Wednesday, June 27, 2012

Gram Scams in the Information Age

The expression “con man” is a short form of “confidence man,” which describes a scammer who employs ruses that gain the trust of his victims. Scams that target vulnerable groups, such as the elderly, using confidence tricks have been around a long time. However, the loss of privacy brought about by the Internet has allowed scammers to concoct more enticing stories because of ready access to personal information.

 My father-in-law lost $6250 in a matter of hours to a scam last year, and this month, almost exactly a year later, my father became a target of scammers using the exact same techniques that tricked my father-in-law.

The theft from my father-in-law unfolded in the following way:

The phone at his house in Holmen, Wisconsin rang and when he answered his 24-year old grandson Isaac spoke on the other end with his familiar greeting of: “Hi grandpa, how are you?” Isaac, who lives in another part of the state about 150 miles away, went on to recount a disturbing sequence of events that had just happened to him. He had travelled to Canada with some friends to attend a funeral. They were pulled over for speeding and cocaine was found in the car. He needed $5950 within two hours to pay the bond to get out jail. He begged his grandfather to please wire him the money and not tell anyone because he didn’t want it to get out what had happened.

My distraught father-in-law went immediately to the bank, withdrew the money, went to Western Union, followed the wire transfer instructions, and in addition to the $5950, paid a $300 transfer fee. Within an hour Isaac called back. He needed an additional $5000 to pay a lawyer. Still in shock, my father-in-law went back to the bank to withdraw more cash, but this time the bank refused his request. The bank manager told him that he was being scammed.

How was he being tricked? The person on the other end of the phone line was impersonating Isaac. The real Isaac was still in Wisconsin having an ordinary day at work. Phone calls to Isaac’s mother and then Isaac himself confirmed that he was not in Canada, or in any kind of trouble.

Impersonating grandchildren in severe distress is an effective technique for emotionally upending grandparents to the point at which they will suspend normal skepticism. Last week my father became the target of the exact same scam. The phone at his house in Clifton Park, New York rang and a person claiming to be my 23-year old son Tom recounted a similar story. He was in Baltimore with some friends and had to attend a funeral. Afterwards he and his friends went out for some drinks. There had been a car crash and he had been arrested for drunk driving. Then a second person got on the line, his “court appointed attorney,” who told my father he needed to wire $6300 for a bail bond, and gave him instructions on where and how to use Western Union.

As any good storyteller knows, filling your narrative with vivid and compelling details is the way to emotionally engage your audience. This story had plenty of upsetting details. My son’s “nose was broken in the crash,” a “woman had been hit and her medical condition was unknown,” police alleged that he had a “blood alcohol level of 0.12,” the charge was “felony drunk-driving,” and the jail was “rat-infested.” He needed to be bailed out immediately and he didn’t want anyone else to know what had happened to him.

Deeply shaken, my father said he would need about an hour to go to the bank to get the money. The “attorney” said he would call back in about an hour. Fortunately my sister and brother-in-law were visiting. My brother-in-law, who is a real attorney, told my father it was scam and suggested the obvious, that he call my son. Fortunately my son had programmed his cell phone number into my father’s cell phone a couple months earlier. Fortunately when my father called, my son answered immediately. My son was having an ordinary day at work in Rochester, New York and was nowhere near Baltimore, let alone in any kind of trouble.

So why is this scam so effective? My father-in-law, Dean Baldwin, was absolutely convinced that he was talking to Isaac on the phone. He thinks that the scammer dubbed his grandson’s actual voice. The article about the crime that appeared in the Lacrosse Tribune reported the following:

 "They dubbed his voice," Baldwin said. "It was his voice. He said ‘Hi Grandpa, how are you.' That's the way he opens a conversation. We would have never fallen for it if they hadn't used his voice."

Holmen Police Chief Mike McHugh said dubbing a voice is a different twist. "That would really take a lot of preplanning by the person, but it's possible," he said. "They already know a lot about the person they are faking."

Brock Bergey, spokesman for the Wisconsin Department of Agriculture, Trade and Consumer Protection, said he had heard about software that allows people to manipulate voices, but he had not heard of it being used in the Gram Scam before.

When I talked to my father about what happened, he too thought that the voice on the other end of phone was my son Tom’s. The act is very convincing. So are the thieves surreptitiously recording voices and then using software to synthesize fake conversations? My belief is that the scammers aren’t that sophisticated, and don’t have the time or technical know-how to bother with such an elaborate ruse. I don’t think that they need to. Real voices already lose much of their fidelity when transmitted over phones. I cannot tell the difference between the voices of my two daughters over the phone, but have no trouble doing so in person. For octogenarians (my father is 85, my father-in-law is 84) who rely on hearing aids for normal conversation, voice recognition over phone lines is much more difficult than they realize. All voices of distraught 20-something males are going to sound similar, and as a result the grandparents assume the person is whoever he claims to be.

What makes this scam believable is the knowledge of personal details that grandparents unconsciously assume are not readily available. The thieves are able to piece together family networks that extend over large geographical distances. Who else but a close friend or family member would know that my son, who grew up in Baltimore County, has a grandfather living more than 300 miles away in Clifton Park, New York? And when my son’s impersonator says he is in Baltimore that gives him immediate credibility because my father expects him to be in Baltimore. The scammers also know that grandchildren and grandparents that live far apart are probably not in daily contact, so the false story of the funeral will not be immediately challenged.

However, personal details about anyone’s life are not as personal as many people believe. Using Google searches, social media Websites, and online public records, it is now possible to pick any person and easily learn a great deal about his or her life story, friends and family relationships, and age and income level. The elderly in particular are unaccustomed to the loss of privacy that now pervades our entire society. As a result they are more susceptible to the kinds of unconscious assumptions that make this scam so effective.

The privacy genie is out of the bottle and it is not going back in. Everyday more and more personal data accumulates on the Web in databases that are easily searchable and will stay public forever. We all must be aware of the fact that thieves can now know a great deal of personal information about someone without knowing that person at all.