Planet Money - So you've been scammed, now what?

Episode Date: May 29, 2024

We are living in a kind of golden age for online fraudsters. As the number of apps and services for storing and sending money has exploded – so too have the schemes that bad actors have cooked up to steal that money. Every year, we hear more and more stories of financial heartbreak. What you don't often hear about is what happens after the scam?On today's show, we follow one woman who was scammed out of over $800,000 on her quest to get her money back. That journey takes her from the halls of the FBI to the fraud departments of some of the country's biggest financial institutions. And it offers a window into how the systems that are theoretically designed to help the victims of financial cybercrime actually work in practice. This episode was hosted by Alexi Horowitz-Ghazi and Jeff Guo. It was produced by Willa Rubin and edited by Keith Romer. It was engineered by Neal Rauch and fact-checked by Sierra Juarez. Alex Goldmark is Planet Money's executive producer.Help support Planet Money and hear our bonus episodes by subscribing to Planet Money+ in Apple Podcasts or at plus.npr.org/planetmoney.Learn more about sponsor message choices: podcastchoices.com/adchoicesNPR Privacy Policy

This election season, you can expect to hear a lot of news, some of it meaningful, much of it not. Give the Up First podcast 15 minutes, sometimes little less, and we'll help you sort it out. What's going on around the world and at home? Three stories, 15 minutes, Up First every day. Listen every morning wherever you get your podcasts. A heads up before we start, today's episode includes a few swear words in the second half, and full disclosure, we reference Citibank, Apple, and Amazon in the story. They're all NPR sponsors. This is Planet Money from NPR.

When you talk to Frances about how she got lured into the scam that's taken over her life for the last year, she says the exact details are a bit of a blur. It starts with a voicemail, but I was also really sick around that week, so I don't think I... It just gets fuzzy on how I got into it. Frances is a white-collar worker in her 40s, lives in New York, and we're only going to use her first name to protect her professional reputation. Now, she says what is clear is that last May, she got this voicemail claiming to be from Citibank, flagging this suspicious, outgoing wire for $50,000. Shortly thereafter...

I get a text saying, oh, this is David from the security department. And I'm like, the security department for a city because of the wire. When she gets this guy, David Smith, on the phone, he explains that the suspicious wire, it might be part of a bigger attack on her whole network of accounts. He asked her to check her Apple account, for example. And I do see these extra charges that are hidden charges on the Apple account. Pretty soon, she's actually getting blocked out of her accounts. Everything just seems like chaos, not only like the Citibank wire.

That's one thing. Then you see my Amazon account is frozen, and my Apple account, everything's kind of frozen. And I'm like, whoa, what the hell? The story that David tells Frances is that she's been targeted by a group of Russian hackers. He says he's been working with someone high up at the FBI to try to catch these guys for a while. And he tells Frances that if she wants to keep her assets safe, they're going to need to work together to secure her home network

and her various bank accounts. Frances in that moment, she was primed to believe this story. She was panicked, and the man on the other end of the phone seemed calm and collected and above all, competent. And he was offering all the might of the US government to help steer her safely through this storm. I'm a single person. You know, I live by myself.

So, and you know, I'm alone on this, right? Whatever help that I can get, um, like, yeah you know, I'm alone on this, right? Whatever help that I can get, like, yeah, like I wanna make sure everything is secure. Like, let's fix this. Over the next couple of weeks, David and Frances spend hours and hours on the phone together. By now she's given him remote access to her computer. And David tells her that in order to figure out

what the hackers are up to, they're going to need to move around some of her funds through a complicated series of transfers. Francis gets set up with accounts on Cash App and Coinbase. They start transferring some of that money into cryptocurrency. David warns Francis that this is a confidential government investigation, so she isn't allowed to tell anyone else what they are doing. He also insists that Francis shouldn't even look at her accounts. She should only sign into her bank and payment apps when he instructs her to verify her identity

or approve various transfers. Francis goes along with this process for a couple of months. Only then does she finally decide to break this rule. She signs into her accounts to see what's been happening, and that is when she realizes someone has been steadily transferring money out of her investment accounts. When she tallies it all up, she sees that over $800,000, nearly all the money she's saved and invested for the last 20 years, has been transferred out of that account.

Frances freaks out. She immediately gets on the phone with the one person she thinks might be able to fix this problem. That David Smith from the security department. Well, I was kind of cursing into everything over the phone. Like, where the F is my money? And Dave is like, your money is safe. You know, it's safe in like government accounts.

