Scam Targets AT&T Customers to Steal Cellphones

(MUSIC INTRO)

[00:00:01] Bob: This week on The Perfect Scam.

[00:00:05] Nate Lewis: I went and opened it up and called the number that they gave me, 'cause there's a number that they tell you to call in order to receive the discount, because if I go through the regular method, I won't get the promotion. They asked for the serial number of the phone. I give them the serial number. And then they put me on hold again. They come back. They're like, "Oh, we're sorry, the phone that you have belonged to another customer. Sometimes they get mixed up in, in the shipping.” I'm like, really? That's never happened before.

(MUSIC SEGUE)

[00:00:53] Bob: Welcome back to The Perfect Scam. I'm your host, Bob Sullivan. It's a story as old as commerce and crime. Why steal something yourself when you get someone else to steal it for you? But in the digital age, criminals have so many more tools they can use to turn regular people into unwitting accomplices. Regular people like Nate Lewis, a school bus driver from Round Lake, Illinois, right near the Wisconsin border, he was taken for a ride by cellphone thieves recently and he's worried the exact same thing might happen to you.

[00:01:33] Nate Lewis: I am a bus driver.

[00:01:35] Bob: Which is a calling, if you ask me. You work with kids, right?

[00:01:38] Nate Lewis: Yes.

[00:01:40] Bob: So all, all ages?

[00:01:42] Nate Lewis: I have worked with all ages. I do high school currently.

[00:01:46] Bob: So does that mean you are about to get a break for the summer?

[00:01:50] Nate Lewis: We're already on break, but we'll be heading back soon in August, August 12th, actually.

[00:01:56] Bob: Oh, okay, that's, that must be a, it must be fun being on a school cycle though.

[00:02:01] Nate Lewis: It is, it actually it helped me 'cause I was a single parent, so when my son was out of school, I was out of school. So it helped a lot.

[00:02:10] Bob: It's fall 2025. The school year is still new and it's a busy time for someone like Nate when he gets a phone call. And it's a call that will ultimately cause him to lose sleep for most of the rest of the school year. He doesn't answer the call, but he listens later to the voicemail. Here it is.

[00:02:32] (voicemail) Hi there, I'm calling you from AT&T and DirectTV to let you know that your existing account qualifies for a 50% discount that can save you money on your monthly bill, and you can also check for the eligibility of getting a free phone. In order to avail the promotion, please call us back on the same number from 8 am to 5 pm according to Pacific Standard Time. Don't miss out on the savings. Thank you and have a good day.

[00:02:57] Bob: Hey, AT&T, that's Nate's provider. Nate, like most of us, has a hefty phone bill, so a 50% discount, that gets his ears perked up. And when he gets a chance, he calls the number.

[00:03:12] Nate Lewis: So the first thing they say, they give me the spiel, and you can save 50% off your monthly bills from AT&T. And I was like, okay, and get DirecTV. That sounded like a good deal. One of the things was that they said I would have to get a new phone.

[00:03:31] Bob: Uh-huh.

[00:03:31] Nate Lewis: I wasn't too particular about it, but if it was going to, and they said that it wouldn't initially cost me anything except for the taxes on it.

[00:03:41] Bob: Hmm, okay.

[00:03:44] Bob: Everything sounds normal, even the hold music when they put him on hold, and he's on his own account at the AT&T website.

[00:03:53] Nate Lewis: I'm like, okay. So they walked me through the steps, it was like taking my hand and pushing a button going, how to order those things, but the funny thing is, they knew who I was. I didn't have to give them my name.

[00:04:10] Bob: Hmm.

[00:04:11] Bob: If Nate agrees to a new phone now, well the savings are going to be substantial. He's currently paying about $160 a month.

[00:04:21] Nate Lewis: Yes, so I'm like, okay, I'm going to get half off of those.

[00:04:25] Bob: Yeah. That's pretty steep. So 80 bucks a month is a lot of money. It's a thousand dollars in a year.

[00:04:28] Nate Lewis: Yeah.

[00:04:30] Bob: And so it's time for him to pick a new phone.

[00:04:34] Nate Lewis: Yes. So they went to, and you know they're showing, "Okay, what kind of phone would you like?" So of course, I went for the newest phone they had out there. And they said, "Okay, well you have to pay for the taxes on that and that's it." So I'm like, okay. And that's what I did.

[00:04:54] Bob: The checkout is easy. They don't even ask for a credit card. The payment for taxes just gets added right to his account balance.

[00:05:03] Bob: At some point does the website say, okay, $1000 is going to be added to your bill, but they tell you, don't worry about that. Does something like that happen?

[00:05:11] Nate Lewis: Well, no, 'cause that wasn't, so I didn't see any of that. What I saw was the initial cost was the taxes on it.

[00:05:20] Bob: Hmm, okay.

[00:05:20] Nate Lewis: 'Cause they were like, the only thing it's going to do, it's going to charge you for the taxes on the phone.

[00:05:27] Bob: And even more good news, they tell him he doesn't even have to give up his old phone.

[00:05:33] Nate Lewis: And that was one of the things I asked them. I said, "Do I have to trade in my, my old phone?" And they were like, "Oh no, you can keep your old phone."

[00:05:41] Bob: Hmm, hmm-mmm.

