Modern Love: He Scammed His Way Into My Heart 💔

How to fall for a PayPal phishing scheme, in excruciating detail

THREE NOTES, BEFORE WE GET STARTED:

1. I might try to condense the story that follows into something more *profesh*, maybe even something I submit as a legit, i.e. grander-than-Substack essay (connections? let me know!) but for now I just wanted to let ‘er rip

2. I’m mortified to share this but also think it’s pretty good, and suspect those two things are not unrelated

3. Read this on the site! It will cut off in your inbox

---

Raise your hand if you’ve ever gotten a suspicious looking email, maybe about money you owed, which you immediately deleted. Okay, lot of hands. Now raise your hand if, a little concerned, you read the whole email before concluding it was bullshit, then deleted it. Great.

Okay, last one: raise your hand if you read the email, took it to be totally valid, then went out of your way to help the absolute stranger who’d sent it, embarking on what can only be described as a “Bitcoin scavenger hunt” that results in you losing a significant amount of money and, this cannot be overstated, feeling like a real friggin’ goober.

…Just my hand?

On a Substack in which I usually just talk about movies or TV in an effort to mask any sort of real feeling or experience, today I’ve got my legs wrapped around the back of a folding chair and my hands gently but commandingly ushering you guys to take your own seats around me in the church basement as I tell you a tale that… well, embarrasses the hell out of me, but also feels valuable to share: not just as an entertaining and frankly ZEITGEISTY story, which this very much is, but a therapeutic bloodletting I’m confident I (Henning, the person) need at the end of a pretty frustrating year.

Let me tell you the story of how I got scammed out of $7000.

PayPal? More Like PayBully

It was November 3rd. A Thursday, not that this is an important detail, but the same way I’ll always remember never forget 9/11 taking place on a Tuesday, Thursday is now etched in my brain as Scam Day. Like all good Millennials, my inbox was flooded with daily marketing emails and New York Times roundups I refuse to unsubscribe from but instead just dutifully delete. One of those emails was from PayPal, a service I barely use, informing me of a $789.99 Apple Watch purchase I definitely did not make.

Do you have your magnifying glasses out? I certainly didn’t notice these when I got the email (or this would be a different newsletter today!), but a month later the scamming tells seem… if not obvious, then noticeable:

• The indentations. Why is the Apple Pay logo not lined up with the email address? Why does it jump back after “Seller note to customer”?

• “Hello, ALL CAPS EMAIL ADDRESS” feels both too informal and too aggressive all at once, and appears to have randomly grabbed the comma that should have appeared in Olivia Wilde’s ‘Don’t Worry Darling’

• The last instance of “Paypal” there is missing a second capitalized “P.” The House That Peter Thiel built would NEVER

There’s also this bit which, if I’d read it, would have seemed contradictory enough with the listed phone number to at least make me pause:

Ron Howard voice: “But he didn’t pause.” All I saw at 8:45am was a $789.99 purchase that even at my drunkest I would never have made, and what looked like an easy enough charge to dispute. So I called the 888 number. And buddy, we were off to the races.

A man with a South Asian¹ accent picked up and I explained the issue at hand. We talked for a few minutes before he told me purchase disputes were actually above his pay-grade (this, in hindsight, should have been my first red flag²) and he connected me with his manager, David Hay.

Also speaking with a South Asian accent, David apologized for the mishap and told me the whole issue was easily resolved with the aid of a downloadable remote desktop application called AnyDesk³. And then--

---

A QUICK ASIDE: Guys, I hate this too! I wish I could tell you I’m making this up, another tall tale like the woman I made up for a fake AirBnB review, but no — this is all me, all stupidity. Red flags? I’m wearing rose-colored glasses, man; they just look like normal flags⁴. Every time you’re thinking “is this for real?” the answer is “yes, and it’s going to keep getting worse.” Buckle up!

