How Do Scams Bypass Our Defenses?
The answer lies in the way powerful stories exploit our cognitive blind spots. Some of us are more blind than others — as I discovered on Christmas Eve.
Natalie Vineberg illo
from THE WALRUS, Feb 11, 2020
I: The crime report
THE EMAIL popped up on my screen at 6:45 a.m. on December 24. I’d already been up for a couple of hours, working to deadline. It was from someone I know quite well: the minister of the North Shore Unitarian Church, which we attend.
No one else in the house was up, so there was no one to run this by. But then, I probably wouldn’t have asked for a second opinion anyway. For reasons I’ll explore, reasons that are the heart of this story, it didn’t really occur to me that this might be a scam.
“Ok,” I emailed back.
“THANK YOU so much, Bruce,” my correspondent replied. Then he got down to business. I was to buy $300 of cards. (That is quite a lot of music, I thought.) “I need you to scratch the silver lining laced at the back of each card to reveal the redemption code, then take a snapshot of the code and have the picture or the Ecodes sent directly to Sharon at the hospital on her email.” He gave the address.
“Let me know when you’ve sent it,” he said. “God bless.”
God bless? We’re Unitarians. Optimistic agnostics at best. The “G” word doesn’t come up much. Totally weird sign-off there. I assumed Ron’s mind was still on the dire circumstances of his friend Sharon, who was evidently a Christian.
“I can pick up the card around noon and engineer this by tonight,” I said.
He was super grateful, he replied six minutes later, but tonight’ll be too late for Sharon to use the cards. “Can you please send them to her by noon so she could be able to use them before her surgery?”
This was unhandy. But hey, what was my slight inconvenience against this woman’s cancer fight—on Christmas Eve, no less? I drove to the grocery store and purchased four gift cards. The clerk activated them at the till, turning them into currency. Back home, I took pictures of the codes. At 9:30, I emailed the pictures with the following message:
Dear Sharon,
The codes on the cards below will buy you music via iTunes.
Everybody is pulling for you.
A busy Christmas Eve day then unfolded. I forgot all about this until, around 4:30 p.m., while waiting for takeout fish and chips, I checked my email. A follow-up message had been sitting in my inbox.
“Sharon just emailed me now saying she got the cards. I want to really appreciate you for that. I’m sure it’s going to go a long way in her fight over cancer.”
But now there was a new development. Apparently word of the gift cards had made its way around the cancer ward. Now other patients were asking for the same thing.
“Could you please get me additional $500 worth of Itunes gift cards right away? I will be paying you back $800. I’m so sorry for the inconvenience.”
This was a bridge too far. The personal friend was one thing, but random strangers on the ward? Don’t these women have family? And anyway, I thought, it might be too late.
I called Ron.
“Hey Bruce. What’s up?”
“Are we too late to help those other patients?” I asked.
Silence. Then: “Um. I don’t know what you’re talking about.”
“Those other patients on the ward who now also want music,” I said.
“Uhhh . . . ”
“I’ve been copying you on these emails,” I said. “Haven’t you been getting them?”
“Bruce.” A long beat. “It’s a scam. Somebody has been impersonating me. I put out a warning out on Facebook.”
“I didn’t . . . see that.”
I heard Ron exhale. Neither of us knew quite what to say next.
*
II. The narrative architecture of a successful scam
Phishing, the current “attack vector of choice among cybercriminals,” as one security consultant put it, is now so common it’s practically a demonstration sport at the fraudster Olympics. Indeed, the exact scam I’ve just described can be found on the Internet in 30 seconds. But it never occurred to me to check. The question is why.
Near the end of the film The Sixth Sense, director M. Night Shyamalan springs his trap. And you go: Wait. Bruce Willis is … dead? I remember feeling stung. Disoriented. And yet, in retrospect, the evidence was there all along.
