Evil is Lurking Out There

Image via Wikipedia

Post Script: This cyber criminal is now using the name Kimberly Locke. 

I’m predisposed to consider Life to be a wonderful thing. I can’t defend this perspective with a rational argument. It’s just how I’m wired, and I’m grateful for it. I suppose the alternative type of wiring would be depressing. It's so easy to worry all day, every day, about overpopulation, pollution, global warming, and the general decline of civility. If ignorance is bliss, then my inclination to see the good in the world must be evidence of my naïveté. I'm okay with that.

But there are definitely pockets of Evil all around us. I tend not to spend too much of each day thinking about terrorists and maniacal dictators and child molesters, but I know they are out there. And in the past few days I came to face to face, in a cyberspace/virtual manner, with true Evil.

I recently determined that I needed a backup power wheelchair- to supplement my iBot. Long story short- I bought a used one, but soon realized that it was actually too small for me. So I put it up for sale at craigslist.org (and a couple of other places).

A few of days ago I received an email inquiry about the wheelchair:

Hi,
I'm interested in buying this item, and I'd like to know if its still available for sale?can you give me more details about it?like how long you have been using it? Did you bought it new?(are you the first owner, did you get it from someone trustworthy) Is it still in good working condition? Not trying to be rude here, but there are tons of crappy items out there and don't want to be stuck with something in bad condition. Can you provide me more pictures of it? Finally what's your last price? Get back ASAP.
Thankx.
Tracy

Three things stood out to me about this e-mail. First, my advertisement included four photos of the wheelchair from various angles. How many more photos did this person need? Second, I felt like saying "You don't get to ask me what my best price is. Make me an offer and see how I respond. That's how a negotiation works." But I didn’t. Third, the typing/spelling and grammar was terrible, but not completely unusual for this type of communication. Here was my response:

Tracy,
Yes, I still have the chair.
I bought it a couple of weeks ago, not knowing that the seat was too small for me. It's like I went to the store and bought a pair of pants without trying them on :-)
The guy I bought it from said that his mother had passed away recently, and had used the chair for only 5 - 10 hours. It looks to be in great shape, and operates well, so I have no reason to doubt him.
I live in Scarborough. Where are you located?
I asked $1625 with the intention for taking an offer of $1500. Let me know if you'd like to see it. Attached is one more picture.
Mitch

So far, so good. The next day I received this response from “Tracy”:

Hi,
Thank you very much for the details. So Sad im buying this for myself(im an handicapped and I need this to make my life more better again), for this reason, I will not be able to come and see it, but I will take your word that its in good condition. Just to let you know that you will not be responsible for shipping and handling. I have made an arrangement with a shipping company who will come to your location for pick up. Kindly provide me your full address, so i can forward it to the shipping company to calculate the cost of pick up for me. Please get back to me as soon as possible.

Notice that she didn’t answer my question about where she lived. I was starting to smell a rat, so I asked Kim, via email, if my concerns were justified:

Kim,
What could be wrong with this? What are the risks of me giving my address?

And Kim replied:

Gretchen just searched your name in Scarborough online, and got our home address and home phone number. No risk in you giving it out now :-)
When we put Tracy Grubbs into the search, the closest one out of the 16 listed was in South Carolina.
I would make sure we have all $$ up front prior to letting the wheelchair go.... maybe she could use PayPal instead of a check???

This made sense to me. Proceed with caution, but continue to proceed…I emailed her my home address. Then I received this email from “Tracy:”

THank you so much. I have forwarded the address to the shipping company so they can calculate the pick up and delivery cost for me to make the payment. I'm sure they will contact you soon. I would like you to know that the payment will be made via PayPal, All you have to send me is your paypal email address so I can make the payment immediately. Also I will be including the pick up cost with the total payment so you will help me send it to the shipping company via Western union money transfer as soon as you receive the payment from paypal. I would have done it myself but I'm an handicapable, i cant walk and thats why i need this to make my life more easier again, I will appreciate your help here.
Please note that I will include additional $80 for the western union charges to send the pick up money to the shipping company.

Now things were definitely getting weird, and I began to assume this was probably fraud, but decided to proceed with care, so as not to miss out on a potential, although unlikely, sale. I was confident that I could not be scammed. That was a mistake. I replied:

Tracy,
I'm glad you are moving forward with the purchase. My PayPal email address is the one we're using right now.
I'm not clear on this shipping situation. Why can't I just hand a check to the company when they come to pick up the unit? Or why can't I pay via credit card or PayPal? I've never used Western Union.
Mitch

Her response, which did not answer my shipping questions, was:

Hi Mitchell,
I have made the payment now as promised. You will be receiving the payment confirmation message from paypal regarding the payment. The shipping company wants $500 for pick up and delivery. So I made a total payment of $2,230. $1650 for the Chair, $500 for the shipping company, and $80 for whatever Western Union will be charging you to send the money to them. Please let me knw as soon as you send them the money ASAP. thank you.

