This morning my friend Judy’s email account was hacked (I’ve changed her name here). Someone claiming to be Judy—a friend I haven’t seen or spoken to in a few years—sent a mass email of utter distress, saying she was in London on vacation, about to head home, when she was mugged outside her hotel. All of her credit cards and money were stolen, and she was “freaked out” and needed help settling her hotel bills because she had a plane to catch in six hours. It was a plausible email—this coming from me, who has Snopes.com in my bookmarks and who routinely wags my finger at others who fall for similar hoaxes.I think it was the sign off—”I’m freaked out at the moment”—with no punctuation, completely guileless, that took me in initially.And six hours: not three, not two… six. Enough time so that urgency could be felt, without being so rushed that I had to drop everything or throw up my hands in helplessness. Six hours. It shaves the hard edge off the direness, makes the story more plausible, makes the knife go in easier. What a great detail.
I wrote back. How horrible! Are you okay? Where are you staying? Do you have access to a phone? Can you call me, or can I call you at the hotel? If I was the only one responding, I wanted to be sure I could reach her and help. Obviously wasn’t going to do anything rash, like sending a wire transfer to London without further detail. When “Judy” wrote back, she thanked me for the quick reply.
Thanks for your quick response I still need help, I have nothing left on me right now and I am lucky to have my life and passports with me it would have been worst if they had made away with me passports. Well all I need now is just $1,900 you can have it wired to my name via Western Union i’ll have to show my passport as ID to pick it up here and i promise to pay you back as soon as I get back home. Here’s my info below
Name: Judy Bleeker
State: London W10 4AH,
Country: United Kingdom
As soon as it has been done, kindly get back to me with the confirmation number. Let me know if you are heading to the WU outlet now???
Well then. That’s all the proof I need that this is not my friend Judy but a criminal on a phishing spree. Bad enough to get emails from people in Nigeria claiming to need ten thousand dollars wired to an account; this person has actually stolen someone’s identity and preying on the trust and concern of her friends.
I wrote back, telling this person that in order for me to send any money, I just needed to confirm that this was in fact my friend Judy. Are there any details you can provide proving that you are who you say you are? I mean, even if she had written the name of the company we both worked for, that would have been enough for me to be legitimately concerned. Instead, I got another email, lacking any details, in which Judy’s English slips:
Hello thanks for your quick response i will like to ask if you got the information which i sent to you for the transfer, like i told you in my last email everything i have with me was collected, and again even all the line to the room where i am in this hotel has been disconnected and i was told i will not be allowed to live the hotel until there bills is been sort please i will be so happy if there is anything you can do to help me out if you can send the money directly by western union to the information which i sent to thanks and i will hope to read from you soon.
OK, this DEFINITELY isn’t Judy. Not only have my suspicions been confirmed, but this person is virtually abandoning pretense and just asking for money. I called Western Union to alert them. They had me forward them the thread of the emails. But they weren’t going to do anything about it, and I had no way of reaching Judy quickly. It’s been a few years since we’ve spoken, I don’t have her phone number, and though I tried friending her on Facebook and sending her an alert. I have no idea when she’ll get the message. I tried emailing a fellow former coworker, but still no immediate response.
I was furious at this thief. Identity theft has happened to me before—someone once stole my social security number and used it to perpetrate tax fraud, and the person was never caught. I was also mugged before. I can’t tell you which is worse. I wanted to catch this guy. And yes, I’m assuming the suspect is male.
I remember an episode of “This American Life” from not too long ago, in which a group of people—were they federal agents? local law enforcement? vigilantes?—engaged some of these Nigerian scam artists in a game of cat and mouse. In fact, I believe that was the name of the segment. They took these criminals on a wild goose chase, and eventually trapped them in a net that was very similar to the one laid out by the thieves. What schadenfreude! What sublime vengeance!
I wrote back to not-Judy: money is on its way. Where are you staying?
Home Home’s Hotel London
This is too easy. I googled the hotel and found a small property on Mewesbury Street in South Kensington. I don’t know why this guy would give me the name of a real place, unless he was stupid (likely) or trying to give me a false lead. I don’t think he was that smart. I looked up Western Union near the hotel, and found one just a couple Tube stops away, near Hammersmith. I went to their website: they were closed.
That gave me an idea.
I wrote back to not-Judy: Transfer complete. Go to WU at Galena Road, off King St. Your confirmation number is 23VWPSO.
I wondered if this guy was on a mobile smart phone. I figured it’d take about ten minutes walking, plus five minutes on the Tube, plus however long it took him to get to the station at South Kensington or Gloucester Road or wherever he was. So if he was mobile, he’d email back in 20-30 minutes. Double that time if he was on a home computer or internet cafe and needed to make the round-trip before checking back in with me. In any event, I sent Judy a notice on Facebook not to respond or send any emails on that hacked account. Rest assured, this puppy was mine. Honestly I can’t believe how easy this is. The whole thing is surreal. I’m about to catch a real criminal!
About half an hour later I got another message:
WU is closed, if you please where is nearest other office?
So: smart phone, dumb crook. I went back to the google map and conducted one more search. Within a minute, I wrote back: Sorry, here is one that is open: go back to Hammersmith Stn. Go to 226 Shepherds Bush Road. I have called and they are open and will be expecting you, Judy.
I didn’t get a response, but I didn’t expect one at that point. Not-Judy had what he needed. Now all I had to do was put the finishing touch on it. I went back to the Google Map for 226 Shepherds Bush Road, clicked on the little red flag pin. The detailed info came up, with the website and phone number. I dialed using Skype. Might as well save my pennies…
“Metropolitan police, Hammersmith, how may I direct your call?”
“I’d like to report an identity theft,” I said. My heart was pounding. “The thief will be arriving at your station shortly.”