[00:05:41] Nate Lewis: "Give it to somebody who would like it." I'm like, oh, okay.

[00:05:46] Bob: That's great. Yeah.

[00:05:48] Bob: So like anyone, Nate is excited about getting his brand-new iPhone, and of course, he's excited about the savings too. He doesn't have to wait long.

[00:05:58] Nate Lewis: So a couple of days, I think they came the next day via UPS.

[00:06:04] Bob: That's pretty quick. Wow.

[00:06:05] Nate Lewis: I, I know. But I wasn't here to receive it. Here's the thing; they called me that they're saying, "You missed the UPS for the phone. Make sure you're there tomorrow so that you can sign for it." Alright?

[00:06:22] Bob: They, they knew you hadn't gotten the pickup. Wow.

[00:06:24] Nate Lewis: Exactly. I'm like, okay, I've never known AT&T to, to be so involved, but yeah, I get it, okay. So the next day it comes, and it was about 11 am that the phone comes. So I didn't mess with it the first day.

[00:06:44] Bob: He's too tired from driving the school bus all day, plus there are special instructions for activating this phone.

[00:06:53] Nate Lewis: On the second day, I went and opened it up and called the number that they gave me, 'cause there's a number that they tell you to call in order to receive the discount, because if I go through the regular method, I won't get the promotion.

[00:07:09] Bob: Hmm-mmm. They were very stern with, don't call your regular number to activate this phone, call this other thing.

[00:07:14] Nate Lewis: Yeah.

[00:07:14] Bob: Okay.

[00:07:15] Nate Lewis: Because this is how you'll get the promotional. So I'm like, okay.

[00:07:20] Bob: Got it.

[00:07:20] Nate Lewis: So I, that's what I did.

[00:07:22] Bob: So he calls the special number and well the discount must be popular because he's on hold for a while. Finally, an operator gets on the line.

[00:07:33] Nate Lewis: So then they asked for the serial number of the phone. I give them the serial number. And then they put me on hold again. They come back. They're like, "Oh, we're sorry, the phone that you have belonged to another customer. Sometimes they get mixed up in, in the shipping."

[00:07:57] Bob: Ooh.

[00:07:58] Nate Lewis: I'm like, really? That's never happened before.

[00:08:03] Bob: They've sent him the wrong phone. He can't activate this one, and in fact, if he wants to get the discount, he'll have to send it back.

[00:08:13] Nate Lewis: I'm like, oh, okay. So they was like, "When you send back this phone, and we receive it, then we'll ship out your, your phone." And then they sent me a text with the bar code to take to UPS.

[00:08:30] Bob: That sounds like a huge pain in the ass.

[00:08:33] Nate Lewis: It was, because my hopes was high and then I was like, "What about can we start the promotional now?" And they were like, "No, we got to get things and get the phone activated."

[00:08:42] Bob: Yeah, yeah, but then meanwhile you got to like get in your car, drive to a UPS and wait...

[00:08:47] Nate Lewis: Yes.

[00:08:47] Bob: ...another few more days, right, yeah.

[00:08:49] Nate Lewis: Exactly. And I did that. I shipped it off the next day and something told me to keep the shipping label.

[00:09:01] Bob: So he drives across town and ships the phone back to the address supplied by the operator. And waits. A few days go by. He expects a phone call acknowledging receipt and a chance to initiate the process again, but nothing.

[00:09:18] Nate Lewis: So I called back, and I asked to speak to them, but there was some other guy that's on the line. And he says, "Well you didn't get your, we didn't, you didn't receive your new phone? We're sorry about that. We do apologize. So to make up for that we'll give you two more items plus the phone that you were supposed to have." I'm like, "Really? That's, o--, okay." So then they told me to pick two.

[00:09:50] Bob: As compensation for the frustration, he gets to pick a couple of gadgets as gifts right from the AT&T website. He picks out an iPad...

[00:10:01] Nate Lewis: And same process. They took me through the ordering process and picking them out. And so I think this time they were shipped through FedEx. So I get the products, probably next day, I can't remember.

[00:10:21] Bob: And once again, he has to call that special number to activate the phone and get the deal.

[00:10:28] Nate Lewis: So I called them to activate the iPad and the phone. First, they said, "Well the promotion for this phone ended yesterday."

[00:10:40] Bob: Oh my God.

[00:10:41] Nate Lewis: I'm like, "It ended yesterday?!"

[00:10:42] Bob: Ah.

[00:10:44] Nate Lewis: They's like, "Yes. So we'll need you to ship that phone back to us so that we can send you another phone."

[00:10:56] Bob: Ship those devices back too? Well that's really frustrating. Here's what that call sounds like.

