Chapters
Shownotes Transcript
This message comes from NPR sponsor, Discover. Heard about DoubleNomics? Discover automatically doubles the cash back earned on your credit card at the end of your first year. That means you could turn $150 cash back into $300. See terms at discover.com slash credit card.
This message comes from NPR-sponsored Train Technologies, challenging what's possible for a sustainable world. Train Technologies is at the forefront of sustainable heating and cooling systems for homes and buildings, and climate-controlled solutions for the safe transportation and storage of food and medicine. By setting a higher standard for the industry, they're accelerating their action for impact, aiming to achieve net-zero carbon emissions by 2050. See how they're doing it at TrainTechnologies.com.
A heads up before we start, today's episode includes a few swear words in the second half. And full disclosure, we reference Citibank, Apple, and Amazon in the story. They're all NPR sponsors. This is Planet Money from NPR.
When you talk to Frances about how she got lured into the scam that's taken over her life for the last year, she says the exact details are a bit of a blur. It starts with a voicemail, but I was also really sick around that week. So I don't think I, it just gets fuzzy on how I like got into it.
Frances is a white-collar worker in her 40s, lives in New York, and we're only going to use her first name to protect her professional reputation. Now, she says what is clear is that last May, she got this voicemail claiming to be from Citibank, flagging this suspicious outgoing wire for $50,000. Shortly thereafter... I get a text saying, oh, this is David from the security department. And I'm like, the security department for a city because of the wire.
Once she gets this guy, David Smith, on the phone, he explains that the suspicious wire, it might be part of a bigger attack on her whole network of accounts. He asked her to check her Apple account, for example. And I do see these extra charges that are hidden charges on the Apple account.
Pretty soon, she's actually getting locked out of her accounts. Everything just seems like chaos. Not only like the Citibank wire. That's one thing. Then you see my Amazon account is frozen. My Apple account, everything's kind of frozen. And I'm like, whoa, what the hell? The story that David tells Frances is that she's been targeted by a group of Russian hackers.
He says he's been working with someone high up at the FBI to try to catch these guys for a while. And he tells Frances that if she wants to keep her assets safe, they're going to need to work together to secure her home network and her various bank accounts. Frances, in that moment, she was primed to believe this story. She was panicked. And the man on the other end of the phone seemed calm and collected and, above all, competent.
And he was offering all the might of the U.S. government to help steer her safely through this storm. I'm a single person. You know, I live by myself. So and, you know, I'm alone on this. Right. Whatever help that I can get. Yeah. Like, yeah. Like, I want to make sure everything is secure. Like, let's fix this.
Over the next couple weeks, David and Frances spend hours and hours on the phone together. By now, she's given him remote access to her computer. And David tells her that in order to figure out what the hackers are up to, they're going to need to move around some of her funds through a complicated series of transfers.
Francis gets set up with accounts on Cash App and Coinbase. They start transferring some of that money into cryptocurrency. David warns Francis that this is a confidential government investigation, so she isn't allowed to tell anyone else what they're doing. He also insists that Francis shouldn't even look at her accounts. She should only sign into her bank and payment apps when he instructs her to verify her identity or approve various transfers.
Frances goes along with this process for a couple of months. Only then does she finally decide to break this rule. She signs into her accounts to see what's been happening, and that is when she realizes someone has been steadily transferring money out of her investment accounts. When she tallies it all up, she sees that over $800,000, nearly all the money she's saved and invested for the last 20 years, has been transferred out of that account.
Frances freaks out. She immediately gets on the phone with the one person she thinks might be able to fix this problem. That David Smith from the security department. Well, I was kind of cursing and everything over the phone. Like, where the F is my money? And Dave is like, your money is safe. You know, it's safe in like government accounts.
At this point, did it cross your mind at all that this guy who said he was out to help you might have been scamming you all along? I felt helpless. Like, if he's real, then somehow I'm going to get my money back. And if it's not, well, it's already gone and I have to figure out what to do next. And that maybe I have no choice but to see where things go.
Hello and welcome to Planet Money. I'm Alexi Horowitz-Ghazi. And I'm Jeff Guo. We are living in a kind of golden age of online fraud. As the number of apps and services for storing and sending money has exploded, so too have the schemes that bad actors have cooked up to take that money. Every year, it feels like we hear more and more of these stories of financial heartbreak. What you don't often hear about is what happens after the scams.
