Modern Love: He Scammed His Way Into My Heart š
How to fall for a PayPal phishing scheme, in excruciating detail
THREE NOTES, BEFORE WE GET STARTED:
I might try to condense the story that follows into something more *profesh*, maybe even something I submit as a legit, i.e. grander-than-Substack essay (connections? let me know!) but for now I just wanted to let āer rip
Iām mortified to share this but also think itās pretty good, and suspect those two things are not unrelated
Read this on the site! It will cut off in your inbox
Raise your hand if youāve ever gotten a suspicious looking email, maybe about money you owed, which you immediately deleted. Okay, lot of hands. Now raise your hand if, a little concerned, you read the whole email before concluding it was bullshit, then deleted it. Great.
Okay, last one: raise your hand if you read the email, took it to be totally valid, then went out of your way to help the absolute stranger whoād sent it, embarking on what can only be described as a āBitcoin scavenger huntā that results in you losing a significant amount of money and, this cannot be overstated, feeling like a real frigginā goober.
ā¦Just my hand?
On a Substack in which I usually just talk about movies or TV in an effort to mask any sort of real feeling or experience, today Iāve got my legs wrapped around the back of a folding chair and my hands gently but commandingly ushering you guys to take your own seats around me in the church basement as I tell you a tale thatā¦ well, embarrasses the hell out of me, but also feels valuable to share: not just as an entertaining and frankly ZEITGEISTY story, which this very much is, but a therapeutic bloodletting Iām confident I (Henning, the person) need at the end of a pretty frustrating year.
Let me tell you the story of how I got scammed out of $7000.
PayPal? More Like PayBully
It was November 3rd. A Thursday, not that this is an important detail, but the same way Iāll always remember never forget 9/11 taking place on a Tuesday, Thursday is now etched in my brain as Scam Day. Like all good Millennials, my inbox was flooded with daily marketing emails and New York Times roundups I refuse to unsubscribe from but instead just dutifully delete. One of those emails was from PayPal, a service I barely use, informing me of a $789.99 Apple Watch purchase I definitely did not make.
Do you have your magnifying glasses out? I certainly didnāt notice these when I got the email (or this would be a different newsletter today!), but a month later the scamming tells seemā¦ if not obvious, then noticeable:
The indentations. Why is the Apple Pay logo not lined up with the email address? Why does it jump back after āSeller note to customerā?
āHello, ALL CAPS EMAIL ADDRESSā feels both too informal and too aggressive all at once, and appears to have randomly grabbed the comma that should have appeared in Olivia Wildeās āDonāt Worry Darlingā
The last instance of āPaypalā there is missing a second capitalized āP.ā The House That Peter Thiel built would NEVER
Thereās also this bit which, if Iād read it, would have seemed contradictory enough with the listed phone number to at least make me pause:
Ron Howard voice: āBut he didnāt pause.ā All I saw at 8:45am was a $789.99 purchase that even at my drunkest I would never have made, and what looked like an easy enough charge to dispute. So I called the 888 number. And buddy, we were off to the races.
A man with a South Asian1 accent picked up and I explained the issue at hand. We talked for a few minutes before he told me purchase disputes were actually above his pay-grade (this, in hindsight, should have been my first red flag2) and he connected me with his manager, David Hay.
Also speaking with a South Asian accent, David apologized for the mishap and told me the whole issue was easily resolved with the aid of a downloadable remote desktop application called AnyDesk3. And then--
A QUICK ASIDE: Guys, I hate this too! I wish I could tell you Iām making this up, another tall tale like the woman I made up for a fake AirBnB review, but no ā this is all me, all stupidity. Red flags? Iām wearing rose-colored glasses, man; they just look like normal flags4. Every time youāre thinking āis this for real?ā the answer is āyes, and itās going to keep getting worse.ā Buckle up!
