JEFF GUO, HOST:
A heads up before we start, today's episode includes a few swear words in the second half. And full disclosure, we reference Citibank, Apple and Amazon in the story. They're all NPR sponsors.
SYLVIE DOUGLIS, BYLINE: This is PLANET MONEY from NPR.
(SOUNDBITE OF COIN SPINNING)
ALEXI HOROWITZ-GHAZI, HOST:
When you talk to Francis about how she got lured into the scam that's taken over her life for the last year, she says the exact details are a bit of a blur.
FRANCIS: It starts with a voicemail, but I was also really sick around that week, so I don't think I - it just gets fuzzy on how I, like, got into it.
GUO: Francis is a white-collar worker in her 40s - lives in New York. And we're only going to use her first name to protect her professional reputation. Now, she says what is clear is that last May, she got this voicemail claiming to be from Citibank, flagging this suspicious outgoing wire for $50,000. Shortly thereafter...
FRANCIS: I get a text saying, oh, this is David from the security department. And I'm like, the security department for Citi 'cause of the wire.
HOROWITZ-GHAZI: Once she gets this guy, David Smith (ph), on the phone, he explains that the suspicious wire, it might be part of a bigger attack on her whole network of accounts. He asked her to check her Apple account, for example.
FRANCIS: And I do see these extraneous, like, these extra charges that are hidden charges on the Apple account.
GUO: Pretty soon, she's actually getting locked out of her accounts.
FRANCIS: Everything just seems, like, chaos. Not only, like, the Citibank wire. That's one thing. Then I see that my Amazon account is frozen, my Apple account. Everything's kind of frozen, and I'm like, whoa, what the hell?
HOROWITZ-GHAZI: The story that David tells Francis is that she's been targeted by a group of Russian hackers. He says he's been working with someone high up at the FBI to try to catch these guys for a while. And he tells Francis that if she wants to keep her assets safe, they're going to need to work together to secure her home network and her various bank accounts.
GUO: Francis, in that moment, she was primed to believe this story. She was panicked, and the man on the other end of the phone seemed calm and collected and above all, competent. And he was offering all the might of the U.S. government to help steer her safely through this storm.
FRANCIS: I'm a single person, you know, I live by myself, so - and, you know, I'm alone on this, right? Whatever help that I can get...
HOROWITZ-GHAZI: Yeah.
FRANCIS: ...Like, yeah, like, I want to want to make sure everything is secure. Like, let's fix this.
HOROWITZ-GHAZI: Over the next couple of weeks, David and Francis spend hours and hours on the phone together. By now, she's given him remote access to her computer. And David tells her that in order to figure out what the hackers are up to, they're going to need to move around some of her funds through a complicated series of transfers.
GUO: Francis gets set up with accounts on Cash App and Coinbase. They start transferring some of that money into cryptocurrency. David warns Francis that this is a confidential government investigation, so she isn't allowed to tell anyone else what they're doing. He also insists that Francis shouldn't even look at her accounts. She should only sign into her bank and payment apps when he instructs her to verify her identity or approve various transfers.
HOROWITZ-GHAZI: Francis goes along with this process for a couple of months. Only then does she finally decide to break this rule. She signs into her accounts to see what's been happening, and that is when she realizes someone has been steadily transferring money out of her investment accounts.
GUO: When she tallies it all up, she sees that over $800,000, nearly all the money she's saved and invested for the last 20 years has been transferred out of that account. Francis freaks out. She immediately gets on the phone with the one person she thinks might be able to fix this problem, that David Smith from the security department.
FRANCIS: Well, I was kind of cursing and everything over the phone. Like, where the F is my money? And Dave is like, your money is safe. You know, it's safe in, like, government accounts.
HOROWITZ-GHAZI: At this point, did it cross your mind at all that this guy who said he was out to help you might have been scamming you all along?
