All last week, I felt stupid and ashamed for being duped by a scam. I’d had an ugly argument with someone I love, and it left me demoralized and not sleeping well. So, when an email hit my inbox from Microsoft saying my subscription had been upgraded to “Premium Class,” and my credit card had been charged an extra $397, it upset me, and I took the bait.

Usually when I get unsolicited or suspicious emails, I flag them, categorize them as scams, and report them. I’m a publicized author. My name, photos, and videos are out there, making me vulnerable to scams, some directly targeting authors, some targeting anyone with a bank account. Romance scammers send me praise on my writing and ask me to follow them. Delete, block, flag. That’s my usual response.

But this time, I fell. If I were being charged for something I didn’t order, I wanted to correct it right now. Without stopping to think, I impulsively called the Microsoft number in the email. Had I been in my usual security-vigilant frame of mind, I wouldn’t have called. I would have loaded Microsoft.com into my browser, accessed my account that way, and checked it.

When a man answered my call, a long conversation began in which he engaged me in a very tedious procedure to correct the erroneous charge. Eventually my call was “elevated” to a senior officer who said he was an FBI agent. He sent me a photo of himself over an image of his badge number. The two men were able to look at my bank accounts before alarm bells finally went off in my head, and I ended the call.

I was lucky I came to my senses in time, but the damage was burdensome—close those bank accounts, start new ones, destroy current checks, shore up online security, contact autopay accounts with new bank account numbers. I had to verify that credit reporting agencies indeed had retained a freeze on my accounts, which I had put in place after a credit card of mine was hacked last year. The list goes on.

How Could I Have Been So Stupid?

Stressed and angry at myself, I’ve done some research on why someone as careful as I am takes the bait even once. According to the University of Central Florida, there are three main factors:

1. Hackers target human emotions. They do their best to engender fear in the victim or a sense of urgency to fix a problem. They gamble on the human need to trust others.
2. There is a situational vulnerability in the victim—the death of a loved one, a new job, information overload (e.g., a busy lifestyle with a constant stream of data to monitor).
3. Tech or social factors: Scammers try to trick you into handing over data so they don’t have to break through firewalls. They use urgency or scare tactics to bypass your usual good sense. They can even use AI to make a fake voice call sound like your loved one. Over-sharing by you on routine social media can expose personal details they exploit.

In my case, yes to all three. I felt a sense of urgency. I was already upset and not sleeping well. Posts on my social media offer information about my life.

It’s a sad fact that trusting to post on social media, believing what you read/see from others, and believing you recognize a familiar voice are all enough to clean out your entire savings. And cryptocurrency is the method used to take your money without any ability to trace it or recover it.

Fortunately, I lost no money, just time, though my self-esteem took a hit, but those intangible losses may be more valuable than money. Research demonstrates that the emotional cost of being hooked into a scam is significant, involving depression, self-criticism, and withdrawal. It takes support from others to recover, and a cognitive switch from self-blame to recognition that scammers are now extremely sophisticated. Software companies are constantly having to provide updates to all of us, which include new security patches. Still, you need time and self-forgiveness to recover.

What You Can Do to Protect Yourself

1. When you encounter an email, text, or phone call that suddenly disturbs you, and you feel the need to respond immediately, don’t. Instead, pause. Even 15 minutes. Give yourself a chance to calm down. Question whether you’re thinking clearly.
2. Verify the source of the email/phone call by using a recognized channel to do so. In my case, I could have keyed in the Microsoft.com website to investigate.
3. Make sure you enable two-factor identification. Take advantage of other security measures like call blocking, credit freezes, protective software, online monitoring of accounts, and password management.
4. If you’re using AI for ideas, or personal writing, etc., toggle off that website’s ability to save your material and use it for “training.”
5. Protect yourself by reducing your reactions to stress, by doing your best to get decent sleep, and by choosing various ways of reducing your anxiety. A tired, worried, and anxious person is more vulnerable to being scammed.

Finally, if you have been the victim of a scam, gather all the information you can about it and report it to the FBI Internet Crime Complaint Center (IC3). They need that information to help you and others, and there’s a complaint form you can complete. They also offer a hotline for victims over age 60: DOJ Elder Justice Hotline, 1-833-372-8311.

And to add to feeling foolish, later that day, when I looked more closely at the photo of the FBI Badge sent to me to verify that my scammer was legit, it was a low-res image of David Duchovny’s FBI badge from The X-Files. Wow…