At this point, did it cross your mind at all that this guy who said he was out to help you might have been scamming you all along? I felt helpless. Like, if he's real, then somehow I'm going to get my money back. And if it's not, well, it's already gone and I have to figure out what to do next. And that maybe I have no choice but to see where things go. Hello and welcome to Planet Money. I'm Alexi Horowitz-Ghazi.

And I'm Jeff Guoh. Hello and welcome to Planet Money, I'm Alexi Horowitz-Ghazi. And I'm Jeff Gwoe. We are living in a kind of golden age of online fraud. As the number of apps and services for storing and sending money has exploded, so too have the schemes that bad actors have cooked up to take that money. Every year, it feels like we hear more and more of these stories of financial heartbreak. What you don't often hear about is what happens after the scam. Today on the show, we follow Frances on her quest to get her money back from the halls

of the actual FBI to the fraud departments of some of the country's biggest financial institutions. And we get a window into how the systems that are theoretically designed to help people like Frances actually work in practice. Support for this podcast and the following message come from Wwise, the app that makes managing your money in different currencies easy. With Wwise, you can send and spend money internationally at the mid-market exchange rate. No guesswork and no hidden fees. Learn more about how Wwise could work for you at wise.com. What does it mean to be Black in America? In NPR's Black Stories, Black Truths,

a collection of stories as varied, nuanced, and dynamic as the Black experience, you'll hear, it means everything. Search NPR Black Stories, Black Truths wherever you get your podcasts. This message comes from Rapid Response. The Rapid Response podcast cuts through the noise with business insights from innovative leaders like Airbnb's Brian Chesky and Thrive Global's Ariana Huffington. Listen to Rapid Response wherever you get your podcasts. By the time Frances discovered that more than $800,000, nearly her entire life savings, had been incrementally drained out of her investment accounts.

She says she was already so deep into this supposed FBI investigation that it was hard to reckon with the idea of walking away. There actually was a part of me, admittedly, that really wanted, really, really, really wanted to be cooperating under a confidential case because Because like, it was so hard to try to face the fact that, oh, you've been scammed in a really costly way. Like, it's devastating. You're like, oh my God, can I even admit this? And so, Frances spent the next several months

in a kind of holding pattern, getting strung along by occasional messages from David Smith and his contact at the FBI about how it would be just a little longer until she got her money back. It wasn't until this past December that Frances says the spell finally started to break. On Christmas, she gathered with her family for dinner at a Chinese restaurant. Her parents, her brother and his family, and her sister. And full disclosure, I know her sister.

She's actually how I found out about this story. her brother and his family, and her sister. And full disclosure, I know her sister. She's actually how I found out about this story. And over that Christmas dinner, Frances explains the whole situation to her family. How she'd become the target of Russian hackers and had been roped into a top secret FBI investigation to try and stop them. How the government had secretly moved all her money into a secure crypto account for safekeeping. And after hearing all of this, her family looks at her and basically says,

Francis, there is no secret FBI investigation. These people have taken your money. And this is all a giant scam. And I was like frozen. I was really frozen. I was embarrassed. And I didn't eat very much during that dinner. That's how embarrassed and that's how ashamed I felt. I was like, I feel stupid.

I felt really, really small. Over the next few days, Francis's family starts to try to help her pick up the pieces. They begin by reaching out to the actual authorities, telling them what happened. Right. Like when you're the victim of a crime, you go to law enforcement, right? So, Frances goes online and she files complaints with the Federal Trade Commission and the FBI. Her sister manages to set up a meeting

with a real FBI agent, who works on exactly these sorts of cases in New York City. So, just a couple weeks after Christmas, Frances heads to the FBI office in Lower Manhattan to see if they might be able to help. My brother and my sister went with me because they wanted to hear it. They want to know. To be honest, I think they're better at asking the questions than I am, right? I'm still in shock and embarrassment. The FBI agent basically confirms what Frances's family had suspected, that this was a scam.

The story had all the hallmarks of what the FBI has dubbed the Phantom Hacker scam. That's where scammers impersonate financial and government officials in order to gain access to your accounts. But unfortunately, the agent tells Francis, the FBI is probably not going to open a case about what happened to you. So as soon as Francis made it to the actual FBI, she'd kind of hit a roadblock. We reached out to the FBI to understand why they did not take on Frances's case, but they didn't make anyone available for an interview.

So we called up Kyle Armstrong. These days, Kyle works as the head of law enforcement relations at a cryptocurrency tracing company called TRM Labs. But before that, he spent 14 years investigating financial crimes at the FBI, cut his teeth on all sorts of internet scams. You have an endless supply of the sort of romance scams and lottery scams that we all think of, like the Nigerian sort of inheritance scam. You know, those walk into your office five days a week.