FRANCIS: I felt helpless. Like, if he's real, then somehow I'm going to get my money back. And if it's not, well, it's already gone, and I have to figure out what to do next. And that maybe I have no choice but to see where things go.
(SOUNDBITE OF RAINMAN'S "MORNING CHORUS")
HOROWITZ-GHAZI: Hello, and welcome to PLANET MONEY. I'm Alexi Horowitz-Ghazi.
GUO: And I'm Jeff Guo.
HOROWITZ-GHAZI: We are living in a kind of golden age of online fraud. As the number of apps and services for storing and sending money has exploded, so too have the schemes that bad actors have cooked up to take that money. Every year, it feels like we hear more and more of these stories of financial heartbreak. What you don't often hear about is what happens after the scam.
GUO: Today on the show, we follow Francis on her quest to get her money back from the halls of the actual FBI to the fraud departments of some of the country's biggest financial institutions. And we get a window into how the systems that are theoretically designed to help people like Francis actually work in practice.
(SOUNDBITE OF RAINMAN'S "MORNING CHORUS")
HOROWITZ-GHAZI: By the time Francis discovered that more than $800,000, nearly her entire life savings, had been incrementally drained out of her investment accounts, she says she was already so deep into this supposed FBI investigation that it was hard to reckon with the idea of walking away.
FRANCIS: There actually was a part of me, admittedly, that really wanted - really, really, really wanted to be cooperating under a confidential case because, like, it was so hard to try to face the fact that, oh, you've been scammed in a really costly way. Like, it's devastating. You're like, oh, my God. Can I even admit this?
GUO: And so, Francis spent the next several months in a kind of holding pattern, getting strung along by occasional messages from David Smith and his contact at the FBI about how it would be just a little longer until she got her money back.
HOROWITZ-GHAZI: It wasn't until this past December that Francis says the spell finally started to break. On Christmas, she gathered with her family for dinner at a Chinese restaurant. Her parents, her brother, and his family and her sister. And full disclosure, I know her sister. She's actually how I found out about this story.
GUO: And over that Christmas dinner, Francis explains the whole situation to her family, how she'd become the target of Russian hackers and had been roped into a top-secret FBI investigation to try and stop them, how the government had secretly moved all her money into a secure crypto account for safe keeping.
HOROWITZ-GHAZI: And after hearing all of this, her family looks at her and basically says, Francis, there is no secret FBI investigation. These people have taken your money, and this is all a giant scam.
FRANCIS: And I was, like, frozen. I was really frozen. I was embarrassed, and I didn't eat very much during that dinner. That's how embarrassed and that's how ashamed I felt. I was like, I feel stupid. I felt really, really small.
HOROWITZ-GHAZI: Over the next few days, Francis' family starts to try to help her pick up the pieces. They begin by reaching out to the actual authorities, telling them what happened.
GUO: Right. Like, when you're the victim of a crime, you go to law enforcement, right? So Francis goes online and she files complaints with the Federal Trade Commission and the FBI. Her sister manages to set up a meeting with a real FBI agent who works on exactly these sorts of cases in New York City. So just a couple of weeks after Christmas, Francis heads to the FBI office in Lower Manhattan to see if they might be able to help.
FRANCIS: My brother and my sister went with me 'cause they wanted to hear it. They want to know. And to be honest, I think they're better asking the questions than I am, right? I'm still in shock and embarrassment.
HOROWITZ-GHAZI: The FBI agent basically confirms what Francis' family had suspected - that this was a scam. The story had all the hallmarks of what the FBI has dubbed the phantom hacker scam. That's where scammers impersonate financial and government officials in order to gain access to your accounts.
GUO: But unfortunately, the agent tells Francis, the FBI is probably not going to open a case about what happened to you.
HOROWITZ-GHAZI: So as soon as Francis made it to the actual FBI, she kind of hit a roadblock. We reached out to the FBI to understand why they did not take on Francis' case, but they didn't make anyone available for an interview. So we called up Kyle Armstrong.
