I was at the hardware store--my version of the shoe store--when I received a text from Aran: "I got a call from a computer company saying that there are errors on my laptop. They are getting rid of them, but the bad part is that the charge is $500."
I froze. This was a scam. I've heard of it. I've gotten it. A guy calls, claims to be from Microsoft, and says there are errors on the computer. They'll fix them for a fee. It's an obvious scam, simplicity in itself to spot--unless you're autistic and naturally trusting.
I called Aran. "Did you give them your debit card number?"
"Yes," he said.
By now I was running toward the door.
"Did you give them your name?"
"Social security number?"
"Driver's license number?"
"Tell me exactly what they said, from the beginning." By now I was speeding home with the phone glued to my ear.
Short version is, a man had told Aran there were errors on his computer and they would fix them for $500. Aran agreed, and gave them his debit card number (despite my repeated warnings never, ever to do this). They tried to run the charge, but it was declined--Aran's account won't accept a charge that high. So they sent him to a web site that would download software to his computer that allowed a technician to control a computer from a distance, if the tech had the password. Aran was in the process of downloading that software at that moment.
"Shut your computer off," I ordered. "Unplug it and take the battery out. Now!"
He said he did. I pulled into the driveway a few minutes later and ordered him to bring his computer, phone, and debit card up to my office.
"That was an extremely foolish thing to do," I told him. "Now you're getting a crash course in fraud prevention."
Aran was clearly trying not to freak out and melt down. While his control was admirable--a few years ago, he would have gone into a panic attack--I had other worries. I used my computer to log into his bank account while simultaneously calling the bank. I told them Aran's debit card was compromised and needed to be destroyed. The technician on the other end said she was seeing a declined charge.
"That's the compromise," I said. "Kill the card right away and send us a new one."
She said she would. I ran Aran's current card through the shredder, then changed the password on his bank account, just in case, and explained to Aran what was really going on.
"They're criminals who tricked you," I said. "They tried to steal your money, and it's lucky you texted me, or they would have done it. Don't =ever= do this again."
I booted up Aran's computer, disabled the wifi connection, and had a look. The software seemed to be a third-party thing with legitimate uses. It had been co-opted by the criminals. It wasn't a virus. I uninstalled it, deleted the folder, shredded the recycling bin.
Aran's phone rang. It was a number I didn't recognize. Aran reached for the phone, but I took it away from him. "Let me."
A female recorded voice said, "We clean air ducts for you, at a low, low price! Call now and--"
I clicked off. Seconds later, the phone rang again. This number was from Orlando, Florida. I answered.
"Hello, sir," said a man in a thick Indian accent. "I am calling from Windows Corporation. We were repairing errors on your computer and got disconnected."
Holy shit! They called back?
"Hi," I said. "Thanks for calling back. I was wondering--what errors did you find on my computer?"
"We found many errors on your laptop," he said smoothly. "More than fifty fundamental errors that you need to fix immediately."
"What are they?" I pressed. "And how did you find them?"
"Our system detected the errors on your laptop."
"Did you download the software from [web site]?"
"I did," I lied.
"Did they give you a password?"
"Yeah, it's right here," I lied again. "How did you detect errors on my computer?"
"We need the password so we can fix the errors on your computer."
The software would grant him remote access to Aran's computer through the Internet, giving him power to download anything and everything from it, including browser history, saved passwords, and the like. The fact that he was pressing for the password was a good sign--it meant he hadn't actually managed to access Aran's computer, so Aran's data was safe.
"How did you say you detected the errors again?" I said.
Small hesitation. "Our system looks for such errors and finds them quite easily."
"How did you know it was my computer?" This was getting interesting now. I knew he had nothing, but he wasn't going to hang up if he thought he had a sucker on the line, and I was going to make him twist.
"Sir, we need the password for--"
"Right, but how do you know it's my computer?"
"We . . . we tracked it using a unique certificate number that only we can see, so we knew it was yours."
Clearly he had never heard of an IP number. I certainly wasn't going to explain it to him. "That's not how it works," I said, and added to the lie with, "I work in IT, and I know better. What errors did you find?"
This didn't faze him in the slightest. "We need to upload the software to tell you exactly. Do you have the password?"
"Where are you calling from?" I said abruptly.
"Me? I'm calling from Las Vegas."
"Oh? That's weird. The phone says you're calling from Orlando, Florida, and your accent says you're from India. So where are you REALLY calling from?"
"I have an accent, yes, because I am a student," he said quickly. "I am studying in Las Vegas and working."
"Working as a technician for Windows," I said, "while your phone line says you're in Florida. You're lying. But your accent is really sexy. I'll bet you're cute. Are you cute?"
Here Aran folded his arms and glared at me.
Without missing a beat, the guy said, "Would you like to talk to my supervisor?"
"Sure. I'll bet he's cute, too."
"I'll put you on hold. Ten seconds."
He put me on hold. I hung up. About a minute later, the phone rang again. It was another guy with an Indian accent. Now I was getting warmed up. We went through much the same conversation as before, with me asking what the errors were and how he had found my computer and him evading but unwilling to hang up. I also dangled the password in front of him, which I think was driving him crazy.
"Are you married?" I asked.
"Not yet," he said. "Do you have the--"
"Because I'll bet you'd make some lucky man a really sexy husband. Do they allow that in India? It's legal in Florida. If that's where you are, you big, hairy Indian liar you. How long have you been scamming people?"
"Sir, this is no scam."
"Sure, it is. We both know it. But as long as I have this password on my screen, you won't dare hang up. Meanwhile, we've canceled that debit card and changed all our passwords while I was distracting you with talk. And the longer I keep you on the phone, the less time you'll spend scamming someone else."
"May I put you on hold? Ten seconds."
"Sure. Don't be long, though, sexy--I might forget that password."
He put me on hold. I hung up. This time I blocked the phone number.
I handed the phone back to Aran. "Never, EVER give your debit card to ANYONE before you ask me. Got it?"