{“lastseen”:”2025-09-12T16:33:50″,”description”:”We hear so often about people falling for scams and losing money. But we often don\u2019t find out the real details of what happened, and how one \\”like\\” can turn into a nightmare that controls someone\u2019s life for many years. This is that story.\\n\\nNot too long ago, a scam victim named Karen reached out to me, asking for help. It\u2019s a story that may seem unbelievable to some, but it happens more often than you think.\\n\\nKaren tells us about the initial hook:\\n\\n\\u003e \u201cMy story started on January 1, 2020, when a man called Charles Hillary \u2018liked\u2019 something that I shared on the exercise app Fitbit. He kept on reaching out instead of just liking and moving on like most people do.\u201c\\n\\nIt wasn\u2019t long until \\”Charles\\” asked Karen if she wanted to move their chats to Google Hangouts. Karen used Google Hangouts at work so it didn\u2019t seem like a strange request.\\n\\nBut moving a conversation to a more secure environment is not something scammers do for convenience. They do it to reduce the chance of anyone listening in on their conversation or finding out their identity.\\n\\nKaren was slightly suspicious about when she would get messages from Charles, given that he had told her he was from Atlanta, Georgia.\\n\\n\\u003e \\”Every time he messaged me, I would receive it around 2am, so I asked him where he was. He responded and said he was on a contract job with Diamond Offshore Drilling in Ireland. I later found that not to be true.\\”\\n\\nAs it happens, Ireland is in the same time zone as West Africa Time (WAT), which is used in countries like Gabon, Congo, and Nigeria.\\n\\nIn late January, after Karen and Charles had been talking for almost a month, he asked her for some help.\\n\\nCharles said he had lent his friend, also in the oil drilling business, a lot of money. His friend had paid him back, he said, but had left it in a box with a security company, Damag Security.\\n\\n\\u003e \\”He said the security company was closing and needed him to get his ‘box.’ He asked me to be the recipient and I asked him lots of questions but ultimately agreed since it would not cost me anything and I could place it in his bank at my local branch of Bank of America.\\”\\n\\nCharles showed Karen the documentation:\\n\\n\\n\\nOnce a scammer has found an angle and the victim is invested, the costs will typically grow in number and in size.\\n\\n\\u003e \\”This is when the nightmare began. The box immediately cost me $3900 for shipping.\\”\\n\\nAfter that, Karen was asked by the security for money for various forms. Charles told her all forms should have been secured when the money was placed with the security company.\\n\\n\\u003e \\”He played innocent through it all.\\”\\n\\nThe forms were expensive and ranged from $25,000 to around $60,000. Karen asked them to reduce the price and they did, so she paid.\\n\\nCharles gave Karen several separate reasons as to why he wasn\u2019t able to get the money himself:\\n\\n * His bank account had been frozen due to money laundering.\\n * His ex-wife had taken a lot of his money so he froze his account until he could return in person.\\n * He had illegally done oil drilling in Russian waters and made a lot of money\u2014also in the box\u2014and could not let anyone find out about it or he would go to prison.\\n\\n\\n\\nIt all does sound far-fetched, and it\u2019s easy to read this and say you\u2019d never get caught by something like this. However, Karen is a well-educated person who was manipulated into paying large sums of money. Scams can catch anyone out.\\n\\nKaren realised something wasn\u2019t right and that she was being scammed, so she filed a police report at her local Sheriff\u2019s Office, along with the FBI, TBI, IC3 and the Better Business Bureau.\\n\\nThe local investigator found nothing on Charles Hillary. Worse, the damage was already done: Karen\u2019s credit was bad, her finances in a mess, and nobody except for one friend and a co-worker knew.\\n\\n\\u003e \\”At this point, I owed about $65,000\u2014some was a Discover loan, some were cash advances and some on credit cards\u2026all in my name alone.\\”\\n\\nThe box scam continued until December 2020 until the scammer decided to change tactics.\\n\\nScammer threats, while scary, are typically empty. But how can a victim be sure of that? Karen tells us about the most recent threats the scammer made:\\n\\n\\u003e \\”The most recent threat was to my son’s wedding. He said the Russians had hired hit men in the United States to create a blood bath. He sent me the wedding invite to prove he knew who, where, and when. Nothing happened but he is still emailing me daily.\\”\\n\\nThe scammer started using a second, more supportive, persona. As an example of how this second persona was used, this bizarre, less aggressive email came after the threats to disrupt the wedding (all sic):\\n\\n\\u003e \\”I woke up with sadness in my spirit due to the recent threats against your children \u2026\\n\\u003e \\n\\u003e I have about $2500 in my wallet and if you can send the balance today that would be great so we can end this immediately instead of waiting for your son wedding to become a disaster or endangering his guess. I am willing to assist with $2500 if you can come up with the balance today and also the board will be in an agreement to prevent any future harm against your children. Get back to me as soon as possible.\\”\\n\\nThis persona expresses concern and sadness about the threats against the victim’s children and criticizes \\”Hillary\\” for continuing the threats. This dual-role tactic is a classic psychological manipulation technique often used in scams:\\n\\n * The victim feels fear and urgency from the threat.\\n * Then they feel relief and trust from the \\”helper\\” who appears to be on their side.\\n * This builds rapport and pressure to comply with demands.