Phishing for suckers

I used to enjoy fishing. There was something calming about the rhythm of casting, retrieving, casting again. A little rush of adrenaline when something took the bait. Taking care not to lose the fish I tricked into chasing something too good to be true.

Once upon a time, I’d eat what I caught. A nice catch on the BBQ, with butter and black pepper, was a treat. Somewhere along the way, I became a catch-and-release angler. The thrill was in the pursuit, not the meal.

Eventually, I lost interest in the catch. As the river changed, I saw more catfish and suckers, aquatic bottom feeders that don’t create “nice fish” moments. Being on the water was what I enjoyed most, so I left the fish to chase each other. It’s not an easy life, someone hiding behind a nearby rock or sunken log, looking to sink their teeth into your tail, or death from the sky, with its razor sharp talons.

Never did I imagine that one day, I would be the fish.

Well, except now it’s called phishing.

The river I’m swimming in is a big one. Like many rivers, it brings enjoyment, recreation, and feeling of being part of a larger community to many. It doesn’t begin with a literal sticking of a toe in the water, but anyone reading this has certainly stuck a digital digit in to test the electronic waters of the world wide web.

Like my favourite waterway, there are risks. One eye out for approaching weather and awareness of the hazards around you, especially the ones hidden just below the surface. The mighty Madawaska has eaten many outboard propellers, chewed up by jagged stones, deadheaded logs, and remnants of the river’s logging days, when “cribs” of logs were tethered to sunken anchors of timber and rocks.  An open spillway can make paddling a kayak through the narrows an exercise in testing just how in shape you pretended to be. As the old joke goes, denial ain’t just a river.

The perils of the internet are craftier, like someone sneaking out in the moonlight to move all the rocks you’d learned to avoid. Hazards aren’t created by glaciers and tectonic shifts. Nope, they are actively evolving in real time, constantly casting in your direction, learning your habits, the logs you hang out near, the Net poised to scoop you out of the drink.

I experienced such phishing this week. It’s certainly not the first time. I’m not swimming about without a care in the world wide web, I’m eyeing up what’s passing in front of me with a guarded eye. What’s that? Lunch? No, that’s the #3 Mepps spinner with a worm on that sharp treble hook. Some dumb rock bass is gonna fall for that downstream.

There’s spam in my inbox, website pop-ups, and phishing emails to both work and home. An email this week informed me the sender was aware of my crimes and I’d better send $1,400 in crypto currency or they’d tell everyone. Two things immediately came to mind: 1) where did I find the time and energy to break the law? I can’t fit a caper into my calendar until 2024, and I’m going to need to get some physiotherapy both before and after to pull it off. 2) Crypto? Have they checked the value lately? Maybe they should check with that actor who said “fortune favours the brave”.

I watch lures come and go, flagging them when needed. My digital life jacket is up-to-date virus software, and I let it do its job. Occasionally, something sneaks through, dangling a juicy morsel, hoping for a nibble.

That happened this week. I listed a slightly-used, but still expensive, item online. A few days later, someone contacted me and made a tempting offer. Would I take my asking price, plus $100, to ship the item to their “kid” at an address in Alberta?

The buyer appeared to be located in an Eastern European country. I looked up their social media page and it had tell-tale photos you see in emails from beautiful European girls that offer to be your new friend. Still, I wondered if the offer could be legit.

And so the dance began. Like two long-time warring nations, we opened negotiations.

I agreed to the transaction, but wanted the money e-transferred in advance. They responded positively, saying they’d send the transfer when I arrived at the post office. I asked for the mailing address and received it, checked online to verify the address existed. At the post office, I paid for shipping and received a tracking number, which they requested. I then received an email from their “bank”, asking for verification (a photo of the receipt and mailing label, neither of which identified me or my address). I complied, then received a response telling me that verification would take “1-24 hours”.

Did I mention to the buyer or “bank” that I still had the package in my hand? Nope.

I went to my car and looked up the tracking number. It showed the package as “in transit” and that average pick-up at that location was 1-2 days. I had some time to consider my next move.

The next morning I received an email from the “bank”, complete with some nonsense about “business transaction limits” and how the buyer needed to send an additional $450, blah blah blah. By now, I was home, with the extra options available for viewing on my laptop. I checked the actual email address for the “bank”, called my bank who told me I was correct in saying it wasn’t authentic. Suspicions confirmed, I reported all the information, including the shipping address.

A few hours later, another message from the buyer, asking if they could trust me to return the $450 they were going to send me to meet the needs of their “bank”. I considered stringing them on, but I had grown tired of the game so just blocked them.

Where are we now? The tracking number still says the box is on its way and expected to arrive in Alberta in five days. I likely can’t get my shipping cost refunded, but it’s a small price to pay, compared to the value of the item. A toe dipped in the global economy. A lesson learned.

I was telling my tale to a colleague and she said her mother got taken in by someone. $5,000 in gift cards later, her mom faced an incredulous daughter, asking how she could be so blind. Anglers can spend a fortune on realistic bait, and phishers are no different.

I have to admit, though I am glad I dodged the hook this time, I am tempted to jump beside the boat and celebrate a little bit. I have a box, a mailing label with a real address and the need for it to be signed for. Should I remove the item and replace with a substitute?  I have a cat, so I have some goodies in the litterbox. Perhaps a baggie filled with baking soda. Sigh. Temptation, unlike Mr. Waits, I should resist.