Blog

I recently completed a bizarre tale here on Wallyhood about a brazenly outlandish attempt to convince me that my digital and financial identities had been compromised—hijacked for the nefarious purposes of gun purchases and money laundering. As absurd as that sounds, I believed what I was told for a period of time. I thought I was cooperating with the New York Office of the FBI, although under implied threat of prosecution and incarceration. It was a well-scripted and elaborate ruse with multiple players, one that someone, somewhere, invested a great deal of time in developing and implementing. When the charade wound down and fell apart of its own accord, I felt pretty dumb.

So, of course I had to share the experience with all of you.

I had mentioned at the very end of my account that if there was anything to update, I would let you know. I can’t report any major breakthroughs in determining who was behind the attempt, and there was no response from the IC3—the Internet Crime Complaint Center—which does not respond to submissions. But I did receive a message via, of all platforms, LinkedIn. It was from a software engineer in California who had seen my Wallyhood story and been through nearly the same ordeal as I had experienced: same initiation by a spoofed phone call from American Express, same connection to fake FBI agents (and even fake Agent Castro in common), same burdensome reporting requirements, same lengthy period of setup and execution that stretched out over weeks and months. This person gave me permission to relate shared experiences and the many overlaps with mine. And more importantly, perhaps, in wrapping up this long story, my fellow victim had some insights into the potential endgame for the ruse that previously had puzzled me:

The actual extraction, documented across thousands of IC3 cases, comes in a few standard forms…Asset “protection” (is) the big one. As the “case” reaches its crisis, the agent warns that your accounts are about to be frozen or seized as suspected proceeds. To “protect” your savings during the proceedings, you must move them into “secure government custody”—a wire to a “Treasury account,” conversion to crypto deposited at a kiosk, or the recent favorite: buy gold bars and hand them to a courier sent to your door “for safekeeping until you’re cleared.” The FBI’s Phantom Hacker advisories describe exactly this; victims routinely lose entire retirement accounts. Note how your case was staged for it: they knew you had “sufficient savings,” which institutions held them, and that a fraudulent account “in your name” already existed as pretext for freezing yours.

Recall that in my case, communication with faux FBI agents simply petered out after around three months. I only half-in-jest think that this is because, after learning about the state of my financial assets, they figured “Pffft, this dude is not worth the effort.” My newfound LinkedIn friend’s experience was a little different. This person made the conscious decision to end communication with the FBI agents, which resulted in a barrage of unanswered texts and phone calls. Those eventually stopped. My colleague not only filed an IC3 report, but also forwarded the Outlook addresses associated with the “security report-ins” and texting to Microsoft. The real FBI in New York confirmed that “Special Agent Castro,” whom both of us had in common as an FBI contact, was not a real agent.

I have to tell you that learning that my situation was not unique, and that otherwise functioning human beings could be led on as I was, was reassuring to me after going it alone for weeks and months. Bonus points that it was a smart person who retired from a large tech company and now is working on AI projects!

This brings to mind a favorite phrase of Ronald Reagan, whom I try to never quote. Reagan was fond of dropping the Russian proverb “Doveryai, no proveryai”—“Trust, but verify”—when he met with Mikhail Gorbachev for nuclear arms negotiations. In fact, he dropped it so often that Gorbachev reportedly complained, “You repeat that at every meeting.” In the context of my money laundering story, it would apply in that you might initially believe what you hear or see from a supposedly trustworthy source. But you should verify by direct dialing those sources to confirm that it is all legitimate before you fully commit to doing anything, especially if it pertains to your finances or personal information.

Other than the fact that neither of us had been played to the point of losing money, it is hard to identify a silver lining to these respective stories. But that’s an important bottom line. We may have been played like fiddles, but we didn’t cough up any money to the scheme. My LinkedIn friend also transformed proverbial lemons into useful lemonade (edited slightly to anonymize):

To turn these painful days into opportunities, I’ve added more security and protection to my accounts and IDs than I ever had before—credit freezes at all three bureaus and ChexSystems, hardened bank and brokerage access, an IRS identity PIN. In a strange way, they left me safer than they found me. And oddly enough, all of it—the hardened accounts, the firsthand education in how fraud actually works—has become the foundation of the next chapter of my life: after retiring last July, I’ve been building an AI-focused venture, and there’s no better preparation for detecting online deception than three months of living inside it.