\\n * The combination makes the victim feel psychologically cornered, pushing them to do things which they\u2019d normally consider irrational.\\n\\n\\n\\n## Our investigation\\n\\nAn analysis of the language and style of the emails from the two personae shows it\u2019s very likely the same person or same group of people working from the same script.\\n\\nMany of the Gmail addresses the scammer used were removed after complaints to Google, but it\u2019s trivial to set up a new one. Google did tell Karen that at least some of the accounts were set up from Nigeria.\\n\\nOur own analysis of the headers of some recent emails didn\u2019t reveal much useful information, unfortunately.\\n\\n### **Email authentication and origin:**\\n\\n * The email was sent from the Gmail server (mail-sor-f41.google.com) with IP 209.85.220.41, which is a legitimate Google mail server IP.\\n * SPF, DKIM, and DMARC authentication all passed successfully for the domain gmail.com and the sending addresses charleshillary****@gmail.com and cortneymalander***@gmail.com. This means the emails were indeed sent through Google’s infrastructure and the sender address was not spoofed at the SMTP level.\\n * ARC (Authenticated Received Chain) signatures are present but show no chain validation (cv=none), which is typical for a first hop.\\n * The Return-Path and From address match, which is a clear sign that the envelope sender and header sender are consistent.\\n\\n\\n\\nConclusion: The sender’s Gmail accounts were likely compromised or set up for this scam, rather than the email being forged or spoofed at the server level. Looking at the list of past email addresses, we are pretty sure that all of them were created specifically for this scam.\\n\\nWe also followed up on some wire transfers that Karen made to pay the scammer, but we found that the receivers were scam victims as well, which the scammers used as money mules. The receivers of the wires were instructed to collect the money and put it in a Bitcoin wallet. Most of Karen\u2019s payments went directly into those wallets.\\n\\nWe\u2019ve advised Karen to ignore the scammers and not even open their emails anymore. At some point they will give up and turn their attention to other victims. Meanwhile, Karen will have to keep working two jobs as she has a remaining $20,000 debt.\\n\\nEven after a month of not replying, Karen reports that she still receives emails from the scammer. They haven\u2019t given up on extracting more money out of her. Her exhaustion and isolation showed in this reply to me:\\n\\n\\u003e \\”Appreciate your help so much. Wish I had found you a long time ago. Could have saved me money, 2nd jobs and a marriage from nearly going under. The devastation they cause is real.\\n\\u003e \\n\\u003e This is what I daily beat myself up over. I saw the signs of scam. I was told it was scam, but they make it so dang real that I could not wrap my head around it being anything but truth. I looked for any and every sign of them stepping all over each other in their stories but never did until about two or so months ago.\\”\\n\\n## How to tell if you\u2019re talking to a scammer\\n\\nA few things that should have warned Karen:\\n\\n * The person that contacted you on one platform now wants to move to a different platform. Whether that is WhatsApp, Signal, Telegram, or as in Karen\u2019s case, Google Hangouts. For a scammer this is not a matter of convenience, but of staying under the radar.\\n * Time zones don\u2019t match up. Based on their activity, you can make a rough guess about the time zone the person you are communicating with is in. Check if that matches their story. In Karen\u2019s case the scammer picked Ireland which is very likely their actual time zone but given their use of the English language, not their actual location.\\n * Dodgy paperwork. The documents Karen received would not have survived any legal or professional scrutiny. But since Karen was too embarrassed to tell anyone what she was involved in, she didn\u2019t get a second opinion on the papers.\\n * A second person starts messaging. Granted that the scammers had a decently thought out script, linguistic analysis would have shown Karen that the two separate personas were one and the same person with a very high accuracy.\\n\\n\\n\\nIf you feel like you might be talking to a scammer, **STOP** and think of the following tips:\\n\\n 1. **S** low down: Don’t let urgency or pressure push you to take action.\\n 2. **T** est them: Ask questions they should know the answer to, especially if you think they are posing as someone you know\\n 3. **O** pt out \u2013 Don\u2019t be afraid to end the conversation.\\n 4. **P** rove it \u2013 If any companies are involved, confirm the request by contacting the company through a verified, trusted channel like an official website or method you\u2019ve used in the past.\\n\\n\\n\\n* * *\\n\\n**We don ‘t just report on scams\u2014we help detect them**\\n\\nCybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard, a feature of our mobile protection products. Submit a screenshot, paste suspicious content, or share a text or phone number, and we\u2019ll tell you if it’s a scam or legit. Download Malwarebytes Mobile Security for iOS or Android and try it today!”,”published”:”2025-09-12T15:34:05″,”modified”:”2025-09-12T15:34:05″,”type”:”malwarebytes”,”title”:”From Fitbit to financial despair: How one woman lost her life savings and more to a scammer”,”source”:””,”references”:””,”id”:”MALWAREBYTES:A035DA185865B8EEA3030EE419B8359B”,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/scams\/2025\/09\/from-fitbit-to-financial-despair-how-one-woman-lost-her-life-savings-and-more-to-a-scammer”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-12T16:33:50″,”description”:”We hear so often about people falling for scams and losing money. But we often don\u2019t find out the real details of what happened, and…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-17250","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n