I was doing something important when the texts started coming in.
Texts like this:
Here’s your verification code to login. Don’t give it to anyone else. If you didn’t request this code call us.
Ever gotten one of those?
Right. They were from my credit card company. But I wasn’t trying to login. I was doing important stuff. I stared at the text, annoyed — and then another one came in.
Ding! Lookit, Loookit, LOOOKIT!
Same message, different code.
Our credit cards whiz around a leaky internet; fraud happens constantly. It’s happened to me; I bet it’s happened to you.
So I stopped doing important stuff and called the number.
After 30 minutes on hold (credit card fraud still requires real people) I got a guy who asked me to confirm who I was — DoB, SSN, Address. Some combo of that. I did the drill.
How many times have you done the drill?
He asked me for my phone number. I paused. This was getting circular. I’d already proven my identity.
“Don’t you have my phone number on record?”
“Yes, but we need you to tell us for security”
So I told him, but that was my first oh shit moment. This guy was just milking me for every bit of personal info I was stupid enough to divulge.
The line went quiet. While I expected him to come back asking for my high school mascot, the street I grew up on and where I had my first kiss, instead he said he cancelled my cards.
Ok great. I guess. But when I asked him when I’d get new cards, he hung up.
Second oh shit moment.
I put down my phone and looked up the 888 number. Soon I was looking through a bunch of credit card scam forums on Reddit.
Third oh shit moment.
I figured not only had someone stolen my credit card, but I had just given them all my personal information, weaponizing them to wreak more havoc on my world.
I flipped the credit card over and did what I should have done in the first place — called the number printed on the back.
Another 30 minutes on hold. This second 30 minutes felt longer. What important thing had I been doing?
I got my human and I told him my sad story. He looked at the charges, confirmed them with me and then said Jeff had cancelled my card. Jeff? That was the name the first guy gave me.
A wave of relief washed over me. Jeff had been legit. He’d even expedited our new cards. Jeff just shouldn’t be on frontline phone duty.
Here’s the kicker. JFran has a card too, right? But she was on Jury Duty. Unreachable; certainly not shopping.
Incorrect. Shopping.
Apparently Jury Duty is prime time for shopping and she was buying a record player from Best Buy (for her dad).
Two hours of my life. Important things left undone. No credit card. Autopay broken all over the place.
But you know what — it easily could’ve been a scam and I walked right into it.
There are man-in-the-middle attacks to intercept texts. You can spoof the sending number — even the short code numbers reserved for business. 888 numbers are easy to come by. People waiting to answer calls and read a script? We’ve been offshoring contact centers for twenty years.
This is all easy to wire up. And if I’d thought for just a moment I knew it.
But I was doing important stuff.
Here’s another scam, a for real one. Not me, but a tech savvy friend — let’s call him Larry.
Larry was flying to Europe that day. His wife left a week earlier, and her last words to him were:
“Don’t forget to call the airline to get your seat assignments”
Larry forgot. There’s a lot to do when you’re working the grind and flying midweek. He remembered just as he was walking out the door. He searched for Lufthansa and called them. After getting all his info — name, credit card he used to reserve the flight, address, etc. they gave him seat assignments.
Larry got into an Uber headed for the airport. But when he got no confirmation from Lufthansa, he called them again, this time from the number on the ticket sleeve in his hand.
They had no record of seat assignments.
Larry quickly figured it out. He had looked up Luftansa on his phone (not Lufthansa — who can spell that?) and hit a bogus site cloned from the real one but with phone numbers that routed to a shady call center.
He had the Uber driver turn around. He ran around his house sticking everything that looked valuable in a safe and telling his neighbors to keep an eye out for randos. Put a hold on his credit card, took a deep breath and got back in the Uber for the airport.1
Larry has a better excuse than me — he literally had a plane to catch. Me, I was just distracted and annoyed.
That important thing I was doing?
Seems that I was busy doing something close to nothing
But different than the day before
Taking a breath avoids both of these scams. In retrospect, both were easy — a trusted phone number was right there.
Common sense checkpoints are getting increasingly fuzzy in an age of AI.
Once my debacle concluded, I changed all my passwords. One site had a security page with a pretty red/yellow/green score of how secure my account was. There was a long list of stuff. I wasn’t fully green, so I clicked on a new security measure called Voice ID.
It creates a ‘voiceprint.’ They gave me a prompt and I rambled on for about a minute until they had a good enough voice sample.
Now, when AI Andrew calls in, maybe they’ll know it’s not me.
Remember that scam targeting parents and grandparents where you got a call and they knew all the details about your kid and they’d let them go if you wired them a bunch of money? My parents got one once for my nephew.
AI adds a new wrinkle — grab a sample of the kid’s voice from social media and have them make the plea themselves. A few months ago, a local mom got a call like this. She heard what sounded like her daughter having a panic attack. She wired thousands to Mexico. The daughter was actually at work and she was fine.
Maybe you heard the $25M Zoom call where everyone was fake. This one went down in Hong Kong. CFO asked to wire a bunch of money. The guy doing the wiring got suspicious but after joining a Zoom with the CFO he did it. The CFO and everyone else on the call were deepfakes.
Every day we navigate a more complex world. As the scams get better, security systems get more complicated.
Increasingly, even what’s legit looks suspect.
Everything was fine. No one stormed his castle. He did get a new credit card.