you.
Here’s what happened: I had a couple of missed calls from an out-of-state number, so I called back. The recorded operator said that I had reached the social security administration’s litigation department, and that I had received this call because there was pending litigation against the social security card associated with this phone number.
Does this make perfect sense? No. But obviously my curiosity was piqued, and obviously I was going to hit “1” to be connected with the department.
Me, mid-hacking, 2014
Let me emphasize: The recording sounded legit. Calm; official; all the things. When I was transferred to a woman, she also sounded legit. She asked for my case ID, and sounded like she assumed I’d know it. She gave me her full name, her badge number, the aforementioned case ID, and her department location. The fact that she had a heavy Indian accent but went by the name “Christie Brown” gave me pause, but of course that’s not beyond the realm of possibility.
“Officer Brown” read me my three most recent addresses and confirmed that I had resided at them, then confirmed my present address and informed me that there was litigation pending against me in the state of Texas connected to criminal activity associated with my social security number. She asked whether I had ever owned a Toyota Camry – no – and said that one had been found abandoned in San Antonio, Texas, with my name and social security number attached to the documentation, and that the case also involved substantial drug trafficking and money laundering charges.
She said that she had an affidavit in front of her, and asked whether I wanted her to read it. I said not without my lawyer present, thanks, and she said I could have my lawyer call her personally. She then told me that she was obligated by law to inform me that we were on a recorded line and that while she understood that this was likely a case of identity theft, there was a warrant for my arrest in the state of Texas, and local law enforcement would be contacted if I should decline to assist with information. I said that if I were to give any information, it would be in person, after being shown legal documentation. She said that was fine, and that she would set up an appointment for a local officer to visit my home the following day.
Now, a lot of this was obviously weird – from her reading an affidavit over the phone to her offering details about a pending criminal case – but when I blanched and said I’d need to return the call later, she moved onto the part of the scam where she injected a little terror into my heart.
The call was upgraded to a “supervising officer” – a man who also gave me his name, confirmed my case number, and informed me that, pending my interview with local law enforcement, my accounts would be frozen and my social security number would be suspended (whatever that means). He was trying to help me put into place measures to protect my assets should this happen, he explained.
…And then he said that in order to ensure that my funds were protected, I should transfer them into government bonds that the local officer would then “scan,” and I hung up the phone.
So.
Here are the things that these people did “right”:
– Made themselves sound (really) legit. First, remember that I called them back after two missed calls. The recording that I heard when I called the number sounded like every official government line I’ve ever called, and the woman on the other end offered her badge numbers right off the bat (which seemed like an excess of caution, but who knows?). She was able to “pull up” my “account” right away once I gave her my name (which I did willingly, not seeing any reason not to at that point), and gave me my case ID using the phonetic alphabet (Alpha-Bravo-Charlie) for accuracy. I could hear other people talking in the background, and it sounded like any old office space.
– Gave me a substantial amount of information about myself. The woman knew all of my previous addresses – and of course that info could be pulled up with a Google search, but remember: everything up until this point felt reasonably legit. She also asked whether I “may have owned” one of the most popular car models in the U.S. (if I had, which was relatively likely, that would have been just more confirmation for me) and asked whether I “may have banked at” a bunch of national banks (all of the ones she named were ones I had indeed banked at – unsurprising, because they’re the ones everyone banks at).
If there had been a pause to process all this information I would have realized that they didn’t actually know anything about me at all that couldn’t be found in a three-second Google search, but when all this is coming at you rapid-fire, you get flustered. And recall, my personal information was stolen not all that long ago – it seemed within the realm of possibility to me that someone who steals passports and birth certificates might do something nefarious with them.
– Made me feel like they were on my side. They said that they knew it was identity theft, and they were trying to ensure that I was “protected.” They also gave me advice to protect my accounts, such as calling in to request additional security.
– Gave me options. You can facilitate our “investigation,” or you can risk being pulled into a long-term identity theft case with potentially devastating consequences. Your call!
– Changed their approach based on how the conversation was going. In short, they variously played on my anxiety, goodwill, and so forth.
And again, I promise you, these people are good. They didn’t have me so convinced that I handed over any personal information at all – I simply repeated the “I’ll have to speak with my attorney” line, over and over – but had I been someone not particularly well-versed in these matters, or simply a less suspicious person? These people would have potentially gotten much further with me.
A few months back, I had a phone call with the FBI agent who worked on my hacking case because my friend’s mother had been scammed by someone she met online, and she needed some advice. He told me that this is exactly what they do: They cast as wide of a net as possible, and while many people will end up not falling for the scam, some inevitably will. And those who do are often older, less tech-savvy individuals. Which is, not to put to fine a point on it, awful.
Tl;dr: Protect yourself and maintain a healthy amount of skepticism in all things related to your personal information, but also take a moment to pass on this information to those in your life who may be more vulnerable to scams of this nature. I’m living evidence of just how easy it is to get hacked.