Hmmm. I read this email on my cell phone, and needed to wait until I got home to see if the money was really in my PayPal account. I was doubtful. Then, almost immediately after Tracy’s email, I received an official looking email, complete with PayPal logo, which read:

Dear Mitchell Sturgeon,
My name is Richard Wilson. I'm a PayPal representative in charge of your transaction with Tracy Grubbs.
Kindly reply to this message if you have any question regarding this transaction and I will be happy to help you.
We thank you for being an asset to PayPal and we hope to serve you better in the nearest future.
Sincerely,
Scott Thompson
President
PayPal Inc.

Now this is where the cybercriminals really got sloppy. He told me in his opening sentence that his name was “Richard Wilson,” but signed the e-mail “Scott Thompson.” And I really didn't think the president of PayPal would be concerned about my little transaction. I became quite certain that when I got home, there would be no $2,230 deposit in my PayPal account, and indeed there was not.

I found a PayPal email address to report fraud, sent off copies of these emails, and received this response from the real PayPal:

Hello Mitchell Sturgeon,
Thanks for forwarding that suspicious-looking email. You're right – it was a phishing attempt, and we're working on stopping the fraud. By reporting the problem, you've made a difference!
Identity thieves try to trick you into revealing your password or other personal information through phishing emails and fake websites.
To learn more about online safety, click "Security Center" on any PayPal webpage.
Every email counts. When you forward suspicious-looking emails to spoof@paypal.com, you help keep yourself and others safe from identity theft.
Your account security is very important to us, so we appreciate your extra effort.
Thanks,
PayPal

It's been about 48 hours since I last heard from the cybercriminals. I expect that since I did not respond to the official-looking PayPal e-mail, complaining about my lack of payment, they are done with me. They didn't get any money from me, but in retrospect, I’m not sure that was their only objective. They got my mailing address, which as Kim stated is public knowledge. They got my PayPal e-mail address, which shouldn't allow them to do anything. Nevertheless, if their job is to build an identity-theft portfolio for me, they just put together a couple pieces of the puzzle. I thought that I only needed to be careful enough to not lose money or my wheelchair on this transaction, but that may not have been the game. It may have been an identity theft game instead.

It's easy to see in hindsight that I should not have provided any of this information, but it was less obvious to see in real time. These identity thieves tend to work on the more expensive products advertised at places like craigslist, because they know they can string us along longer due to the potential of a significant sale.

Let’s review the red flags. No single red flag necessarily should have indicated to me that this was a fraud, but the combination certainly should have:

1. Poor spelling and grammar- points to potential offshore criminals.
2. No indication of the buyer’s location or address.
3. Buyer asking to proceed ASAP.
4. Buyer indicating that she will take care of shipping and asking for my shipping address.
5. Buyer telling me that they will use PayPal, instead of asking me if that is the preferred method of payment.
6. Buyer mentioning the use of Western Union.
7. Shipping cost being a nice round number of $500.
8. Buyer avoiding answering any of my questions.
9. Poorly written letter from PayPal, with name change from opening to closing, and trying to get me to think that the president of PayPal was writing to me directly.

I proceeded as far as I did with these people due to my supreme confidence that I could not be scammed. But they are pros. We may have been playing different games. I was confident the wheelchair would not leave my possession without cash in my hand. In retrospect, I should've stopped this as soon as I smelled any kind of foul odor.

As a result of my folly, I decided to sign up for an identity protection service at about $15 per month. I certainly didn't need this expense, but it may be money well spent. I also changed my PayPal email and login information. I won’t be changing my home mailing address though :-).

It’s one thing to pull a scam, but to pretend to be a handicapped person, and try to steal from a wheelchair user? That is beyond reproach. How do these people sleep at night? They must be a different sort of person than you or I.

I'm so disgusted by this experience that I'm almost… angry, but not quite. My internal wiring overrides that urge. It was a learning experience for me, and I simply want to share it with you.

I’m not going to let this episode change my outlook on life. That would be a victory of sorts for the criminals. I still think the world is a wonderful place, even if that means I’m ignorant or naive.

Oh, does anyone want a nice wheelchair for $1,500? Heck, I’ll take $1,200 now. It reclines!