I Never Thought I Could Be Scammed ... Until I Was

Aside from my bruised ego and rattled nerves, I was unscathed. My money hadn’t left my account and, after a brief investigation of the original invoice, PayPal closed the case in my favor.

Until this, I’d prided myself on being wise to phishing scams. I know to check a sender’s email address and not to click links. I delete all texts from unknown numbers and go directly to the source whenever I’m notified of problems on my accounts. But this criminal tricked me into responding by alerting me to his own fraudulent activity. Combined with spoofing the sender’s domain to appear as a trusted source, this was a whole new level of deception.

Darius Kingsley, head of consumer banking practices at Chase Bank, says scammers are always evolving their tactics, even using AI (artificial intelligence) to replicate the voice of a loved one in trouble who needs money immediately. “They can also spoof a contact’s phone number so it looks like a friend or family member is calling you, making the scam more believable,” he says.

McAfee’s Global Scam Message Study, released late last year, revealed the sophistication and volume of scams as significantly better and larger than anticipated. A key finding: People receive an average of nearly 12 fake messages or scams daily, via email, text or social media.

Roma Majumder, senior vice president of product and design at McAfee, says scam artists wait for any opportunity, and when we take security shortcuts for speed or convenience, they take advantage. She explains that access to advanced technology has made it even easier for cybercriminals. However, companies are also using that technology to try to stay ahead.

For example, Scott Knapp, director of worldwide buyer risk prevention for Amazon, says a passkey — a newer two-factor authentication method — is more secure than a password. It creates an encrypted connection between a website or app and your device using the same biometrics you’d use to unlock your device, such as a fingerprint or face ID.

Those I spoke with emphasized the importance of staying vigilant, using available tools to protect your devices and transactions, and reporting all fraudulent activity. Companies like theirs are working with telecoms and web-hosting providers to outsmart cybercriminals.

“Last year, we took down over 40,000 phishing websites and over 10,000 fraudulent phone numbers,” Knapp says. “So reporting can make a very real difference.”