---

Suffice it to say “remote desktop application” does exactly what it says on the box, but again — in my mind, I’m talking to an official PayPal employee. Whatever unease inherent to granting a total stranger access to your desktop was mitigated by unassuming trust. I trusted David, or anyway the company David worked for, and… did not think twice about logging into my Bank of America account⁵, and showing off all the pretty numbers therein.

I'm genuinely not smart enough to understand whether this next part was just smoke and mirrors or a technical cornerstone of the whole operation, but David got me to open another (native) Mac app called Terminal -- a command line interface used to do… backstage computer stuff⁶ -- into which he had me input my name (Henning Fog), zip code (900nice try), and amount owed ($789.99). How easy! I was about to get my money back, which of course had never been taken in the first place, and move on with the rest of my day.

But after entering the correct dollar amount, I noticed David’s remote cursor adding another "9," bringing the new total to $7899.99 — right before I clicked. Sure enough, moments later I saw this deposit reflected in my bank account. Had I accidentally just… stolen $7110 from PayPal? WHAT A TWIST.

It’s called phishing because they get you on the emotional hook

Still on the phone with David, I told him what had happened and figured okay, it’ll be just as easy withdrawing money from the account as it was depositing. But he began to audibly panic, explaining that not only could he lose his PayPal job for this⁷, but I could suffer legal repercussions⁸. He knew it wasn’t theft. But would PayPal executives higher up than David Hay know that? Still calm, almost astonishingly calm for me, I told him none of this seemed like a big deal, just a technical snafu, and if he just walked me through it I’d return the money to PayPal. Obviously. It’s very possible I even told him I “wasn’t trying to scam anyone,” at which point he would have had to mute himself, lest his GUFFAWS give the whole thing away.

From what I remember, this is when David began to really lay it on thick. He told me I was a good person⁹, a rarity in his experience dealing with PayPal invoice disputes. A few weeks ago, actually, this same thing happened with a co-worker of his, the same kind of transactional hiccup. Only there — the customer took the money. Split. His buddy was summarily terminated. And then he killed himself.

The face I should have made

The face I did make

So I haven’t studied scamming at the university level, can’t break it into its component “stages” the way I can tell you in magic there’s the pledge, then the turn, and then the prestige. But scam-ee that I now am, and reflecting on the events of this day like they happened to someone else entirely, it seems clear to me this was a make or break moment for David (and Co., I can only assume). The $7899.99 — that was technically in my account! With a few changed passwords, and a sharper sense of what was going on, I could have easily walked away with their phishing money. That was theirs to lose, at this point. But having done this to enough people, presumably, and learning to predict those people’s behavior, they made a calculated bet on my emotions. On how a person like me might respond to the situation at hand, as I perceived it. And all I can tell you is… the suicide story genuinely impacted me. I told David how incredibly sorry I was for his loss, that there was no way he was getting fired today, that I’d do whatever he needed to remedy the situation. David once again told me how grateful he was to be speaking to me. He phished my ass hook, line, and s(t)inker.

Enter: Crypto (of course)

A few words on crypto first, to make sure we’re using the terminology right: crypto is fucking bullshit, the absolute sandiest house of sand, and not only should anyone manipulating OR shilling it be sent to fucking jail (I include celebrity endorsers in this), I have no sympathy for anyone who’s lost money on the crypto market. You knew it was a snake when you picked it up.¹⁰

Glad we covered that! David explained how, given PayPal’s complicated architecture (🥸), the easiest way for me to return the extra $7110 was via crypto. Reader, this WAS a red flag for me, or at least a dull auburn flag, and I told him it made me feel a little¹¹ uneasy. But David had an answer to that, showing me on the PayPal website that this was definitely a service they offered, and explaining that re-transferring the funds this way provided him some measure of cover with his bosses. Or something. Again, I didn’t want the guy to get fired and kill himself!