[00:11:02] (call) "So why do we have to go through all that? Why can't I just go into a, a, a AT&T store." "The store, no sir, there, not affiliated with the promotions. They are our sale partners, so if you go for the activation there, they are going to activate them on the installment plans. That's what I'm telling is right now these devices are on these installment plans. So if we get these registered under your name, Mr. Lewis, it means we are registering them under the installment." "Alright, so you're saying I have to send this in first before you ship out the other stuff." "You have to do it all immediately, Mr. Lewis, so we can get that package on the way because the policy says unless you have a package in your possession, they are not going to send you another package. So it's already there. We'll wire this back to UPS partners once you drop this package off at the UPS store with the prepaid code that is generated on your AT&T files." "Now I, I get that, so you want me to send this off today, and then Monday I will get a new iPad and, and..." "You are going to receive four total, total four things on Monday. One, first one is going to be an iPad, so 13" with a silver cover. Then you're going to have an i--, iPhone 17 ProMax with an orange color. The reason why that orange one was canceled because the, the promotion is going on on the silver, not on the silver one but in your, in your order, there was a silver phone, not the orange one. So what we're going to send you is an orange 1 terabyte phone, and a blue 1 terabyte phone, and the fourth thing is going to be an $85 gift card, sir, and that's now what I just promised to you for all this inconvenience, I'm getting you $85, so you can use that money at Walmart, at a gas station, at any drugstore, or at any like AT&T store."

[00:13:01] Bob: Again, they give him shipping information.

[00:13:04] (call continues) "That's what you need to show to the UPS store is the prepaid code. Once you show this code to the UPS store, they'll scan this code and they will print your shipping label, and they will ship this box back." "Okay. So one last time, correct? I don't have to go through this again?" "Exactly, that's going to be my guarantee, I assure you that now." "Okay." "Because I'm taking care of this, I have already done this, this for you. Get everything set up, so you're good to go."

[00:13:37] Bob: Despite this guarantee, Nate doesn't like the sound of any of this, so instead of going to the UPS store to ship the gadgets, he calls AT&T.

[00:13:50] Nate Lewis: I'm like, look, I was supposed to get a promotion, a promotional on this phone, and this is what's happening." So I went through the whole thing with them.

[00:14:01] Bob: We have no such program AT&T tells Nate, and that address you shipped the phone to, it's not us. Nate was used in what's known as a reshipping scam. He unknowingly ordered the phone from AT&T and then shipped it along to a criminal.

[00:14:19] Bob: What was that like? How does that feel?

[00:14:24] Nate Lewis: My heart sunk, that is I oh, you know, I've been caught up in this scam. So it's, and like I said, I'm usually the guy who's always skeptical.

[00:14:39] Bob: So he's not going to get any discount, but what about those gadgets he has now, and the phone he shipped back to AT&T?

[00:14:47] Bob: What did AT&T tell you to do with them?

[00:14:51] Nate Lewis: They didn't. They said that I was responsible for them.

[00:14:54] Bob: Oh boy. Uh-oh.

[00:14:56] Nate Lewis: Yeah. But lucky for me, I didn't open up either one, so I went to the AT&T store. I went to the one that's near me, and they were like, "Oh, we don't take these things back. You'll have to ship it in."

[00:15:10] Bob: Oh God.

[00:15:12] Nate Lewis: And yeah, I didn't want to do that. I was like, I'm not shipping this thing back in.

[00:15:17] Bob: Yeah.

[00:15:18] Nate Lewis: Because I heard that AT&T, they always take these things back. So then I went back home and then I called AT&T and they told me that the store near me takes them back. So then I called back the store, and I talked to someone, and they says, "We don't do it, but the corporate stores do it."

[00:15:35] Bob: So he's able to return that second set of gadgets, but...

[00:15:40] Bob: What about the first phone?

[00:15:42] Nate Lewis: So now I'm on the line with AT&T trying to get this figured out. I'm stressing, right, because I know that this thing is out there, and it doesn't seem like anybody's trying to help.

[00:15:57] Bob: And finally, he gets the bad news via email. It says...

[00:16:03] Nate Lewis: "So you're responsible for that." Okay, for that phone. And the price was like $1200.

[00:16:13] Bob: Ouch, oh God.

[00:16:15] Nate Lewis: And not only that, but I was paying for service.

[00:16:19] Bob: Right. Oh you were paying for service on this new phone.

[00:16:22] Nate Lewis: Yeah, so I was paying for service on this phone.

[00:16:25] Bob: For like two services then?

[00:16:27] Nate Lewis: Yes.

[00:16:28] Bob: Well that, how did that happen? (chuckles) That, obviously that...

[00:16:33] Nate Lewis: It was considered a extra line, so I was paying for that extra line service, which I never activated.

[00:16:41] Bob: As of now, Nate is on the hook for a $1200 phone and he's paying for service on that phone.

[00:16:49] Nate Lewis: Yeah. So, I was like, okay, this is not working. So I made the second claim, and I actually spoke to a live person. And I forget her name, but we were on the phone for an hour and a half and she was typing everything down, I kid you not, typing everything down, what I was telling her, and then at the end she claims that it was erased.

[00:17:17] Bob: Oh God.

[00:17:18] Nate Lewis: And would you like to go over and do it again? I'm like, we're on here for an hour and a half and I have to get out of here and go to work.

[00:17:26] Bob: You've got kids to drive to school right?

[00:17:28] Nate Lewis: Oh yeah, exactly, to drive back home.

[00:17:31] Bob: This all started back in the fall. Well now it's January 2026, and Nate is still going back and forth with AT&T about this new phone.

[00:17:41] Bob: So did you end up, are you on the hook for that money?

[00:17:45] Nate Lewis: Well, you know, it's funny because I came across a commercial about CBS investigations, like you know how they do the investigation, and I talked to one, someone on the team. And she called AT&T. Because they were like, you are responsible for that phone. So I'm losing sleep, because, you know, I'm stressing.