Suffice it to say āremote desktop applicationā does exactly what it says on the box, but again ā in my mind, Iām talking to an official PayPal employee. Whatever unease inherent to granting a total stranger access to your desktop was mitigated by unassuming trust. I trusted David, or anyway the company David worked for, andā¦ did not think twice about logging into my Bank of America account5, and showing off all the pretty numbers therein.
I'm genuinely not smart enough to understand whether this next part was just smoke and mirrors or a technical cornerstone of the whole operation, but David got me to open another (native) Mac app called Terminal -- a command line interface used to doā¦ backstage computer stuff6 -- into which he had me input my name (Henning Fog), zip code (900nice try), and amount owed ($789.99). How easy! I was about to get my money back, which of course had never been taken in the first place, and move on with the rest of my day.
But after entering the correct dollar amount, I noticed Davidās remote cursor adding another "9," bringing the new total to $7899.99 ā right before I clicked. Sure enough, moments later I saw this deposit reflected in my bank account. Had I accidentally justā¦ stolen $7110 from PayPal? WHAT A TWIST.
Itās called phishing because they get you on the emotional hook
Still on the phone with David, I told him what had happened and figured okay, itāll be just as easy withdrawing money from the account as it was depositing. But he began to audibly panic, explaining that not only could he lose his PayPal job for this7, but I could suffer legal repercussions8. He knew it wasnāt theft. But would PayPal executives higher up than David Hay know that? Still calm, almost astonishingly calm for me, I told him none of this seemed like a big deal, just a technical snafu, and if he just walked me through it Iād return the money to PayPal. Obviously. Itās very possible I even told him I āwasnāt trying to scam anyone,ā at which point he would have had to mute himself, lest his GUFFAWS give the whole thing away.
From what I remember, this is when David began to really lay it on thick. He told me I was a good person9, a rarity in his experience dealing with PayPal invoice disputes. A few weeks ago, actually, this same thing happened with a co-worker of his, the same kind of transactional hiccup. Only there ā the customer took the money. Split. His buddy was summarily terminated. And then he killed himself.
So I havenāt studied scamming at the university level, canāt break it into its component āstagesā the way I can tell you in magic thereās the pledge, then the turn, and then the prestige. But scam-ee that I now am, and reflecting on the events of this day like they happened to someone else entirely, it seems clear to me this was a make or break moment for David (and Co., I can only assume). The $7899.99 ā that was technically in my account! With a few changed passwords, and a sharper sense of what was going on, I could have easily walked away with their phishing money. That was theirs to lose, at this point. But having done this to enough people, presumably, and learning to predict those peopleās behavior, they made a calculated bet on my emotions. On how a person like me might respond to the situation at hand, as I perceived it. And all I can tell you isā¦ the suicide story genuinely impacted me. I told David how incredibly sorry I was for his loss, that there was no way he was getting fired today, that Iād do whatever he needed to remedy the situation. David once again told me how grateful he was to be speaking to me. He phished my ass hook, line, and s(t)inker.
Enter: Crypto (of course)
A few words on crypto first, to make sure weāre using the terminology right: crypto is fucking bullshit, the absolute sandiest house of sand, and not only should anyone manipulating OR shilling it be sent to fucking jail (I include celebrity endorsers in this), I have no sympathy for anyone whoās lost money on the crypto market. You knew it was a snake when you picked it up.10
Glad we covered that! David explained how, given PayPalās complicated architecture (š„ø), the easiest way for me to return the extra $7110 was via crypto. Reader, this WAS a red flag for me, or at least a dull auburn flag, and I told him it made me feel a little11 uneasy. But David had an answer to that, showing me on the PayPal website that this was definitely a service they offered, and explaining that re-transferring the funds this way provided him some measure of cover with his bosses. Or something. Again, I didnāt want the guy to get fired and kill himself!
But how to, you know, get the crypto to PayPal? Donāt you first have to convert cold, hard USD into BitCoin, or another decentralized digital currency? Usually in person? Uh-huh! And thus began, now 45 minutes into my phone conversation with David Hay, the physical challenge portion of the morning. I was going to drive to the nearest Bank of America, withdraw the funds, and convert them to BitCoin at what are apparently a great number of BitCoin ATMs scattered all over Los Angeles, and presumably most metropolitan areas. Iād send these new funds to a QR code David had provided, that I (incorrectly, it goes without saying, always incorrectly) assumed belonged to PayPal.
