Fool Me Thrice

My misadventure with a ransomware hacker

Photo by Sasun Bughdaryan on Unsplash

In mid-January of this year, my X (formerly Twitter) account was hacked and held for ransom. It was a humbling experience.

I have long been interested in con artists and catfishing and how people get lured into believing what is in hindsight clear manipulation. It can never happen to me, I’ve thought.

Sure, Doc.

I recently (ironically) finished Dr. Anna Akbari’s compelling book, There Is No Ethan: How Three Women Caught America’s Biggest Catfish. (There’s a good podcast about it here.)

Ethan is the first person narrative of a psychologist who falls for a catfishing imposter on a dating website. Said imposter serially seduces women via online chats, gets them thoroughly hooked on the promise of romantic love (morphing into who they want him to be, quite persuasively)—while perpetually postponing an in-person meeting or phone call through a variety of lies: his “cancer diagnosis,” or a loved one’s, or a work or travel emergency, financial crisis, and so on. It becomes increasingly painful to witness, and makes me realize how valuable is genuine empathy.

Eventually Akbari ferrets out and contacts other victims of “Ethan,” and they band together to uncover the surprising truth. But the real surprise was just around the corner.

One morning, shortly after finishing the book, I found I could not get into my X account. Had I changed my passcode? Then I received a message on WhatsApp, with a Nigerian area code: “Is this your account?” it said, with a screenshot of same. It was like a thief locking you out of your own house.

X has notoriously poor customer service, and I could not find a means of contact other than a generic online form. A quick Reddit search told me that frozen accounts take weeks if not months to resolve, if ever. I frequently use my professional account to connect with other therapists and promote new articles. Also the account was mine; I hated the idea of someone else “in” it, sending scam messages to colleagues.

WhatsApp pinged: “I can get it back for you.” I asked, “How much?” Answer: “$200.”

$200 to make it go away. Let’s do it. (Hold that thought.)

What followed for hours was an infuriating comedy of errors, the hacker demanding payment via apps like Coinbase or CashApp, while asking for screenshots to guide me through payment. Nothing worked for some reason, as both apps rejected my photo ID (required for new accounts.) A creeping desperation took hold. Finally my Nigerian entrepreneur agreed to a bank transfer.

What is interesting to this psychoanalyst is my failure to consult with anyone before plowing ahead. It felt like a shameful secret, one I had somehow “created” (surely an oversight on my part) and now needed to fix.

But his constant messages grew infuriating, as problems with the bank transfer slowed me down. “Status?” he would ask. “What’s going on?” “Got it yet?” “You Still there?”

My frustration leaked in the middle of setting up the bank transfer. Again, Moses (who claimed he had “a partner,” presumably “Aaron”) continued pestering me for screenshots. I typed “thief” in the “note” section of the transfer form, and included it in the screenshot by accident. (I was at the time reading The Psychopathology of Everyday Life.)

Moses was not amused: “Why you say ‘thief,” G? You should have said friends and family. 😡”

Fortunately no plague of locusts arrived; I deleted the note and completed the transfer—which I then realized, this being a holiday weekend, would take two days to complete. Moses said he would get back to me, then vanished.

Two days later I got a call from the bank, saying that the recipient bank (Lead Bank) had a “problematic reputation,” and did I still want to go through with the transfer? I paused, asking myself what in the world I was doing, but also with the sense that it was too late to turn back. “Yes,” I said.

A few minutes later, my WhatsApp buzzed: “I got the money G, but I need $200 more to give you the password.” After some angry haggling, he gave me the password anyway. I typed it in, happy it was finally over.

A message appeared: Passkey incorrect. Please enter your passcode.

I messaged Moses: “WTF.” Response: “Sorry, my partner will need $2000 for the code.”

“Forget it,” I said, and wanted to smash my phone. I filled out yet another X customer service form, having heard nothing so far. I had however heard from concerned colleagues via email, about the strange solicitations they’d received from me on X, and why had I posted about buying a new car using crypto?

An hour later, Moses agreed to give me the passcode for $100, this time using Crypto.com. Screw it, I thought, let’s wrap it up. And so again the comedy of errors, the long process of registering for a new account, the photo ID not being accepted, Moses asking for screenshots, and me struggling with the app.

Finally the crypto transfer went through. I asked for the passcode. He responded: “I’m sorry, but my partner has taken over the account. He wants $1,000 more. I’m so sad.” “I’m sure you are,” I said, powering off the phone and popping a Tylenol.

He reappeared later that day, asking for $200. I offered $100, with the proviso that I be let into the account first. “Lol, how do I know to trust you?” he said, without irony. “Exactly!” I said, and blocked him for good. I filled out a cybercrime report on the FBI website. (Thanks, ChatGPT.)

Con artists manipulate us by playing the familiar language games of ordinary commerce: pay and receive. Their logic and manipulation of empathy twists the norms of good-enough honesty (assuming you are not currently working in the White House.)

Another twist involves the compulsive nature of social media in general, where the now becomes a powerful lure, me entertaining the quasi-delusion that my followers are keenly awaiting my next article or insight, despite the daily din and flood of posts, texts, and clicks vying for our immediate attention. What I am afraid of missing out on is something to reflect upon.

Perhaps it is such immediacy that, as with Dr Akbari and Ethan’s other victims (via his very online seduction), hypnotizes and bypasses our better judgment, for a happiness apparently within reach. A reader might of course bypass empathy here and think, in regard to the author, what a sucker. In fact I thought the same, even as I frantically pursued what was allegedly “mine,” on a platform owned by yet another tech edgelord for whom billions are not enough. It seems my hacker knew all this, without illusion.