[00:18:11] Bob: Yeah, that's a lot of money to you, right?

[00:18:12] Nate Lewis: Yeah, and I'm like, I’ve been with them for a long time and it looks like that I'm not just going to have to pay this, but I'm going to be losing my service, because that's a lot of money to be trying to come up with. And I didn't go through all the details about because they were, it was coming up on my charges, on my monthly bills. I was like, okay, this is supposed to be in a claim. So the guy was like, "Okay, what we'll do is set that off for a couple months so that the claim can catch up to the bill and it'll be taken off." Alright, so I'm like, that gave me a little comfort, but I wasn't too comfortable with that.

[00:18:54] Bob: You still think there might be a $1200 bill showing up in a couple months, right?

[00:18:57] Nate Lewis: Yes. Well again, I was nervous about that, I'm like, because are they going to try to still pin this on me? Because remember, I'm going through what, over a month of this. I think this is like in January and this didn't get resolved until March.

[00:19:12] Bob: Oh my God. And you're losing sleep over this, right?

[00:19:15] Nate Lewis: I am, I, I'm stressing.

[00:19:18] Bob: Hmm-mmm. But so you talked to this reporter and what happens then?

[00:19:21] Nate Lewis: Yes. So she calls them, and I think this was on a Friday. Now somebody from the president's office calls me Saturday, and, and we talked and I'm telling, I had to go through the whole spiel with him about what happened, so he's, "Okay, we're going to get this taken off of your bill." I was happy about that, but I wasn't sure because the reporter asked me, "Did you get anything in writing?"

[00:19:56] Bob: Yeah, right, right.

[00:19:57] Nate Lewis: You know, like no, I didn't get anything in writing, but it was taken off my bill.

[00:20:03] Bob: AT&T gave this statement to CBS Chicago reporters Carol Thompson and Megan Demar. "We understand this customer was a victim of a sophisticated scam, something we take very seriously. We helped address his concerns with his account." And even after that, the criminals wouldn't leave Nate alone.

[00:20:25] Nate Lewis: And you know the funny thing is, they contacted me again with the same line about 50% off on your services.

[00:20:34] Bob: How long after did they start it all over again with you, right?

[00:20:37] Nate Lewis: Yeah, so this is like a couple months ago. I'm like, are you serious?

[00:20:41] Bob: Wow.

[00:20:43] Nate Lewis: But the one thing because I, so I went through the whole thing, I made a police report, right, when this first happened and the number that I originally called was disconnected. So they had already moved on. So they were onto something different.

[00:21:05] Bob: Hmm.

[00:21:05] Nate Lewis: So it doesn't seem like they were afraid that they would get caught.

[00:21:10] Bob: So how are things now?

[00:21:13] Nate Lewis: Everything seems pretty good. I haven't heard anything or they haven't charged me anything.

[00:21:18] Bob: And at this point you are pretty sure it's all gone away, right?

[00:21:21] Nate Lewis: Yes.

[00:21:22] Bob: Thank goodness, yeah. So, it all, in the end it just cost you a whole bunch of frustration?

[00:21:27] Nate Lewis: Yeah, a whole bunch of frustration, time, and loss of sleep. (laughs)

[00:21:33] Bob: You're trying to solve this, meanwhile you're like, I've got kids to take home. I can't stay on a hold for an hour, right?

[00:21:38] Nate Lewis: Exactly. So you're trying to take care of that and to do your job, right? This is unnecessary. And like I said, I think AT&T could have done a better job. And not just with this whole situation but making sure that if you've had these kind of things happen before, then you should have looked into it and made sure that your customers know about it. They didn't tell me, they says, "Oh, we don't contact customers by phone. We usually text."

[00:22:14] Bob: Oh great, yeah.

[00:22:15] Nate Lewis: I'm like, thanks for letting me know that.

[00:22:19] Bob: Okay, so what do you want people to remember when they hear your story?

[00:22:22] Nate Lewis: I do want I do want them to remember that these people are persistent and constant. I, like I said, they had more knowledge than what just some regular old scammer would have. How did they know that I had missed the pickup or the delivery? Like how did they know that?

[00:22:46] Bob: Somehow, they have a tracking number, right? If you have a tracking number from say UPS or, or FedEx it'll show you the status of the delivery, so I'm wondering how they would have gotten that.

[00:22:56] Nate Lewis: I never gave it to them.

[00:22:56] Bob: Yeah, that's, that's wild. Hmm.

[00:22:59] Nate Lewis: So yeah, you're correct.

[00:23:01] Bob: And you want people to realize how persistent these criminals are, right?

[00:23:06] Nate Lewis: Yeah, persistent and when it comes to trying to get you into this, this web of seduction and with these prices. And it's oh yeah, this is a good deal. And then all you have to do is do this and, because it doesn't seem like much, right? I'm like, I don't have to give them my credit card number and I'm actually going to the website that's AT&T or the app that's AT&T, and it's actually been shipped to me, so it doesn't sound like it's a scam. And it didn't hit me when they told me to ship the phone back. I'm like, what I did feel was like man, so I've got to wait a couple more days for this.

[00:23:50] Bob: Right.

[00:23:50] Nate Lewis: And, and that was my attitude, not is this, is this a scam and...