Today on the show, we follow Frances on her quest to get her money back from the halls of the actual FBI to the fraud departments of some of the country's biggest financial institutions. And we get a window into how the systems that are theoretically designed to help people like Frances actually work in practice.
This message comes from Capital One. Banking with Capital One helps you keep more money in your wallet with no fees or minimums on checking accounts. What's in your wallet? Terms apply. See CapitalOne.com slash bank for details. Capital One N.A. Member FDIC.
This message comes from NPR sponsor Dell Technologies. During their back-to-school event, learn how Dell is helping underserved communities around the world. Make a difference with Dell and shop AI-ready PCs powered by Snapdragon X series processors at dell.com slash deals.
Support comes from our 2024 lead sponsor of Planet Money, Amazon Business. Everyone could use more time. Amazon Business offers smart business buying solutions so you can spend more time growing your business and less time doing the admin. You'll see why they call it smart. Learn more about smart business buying at amazonbusiness.com.
By the time Frances discovered that more than $800,000, nearly her entire life savings, had been incrementally drained out of her investment accounts, she says she was already so deep into this supposed FBI investigation that it was hard to reckon with the idea of walking away. There actually was a part of me, admittedly, that really wanted, really, really, really wanted to be cooperating under a confidential case. Because, like...
It was so hard to try to face the fact that, oh, you've been scammed in a really costly way. Like, it's devastating. You're like, oh, my God, can I even admit this? And so Frances spent the next several months in a kind of holding pattern, getting strung along by occasional messages from David Smith and his contact at the FBI about how it would be just a little longer until she got her money back.
It wasn't until this past December that Francis says the spell finally started to break.
On Christmas, she gathered with her family for dinner at a Chinese restaurant. Her parents, her brother and his family, and her sister. And full disclosure, I know her sister. She's actually how I found out about this story. And over that Christmas dinner, Frances explains the whole situation to her family. How she'd become the target of Russian hackers and had been roped into a top-secret FBI investigation to try and stop them. How the government had secretly moved all her money into a secure crypto account for safekeeping.
And after hearing all of this, her family looks at her and basically says, Francis, there is no secret FBI investigation. These people have taken your money. And this is all a giant scam. And I was like frozen. I was really frozen. I was embarrassed. And I didn't eat very much during that dinner. That's how embarrassed and that's how ashamed I felt. I was like...
Like, I feel stupid. I felt really, really small. Over the next few days, Frances's family starts to try to help her pick up the pieces. They begin by reaching out to the actual authorities, telling them what happened.
Right. Like when you're the victim of a crime, you go to law enforcement, right? So Frances goes online and she files complaints with the Federal Trade Commission and the FBI. Her sister manages to set up a meeting with a real FBI agent who works on exactly these sorts of cases in New York City. So just a couple weeks after Christmas, Frances heads to the FBI office in lower Manhattan to see if they might be able to help.
My brother and my sister went with me because they wanted to hear it. They want to know. And to be honest, I think they're better at asking the questions than I am, right? I'm still in shock and embarrassment.
The FBI agent basically confirms what Francis' family had suspected, that this was a scam. The story had all the hallmarks of what the FBI has dubbed the Phantom Hacker scam. That's where scammers impersonate financial and government officials in order to gain access to your accounts. But unfortunately, the agent tells Francis, the FBI is probably not going to open a case about what happened to you.
So as soon as Frances made it to the actual FBI, she kind of hit a roadblock.
We reached out to the FBI to understand why they did not take on Francis's case, but they didn't make anyone available for an interview. So we called up Kyle Armstrong. These days, Kyle works as the head of law enforcement relations at a cryptocurrency tracing company called TRM Labs. But before that, he spent 14 years investigating financial crimes at the FBI, cut his teeth on all sorts of Internet scams. You have...
an endless supply of the sort of romance scams and lottery scams that we all think of, like the Nigerian sort of inheritance scam. You know, those walk into your office five days a week. Kyle says you got to think about Francis's case from the FBI's perspective. The FBI's number one priority is counterterrorism. Their number two priority is counterintelligence. Their number three priority is cybercrime. And so they're
They are, by design, going to be prioritizing nation-state style cyber and financial institution threats. So things like North Korean crypto hacks to fund their weapons programs, which we've covered on the show, or the investigation into how the servers of the Democratic National Committee got hacked back in 2016. That is where the FBI is putting the most muscle.