ANOTHER ASIDE: Would a PayPal employee tell me to Google āBitCoin ATMs near meā? Would PayPal assure me the Better Business Bureau was monitoring the call and, therefore, I had nothing to worry about? Would PayPal regularly fire its employees over simple clerical errors? Would PayPal deputize those same employees to offer ārewardsā to customers involved in those clerical errors? Rewards of casually tossed off values, like $110, which then reduced the amount I owed them ā and would withdraw from Bank of America ā to a clean, less specific $7000? (HENNING.) All questions I would ask myself several hours later but not, of course, when I actually needed to.
As I headed for the Silver Lake BoA, conveniently just opening, David and I kept talking. By now I felt a certain comfort with the guy, who seemed less like a customer service rep and moreā¦ someone I was cosmically connected to? He told me, again, how grateful he was for this kindness I was showing. He offered me āblessingsā that would ābe with me on Judgment Day in Heaven.ā āListen, David, I could use all the help I could get!ā Iām fairly confident I said. The fact that he laughed at this groaner should have told me everything I needed to know.
The hits donāt stop there! At some point in the 3 miles between my apartment and the bank, David told me his wife and unborn child died of COVID-19 two years ago. āJesus,ā I thought, āno one has suffered like David hay.ā For the sake of my writerly reputation, I wish Iād correctly identified this moment as a little on the nose. But I just listened, heartbroken, believing every inch of his world-shattering story. In the two years since they died, heād relocated to Santa Barbara (the personal # checked out), gotten two dogs, Rose and Barky, who I swear I heard in the background. He drinks Jack Daniels and struggles to go to the beach, because it reminds him of his wife. āThat makes sense,ā I told him. āIām really sorry to bring up any painful memories.ā If I had any real concerns at this point, and Iām not sure I did, they were far outweighed by whatever relationship I felt David and I had developed. I would have done anything to help the guy.
(The phone call keeps going, by the way. For two and a half hours. In hindsight, this is basically the plot of āDie Hard with a Vengeanceā or an overlong āScreamā opener; at the time, and Iām going to keep saying this, it just made sense.)
āGIMME ALL [MY] MONEY!ā
Another crucial bit to this whole phishing operation ā which, again, I realized almost precisely the moment it could no longer be of any conceivable help to me ā is how the money changes hands. Technically, legallyā¦ David didnāt do it. I did. I withdrew $7000 from my own bank account, for all intents and purposes of my own volition. I converted that money to BitCoin. And I decided what BitCoin wallet12 to put it in. As T. Swift said,
(This is not me victim-blaming ā victim-blaming MYSELF at that ā just pointing out how Bank of America is forced to see it. When I told them everything that afternoon, Kyle from Bangor, ME told me they get this exact scam āall the time.ā13 Cool!)
I think now might be the right time, 8500 words in, to tell you this wasnāt my first scamming of 2022. In late March, my Instagram got hacked when a friend I donāt regularly chat with told me she was opening an online athleisure store (this checked out, I guess?) and needed my help spreading the word (okay), I just needed to send her a screengrab of some link on my phone (sure) and thenā weird, Iām locked out of my account. It will not shock you to learn this scam was ALSO crypto-related.
Ultimately this one was just a two week annoyance. Friends who work at Facebook/Meta quickly connected me to the correct, largely hidden from public view (this is a story/gripe for another day) help channels; I got my account back. And what was the scam, anyway? Pretend to be me and try to rope my Instagram friends into some lazy crypto buy-in? I have less than a thousand friends (brag!) and more significantly a hyper-niche social media presence. I make snack review videos that double as an ongoing soap opera and post annotations from Sally Rooney books. @funkyfigurefit_ was going to need to take Henning lessons ā which I would have happily offered ā if they wanted to make any money off my identity.