[00:23:55] Bob: I suppose it's not, I've heard of, I've actually heard of bundled deals with DirectTV before, so I, that's not so extreme and I think what makes it so shockingly believable is that a thing was delivered to you, right? Normally the first thing that happens at a crime is someone takes something from you. But you had a thing come to your house, so you maybe it didn't cost any money, theoretically, and so that's ...

[00:24:20] Nate Lewis: Right.

[00:24:20] Bob: ... real, and it came right from AT&T, right? Certainly all that looked incredibly believable.

[00:24:26] Bob: Incredibly believable. Criminals looking to steal from retailers go to elaborate lengths. To understand just how far criminals can go, we have Julie Fergerson here today. She is Co-Founder and CEO of something called The Merchant Risk Council.

[00:24:43] Julie Fergerson: The Merchant Risk Council's a global, nonprofit membership association for the world's largest eCommerce payment and fraud prevention professionals. And we've been in business now for over 25 years, and we are in APAC, Europe, LATAM, and the US, and we have members in over 97 countries, and we have 13,000 individual subscribers as part of our organization.

[00:25:08] Bob: And, and those subscribers are businesses, right?

[00:25:11] Julie Fergerson: Yeah, they're individual members of the businesses who are part of MRC.

[00:25:15] Bob: I've been to some of your conferences and what I recall is that at almost every business now, there is a very small, but ardent, team but doing everything they can to fight back crime, to fight back digital theft. And your conferences are great because it's like seeing a bunch of geeks get together and geek out about chasing after bad guys. How did I do?

[00:25:37] Julie Fergerson: That's great. Yeah, people refer to us as the engine room of the eCommerce fraud prevention crime.

[00:25:43] Bob: Ooh, I like that -- the engine room. Okay, but sometimes that's a lonely job, right?

[00:25:47] Julie Fergerson: Yeah, it is definitely a lonely job, although 25 years ago it was not cool and actually now to be in the cybercrime industry is pretty cool.

[00:25:57] Bob: Once upon a time, it was a simple as say stealing a credit card number and going to a merchant.com website and ordering something and picking it up, right? So that would be, that was the path for cybercrime. But the story that I just listened to was weeks and weeks in the making and all to steal a $1000 gadget that hardly seems like it could be profitable to me. It seems like so much work, but you're going to tell me otherwise, right?

[00:26:25] Julie Fergerson: Yeah, I don't think it's as much work as you think because these are repeatable processes. A lot of times the criminals are in basically call centers, business centers, centers, or scam compounds where they are tasked with running multiple scams all at once all day long, and they actually have quotas there's actually incentives for committing more crime. And so it's not unusual for a scammer to be working lots of cases all at once and targeting lots of victims.

[00:27:00] Bob: So it might only have been 15 or 20 minutes' work even though it happened over a, a number of days and a thousand-dollar phone for 15 or 20 minutes' work, that's probably worth it, right?

[00:27:09] Julie Fergerson: Yeah, and you come into work at 8 am and you leave at 5 pm in a scam center, and it might even be longer hours, it depends on which one, but you're working all of your scam victims all at once, so it's just a part of your job.

[00:27:24] Bob: Criminals come up with elaborate schemes like the one that hit Nate, precisely because there are folks like the people at The Merchant Risk Council working so hard to stop cybercrime.

[00:27:34] Julie Fergerson: I think that the schemes are getting more and more elaborate and it's easier for the criminals to do them with all of the awesome tools and technology that are emerging.

[00:27:46] Bob: One reason for these, I'll just call them elaborate cover stories, it seems to me is that in order to get around people who work with The Merchant Risk Council, criminals essentially have to enlist the help of regular consumers who don't know that they're being enlisted to help a crime. Is that what you guys are dealing with now is sort of unwitting assistance that criminals get from regular consumers?

[00:28:08] Julie Fergerson: Yeah, absolutely. So whenever there is a, a fraud attack, typically there are innocent victims who don't even know they're a part of the scam.

[00:28:17] Bob: Clearly Nate had no idea he was caught up in a crime ring.

[00:28:22] Bob: So would you call this crime a reshipping scam at core?

[00:28:26] Julie Fergerson: Yeah, reshipping or triangulation, yes.

[00:28:29] Bob: Oh, okay, let's define both those terms. So what's a reshipping scam?

[00:28:39] Julie Fergerson: A reshipping scam is where you've got an innocent victim who is receiving goods at their house, packaging them up, and then sending them onto the criminal. And so a lot of times they've hired, they've applied for a job and they're a victim here too because eventually their identity will be stolen because they, when they applied for the job, but in the meantime, they're accepting all the goods and everything that they ship or forward on, they actually are getting a small stipend or payment or a promise of payment, and so that's a reshipping scam. And a triangulation scam is very similar in that somebody might post something for sale on eBay that looks too good to be true, and or it might be a used good or something, and then the consumer says, yeah, I'm going to buy it and then they take the victim who they're stealing the phone from, and they send it to the person who bought the product on eBay, the used iPhone, for example. And so then that's almost a way of getting the cash out a little faster. So you're not, the crook in that case doesn't necessarily even have to get the iPhone because they're shipping it directly to somebody else where they're, they're getting the payment from a, an auction platform like eBay.