But how to, you know, get the crypto to PayPal? Don’t you first have to convert cold, hard USD into BitCoin, or another decentralized digital currency? Usually in person? Uh-huh! And thus began, now 45 minutes into my phone conversation with David Hay, the physical challenge portion of the morning. I was going to drive to the nearest Bank of America, withdraw the funds, and convert them to BitCoin at what are apparently a great number of BitCoin ATMs scattered all over Los Angeles, and presumably most metropolitan areas. I’d send these new funds to a QR code David had provided, that I (incorrectly, it goes without saying, always incorrectly) assumed belonged to PayPal.

---

ANOTHER ASIDE: Would a PayPal employee tell me to Google “BitCoin ATMs near me”? Would PayPal assure me the Better Business Bureau was monitoring the call and, therefore, I had nothing to worry about? Would PayPal regularly fire its employees over simple clerical errors? Would PayPal deputize those same employees to offer “rewards” to customers involved in those clerical errors? Rewards of casually tossed off values, like $110, which then reduced the amount I owed them — and would withdraw from Bank of America — to a clean, less specific $7000? (HENNING.) All questions I would ask myself several hours later but not, of course, when I actually needed to.

---

As I headed for the Silver Lake BoA, conveniently just opening, David and I kept talking. By now I felt a certain comfort with the guy, who seemed less like a customer service rep and more… someone I was cosmically connected to? He told me, again, how grateful he was for this kindness I was showing. He offered me “blessings” that would “be with me on Judgment Day in Heaven.” “Listen, David, I could use all the help I could get!” I’m fairly confident I said. The fact that he laughed at this groaner should have told me everything I needed to know.

The hits don’t stop there! At some point in the 3 miles between my apartment and the bank, David told me his wife and unborn child died of COVID-19 two years ago. “Jesus,” I thought, “no one has suffered like David hay.” For the sake of my writerly reputation, I wish I’d correctly identified this moment as a little on the nose. But I just listened, heartbroken, believing every inch of his world-shattering story. In the two years since they died, he’d relocated to Santa Barbara (the personal # checked out), gotten two dogs, Rose and Barky, who I swear I heard in the background. He drinks Jack Daniels and struggles to go to the beach, because it reminds him of his wife. “That makes sense,” I told him. “I’m really sorry to bring up any painful memories.” If I had any real concerns at this point, and I’m not sure I did, they were far outweighed by whatever relationship I felt David and I had developed. I would have done anything to help the guy.

Me and David

(The phone call keeps going, by the way. For two and a half hours. In hindsight, this is basically the plot of ‘Die Hard with a Vengeance’ or an overlong ‘Scream’ opener; at the time, and I’m going to keep saying this, it just made sense.)

“GIMME ALL [MY] MONEY!”

Another crucial bit to this whole phishing operation — which, again, I realized almost precisely the moment it could no longer be of any conceivable help to me — is how the money changes hands. Technically, legally… David didn’t do it. I did. I withdrew $7000 from my own bank account, for all intents and purposes of my own volition. I converted that money to BitCoin. And I decided what BitCoin wallet¹² to put it in. As T. Swift said,

(This is not me victim-blaming — victim-blaming MYSELF at that — just pointing out how Bank of America is forced to see it. When I told them everything that afternoon, Kyle from Bangor, ME told me they get this exact scam “all the time.”¹³ Cool!)

I think now might be the right time, 8500 words in, to tell you this wasn’t my first scamming of 2022. In late March, my Instagram got hacked when a friend I don’t regularly chat with told me she was opening an online athleisure store (this checked out, I guess?) and needed my help spreading the word (okay), I just needed to send her a screengrab of some link on my phone (sure) and then— weird, I’m locked out of my account. It will not shock you to learn this scam was ALSO crypto-related.

Ultimately this one was just a two week annoyance. Friends who work at Facebook/Meta quickly connected me to the correct, largely hidden from public view (this is a story/gripe for another day) help channels; I got my account back. And what was the scam, anyway? Pretend to be me and try to rope my Instagram friends into some lazy crypto buy-in? I have less than a thousand friends (brag!) and more significantly a hyper-niche social media presence. I make snack review videos that double as an ongoing soap opera and post annotations from Sally Rooney books. @funkyfigurefit_ was going to need to take Henning lessons — which I would have happily offered — if they wanted to make any money off my identity.