Kyle says you gotta think about Francis's case from the FBI's perspective. The FBI's number one priority is counterterrorism. Their number two priority is counterintelligence. Their number three priority is cybercrime. And so they are by design going to be prioritizing nation-state style cyber and financial institution threats. So things like North Korean crypto hacks to fund their weapons programs, which we've covered

on the show, or the investigation into how the servers of the Democratic National Committee got hacked back in 2016. That is where the FBI is putting the most muscle. As for individual cases of cybercrime, like what had happened to Francis, the FBI kind of has to pick and choose because there are just so many of them. Whenever somebody falls victim to one of these schemes, they're supposed to immediately file a report on a website called the Internet Crime Complaint Center, or IC3. on a website called the Internet Crime Complaint Center, or IC3. When complaints are submitted to the IC3, they arrive at an FBI facility in West Virginia. That's where a staff of specialized analysts sift through each one to see if it potentially

warrants an investigation. How are these FBI analysts doing the triage to figure out which cases to allot these limited resources to, to try to investigate. The primary factor in determining priority is going to be dollar amount. And so if there's a $50,000 case and there's a $5 million case, the $5 million case is going to be prioritized. Now some of these cases do get routed to state and local law enforcement and other agencies depending on the details.

But for cases that could use the expertise of the FBI, Kyle says your chances depend a lot on where you file from. FBI agents are distributed geographically into 56 field offices in all these different parts of the country. He says the upshot is that a million dollar fraud in say Columbus, Ohio, might be a higher priority than it would be in a place like New York City, where the number and frequency of million dollar scams is just much higher. But no matter where in the country you are, Kyle says the fundamental problem these days

is that every complaint is competing with a record number of other complaints coming into the system. There are 2,400 complaints received on a daily basis. Wow. There are 2,400 complaints sent to the FBI every day about some form of cybercrime. Yeah. Losses in 2023 were $12.5 billion overall. And when you compare these numbers to the 10,000 or so FBI agents in the country, you start to understand how hard it can be to get law enforcement to bite on any particular case. And Kyle says the same dynamic exists at other agencies that investigate fraud,

like the IRS or the Secret Service, which have even fewer agents. Kyle says the second big reason the FBI probably didn't take Francis's case was that by the time she filed her complaint, several months had already passed since the money had actually left her accounts. And time? Time is probably the most critical element of these cases, because the money can move immediately, internationally, and be cashed out. And once it has been exchanged for currency in a foreign location, it's very, very difficult to get back. As far as Frances could tell, when she pieced together the list of transfers and transactions from the past year,

it looked like most of her money was moved to a Coinbase account, where it was likely converted to cryptocurrency and scattered across various blockchains. Cryptocurrency can move incredibly fast. Sometimes these funds are cashed out in as little as an hour. Many times it's, you know, a few days, maybe a few weeks if they're lucky. But if you wait six months to report the fraud scheme, it's going to be almost impossible for law enforcement to get your money back.

Okay, so the FBI was not going to help. But Frances was still determined to find a way to get back some of what she'd lost. And the next step on her quest to try to recover her money was to go to the institutions entrusted with keeping her money safe in the first place. After I met with the FBI in the office, I started contacting the banks, telling them that I'm filing a fraud report. There are actually laws on the books that say the banks have to help their customers after some kinds of cybercrime, sometimes to even

reimburse some of the money that's been stolen. But whether those laws would apply to Francis's situation is a little difficult to parse because the rules that govern this process can be pretty opaque. So we went to someone who knows their way around them. I'm Carla Sanchez Adams, a senior attorney with the National Consumer Law Center. Carla says the first thing you need to know is that there's this big federal law governing whether banks are required to reimburse their customers who've fallen victim to some type of cybercrime.

It's called the Electronic Fund Transfer Act, or the EFTA. But the law only covers certain kinds of transactions. So that would be, you know, the peer-to-peer payment through Zelle or Venmo or PayPal. That would include ACH transactions, debit card transactions, things like that. And yet it excludes checks and it excludes wire transfers. So the law covers automated clearinghouse transactions and apps like Zelle and Venmo. It does not cover checks or wire transfers. Now, in Frances's case, her money appeared to have sometimes been moved using wire transfers,

so the EFTA wouldn't apply there. But sometimes the money had gone through apps like Zelle and Cash App, or ACH transfers, which could potentially qualify for protection. But, Carla says, even for transfers that the bank might be on the hook for under the EFTA, customers still have to clear another couple of hurdles to qualify. First, customers have to have lost money to what the banks often think of as a fraud as opposed to a scam. Those may sound similar, but they're actually treated very differently by financial institutions.