GUO: These days, Kyle works as the head of law enforcement relations at a cryptocurrency tracing company called TRM Labs. But before that, he spent 14 years investigating financial crimes at the FBI - cut his teeth on all sorts of internet scams.
KYLE ARMSTRONG: You have an endless supply of the sort of romance scams and lottery scams that we all think of, like the Nigerian sort of inheritance scam. You know, those walk into your office five days a week.
GUO: Kyle says you've got to think about Francis' case from the FBI's perspective.
ARMSTRONG: The FBI's No. 1 priority is counterterrorism. Their No. 2 priority is counterintelligence. Their No. 3 priority is cybercrime. And so they are, by design, going to be prioritizing nation-state-style cyber and financial institution threats.
GUO: So things like North Korean crypto hacks to fund their weapons programs, which we've covered on this show, or the investigation into how the servers of the Democratic National Committee got hacked back in 2016. That is where the FBI is putting the most muscle.
HOROWITZ-GHAZI: As for individual cases of cybercrime, like what had happened to Francis, the FBI kind of has to pick and choose because there are just so many of them. Whenever somebody falls victim to one of these schemes, they're supposed to immediately file a report on a website called the Internet Crime Complaint Center or IC3.
GUO: When complaints are submitted to the IC3, they arrive at an FBI facility in West Virginia. That's where a staff of specialized analysts sift through each one to see if it potentially warrants an investigation.
HOROWITZ-GHAZI: How are these FBI analysts doing the triage to figure out which cases to allot these limited resources to, to try to investigate?
ARMSTRONG: The primary factor in determining priority is going to be dollar amount. And so if there's a $50,000 case and there's a $5 million case, the $5 million case is going to be prioritized.
HOROWITZ-GHAZI: Now, some of these cases do get routed to state and local law enforcement and other agencies, depending on the details. But for cases that could use the expertise of the FBI, Kyle says your chances depend a lot on where you file from. FBI agents are distributed geographically into 56 field offices in all these different parts of the country. He says the upshot is that $1 million fraud in, say, Columbus, Ohio, might be a higher priority than it would be in a place like New York City, where the number and frequency of million-dollar scams is just much higher.
GUO: But no matter where in the country you are, Kyle says the fundamental problem these days is that every complaint is competing with a record number of other complaints coming into the system.
ARMSTRONG: There are 2,400 complaints received on a daily basis.
HOROWITZ-GHAZI: Wow. There are 2,400 complaints sent to the FBI every day about some form of cybercrime?
ARMSTRONG: Yeah. Losses in 2023 worth $12.5 billion overall.
GUO: And when you compare these numbers to the 10,000 or so FBI agents in the country, you start to understand how hard it can be to get law enforcement to bite on any particular case. And Kyle says the same dynamic exists at other agencies that investigate fraud, like the IRS or the Secret Service, which have even fewer agents.
HOROWITZ-GHAZI: Kyle says the second big reason the FBI probably didn't take Francis' case was that by the time she filed her complaint, several months had already passed since the money had actually left her accounts. And time?
ARMSTRONG: Time is probably the most critical element of these cases because the money can move immediately internationally and be cashed out. And once it has been exchanged for currency in a foreign location, it's very, very difficult to get back.
GUO: As far as Francis could tell, when she pieced together the list of transfers and transactions from the past year, it looked like most of her money was moved to a Coinbase account where it was likely converted to cryptocurrency and scattered across various blockchains - and cryptocurrency can move incredibly fast.
ARMSTRONG: Sometimes, these funds are cashed out in as little as an hour. Many times it's, you know, a few days, maybe a few weeks if they're lucky. But if you wait six months to report the fraud scheme, it's going to be almost impossible for law enforcement to get your money back.
HOROWITZ-GHAZI: OK, so the FBI was not going to help. But Francis was still determined to find a way to get back some of what she'd lost. And the next step on her quest to try to recover her money was to go to the institutions entrusted with keeping her money safe in the first place.