Thank you, friends, for seeing me

I bring this all up because… well, for starters, I do find it funny, and I thought you would, too. But it was also very much on my mind as I followed David’s “Simon Says” routine all over East LA. By now the morning’s initial GO GO GO energy had given way to me just… driving around, trying to find one of those BitCoin ATMs I mentioned earlier. I’m still on the line with David, who has now actually invited me to come up to Santa Barbara that weekend because, wouldn’t you know it, it was his dead wife’s birthday¹⁴ and he wanted to mark the occasion.

I was starting to feel weird! (“You were STARTING to feel weird?!?” -everyone) But every time my rational brain allowed for the possibility that something, who could say what, wasn’t adding up, the emotional one piped in with a “Hendog, what if this is all legit? What if, weirdness aside… this is a story about trust? You got scammed in March, and lost some faith in people; today you get that faith back.” I won’t lie: I was already imagining the Substack I’d write about it. Title: “A Tale of Two Scammings.” The mental gymnastics I’m capable of are truly Olympic level.

One Bill At A Time

Flush with $7000 cash — aka seventy hundos, aka a fat stack — and having finally found a real BitCoin ATM at a 76 gas station after several false starts (if you’re looking for the one at a place called USA Smoke & Vape on Vermont Ave. near the Fatburger, it’s not there!), I began the process of converting USD to cryptocurrency. Desmond Tutu once said there is only “one way to eat an elephant: a bite at a time.” The same is true of crypto scamming. Bill by bill, I inserted all of the money I’d withdrawn. Another hundred. Another hundred.

In truly poetic fashion, this took a while. One of the bills was even creased, and wouldn’t go through. I saved that one for last. What a relief when it was finally accepted!

(Fun Fact: did you know BitCoin ATMs, at least this one, are forced to display a scam warning at the start of the transaction? It’s like the Surgeon General’s warning on a pack of cigarettes. And just like I would right before lighting up another smooth, smooth Camel Light that I smoked for all of two months my senior year of college… I ignored it.)

So yeah, I converted $7000 of my own, real money into digital currency which I then uploaded into David’s account, easy to do with the QR code he’d sent me earlier. What a day! I stayed on the phone with him, by now largely silent, driving back home. I think he asked if I “liked to party?” (presumably something we were going to do on Sunday in Santa Barbara, after eulogizing his late wife) but I don’t really remember. By this point I think my body had accepted something profoundly shitty had just happened, or was still happening, even when my brain was fighting it.

What was left to do? Wait, David told me, as he and the PayPal team worked to secure the account that had been compromised earlier that morning. Oh right, PayPal! I’d almost forgotten how this whole ride even got started. This made sense, I assured him, and I really appreciated the steps they were taking to make things right.

……………

I think just sitting with it all for two hours, back home, finally cracked something in my ultra-thick skull and the NYT Needle began to point toward a 90% likely scam. David had told me not to check my bank account or PayPal account yet — the cyber-maintenance PayPal was doing was obviously super-delicate! — but embracing something like abstract thought for the first time all day, I ignored my good friend and logged onto BoA anyway. One thing was immediately obvious, that my checking account suddenly had more money and my savings account less. And the second thing, truly Dumb Keyser Soze when it finally hit, was that totaling both accounts and then subtracting from the total I’d started the day with resulted in a clean loss of — you guessed it! — $7000.

I called David and patiently (why?) told him that, you know, this was all really looking like a scam to me along with some version of “I’m not mad, I’m just disappointed.” But David, as enthusiastic and masterful a practitioner of his craft as anyone I’ve ever met, didn’t give an inch. He tried to explain that the account discrepancy was another PayPal snafu, he was sorry, they were figuring it out. “David, there’s no way PayPal would still be in business if something as simple as a claims adjustment feels like a game of fucking whack-a-mole,” I said, or wanted to say. He told me that if I just launched AnyDesk one more time, they could probably — no, definitely — get everything squared away. THE BALLS ON DAVID HAY OF SANTA BARBARA, CALIFORNIA.