Yeah, banks often use fraud as a shorthand for a transaction that the customer did not authorize. So maybe the bad actors got a hold of your login information or hacked into your accounts and started firing off transfers. The bank might have to reimburse you for that. But then if it's one where the consumer was deceived and made the payment. They initiated it. There's no statute requiring a financial institution to reimburse that consumer for that loss. So if the cyber criminals are really good at social engineering, they trick you into authorizing the transfers yourself, that is what the banks often think of as a scam. And the EFTA doesn't require them to make you whole.

So not great for Francis. And even if some of the transactions the scammers had used might be what the banks call fraud, there is a second big question. And this one goes back to the issue of time. If you wait too long to report a fraudulent transaction, the bank has less of an obligation to fully reimburse you. Now, financial institutions do have some latitude in how they apply laws like the EFTA and other state and federal laws that sometimes protect consumers. So consumer advocates and a group of senators have started pushing banks and payment apps

like Zelle to clarify and expand their policies, to reimburse customers who've been scammed into sending money. At this point, it isn't exactly clear which of all the transactions between Frances's accounts were in fact authorized and which might have been initiated by her scammers without her knowledge. What is clear is that of all the transactions that she's reported to her financial institutions, none of them have been reversed or reimbursed. Which, Carla says, isn't necessarily the end of the road.

If the investigation does not come out in your favor and it was unauthorized, unfortunately, as far as the recourse, a lot of times it does take the help of a lawyer. recourse, a lot of times it does take the help of a lawyer. Coming up, Frances goes in search of a lawyer and she sets up one final conversation with her scammers, a conversation that she recorded. Hello? Yes, good afternoon, Frances. That's after the break.

In this country, some truths aren't self-evident. In NPR's Black Stories, Black Truths, a collection of stories as wide-ranging and real as the people who tell them, we celebrate the Black experience for all its soul and richness. Search NPR, Black stories, Black truths, wherever you get podcasts. All that sitting and swiping, your body is adapting to your technology. Learn how and what you can do about it. I really felt like the cloud in my brain kind of dissipated. Once I started realizing what a difference these little bricks were making, there's no turning back for me.

Take NPR's Body Electric Challenge. Listen to the series wherever you get your podcasts. What does it mean to be black in America? In NPR's Black Stories, Black Truths, a collection of stories as varied, nuanced, and dynamic as black experiences, you'll hear. It means everything. Search NPR Black Stories, Black Truths wherever you get your podcast. When voters talk during an election season, we listen. We ask questions, we follow up, and we bring you along to hear what we learned. Get closer to the issues, the people, and your vote at the NPR Elections Hub. Visit npr.org slash elections. Hey, it's Greg Rosalski. For generations, American politicians have talked about freedom as if it only means freedom from government. Nobel Prize-winning economist Joseph Hegelitz

in a new book opposes that narrow view of freedom. So it's really what you are free to do. You know, somebody who is at the point of starvation doesn't really have much freedom. He does what he has to do to survive. In our latest bonus episode, I talk with Stieglitz about his conception of freedom and what he calls progressive capitalism, his vision of the government playing

a more active role in the economy. That's for Planet Money Plus listeners. If that's you, thank you very much. If it's not, well, it could be. By signing up, you get sponsor-free listening and support and PR. Just go to plus.npr.org. Not long after Frances finally met with the real FBI

and started filing paperwork with their financial institutions, her scammer, the so-called David Smith, reaches out to try to schedule another call between Francis and this supposed FBI agent, Robert Johnson. He tells her they want to give her an update on her case. So in early February, she sets up a phone call. But this time, potentially with an eye toward a future investigation, she decides she is going to record the conversation. I was so angry. I was like, I want to get these efforts because I want to at least get

the information and show them like I'm not making this up. These are people that I've been in contact with trying to convince me that my money is safe. But Frances, she was still kind of of two minds. Even after telling her family what she'd been through, even after going to the authorities to try to get help, she was still hoping that maybe these men on the other end of the phone would turn out to be legit, that her money really was safe, and that this was all just some big miscommunication between different parts of the FBI. Yeah, before working on this story, I don't think I fully understood just how hard it can be to rip yourself from the fictional world that some of these social engineering

scams weave for their victims. Like, how hard it can be to break free. But think about this from Frances's perspective. When she'd gone to actual law enforcement, they told her they couldn't really do anything for her, same for the banks. But the scammers? Not only did they seem to actually care about her situation, they were the only ones offering her any hope that she'd be able to get her money back. There was always still a part of me that I was thinking like maybe it's still like maybe it's still real and maybe I just need to like kind of like hedge my bets. Frances's call with the scammers starts around midday. She talks to David Smith for a little bit and then the supposed FBI agent joins joins the call. But even in the face of these seemingly obvious holes in these scammers' aliases, you can hear Frances start to engage with them.

