Scammed Again!

Can you learn from my nearly disastrous experience?

Photo by Jan Canty on Unsplash

On Thursday, September 5, I received an email from Microsoft, stating: “Thanks for your order on September 4, 2024.” The billing statement showed that I had purchased  Microsoft 365 Business Standard package for $450.00, marked up (for reasons unstated) to  $492.08.

I do have Microsoft 365 on my computer, but not the business standard. I don’t need it. I don’t want it. And I was mad as hell about it.

Scam Stoppers Notebook:  Be suspicious of your “fight or flight” response. Phishing schemes rely on triggering that rush of adrenalin that inclines you to act immediately. If it feels urgent, breathe in and take a step back.

The email continued with “Additional Resources” offering links for understanding the invoice, paying by wire transfer, and how to cancel the subscription.

Instinctively, I clicked the link to cancel the subscription.

Scam Stoppers Notebook: Don’t click on links in suspicious emails. Tip: To check a link, let your cursor hover over the link text until you can see the URL address the link is pointing to. If the URL is longer than your arm, step away.

The link led me to a subscription cancellation form, which asked me to supply the usual information – name, mailing address, email address, phone.

Scam Stoppers Notebook: Do not provide any personal data, especially not bank account numbers, Social Security number, driver’s license number, etc. These become ammunition for identity theft.

Once I filled out the form, however, there was no way to submit it.

Scam Stoppers Notebook: My IT guy thinks this is by design. The form’s real purpose is to install remote control software on my computer. If the submit button doesn’t do what I expect it to do, then I am more likely to contact the scammers by phone.

Frustrated, I called the help number at the bottom of the form.

Scam Stoppers Notebook: For God’s sake, don’t pick up the phone! It’s a trap!

The phone was answered by “Brad,” who had an Indian accent (Which I thought odd, but then considered that perhaps Microsoft outsources call centers overseas). I told Brad I did not order the product and wanted a refund. After running me through a few hurdles, he agreed that I should receive a refund, but first he had to let me talk to his supervisor.

While I was on hold, a thought occurred to me: I wonder whether this purchase has actually shown up on my bank statement. If it hasn’t, how can they give me a refund? I opened another screen and logged into my online banking. There was no charge from Microsoft.

Meanwhile the supervisor came on the line to explain that he was connecting to my computer to send me the refund. In the lower right corner of the screen, an icon of a remote connection program flashed briefly. Then the screen split: on the left, what appears to be a Microsoft log; on the right, my checking and savings account balances.

Scam Stoppers Notebook: DO NOT ever allow a stranger to remotely access your computer.

Now I was certain that I was being scammed. I told the supervisor that I was done with this charade.

“Please do not disconnect your computer,” said the supervisor.

“I have just disconnected,” I replied.

“Why would you do that?” he shouted. “Why do you not do what I told you to do?”

“Who do you think you are?” I shouted back. I terminated the call.

I breathed a sigh of relief at how narrowly I had averted disaster. Another minute and they might have drained my bank accounts. Feeling foolish but lucky, I had a pleasant, carefree weekend.

On Monday morning, Paypal notified me of a suspicious charge on my account. I checked my account and there were actually two suspicious charges totaling $600.

Before I had time to lodge a dispute with Paypal, my bank texted me about two suspicious charges via Zelle. Then I received another inquiry about a suspicious charge on my credit card. I felt bombarded by air, land, and sea.

One by one, I disputed the charges and changed my passwords on all three services. Two hours later, I had put out all the fires. Or so I believed.

But on Wednesday, a regional bank officer called and suggested that my computer might be infected with malicious software. He strongly advised me to have an IT professional inspect it and clean it immediately. For the sake of security, he said, he was freezing my checking and savings accounts, and he advised me to open new accounts (with new passwords, of course) at a branch bank.

The next day my IT guy checked out the computer and found two remote access programs. Because both are legitimate programs and not malware,  my anti-malware software didn’t detect them. Opening new accounts and changing passwords would not have protected me if the criminals could see what I was doing through the remote-control software. How they failed to empty my bank accounts is still a mystery.

Scam Stoppers Notebook: No legitimate organization will ever reach out to you directly, so ignore all emails, texts and calls purporting be Microsoft, Apple, the Post Office, Social Security, or your bank. If in doubt, reach out to them directly through known channels. If you can’t visit in person or call directly, just don’t. Trust your intuition and assume it is a scam.

Sadder but wiser, I hope you can learn from my mistakes. Next time I react to a message with anger or urgency, I will stop and call someone and put my suspicious senses into high alert. Unfortunately, artificlal intelligence has made it much easier for criminals and much harder for their victims. So apply the new rules: Ignore all triggering emails.