[00:29:42] Bob: That sounds even more complicated to me.

[00:29:45] Julie Fergerson: Yeah, it, all, both of them, both the reshipping and the triangulation scheme have been around for longer than 20 years, unfortunately.

[00:29:55] Bob: From a merchant perspective, why are these harder to catch than the sort of straightforward um, buying something with a stolen credit card crime?

[00:30:05] Julie Fergerson: I think that because there is a consumer, a real consumer in the middle, it doesn’t necessarily look like fraud. It has the aspects of looking legitimate. And that has been the problem for the last 3 years with AI technologies. The fraudsters are now really able to look like a good consumer, and so it's very, it's becoming very hard to differentiate from a consumer, and from a victim, and from a fraudster.

[00:30:36] Bob: So some of this is probably really obvious to you. Maybe it is obvious to my listeners, but just to make sure everybody's on the same page here, normal basic fraud fighting involves noticing that, oh, someone just ordered a bunch of phones with a credit card that has a zip code from New York, but they're shipping them to California. That's suspicious, right? So that just so it's on the table for everyone, what are the normal ways that merchants find fraud or act, get suspicious about fraud?

[00:31:06] Julie Fergerson: There's so many different ways now. Definitely looking at the address, the billing address versus the shipping address is one traditional method. Some of the other things that merchants take a look at is the path and the pattern the consumer clicks through on the website. So there's a typical path. When I'm purchasing something, I might look at it, I might read the description. There's longer and shorter pauses depending on what the content of the page, whereas if it's like an automated fraud attack, it just automatically clicks through the website. They can look at pattern seconds between pages, they can look at the IP address of the person looking at it, compare it to where their credit card's located. There's lots of different angles that when a consumer is buying on a website, you can see a buying pattern and a behavior versus when a fraudster's doing it, it's more automated.

[00:31:54] Bob: When I buy a phone, first of all, I spend about three months going back and forth. (chuckles) Put it in the cart, remove it from the cart, move it to cart, remove it from a cart, all those kind of things. So that's typical behavior, right, where the machine does all this in three seconds?

[00:32:09] Julie Fergerson: You got it.

[00:32:09] Bob: Okay, that makes sense. Okay, so the criminal's goal is to look more like me.

[00:32:16] Julie Fergerson: They want to look like a human so they can fly under the radar of the, all the fraud tools that the merchants have in place.

[00:32:23] Bob: I think this is a really important concept to try to get into, to have consumers understand because the easiest way to look like a real consumer is to enlist the help of a real consumer, right?

[00:32:33] Julie Fergerson: You got it. And that's exactly what they're doing. They are getting the consumers to commit the crimes.

[00:32:40] Bob: Wow, and by the way, also that feels terrible to the consumer, right?

[00:32:45] Julie Fergerson: Oh, absolutely. And when it happens to you, you, you really feel like, oh, I can't believe I got tricked, and the number one thing that you should do when that happens is tell somebody, get help. Tell, file a police report. Lock down your credit card, and if you've given personal information, your credit report, but what our natural instinct is to have shame and not want to share that information. It's a totally normal reaction, but the thing that we all need to do if we have any shot at winning against these criminals, is to start sharing and banding together because all of the criminals are sharing and banding together against the consumers. And that's why fraud and all these scams are just growing out of control.

[00:33:28] Bob: Now that's really interesting, because you always hear that one of the reasons that evil loses is because evil doesn't cooperate whereas the good guys cooperate. But you're telling me, at least in this world, sometimes it's the reverse of that.

[00:33:39] Julie Fergerson: Yeah, so if I am a criminal and I'm committing a scam against a merchant, I'm really easy to find. But if me, and a hundred other buddies of, that are all criminals are all committing the crime, it's going to be really hard to catch me. And so the criminals are incented because it makes it harder for them to be caught, to share as much information as possible amongst each other. So they have under, everybody's heard of the Dark Web where all the criminals are. There really is a Dark Web, and they really do sell information to each other, but they also share best practices. There's guidebooks on how to commit scams and fraud. It's very well organized.

[00:34:18] Bob: Very well organized, and working to come up with new cover stories, new ways to manipulate people.

[00:34:26] Bob: Are there any other kind of elaborate reshipping crimes that you've heard about recently?

[00:34:32] Julie Fergerson: I think the utilities and the phones are really the biggest target. There's some computer electronics and memory where the fraudsters are starting to attack as well because the prices have gone up like crazy this year.

[00:34:44] Bob: Oh, sure. Yeah.

[00:34:46] Julie Fergerson: Yeah. When the school year started back in September, there was a lot of back-to-school attacks against people saying, hey buy your kid a computer, here's the discount. And then you would order the computer, and it would be like the wrong one or maybe they'd redirect the shipping while it was being shipped to the consumer who ordered it. So there's, there's been several of those as well.

[00:35:11] Bob: So a parent orders a laptop for their kid thinking they're getting a deal, but what's going on behind the scenes there?

[00:35:18] Julie Fergerson: So one of the ones that I know about was a man in the middle attack where the criminal actually set up a website that looked like a student discount version of that computer manufacturer, and so the person entered it in, thought they were ordering directly from that manufacturer, looked completely legit, and so they even got a real receipt from the company saying, yep, it's on its way, but because it was a man in the middle attack, the criminal actually had the user ID and password, the credentials to log into the company site, and then when the computer was shipped, they change the address where it was getting delivered.