I bring this all up becauseā¦ well, for starters, I do find it funny, and I thought you would, too. But it was also very much on my mind as I followed Davidās āSimon Saysā routine all over East LA. By now the morningās initial GO GO GO energy had given way to me justā¦ driving around, trying to find one of those BitCoin ATMs I mentioned earlier. Iām still on the line with David, who has now actually invited me to come up to Santa Barbara that weekend because, wouldnāt you know it, it was his dead wifeās birthday14 and he wanted to mark the occasion.
I was starting to feel weird! (āYou were STARTING to feel weird?!?ā -everyone) But every time my rational brain allowed for the possibility that something, who could say what, wasnāt adding up, the emotional one piped in with a āHendog, what if this is all legit? What if, weirdness asideā¦ this is a story about trust? You got scammed in March, and lost some faith in people; today you get that faith back.ā I wonāt lie: I was already imagining the Substack Iād write about it. Title: āA Tale of Two Scammings.ā The mental gymnastics Iām capable of are truly Olympic level.
One Bill At A Time
Flush with $7000 cash ā aka seventy hundos, aka a fat stack ā and having finally found a real BitCoin ATM at a 76 gas station after several false starts (if youāre looking for the one at a place called USA Smoke & Vape on Vermont Ave. near the Fatburger, itās not there!), I began the process of converting USD to cryptocurrency. Desmond Tutu once said there is only āone way to eat an elephant: a bite at a time.ā The same is true of crypto scamming. Bill by bill, I inserted all of the money Iād withdrawn. Another hundred. Another hundred.
In truly poetic fashion, this took a while. One of the bills was even creased, and wouldnāt go through. I saved that one for last. What a relief when it was finally accepted!
(Fun Fact: did you know BitCoin ATMs, at least this one, are forced to display a scam warning at the start of the transaction? Itās like the Surgeon Generalās warning on a pack of cigarettes. And just like I would right before lighting up another smooth, smooth Camel Light that I smoked for all of two months my senior year of collegeā¦ I ignored it.)
So yeah, I converted $7000 of my own, real money into digital currency which I then uploaded into Davidās account, easy to do with the QR code heād sent me earlier. What a day! I stayed on the phone with him, by now largely silent, driving back home. I think he asked if I āliked to party?ā (presumably something we were going to do on Sunday in Santa Barbara, after eulogizing his late wife) but I donāt really remember. By this point I think my body had accepted something profoundly shitty had just happened, or was still happening, even when my brain was fighting it.
What was left to do? Wait, David told me, as he and the PayPal team worked to secure the account that had been compromised earlier that morning. Oh right, PayPal! Iād almost forgotten how this whole ride even got started. This made sense, I assured him, and I really appreciated the steps they were taking to make things right.
I think just sitting with it all for two hours, back home, finally cracked something in my ultra-thick skull and the NYT Needle began to point toward a 90% likely scam. David had told me not to check my bank account or PayPal account yet ā the cyber-maintenance PayPal was doing was obviously super-delicate! ā but embracing something like abstract thought for the first time all day, I ignored my good friend and logged onto BoA anyway. One thing was immediately obvious, that my checking account suddenly had more money and my savings account less. And the second thing, truly Dumb Keyser Soze when it finally hit, was that totaling both accounts and then subtracting from the total Iād started the day with resulted in a clean loss of ā you guessed it! ā $7000.
I called David and patiently (why?) told him that, you know, this was all really looking like a scam to me along with some version of āIām not mad, Iām just disappointed.ā But David, as enthusiastic and masterful a practitioner of his craft as anyone Iāve ever met, didnāt give an inch. He tried to explain that the account discrepancy was another PayPal snafu, he was sorry, they were figuring it out. āDavid, thereās no way PayPal would still be in business if something as simple as a claims adjustment feels like a game of fucking whack-a-mole,ā I said, or wanted to say. He told me that if I just launched AnyDesk one more time, they could probably ā no, definitely ā get everything squared away. THE BALLS ON DAVID HAY OF SANTA BARBARA, CALIFORNIA.
