I was in the shower when the phone calls began. A friend rang to tell me she had received an email saying I was stranded in the Ukraine having lost my passport and “cell phone”, and urgently needed £2,100 to settle my hotel bill and get home. Since she’d only seen me the previous day she knew it was a scam.
Checking my mobile phone, it was full of texts and voice mails from other concerned friends with the same message. When I actually opened my email my entire address book of nearly 1,000 business and personal addresses had disappeared. Knowing I couldn’t send out emails warning my friends and contacts, I hurriedly put a message on my Facebook page and on Twitter to ignore my plea for money, handy though it would have been, and to assure everyone I wasn’t stuck in the Ukraine.
I had no inkling at first how it had happened. Then I realized I had opened an email the previous day, supposedly from my internet provider BT, saying I needed to confirm my email address as it was introducing changes. Unless I did so, I would lose my address and access to my emails.
As a freelance journalist my email is an essential tool and I didn’t want to be without it. I clicked on a link in the email, filled out the resulting form and entered a code I had been given. Both the email and the form looked official, but when I submitted the form it refused to accept it.
I remembered reading about BT introducing changes to its email accounts and went on its website to check. There it confirmed that the BT Yahoo! portal was closing over a number of weeks. On re-reading the email I realized it said the deadline for confirming that I wanted to keep my email address had expired the day before the email was sent. I was livid and even submitted a complaint to BT. Still I wasn’t suspicious; the best lies are based on an element of truth.
The next morning, I was hugely embarrassed at having joined the ranks of the 3 million people in the UK who fall victim to scams each year. Citizens Advice estimates that almost half of us (48%) have been targeted and that £3.5bn is lost to this type of fraud a year.
I rang BT and the first person I spoke to “took over” my computer and checked the phishing email I’d been sent. Although it looked like it had come from BT Yahoo!, when they hovered over the sender’s name without clicking on it, it came up with a “Davan Wilson”. I wish I’d checked that.
The BT assistant said Davan would be an innocent person with BT internet who had also fallen for this scam. After 45 minutes I was still no closer to getting my email addresses restored, although I had changed my password and security question twice. So I was transferred to another assistant. After another long wait and another change of security details she spotted that the phishers had changed my email settings so that replies were redirected to a different address still in my name but ending “yahoo.com” rather than “btinternet.com”.
The first assistant hadn’t picked this up. When I asked why I was told the first person was in the broadband department, not email as I had requested two hours earlier. The time wasted was infuriating. It also meant that any emails sent back to me checking whether the begging message was genuine would be diverted to the scammers who would no doubt tell the senders where to send the £2,100. In fact, some friends said they had received a further email doing just that. Fortunately, no one fell for it as the English was ungrammatical and littered with Americanisms.
It took until lunchtime to resolve and I spent the rest of the day taking calls and answering emails from friends and colleagues about it. It was 48 hours before my email addresses were restored. In the meantime, I could have lost work and some of my friends could have lost money.
These scam artists are time wasting crooks, invading us in our homes and trying to rip off our friends. I have learned never to click on a link in an email message, no matter how genuine it appears. In future I will close the browser, reopen it and type the address directly into the address bar.
It’s also a good idea to check the sender’s address, but be aware that phishing emails often contain very plausible email addresses. For instance, HMRC says recent false tax rebate emails had the spoof address email@example.com. If in doubt, Google it and see if you land on an official website. If not, be cautious.
Phishing emails often create a sense of urgency by saying something like you only have “one day to respond”. That certainly caught me out. They also usually have a generic greeting such as “Dear customer” rather than your name. Never give out bank details, passwords, pin numbers or credit card details. Also, never open attachments, as these could contain viruses which can then search other areas of your computer’s hard drive.
Report the phishing attack by forwarding the email to the organization it pertains to be from, then delete it. Also report it to the police at Action Fraud, or ring 0300 123 2040.
The fraudsters are getting smarter all the time. I dread the day they learn how to write perfect English.