I hung up. I visited and contacted all the banks and law enforcement agencies I needed to. I wrote the FBI a much shorter version of this story, with the sign-off “thank you for reading this thorough diary entry of an FBI complaint.” I enjoyed a whiskey cocktail in Mrs. Hay’s honor. I closed my eyes and, in my mind, committed murder.

🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩🚩

It’s a month later, and the dominant feeling for me remains embarrassment. I read the story above and I think… how did the protagonist miss so many very distinct, very bright red flags? How does a guy like that, pushing fucking 40, survive?

It almost makes me wish I were one of these TikTok teens claiming dissociative identity disorder. That wasn’t me! It was my alter, Walter (he’s into wordplay). But nope — it’s all me. I very much know that guy, because I’ve been him forever: emotional, reactive, and a sucker for story (however “hat on a hat” David’s was), including this one I’m telling you right now. Am I an easy mark? Unquestionably, to a degree that concerns me. But then I think, well, this dude’s a sociopath. We were probably always going to find each other.

Phishing is all about emotion management. Most obviously in catfishing, with something as big as LOVE on the line. David preyed on my empathy. This dude had suffered more than anyone else who ever lived, including maybe Job from the bible! I wouldn’t have gone to the lengths I did if I didn't think he needed my help, that his job wasn't in jeopardy, and that the possibility of DEATH didn't exist on the other end.

Even now, I find myself wondering about the tragic death of his wife and child. The intellectual part of my brain knows neither of them was ever real, just David’s boldest play to hook my sympathies (and a lazy one at that!). But the emotional part of my brain wonders… I mean, what if? Hendog, maybe that part’s real and you’ve been shitting on his very real dead wife, and you should put yourself in the shoes of someone losing the love of their life to COVID, that could make a scammer out of anybody. Of course you’d become the Joker because of that.

…That’s the extent to which this clown got to me!

David’s superpower, at least working with yours truly (I like to think of it as a collab), was appealing to some deep desire for connection in an increasingly cold world. However indefinable, you can just feel it: in our entertainment habits, far less social than ever before; in our social media consumption, which we know is turning us into monsters. In our political polarization. In, like, AI art. It all just feels less human. For me, personally, the idea I was part of some great — nay, beautiful — testament to the power of human connection… I never stood a fucking chance.

This portrait is called “Lamb 2 tha Slaughter”

Here’s one last thing I’m not sure I’ve explicitly said about David, but that seems meaningful as I tie a bow on this story. Mind you, I’m aware (now!) that he was never an employee of PayPal, was never trying to repair my account, was in fact actively trying to harm me for the duration of our time together. But in the guise of “David Hay from Santa Barbara”… he was maybe the most attentive customer service rep I’ve ever spoken to. He listened! He was human. He made me feel, in what’s almost always a mechanized, unfeeling setting, seen.

A few days after my adventure with David, and already long past giving up hope that I’d ever get my money back, I received this email from Bank of America:

Reader… it couldn’t be anything less than a 10.

1. Which I bring up in an effort to paint a full picture, not assign nationalistic blame! Scamming is an international sport, bigger at this point than soccer

2. my first phone red flag. Obviously there were already at least three email red flags before this

3. I’m just gonna start counting the flags. This is 🚩 #5!

4. don’t applaud this line, it’s lifted directly from a season two episode of ‘BoJack Horseman’

5. 🚩 #6

6. …anal?

7. 🚩 #8

8. 🚩 #9

9. 🚩 #10 (okay, I’m stopping, the final tally is going to make me too sad)

10. This line stolen from a late season three episode of ‘You’re the Worst’

11. just a little

12. all the Disruption™️ in Silicon Valley and you motherfuckers can’t come up with a new word for “wallet”

13. my friend Sherry got this scam JUST THIS MORNING

14. Sunday the 6th of November! Mark it down for next year, we’re all going to Santa Barbara and toasting her memory with Jack Daniels