She's obviously angry, but she also acts as if she is in fact talking to a real FBI agent. And if she could just get him to take her concerns seriously, maybe this would all work out. So I need some proof that this would all work out. I totally understand your concern. I totally understand your pain. As you know that in our US government, we don't have any single case. We have a bunch of cases which we are dealing in one time. And that is the reason sometimes we are getting delayed. And how do I know that you can go

if you don't have any other evidence to prove that you're fake? As far as I can see, I'm being tripped. I'm being scammed. It looks like a duck. It quacks like a duck. Then in the next moment, she'll start to slide back into the Scammers' narrative. As you can see, your money is totally safe in a safe, secure wallet.

And you're going to get your competition money of $200,000. Which wallet? Like I'm trying to understand like where is this wallet? It is not entirely clear whether after nine months of being manipulated by these scammers, Frances will finally be able to break free from the story they've been telling her. This is completely upsetting. But then all of the pain and confusion she's been feeling starts to boil over. I need something on paper.

Talking on the phone is complete bullshit to me. I've lost $800,000 from my retirement over 20 fucking years saving for my retirement. And you guys just go like, withdraw, make these transactions like it's monopoly money. The entire conversation lasts a little over 30 minutes. And all the way to the very end, you can hear Frances wrestling

with these two conflicting realities. You're bullshit. I will say goodbye. Thank you very much. It's been great working with you, but sorry, I cannot do anything more. Okay, thank you. Thank you. Thank you. Bye. Bye. No, no, no. Goodbye. With that last goodbye, Frances finally does it. She manages to hang up the phone

once and for all and break contact with the men who lured her into this elaborate financial trap over the last year. It was the last time she spoke with them. In the months since then, Frances hasn't gotten any further with law enforcement or her financial institutions. So she's engaged the services of a couple of former Department of Justice lawyers specializing in cybercrime. They're working for her on contingency,

meaning they'll only get paid if they're able to recover some of her money. Her lawyers are hoping to trace Francis's money across the various blockchains and then get the courts or law enforcement to help freeze and seize whatever they're able to find. And they're looking into whether Frances's financial institutions

might bear some legal responsibility for the money she lost. Frances, she's trying to get her financial life back on the rails. And she's hopeful that the lawyers will be able to help with that. It's new. It's Uncharted Waters for me.

You know, I I hope I'll see a light at the end of the tunnel. I don't know, you know It's definitely complicated We spoke to Francis's lawyers as part of our reporting and they say the real problem here is that the banking laws are Outdated they just weren't designed with the current technological landscape in mind. On top of that, the law enforcement system is not set up to handle the sheer number of people falling victim to these scams every year. As for whether Frances will get any of her life savings back, her lawyers say

that is still very much up in the air. Coming up on Planet Money, at one time the FBI launched a phone company for criminals. His offer is that the FBI can take this company and use it for their own investigations. Why doesn't the FBI just run its own encrypted phone company and then put in whatever backdoor they feel like? They could run a tech startup for organized crime. The story of one of the weirdest tech companies and the largest sting operation of all time. That's on the next Planet Money.

Today's episode was produced by Willa Rubin and edited by Keith Romer. It was engineered by Neil Rauch and fact-checked by Cierra Juarez. Alex Goldmark is our executive producer. Special thanks to Kieran Raj and Scott Ferber. I'm Alexi Horwitz-Ghazi. I'm Jeff Guowe. This is NPR. Thanks for listening.

This message comes from NPR sponsor Organic Valley, a co-op of small organic family farms like Stoney Pond Farm, where Tyler Webb and his family consider the earth, the animals, and the community in the stewardship of their farm. This is Electra who's wandered up the lane to say hi. She is very curious. She's probably the most curious cow that we have. Every one of those cows all has their own sort of unique attribute.

They're such peaceful docile creatures, you know, and I say that that's my job is to wake up in this beautiful place every day and wander around and try to figure out how to make it better. Better for my cows, better for the land, better for the community, the overall ecology. And it's that stewardship which evolves from that patient observation, I think. Discover organic valley dairy at ov.coop slash ethically sourced.