[00:35:53] Bob: Oh wow.

[00:35:53] Julie Fergerson: And so, so in this case, the consumer really was just duped with for all their information, and then the, the computer was rerouted.

[00:36:01] Bob: The theft was actually from the delivery service, not even the merchant, right?

[00:36:05] Julie Fergerson: Yeah, because they had all the U--, the UPS details to reroute it.

[00:36:09] Bob: Sure.

[00:36:10] Julie Fergerson: Yeah, it, it definitely has caused some challenges. And then there's also the traditional get it shipped to somebody's house, but then you know when it's delivered so you can go grab it off their front porch. That certainly is on the rise as well, but that's not so much a scam as they've stolen the user identity and password of somebody's account where they're ordering lots of products, and so that they now know when products are coming, so they can grab them.

[00:36:35] Bob: So that seems to me to be so risky, especially with
Ring cameras and everything. That but so somehow or another they have an army of people who run to people's houses and steal their packages?

[00:36:44] Julie Fergerson: Yeah, and I don't, even though there's all these Ring cameras, it doesn’t take much to have a hat, right? And, and...

[00:36:50] Bob: Yeah, sure.

[00:36:51] Julie Fergerson: ... you park around the street and walk over. The really good, organized ones are, know exactly how to avoid all of the cameras.

[00:36:59] Bob: It makes sense. But it also, to me it sounds like they must have representatives everywhere if they're doing that.

[00:37:04] Julie Fergerson: Yeah, they're definitely organized and the shipping ports seem, so like the cities like Miami and San Diego and New York seem to be hotspots for those kinds of scams as well. The porch pirates is what they've been coined a lot of times.

[00:37:19] Bob: A big part of The Merchant Risk Council involves regular meetings of members. I've already mentioned them, and I wanted to know what the engine room fraud fighters are talking about now when they get together.

[00:37:30] Julie Fergerson: We just talk a lot about AI, the fraudsters and how they're using AI are so good. The videos, you can just take about 15 seconds of anybody talking on video and voice, and you can easily impersonate them. And you used to be able to say, oh, with the video, turn left, turn right, or put, wave your hand in front of, and then you know it's not a real person, that it's a AI-generated avatar. But even that, the AI is now so sophisticated, those tricks don't work. And you know what I've warned all of my family members about is if you ever get a video that looks and sounds like me asking for anything, passwords, information, money, whatever it is, we have a family password that we share, and if it doesn't include that family password, you know it's fraud. And we regularly quiz each other on what the family password is so nobody will forget, and we even have a company password at the MRC, because it's happened, we've seen in the headlines impersonations of companies, but there are so many people getting those videos saying, hey, I'm your grandson and I need money. I'm on vacation and I got held hostage, and I need bail money, those kinds of things, and they prey on moms and grandmas and just unsuspecting people. And when you think it's your kid, and when you see your kid and you, or your grandkid and you hear their voice, you panic. That's just where you immediately go, and all rational thought goes out the window. And so we spend a lot of time talking about that AI tactic and how we're going to be able to detect it. The other one that we're spending a lot of time talking about is it now, in under 20 minutes, a criminal can set up a website that looks like a legitimate business, run a campaign, and collect credit card numbers. And it is so easy and with the AI tools you can just say, copy this merchant's website with these products, make it tailored for dog groomers, and make it a dog groomer special website with this brand, and all of the sudden you've, and I want to buy a mailing list from all the dog groomers. AI can go and get you that list, and you email them and all of the sudden you've got all the information you need to go commit a bunch of crime. And so it is really... the speed at which crimes can now be committed is absolutely terrifying, and so we're seeing it already but it's just the start of it.

[00:40:04] Bob: We always used to describe it as a game of whack-a-mole as you're trying to take down say a phishing websites. They go up as fast as you can take them down. But this is like whack-a-mole on steroids.

[00:40:13] Julie Fergerson: It absolutely is.

[00:40:16] Bob: But AI isn't all bad news in the fraud fighting world.

[00:40:21] Julie Fergerson: We've talked a little bit about the doom and gloom of AI. AI does have some good stuff too. Don't lose hope because the fraud prevention professionals are using those tools to fight the bad guys.

[00:40:29] Bob: Hey, so, so like give me an example.

[00:40:31] Julie Fergerson: So right now, orders traditionally have been manually reviewed, and a merchant can only manually review a small portion of those orders, and that human instinct, you can sometimes just look at an order and go, I know that's a criminal. And so we're now using those tools to build custom LLMs to start to have some of that more higher level decisioning and be better able to predict, yep, that, that looks like a fraudulent order. We need to block it or put it on hold. And so we've always used rules engines and even some machine learning to say, okay, this looks like fraud, but now we're able to start to use AI to identify some of the fraud.

[00:41:12] Bob: That's really interesting to me. Rules engines, just as we already used this example, but if the shipping zip code is very far from the building zip code, that sets off a red flag, but then criminals find out that's what you're doing and so they figure out how to get around that rule, right? But if you have something that's able to intuit what might be fraud, 6 or 7 factors all at once, if we can teach the AI how to have a hunch that a fraud fighter would have, that should help a lot, right?