As for individual cases of cybercrime, like what had happened to Francis, the FBI kind of has to pick and choose because there are just so many of them. Whenever somebody falls victim to one of these schemes, they're supposed to immediately file a report on a website called the Internet Crime Complaint Center, or IC3.
When complaints are submitted to the IC3, they arrive at an FBI facility in West Virginia. That's where a staff of specialized analysts sift through each one to see if it potentially warrants an investigation. How are these FBI analysts doing the triage to figure out which cases to allot these limited resources to to try to investigate?
the primary factor in determining priority is going to be dollar amount. And so if there's a $50,000 case and there's a $5 million case, the $5 million case is going to be prioritized. Now, some of these cases do get routed to state and local law enforcement and other agencies, depending on the details. But for cases that could use the expertise of the FBI, Kyle says your chances depend a lot on where you file from.
FBI agents are distributed geographically into 56 field offices in all these different parts of the country.
He says the upshot is that a million dollar fraud in, say, Columbus, Ohio, might be a higher priority than it would be in a place like New York City, where the number and frequency of million dollar scams is just much higher. But no matter where in the country you are, Kyle says the fundamental problem these days is that every complaint is competing with a record number of other complaints coming into the system.
There are 2,400 complaints received on a daily basis. Wow. There are 2,400 complaints sent to the FBI every day about some form of cybercrime. Yeah. Losses in 2023 were $12.5 billion overall.
And when you compare these numbers to the 10,000 or so FBI agents in the country, you start to understand how hard it can be to get law enforcement to bite on any particular case. And Kyle says the same dynamic exists at other agencies that investigate fraud, like the IRS or the Secret Service, which have even fewer agents.
Kyle says the second big reason the FBI probably didn't take Frances' case was that by the time she filed her complaint, several months had already passed since the money had actually left her accounts. And time? Time is probably the most critical element of these cases.
Because the money can move immediately internationally and be cashed out. And once it has been exchanged for currency in a foreign location, it's very, very difficult to get back. As far as Frances could tell when she pieced together the list of transfers and transactions from the past year, it
it looked like most of her money was moved to a Coinbase account, where it was likely converted to cryptocurrency and scattered across various blockchains. And cryptocurrency can move incredibly fast. Sometimes these funds are cashed out in as little as an hour. Many times it's, you know, a few days, maybe a few weeks if they're lucky. But if you wait six months to report the fraud scheme, it's going to be almost impossible for law enforcement to get your money back.
Okay, so the FBI was not going to help. But Frances was still determined to find a way to get back some of what she'd lost. And the next step on her quest to try to recover her money was to go to the institutions entrusted with keeping her money safe in the first place. After I met with the FBI in the office, I started contemplating
contacting the banks, telling them that I'm filing a fraud report. There are actually laws on the books that say the banks have to help their customers after some kinds of cybercrime, sometimes to even reimburse some of the money that's been stolen. But whether those laws would apply to Francis' situation is a little difficult to parse, because the rules that govern this process can be pretty opaque. So we went to someone who knows their way around them.
I'm Carla Sanchez-Adams, a senior attorney with the National Consumer Law Center. Carla says the first thing you need to know is that there's this big federal law governing whether banks are required to reimburse their customers who've fallen victim to some type of cybercrime. It's called the Electronic Fund Transfer Act, or the EFTA. But
But the law only covers certain kinds of transactions. So that would be, you know, the peer-to-peer payment through Zelle or Venmo or PayPal. That would include ACH transactions, debit card transactions, things like that.
Yet it excludes checks and it excludes wire transfers. So the law covers automated clearinghouse transactions and apps like Zelle and Venmo. It does not cover checks or wire transfers. Now, in Frances's case, her money appeared to have sometimes been moved using wire transfers. So the EFTA wouldn't apply there.
But sometimes the money had gone through apps like Zelle and Cash App or ACH transfers, which could potentially qualify for protection. But Carla says even for transfers that the bank might be on the hook for under the AFTA, customers still have to clear another couple of hurdles to qualify. First, customers have to have lost money to what the banks often think of as a fraud as opposed to a scam.
Those may sound similar, but they're actually treated very differently by financial institutions. Yeah. Banks often use fraud as a shorthand for a transaction that the customer did not authorize. So maybe the bad actors got a hold of your login information or hacked into your accounts and started firing off transfers.
the bank might have to reimburse you for that. But then if it's one where the consumer was deceived and made the payment, they initiated it, there's no statute requiring a financial institution to reimburse that consumer for that loss.
