Yesterday I got an email from a friend of mine — I’ll call her Rebecca —asking, “Do you have an Amazon account?” I wrote back saying, “Yes. What do you need?”
Rebecca replied that her Amazon account wasn’t working for some reason, that it was her niece’s birthday, and she wanted to send her a Sephora gift card. She asked if I would do it for her. I said sure.
I logged into my Amazon account and purchased the gift card as Rebecca requested, entering her niece’s email address as the recipient, putting Rebecca’s name in the “From” field, and typing in the birthday greeting she’d asked me to include. I emailed Rebecca back to tell her that her niece should be getting her gift card within five minutes, then left for a five-hour trip with my mother to her summer house in upstate New York.
At a stop along the way I checked my email and found a message from Rebecca telling me that she’d spoken with her niece who said the gift card hadn’t come through yet. There was also an email from Amazon saying they had canceled my gift card order and temporarily disabled my account because they suspected the order was fraudulent and that someone had hacked my Amazon account.
I wanted to yell at Amazon, “No! That was me! That was a legitimate order!” But the customer service number in the email from Amazon didn’t provide the option of talking to a live person, so I began to resign myself to having to let Rebecca know that I was not going to be able to help her with the gift card after all. I wrote back asking her to call me since I was driving and didn’t want to keep pulling over to send and receive emails.
And then it dawned on me that the person with whom I’d been exchanging emails might not have been Rebecca at all, but rather someone who had hacked her account and was pretending to be her. And that was exactly the case.
I’m embarrassed. I used to work in IT and often warned people about email scams and phishing attacks. Now I’d fallen for one myself. But it was interesting to go back though the chain of events after the fact and notice the clues I had overlooked which suggested that all was not as it seemed.
I had tried to call Rebecca as soon as I got her request, not because I was suspicious but because I thought it would be easier to collaborate on the phone. But the number I had for her had been disconnected. My wife, who knows Rebecca better than I do, reminded me that she’d recently moved and had a new number, but my wife didn’t know what it was. So in the next email I sent to “Rebecca,” I asked her to send me her new number. Not surprisingly (in retrospect), her reply didn’t include one. That should have been a clue, but it didn’t raise a flag for me because I’ve often had someone overlook a request I’ve made in an email when their attention was on something else.
Another clue was the fact that “Rebecca” wanted the value of the gift card to be $200. That’s the maximum Amazon allows, I discovered, and a lot more than I’ve given my niece for her birthday.
Yet another clue was the message “Rebecca” asked me to include: “Happy birthday niece!” She calls her niece “niece,” I might have asked? And of course the final clue was that Amazon’s fraud detection software blocked my purchase.
None of those clues registered until they did. It was like a vending machine into which you drop one coin after another until they add up to the full purchase price, at which point they all fall at once and your candy bar pops out.
If I’d had even the slightest inkling previously that something was amiss, I could have called another friend of Rebecca’s who I knew would have her new number so that I could speak to Rebecca directly. That’s what I actually did, but only after it finally dawned on me that this was probably all a scam. As soon as I reached Rebecca’s friend, she told me that everyone Rebecca knows had gotten emails like the one I got and that they’d been calling Rebecca all morning asking her what was going on. (I still don’t know if anyone else was duped into actually placing an order with Amazon.)
In short, the folks who program Amazon’s fraud detection system saved me $200 today, so I’m a little wiser but, luckily, not poorer.