FRANCIS: After I met with the FBI in the office, I started contacting the banks, telling them that I'm filing a fraud report.
HOROWITZ-GHAZI: There are actually laws on the books that say the banks have to help their customers after some kinds of cybercrime, sometimes to even reimburse some of the money that's been stolen. But whether those laws would apply to Francis' situation is a little difficult to parse because the rules that govern this process can be pretty opaque. So we went to someone who knows their way around them.
CARLA SANCHEZ-ADAMS: I'm Carla Sanchez-Adams, a senior attorney with the National Consumer Law Center.
GUO: Carla says the first thing you need to know is that there's this big federal law governing whether banks are required to reimburse their customers who've fallen victim to some type of cybercrime. It's called the Electronic Fund Transfer Act or the EFTA. But the law only covers certain kinds of transactions.
SANCHEZ-ADAMS: So that would be, you know, the peer-to-peer payment through Zelle or Venmo or PayPal. That would include ACH transactions, debit card transactions, things like that. Yet it excludes checks, and it excludes wire transfers.
GUO: So the law covers automated clearinghouse transactions and apps like Zelle and Venmo. It does not cover checks or wire transfers.
HOROWITZ-GHAZI: Now, in Francis' case, her money appeared to have sometimes been moved using wire transfers. So the EFTA wouldn't apply there. But sometimes the money had gone through apps like Zelle and Cash App or ACH transfers, which could potentially qualify for protection.
GUO: But Carla says even for transfers that the bank might be on the hook for under the EFTA, customers still have to clear another couple of hurdles to qualify.
HOROWITZ-GHAZI: First, customers have to have lost money to what the banks often think of as a fraud as opposed to a scam. Those may sound similar, but they're actually treated very differently by financial institutions.
GUO: Yeah. Banks often use fraud as a shorthand for a transaction that the customer did not authorize. So maybe the bad actors got a hold of your login information or hacked into your accounts and started firing off transfers. The bank might have to reimburse you for that.
SANCHEZ-ADAMS: But then, if it's one where the consumer was deceived and made the payment, they initiated it, there's no statute requiring a financial institution to reimburse that consumer for that loss.
HOROWITZ-GHAZI: So if the cybercriminals are really good at social engineering, they trick you into authorizing the transfers yourself, that is what the banks often think of as a scam. And the EFTA doesn't require them to make you whole. So not great for Francis.
GUO: And even if some of the transactions the scammers had used might be what the banks call fraud, there is a second big question. And this one goes back to the issue of time. If you wait too long to report a fraudulent transaction, the bank has less of an obligation to fully reimburse you.
HOROWITZ-GHAZI: Now, financial institutions do have some latitude in how they apply laws like the EFTA and other state and federal laws that sometimes protect consumers. So consumer advocates and a group of senators have started pushing banks and payment apps like Zelle to clarify and expand their policies, to reimburse customers who've been scammed into sending money.
GUO: At this point, it isn't exactly clear which of all the transactions between Francis' accounts were, in fact, authorized and which might have been initiated by her scammers without her knowledge. What is clear is that of all the transactions that she's reported to her financial institutions, none of them have been reversed or reimbursed...
(SOUNDBITE OF MUSIC)
GUO: ...Which Carla says isn't necessarily the end of the road.
SANCHEZ-ADAMS: If the investigation does not come out in your favor and it was unauthorized, unfortunately, as far as the recourse, a lot of times it does take the help of a lawyer.
HOROWITZ-GHAZI: Coming up, Francis goes in search of a lawyer, and she sets up one final conversation with her scammers, a conversation that she recorded.
(SOUNDBITE OF ARCHIVED RECORDING)
FRANCIS: Hello?
UNIDENTIFIED PERSON #1: Yes. Good afternoon, Francis. How are you?
HOROWITZ-GHAZI: That's after the break.