So if the cybercriminals are really good at social engineering, they trick you into authorizing the transfers yourself, that is what the banks often think of as a scam. And the EFTA doesn't require them to make you whole. So not great for Francis.
And even if some of the transactions the scammers had used might be what the banks call fraud, there is a second big question. And this one goes back to the issue of time. If you wait too long to report a fraudulent transaction, the bank has less of an obligation to fully reimburse you. Now, financial institutions do have some latitude in how they apply laws like the EFTA and other state and federal laws that sometimes protect consumers.
So consumer advocates and a group of senators have started pushing banks and payment apps like Zelle to clarify and expand their policies, to reimburse customers who've been scammed into sending money.
At this point, it isn't exactly clear which of all the transactions between Frances's accounts were in fact authorized and which might have been initiated by her scammers without her knowledge. What is clear is that of all the transactions that she's reported to her financial institutions, none of them have been reversed or reimbursed. Which Carla says isn't necessarily the end of the road.
Coming up, Frances goes in search of a lawyer, and she sets up one final conversation with her scammers. A conversation that she recorded. That's after the break.
Support for NPR and the following message come from State Farm. As a State Farm agent and agency owner, Lakeisha Gaines understands the support small businesses need. Knowing that no business is the same, knowing that we're all impacted by things that are beyond our control like a
catastrophes and hearing and listening and understanding what's important to a business owner, understanding how much is truly affordable and what makes sense at that moment. Because a three-year psychiatrist is going to be very different than a 20-year doctor. And a two-year sign owner is going to be very different than a one-month restaurant owner or
who's just trying to figure out what's going to be on the menu next month. Those are the things that I think are extremely important that come to my experience as a small business owner. It's me figuring out how to help the people that I live with, how to help the people that I work with, how to help the people that I volunteer with. Talk to your local agent about small business insurance from State Farm. Like a good neighbor, State Farm is there.
This message comes from NPR sponsor, Quince. Even on a budget, you still deserve nice things. Scoop up timeless high-quality goods for 50 to 80% less than similar brands with Quince. Go to quince.com slash style for free shipping and 365-day returns.
Hey, it's Greg Rosalski. For generations, American politicians have talked about freedom as if it only means freedom from government. Nobel Prize-winning economist Joseph Higlitz in a new book opposes that narrow view of freedom. So it's really what you are free to do. You know, somebody who is at the point of starvation doesn't really have much freedom. He does what he has to do to survive.
In our latest bonus episode, I talk with Stieglitz about his conception of freedom and what he calls progressive capitalism, his vision of the government playing a more active role in the economy. That's for Planet Money Plus listeners. If that's you, thank you very much. If it's not, well, it could be. By signing up, you get sponsor-free listening and support NPR. Just go to plus.npr.org.
Not long after Frances finally met with the real FBI and started filing paperwork with their financial institutions, her scammer, the so-called David Smith, reaches out to try to schedule another call between Frances and this supposed FBI agent, Robert Johnson. He tells her they want to give her an update on her case. So in early February, she sets up a phone call.
But this time, potentially with an eye toward a future investigation, she decides she is going to record the conversation. I was so angry. I was like, I want to get these F-ers. Because I want to at least get the information and show them, like, I'm not making this up. These are people that I've been in contact with trying to convince me that my money is safe.
But Frances, she was still kind of of two minds. Even after telling her family what she'd been through, even after going to the authorities to try to get help, she was still hoping that maybe these men on the other end of the phone would turn out to be legit.
that her money really was safe, and that this was all just some big miscommunication between different parts of the FBI. Yeah, before working on this story, I don't think I fully understood just how hard it can be to rip yourself from the fictional world that some of these social engineering scams weave for their victims. Like, how hard it can be to break free.
But think about this from Frances's perspective. When she'd gone to actual law enforcement, they told her they couldn't really do anything for her. Same for the banks. But the scammers, not only did they seem to actually care about her situation, they were the only ones offering her any hope that she'd be able to get her money back. There was always still a part of me that was thinking, like, maybe it's still, like, maybe it's still real. Yeah.
And maybe I just need to kind of like hedge my bets. Francis's call with the scammers starts around midday. She talks to David Smith for a little bit, and then the supposed FBI agent joins the call. Francis, this is Robert. How are you? Is Robert? Or was it? Sorry. Robert. What? Robert who? Sorry. Robert from FBI. From FBI? Last name?
