GIFT CARD SCAM
I just tangled with a scammer impersonating one of the lead living Hubbell family genealogy researchers!
The real person I met through wikitree years ago when he kindly assisted me overcoming a roadblock. We had traded emails and someone must have hacked his email account. For a little while today I thought I was emailing with the real guy, but it turns out the automated REPLY TO address in this email was altered in the tiniest way, so that I actually responded to the imposter even though the email looked pretty normal.
What these scammers do is hack someone's email account, then exploit that person's familiar name to scam you, first starting with a vague catching up kinda note like this real life example:
STEP ONE: "Hope this finds you well. How are you doing? Please reply when you get the chance, need to ask a favor. Will wait for your email as I'm currently unavailable via phone." signed by someone you think you know.
The phone bit was a little odd, but I thought it was a genealogy research favor being asked of me, like correcting a detail on a profile.Imposter got a very friendly response out of me. Here's what the imposter sent next:
STEP TWO: "Glad to hear from you. Please I need to get a Walmart gift card for a friend (cancer patient) - as it's her birthday - but I can't do this now as I'm currently traveling for a week. I was wondering if you could help get it from any of the stores around you (on my behalf that is). I'll pay back as soon as I get back by next week. Kindly let me know if you can handle this. Thanks,".... signed a person you think you know
I never got to STEP THREE because it was now clearly a creepy scam, but I could have possibly been more entangled if I thought it was a closer relation like a boss or a family member. I read elsewhere that next comes instructions about scratching gift cards codes and sending copies of them with receipts to the scammer. Really could be tough if it was your boss or grandchild being impersonated.
I read that it is important to try to track the actual person if possible and tell them to contact their email provider regarding a hacked account and impersonation. A friend just had a similar case where fake requests went out under her name and the company sent out a good hacking alert to her whole email list. The one being impersonated is victimized too.