(SOUNDBITE OF RAINMAN'S "LOVE STILL")
GUO: Not long after Francis finally met with the real FBI and started filing paperwork with her financial institutions, her scammer, the so-called David Smith, reaches out to try to schedule another call between Francis and this supposed FBI agent, Robert Johnson (ph). He tells her they want to give her an update on her case.
HOROWITZ-GHAZI: So, in early February, she sets up a phone call. But this time, potentially with an eye toward a future investigation, she decides she is going to record the conversation.
FRANCIS: I was so angry. I was like, I want to get these F-ers.
(LAUGHTER)
FRANCIS: Because I want to at least get the information and show them, like, I'm not making this up. These are people that I had been in contact with, trying to convince me that my money is safe.
GUO: But Francis, she was still kind of of two minds. Even after telling her family what she'd been through, even after going to the authorities to try to get help, she was still hoping that maybe these men on the other end of the phone would turn out to be legit, that her money really was safe, and that this was all just some big miscommunication between different parts of the FBI.
HOROWITZ-GHAZI: Yeah. Before working on this story, I don't think I fully understood just how hard it can be to rip yourself from the fictional world that some of these social engineering scams weave for their victims, like how hard it can be to break free. But think about this from Francis' perspective. When she'd gone to actual law enforcement, they told her they couldn't really do anything for her, same for the banks. But the scammers, not only did they seem to actually care about her situation, they were the only ones offering her any hope that she'd be able to get her money back.
FRANCIS: There was always still a part of me that I was thinking like, maybe it's still, like, maybe it's still real and that maybe I just need to, like, kind of, like, hedge my bets.
GUO: Francis' call with the scammers starts around midday. She talks to David Smith for a little bit, and then the supposed FBI agent joins the call.
(SOUNDBITE OF ARCHIVED RECORDING)
UNIDENTIFIED PERSON #2: Hello, Ms. Francis, this is Robert. How are you?
FRANCIS: It's Robert? Oh, was it? Sorry, I thought...
UNIDENTIFIED PERSON #2: Yeah.
FRANCIS: Robert what? Robert who? Sorry.
UNIDENTIFIED PERSON #2: Robert from FBI.
FRANCIS: From FBI. Last name?
UNIDENTIFIED PERSON #2: Flint (ph).
FRANCIS: Say again?
UNIDENTIFIED PERSON #2: It's Flint.
FRANCIS: Yeah. I thought it was Johnson last time, but maybe I missed that.
UNIDENTIFIED PERSON #2: Exactly. So now...
HOROWITZ-GHAZI: But even in the face of these seemingly obvious holes in the scammer's aliases, you can hear Francis start to engage with them. She's obviously angry, but she also acts as if she is, in fact, talking to a real FBI agent. And if she could just get him to take her concerns seriously, maybe this would all work out.
(SOUNDBITE OF ARCHIVED RECORDING)
FRANCIS: So I need some proof that this is a real case. I mean this is time to come up with, like, real, substantial proof that you're working on a FBI case that is for me and that my money is indeed somewhere.
UNIDENTIFIED PERSON #2: I totally understand your concern. I totally understand your pain. As you know, that in our U.S. government, we don't have any single case. We have a bunch of cases which we are dealing in one time. And that is the reason sometimes we are getting delayed.
FRANCIS: And how do I know...
GUO: The call goes on and on like this. In one moment, Francis will hold the scammer's feet to the fire.
(SOUNDBITE OF ARCHIVED RECORDING)
FRANCIS: As far as I can see, I'm being tricked. I'm being scammed. It looks like a duck. It quacks like a duck. I mean...
GUO: Then in the next moment, she'll start to slide back into the scammer's narrative.
(SOUNDBITE OF ARCHIVED RECORDING)
UNIDENTIFIED PERSON #2: I can see that your money is totally safe in a safe, secure wallet and you're going to get your compensation money $200,000.
FRANCIS: Which wallet? I'm trying to understand, like, where is this wallet? Like...