Say again? Flint. Yeah, I thought it was Johnson last time, but maybe I missed that. Exactly.
But even in the face of these seemingly obvious holes in these scammers' aliases, you can hear Frances start to engage with them. She's obviously angry, but she also acts as if she is, in fact, talking to a real FBI agent. And if she could just get him to take her concerns seriously, maybe this would all work out. So I need some proof that this is a real case.
I mean, this is time to come up with like real substantial proof that you're working on an FBI case that is for me and that my money is indeed somewhere. And
The call goes on and on like this. In one moment, Francis will hold the scammer's feet to the fire. As far as I can see, I'm being tricked. I'm being scammed. It looks like a duck. It quacks like a duck. Then in the next moment, she'll start to slide back into the scammer's narrative. As you can see that your money is totally safe in a safe wallet. You're going to get your competition money of $200,000.
Which wallet? Like, I'm trying to understand, like, where is this wallet? It is not entirely clear whether after nine months of being manipulated by these scammers, Frances will finally be able to break free from the story they've been telling her. This is completely upsetting. But then all of the pain and confusion she's been feeling starts to boil over. I need something on paper. Totally.
Talking on the phone is complete bullshit to me. I've lost $800,000 from my retirement over 20 fucking years saving for my retirement.
You guys just go, like, withdraw, make these transactions like it's monopoly money. The entire conversation lasts a little over 30 minutes. And all the way to the very end, you can hear Frances wrestling with these two conflicting realities. You're bullshit. I will say goodbye. Thank you very much. It's been great working with you, but sorry, I cannot do anything more. Okay, thank you. Thank you.
Thank you. Bye. You have to. Bye. No, no, no. Goodbye. With that last goodbye, Frances finally does it. She manages to hang up the phone once and for all and break contact with the men who'd lured her into this elaborate financial trap over the last year. It was the last time she spoke with them.
In the months since then, Frances hasn't gotten any further with law enforcement or her financial institutions. So she's engaged the services of a couple of former Department of Justice lawyers specializing in cybercrime. They're working for her on contingency, meaning they'll only get paid if they're able to recover some of her money. Her lawyers are hoping to trace Frances's money across the various blockchains and then get the courts or law enforcement to help freeze and seize whatever they're able to find.
And they're looking into whether Frances' financial institutions might bear some legal responsibility for the money she lost. Frances, she's trying to get her financial life back on the rails. And she's hopeful that the lawyers will be able to help with that. It's new. It's uncharted waters for me. You know, I hope I'll see a light at the end of the tunnel. I don't know. You know, it is definitely complicated.
We spoke to Francis's lawyers as part of our reporting, and they say the real problem here is that the banking laws are outdated. They just weren't designed with the current technological landscape in mind. On top of that, the law enforcement system is not set up to handle the sheer number of people falling victim to these scams every year.
As for whether Frances will get any of her life savings back, her lawyers say that is still very much up in the air. ♪
Coming up on Planet Money, that one time the FBI launched a phone company for criminals. His offer is that the FBI can take this company and use it for their own investigations. Why doesn't the FBI just run its own encrypted phone company and then put in whatever backdoor they feel like? They could run a phone company.
a tech startup for organized crime. The story of one of the weirdest tech companies and the largest sting operation of all time. That's on the next Planet Money. Today's episode was produced by Willa Rubin and edited by Keith Romer. It was engineered by Neil Rauch and fact-checked by Sierra Juarez. Alex Goldmark is our executive producer. Special thanks to Kiran Raj and Scott Ferber. I'm Alexey Horowitz-Ghazi. I'm Jeff Guo. This is NPR. Thanks for listening.
This message comes from NPR sponsor, Capella University. Capella's programs teach skills relevant to your career, so you can apply what you learn right away. See how Capella can make a difference in your life at capella.edu. This message comes from NPR sponsor, Shopify, the global commerce platform that helps you sell and show up exactly the way you want to. Customize your online store to your style. Sign up for a $1 per month trial period at shopify.com slash NPR.
This message comes from NPR sponsor Twilio, a customer engagement platform that makes interacting with your customers on the right channel, at the right time, in the right way, easy. Twilio powers meaningful customer interactions for more than 300,000 brands. Plus, Gartner just named the company a leader for the second time in its 2024 Magic Quadrant for CPaaS. Learn more at twilio.com slash Gartner.