[00:41:37] Julie Fergerson: Yeah, yeah, that's exactly it. Teach the AI to have the hunch, and that will go a long way to help because instead of just re--, reviewing a small portion of the orders, more orders can be reviewed.

[00:41:49] Bob: But in the end, you, me, all of us need to remember that fraud is way up and so we all have to remain vigilant for ourselves and our loved ones. But we need to be realistic too. We often say here at The Perfect Scam that anyone can be the victim of a crime. And Julie really helped make that point.

[00:42:12] Julie Fergerson: I've been in the fraud industry for over 30 years, and I'll be the first to admit, I like to shop and check my Facebook 5 in the morning when I get up and I'm having my morning coffee, and my guard is down, and I've fallen for a couple of different scams because it looks so incredibly legitimate. And it's really easy. I've typed in my credit card information because it was a product I've been looking at and I really want, it's on sale, it's a really good price, so I just click to buy. And so it's just gotten so good and it looks so much like a legitimate merchant. It's hard. I always tell people, don't be afraid to say I fell for it. Just own it, because we all do, even the experts who've been in the industry a really long time.

[00:42:55] Bob: So yeah, let's underline that point there. Julie Fergerson, who's been thinking about nothing but fraud for 30 years, this happens to you, right?

[00:43:01] Julie Fergerson: It happens to me on a regular basis. I would probably say once every three months, I click on something and after I click on it, I, and I place my order or I watch a video, I immediately know, right, so because all of the sudden when I press submit, I'm like, ooh, that doesn't feel right. And so then I start to take it apart. So if you ever press submit and you say, oh, that doesn't feel right, it probably isn't right. So trust your instinct. But yeah, it happens to the best of us.

[00:43:29] Bob: Recent studies have shown that a very large percentage of ads on social media sights are fraudulent. And a majority of Americans have encountered shopping scams.

[00:43:40] Julie Fergerson: It is a very real problem and some of the consumer advocates have been shouting from the mountaintops about it for a couple of years. And so I think the way things are tackled has got to change. And I'm not a big person for regulatory action, but in this case, I think the regulators are going to have to step in because with those ad--, advertisements from the fraudsters, the businesses are making money. And so if they started to shut down all the criminal ads, they would lose a piece of their revenue stream.

[00:44:12] Bob: So what does one of the world's best fraud fighters, who herself has been a victim, suggest to consumers?

[00:44:19] Julie Fergerson: The I is having that family password because no matter how good we are, I think the fraudsters, with the new tools for the, at least the next decade, I think that we're going to see a lot of really creative scams we never thought of. It may be the same thing but just a completely different spin on it so we don't recognize it. And so being vigilant, but you can't be vigilant every second of the day is, which is why I accidentally click and fall for these, right? But having that family password so that you're comfortable challenging things when you're presented with it, and then the other thing is absolutely don't have shame. It's, it's, you've got to be comfortable picking up the phone and calling and saying, hey, I'm confused about this or I'm curious about this. You can always walk into a bank and ask your bank if you've, if it's with your bank. You can walk into a retailer storefront or call their customer service number if you're confused about something or concerned but just be vigilant. I don't know that there's any magic things other than regulators starting to step in and making a bigger investment. Requiring companies to make a bigger investment on pro-, protecting consumers.

[00:45:31] Bob: So since you opened that doorway, the story I tell whenever I get a chance is that poor customer service is part of the reason we have this problem. If people's impulse, as it should be, was to immediately say this just feels weird, let me call the bank or let me call the merchant. What happens when they do that? They get to a chatbot that puts them off for an hour. Meanwhile, the criminals often have great customer service, right?

[00:45:53] Julie Fergerson: Oh, absolutely. The...

[00:45:54] Bob: They answer the phone.

[00:45:55] Julie Fergerson: Yeah, the fraudsters definitely have much better customer service than industry. That said, if you call into your bank and you say, I have fraud to report, even if you don't think it's fraud, I would just say, I have fraud to report, or I feel like I'm a victim of fraud, you will get fast-tracked to a human with good customer service.

[00:46:12] Bob: That's, I think that's a good piece of advice. So if you think something's wrong right away, tell them it's fraud. Because the, the clock is, they know the clock is, is running for everyone there.

[00:46:24] Bob: The clock is indeed running. For The Perfect Scam, I'm Bob Sullivan.

(MUSIC SEGUE)

[00:46:48] Bob: If you have been targeted by a scam or fraud, you are not alone. Call the AARP Fraud Watch Network Helpline at 877-908-3360. Their trained fraud specialists can provide you with free support and guidance on what to do next. Our email address at The Perfect Scam is: theperfectscampodcast@aarp.org, and we want to hear from you. If you've been the victim of a scam or you know someone who has, and you'd like us to tell their story, write to us. That address again is: theperfectscampodcast@aarp.org. Thank you to our team of scambusters; Associate Producer, Annalea Embree; Researcher, Becky Dodson; Executive Producer, Julie Getz; and our Audio Engineer and Sound Designer, Julio Gonzalez. Be sure to find us on Apple Podcasts, Spotify, or wherever you listen to podcasts. For AARP's The Perfect Scam, I'm Bob Sullivan.

(MUSIC OUTRO)

END OF TRANSCRIPT