HOROWITZ-GHAZI: It is not entirely clear whether, after nine months of being manipulated by these scammers, Francis will finally be able to break free from the story they've been telling her.
(SOUNDBITE OF ARCHIVED RECORDING)
FRANCIS: This is completely upsetting me.
HOROWITZ-GHAZI: But then all of the pain and confusion she's been feeling starts to boil over.
(SOUNDBITE OF ARCHIVED RECORDING)
FRANCIS: I need something on paper. Talking on the phone is complete bull**** to me. I've lost $800,000 from my retirement over 20 f****** years saving for my retirement. And you guys just go, like, withdraw, make these transactions like it's Monopoly money.
GUO: The entire conversation lasts a little over 30 minutes. And all the way to the very end, you can hear Francis wrestling with these two conflicting realities.
(SOUNDBITE OF ARCHIVED RECORDING)
FRANCIS: You're bull****, and I will say goodbye. Thank you very much. It's been great working with you. But sorry, I cannot do anything more.
UNIDENTIFIED PERSON #2: I'm not...
FRANCIS: OK.
UNIDENTIFIED PERSON #2: I'm not...
FRANCIS: Thank you.
UNIDENTIFIED PERSON #2: I'm not...
FRANCIS: Thank you. Thank you. Bye.
UNIDENTIFIED PERSON #2: You have to...
FRANCIS: Bye. No, no, no. Goodbye.
HOROWITZ-GHAZI: With that last goodbye, Francis finally does it. She manages to hang up the phone once and for all and break contact with the men who'd lured her into this elaborate financial trap over the last year. It was the last time she spoke with them.
GUO: In the months since then, Francis hasn't gotten any further with law enforcement or her financial institutions. So she's engaged the services of a couple of former Department of Justice lawyers specializing in cybercrime. They're working for her on contingency, meaning they will only get paid if they're able to recover some of her money.
HOROWITZ-GHAZI: Her lawyers are hoping to trace Francis' money across the various blockchains and then get the courts or law enforcement to help freeze and seize whatever they're able to find. And they're looking into whether Francis' financial institutions might bear some legal responsibility for the money she lost.
GUO: Francis, she's trying to get her financial life back on the rails, and she's hopeful that the lawyers will be able to help with that.
FRANCIS: It's new. It's uncharted waters for me. You know, I hope I'll see a light at the end of the tunnel. I don't know, you know. It is definitely complicated.
HOROWITZ-GHAZI: We spoke to Francis' lawyers as part of our reporting. And they say the real problem here is that the banking laws are outdated. They just weren't designed with the current technological landscape in mind. On top of that, the law enforcement system is not set up to handle the sheer number of people falling victim to these scams every year. As for whether Francis will get any of her life savings back, her lawyers say that is still very much up in the air.
(SOUNDBITE OF RAINMAN'S "BLUE WONDER")
GUO: Coming up on PLANET MONEY, that one time the FBI launched a phone company for criminals.
UNIDENTIFIED PERSON #3: His offer is that the FBI can take this company and use it for their own investigations. Why doesn't the FBI just run its own encrypted phone company and then put in whatever back door they feel like? They could run a tech start-up for organized crime.
GUO: The story of one of the weirdest tech companies and the largest sting operation of all time. That's on the next PLANET MONEY.
(SOUNDBITE OF RAINMAN'S "BLUE WONDER")
HOROWITZ-GHAZI: Today's episode was produced by Willa Rubin and edited by Keith Romer. It was engineered by Neal Rauch and fact-checked by Sierra Juarez. Alex Goldmark is our executive producer. Special thanks to Kiran Raj and Scott Ferber. I'm Alexi Horowitz-Ghazi.
GUO: I'm Jeff Guo. This is NPR. Thanks for listening.
Copyright © 2024 NPR. All rights reserved. Visit our website terms of use and permissions pages at www.npr.org for further information.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.