brendan halpin

Well, I nearly got taken by a VERY good scam this morning, so I wanted to share the details and also some concerns.

This morning I got a call from 410-604-2761. The caller ID said Verizon, so I picked up, figuring it was legit. A woman told me they were calling about potential fraud on my account, and had I ordered a new iPhone to be shipped to Ohio?

I had not.

They asked if I traveled to Ohio, and I said yes, I’m there 4 or 5 times a year. They told me that my account probably got hacked when I was in the airport or something. This was red flag #1 because I am relatively sure I’ve read things about how capturing login info via public wifi isn’t really a thing anymore.

Great, okay, we established I did not order the phone. They asked if I had gotten any emails regarding the purchase. I had not. Ahh, they said. Let’s check the account. It seems the hackers turned off email notifications. Let’s just get you back in to the account. Follow this link we’re texting you.

I got a real text from actual Verizon. I clicked on the link and was taken to a password reset page. “Um, this is password reset,” I said. “Yes, you need to reset your password to Fraud followed by the last 4 digits of your phone number, and then you’ll have access in 24 hours.”

In the meantime, I had logged in to the Verizon website. “Well, I’m logged in to my account on the website,” I said.

“Yes, you still have access on the website, but we need you to change your password on for mobile access.”

That does not sound like a real thing to me. Alarm bells are starting to ring.

“I’m looking here under orders and I don’t see any orders like the one you described.”

Yes, they said, because we put a hold on the order while we determine if it’s fraudulent. Now put the Fraud[digits redacted] password into the form we sent you.

Me: “Um, why can’t I just change the password to something I choose?”

Them: “Because there was fraudulent activity on your account, so we need you to use this password.”

Me: I’m gonna call you back. What’s the num—

Them: *immediate hangup*

So, a couple of things. In retrospect this was an obvious scam, but it did not feel obvious while I was in the midst of it. Someone ostensibly from your phone company is sending you legit links and it seems legit. What I’m saying here is that I fancy myself a sophisticated man about town and almost got caught up by the banality and the urgency of the call. So take it easy on anyone who’s fallen for a scam. Especially yourself.

Now, for my concerns: I’ve long thought this, but this just confirms it. Bad actors have access to your location data. (I mean, worse actors, even than regular advertisers, Google and Apple.) Almost every time I travel on the Massachusetts Turnpike, I get a text a few hours later telling me that my EZ Pass account needs attention. And the fact that these folks mentioned Ohio made their scam more convincing.

Also—Three of the five other people on my family plan got similar calls almost immediately after I did. One of them lives in a different state. So it seems very likely that Verizon has had some kind of data breach they haven’t revealed yet, and someone has the email associated with my account (because the password reset text really were from Verizon) as well as the names and numbers of people on my family plan.

Let me just say this—this fucking sucks. I dodged this particular bullet, but the constantly having to be on guard for scams coming via any communication mode is exhausting. And the fact that big tech has never faced meaningful restrictions on what they can do with our data fundamentally enables scammers. Like we don’t all have enough shit to worry about in our lives.