Recently, I've had a number of bad events occur. Supposedly, these things happen in threes, and I'm hoping that's how it goes. I won't share the first two event details. Needless to say they are both very upsetting and expensive events. The third event was VERY expensive. And very avoidable.
What made it particularly galling was how it happened to me, someone who is ridiculously careful online because among the roles of previous jobs I've held, one has been the management of online privacy and data. Compelling partner companies to take extra effort, steps or other precautions to protect user data and information.
If your company is like mine, you take tests each year to identify several different forms of potential identity capture. Phishing, Spearphishing, downloading Trojan horses, etc. There are many ways to do it, and I'm familiar with all of them. I've always passed these tests with flying colors, and I've even caught several transgressors over the years.
Before I tell my own, very humbling, story, let me say this kind of event is not just an issue of being online. My stepmother is not as adept online as I am, so does not engage the internet to nearly the degree I do. Yet several years ago she was scammed out of several thousand dollars in attempting to do something good for her grandchild - so she thought. Unfortunately, she (much like I am about to detail) missed one or two key details in her situation, and fell victim to a con over the phone. Anyone can be a victim.
My situation involved an online trading account. It was not a particularly small one, but not my 401(k) either. It is a side trading account where I 'have fun' from time to time. Well, the story goes like this.
I know better than to click links in emails, or follow any email directions that lead me to strange sites. I'm also very prudent about typing in URLs when I want to visit sites of this sort. It's (usually) the best way to securely get to where you want to go. I won't bookmark very often, because bookmarks and other information can be stolen. I don't keep passwords hidden on my computer, and I am very careful about my password choices. These are all important details.
Criminals, however, look for moments of weakness and exploit them. So you can be doing everything right, and there can still be a problem and you must be aware at each step along the way.
For this particular account, I hadn't signed on in a few months. So I felt I should visit it, check in on it, and see what was happening. I typed in the URL and signed in, and was met with a message that "your account has been blocked due to identification of a new device." This is not uncommon. New devices won't have the same identifying information that previous devices do, and as a security measure, it's a good one to have. So I contacted their help desk.
I was asked if I had my two factor authentication ready and I did. Now many online accounts will also require ID in the form of a picture ID (driver's license will do) followed by a picture of yourself from an online camera. Again, good precautions.
I went through each step, sharing the Driver's License, then snapping the picture, and finally getting an email asking if I was asking to unblock my account. Each step was one I was familiar with, but this was where I made a critical error.
I was asked for my two-factor authentication to be provided to the help desk chat. I provided it. I waited several seconds, then was told that I could enter my account, but to sign off and sign on again, again - a perfectly normal procedure.
The problem was, when I signed back on and opened my email, I was met with a message that I'd transferred all the money in the account to a wire account.
I freaked out, quickly signed on to my now seemingly unblocked account and indeed - it was empty. I contacted the help desk and walked through the procedures and that's when I noticed my error. Well, really 2 errors.
When I'd typed in the URL, I must have made a small typing error and gone to a fake site which pretended to be my account. The look, the design, the pop ups - everything was perfectly done. I know this happened, because once I determined what had happened, I tried the URL again and did several variations of error until I got it - if you type in the name a particular way, there is a very quick, almost unnoticeable, transfer to another website an if you don't pay attention closely, you'd miss it. That was my first error.
That alone did not doom me. I've visited this site several times since as I shared information with the DA, Police, and the real online site. It is a very craftily designed site, and I give the criminals credit. If they put this much effort into real work, they'd be successful. I shared, with the online site, several ideas to help prevent something like this happening again. 2 or 3 simple ideas that won't take much to implement. For example, while I received an email notification that I had transferred the money - why didn't I receive one asking IF I WANTED TO TRANSFER THE MONEY? I can point fingers at their failure(s) all day long, but ultimately the failure was mine and mine alone.
My failure was sharing the two factor identification IN THE HELP CHAT. It was here that they were enabled to actually enter my account. I'd managed to unlock it. But for them. I knew better, but for some reason that I can't put my finger on, I didn't stop there and think "hm...that's weird...why do they need this?" To me, it just seemed logical.
I can't describe the feelings I've had since them. Mixtures of shame, humiliation, fear that they could have done more - or may do more - if I am not more careful. But the monetary damage alone is significant. Not backbreaking, not small. Just large enough to give me pause and rationalize that "at least I have my health".
It's a strange thing to say, but it's true. Because right now I'm dealing with family members who do not have their health, and face far, far worse financial situations as a result.
I've never been one, because of my background in online data and privacy, to make fun of people who fall for scams. I'll share advice, provide a level of sympathy, and now can even experience a level of empathy with others who go through an experience like this. It's not easy.
Several hours after it happened, I called my stepmother and told her what happened to reassure her that even so-called 'experts' can be had. I felt it was meaningful because her experience had shaken her to the core - as my own had to me - and struck at her confidence, just as it had struck at mine.
For what it's worth, the online account firm is doing an investigation, and so is the District Attorney (who recommended I also notify the FBI Cybersecurity division). So I'm not sitting down on this. I will be realistic. I won't get the money back, and it was a valuable, if expensive, lesson to learn.
On a personal note, one of my recent personal 'crusades' is to push back against 'experts'. "Expert" is a term used far too loosely these days. In fact, I've spoken at several industry events where I have been called an "expert" on this very area. As a friend of mine said as I detailed the events "Bulldog, you geek out about this stuff...if you can fall for it, it shows how good the criminals are getting." Well, no. Maybe it's just that we all have moments of weakness that we need to guard against. As my cousin (who has been speaking as an "expert" in his field for several years) asked my son "What does it take to be an 'expert'?" Well, the answer is simple. Just have a few people recognize that you know your stuff in whatever you're talking about, get invited to write or speak on it, and suddenly you'll be a recognized "expert". So I am an "expert" on this stuff, but reality is the term means absolutely nothing. It's a nice thing to be called, but doesn't make you immune to error.
A last thing I'll share. Over the past few nights, I've had disturbing dreams of someone trying to break into my house. I woke up from one, after experiencing some sleep paralysis, with a loud yell, literally willing myself up and shaking off the paralysis. I know what's causing it, and I'll have to work through this period and get myself to a better mental place. Sharing my experience with others has been helpful. I know I'm not alone - and I hope that my experience and advice can help others.