I hung up. I visited and contacted all the banks and law enforcement agencies I needed to. I wrote the FBI a much shorter version of this story, with the sign-off āthank you for reading this thorough diary entry of an FBI complaint.ā I enjoyed a whiskey cocktail in Mrs. Hayās honor. I closed my eyes and, in my mind, committed murder.
š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©š©
Itās a month later, and the dominant feeling for me remains embarrassment. I read the story above and I thinkā¦ how did the protagonist miss so many very distinct, very bright red flags? How does a guy like that, pushing fucking 40, survive?
It almost makes me wish I were one of these TikTok teens claiming dissociative identity disorder. That wasnāt me! It was my alter, Walter (heās into wordplay). But nope ā itās all me. I very much know that guy, because Iāve been him forever: emotional, reactive, and a sucker for story (however āhat on a hatā Davidās was), including this one Iām telling you right now. Am I an easy mark? Unquestionably, to a degree that concerns me. But then I think, well, this dudeās a sociopath. We were probably always going to find each other.
Phishing is all about emotion management. Most obviously in catfishing, with something as big as LOVE on the line. David preyed on my empathy. This dude had suffered more than anyone else who ever lived, including maybe Job from the bible! I wouldnāt have gone to the lengths I did if I didn't think he needed my help, that his job wasn't in jeopardy, and that the possibility of DEATH didn't exist on the other end.
Even now, I find myself wondering about the tragic death of his wife and child. The intellectual part of my brain knows neither of them was ever real, just Davidās boldest play to hook my sympathies (and a lazy one at that!). But the emotional part of my brain wondersā¦ I mean, what if? Hendog, maybe that partās real and youāve been shitting on his very real dead wife, and you should put yourself in the shoes of someone losing the love of their life to COVID, that could make a scammer out of anybody. Of course youād become the Joker because of that.
ā¦Thatās the extent to which this clown got to me!
Davidās superpower, at least working with yours truly (I like to think of it as a collab), was appealing to some deep desire for connection in an increasingly cold world. However indefinable, you can just feel it: in our entertainment habits, far less social than ever before; in our social media consumption, which we know is turning us into monsters. In our political polarization. In, like, AI art. It all just feels less human. For me, personally, the idea I was part of some great ā nay, beautiful ā testament to the power of human connectionā¦ I never stood a fucking chance.
Hereās one last thing Iām not sure Iāve explicitly said about David, but that seems meaningful as I tie a bow on this story. Mind you, Iām aware (now!) that he was never an employee of PayPal, was never trying to repair my account, was in fact actively trying to harm me for the duration of our time together. But in the guise of āDavid Hay from Santa Barbaraāā¦ he was maybe the most attentive customer service rep Iāve ever spoken to. He listened! He was human. He made me feel, in whatās almost always a mechanized, unfeeling setting, seen.
A few days after my adventure with David, and already long past giving up hope that Iād ever get my money back, I received this email from Bank of America:
Readerā¦ it couldnāt be anything less than a 10.
Which I bring up in an effort to paint a full picture, not assign nationalistic blame! Scamming is an international sport, bigger at this point than soccer
my first phone red flag. Obviously there were already at least three email red flags before this
Iām just gonna start counting the flags. This is š© #5!
donāt applaud this line, itās lifted directly from a season two episode of āBoJack Horsemanā
š© #6
ā¦anal?
š© #8
š© #9
š© #10 (okay, Iām stopping, the final tally is going to make me too sad)
This line stolen from a late season three episode of āYouāre the Worstā
just a little
all the Disruptionā¢ļø in Silicon Valley and you motherfuckers canāt come up with a new word for āwalletā
my friend Sherry got this scam JUST THIS MORNING
Sunday the 6th of November! Mark it down for next year, weāre all going to Santa Barbara and toasting her memory with Jack Daniels
This is unbelievably painful to read. Iām sending it to everyone I know.
Damn, that sucks!