It was exactly the same experience when Ron — the real Ron — said over the telephone: “It’s a scam.” There was the sudden reframe, the forehead-smiting denouement. The resolution seemed almost literary: both shocking and somehow inevitable.
That is the human brain on a well-crafted fiction, says Vera Tobin, a cognitive scientist at Case Western Reserve university in Ohio and author of Elements of Surprise: Our Mental Limits and the Satisfactions of Plot (Harvard University Press). The sympathies and attention of the “victim” are expertly manipulated by narrative sleight-of-hand. O Henry-ish storytellers are social engineers in the same way that scammers are. The architecture of “the con” is the same. Carefully, we are led down the garden path.
The stakes start small. In my case, the initial contact was modest and believable. There were the shoe-shuffling apologies, the thanks in advance. From there, the story unfolded. Next thing I knew, I was putting on my jacket. It was as if I had been “activated,” like a sleeper agent. Once I’d bought the gift cards, I was all-in.
Stanley Milgram, the experimental psychologist—and really, all experimental psychologists are con artists of a sort—ran his most famous ruse out of his Yale lab in 1961. In it, test subjects swallowed the fiction that, by flicking switches of a console, they were administering increasingly powerful electric shocks to a man in the next room as punishment for his getting test questions wrong. The experiment was designed, in the wake of the Nazi atrocities, to test people’s willingness to blindly follow orders to dire ends.
What kept those volunteers going was that they had been led into the madness gradually. They had no idea they’d crossed a border until they were on the other side. “It wasn’t a study of obedience,” said behavioral economist Tim Harford not long ago, “so much as a study of our unwillingness to stop and admit that we’ve been making a dreadful mistake.” We get in over our heads, so we just keep going. For me, beyond a certain point, bailing wasn’t even an option. Three hundred dollars seemed like an audacious ask for some music, but it was just within the realm of the credible.
Scammers exploit thinking errors in the same way those surprise-ending storytellers do. We are “cognitive misers,” taking mental shortcuts and jumping to conclusions wherever possible. That’s why the University of Toronto psychologist Keith Stanovich insists gullibility isn’t a sign of low intelligence. It’s a sign of “low rationality,” which is different. The frontbrain never has a chance; the horse had already left the barn with that first snap judgment. And now all that’s left is rationalization.
Scammers exploit other cognitive errors. Like “optimism bias.” Most people think they’re a little bit charmed, a little luckier than average. We harbour a personal fable that things are likely to go well for us. The possibility that we’ve been hoodwinked just isn’t as “available” as a happy ending. So the Debbie Downer story gets suppressed.
And then there’s “consistency bias,” which says people tend to act in accord with who they believe themselves to be. As I sat waiting for my takeout at the fish shop, and retrieved that second email asking for more money, annoyance flared. But it was soon swamped by another feeling: I’m a nice guy and here’s an opportunity to prove it. “You were on a goodwill mission,” said the cop at the North Shore RCMP detachment who dutifully took down my report. “And that kind of put blinders on you.”
Behavioral economists coined a term, the “curse of knowledge,” which psychologists have adopted. “It’s hard for people to set aside the things you know,” says Tobin. “The more experience we have with something, the harder it is to step outside it.” The scammer had fixed in my mind the image of a cancer ward. Meet my friend, Sharon. She is craving distraction because she’s terrified to die. I could see Sharon, because I have been there. I was at my father’s bedside when he died of cancer. “Once you know something, or think you know something, it’s really hard to suppress that way of seeing things,” says Tobin. “And now you’re suddenly blind to what would be obvious if you didn’t have that baggage.”
That the cancer story was ripped right out of a made-for-TV movie was also no accident. The emotional content put me in what psychologists call a “hot state.” “The more gripping the story, and the more emotionally engaged we are in it,” says Tobin, “the less we’re thinking critically and asking ourselves, ‘What are the discrepancies here? Should I trust this source?” Under such highly charged conditions, “you can talk yourself into anything.”
My scam landed in my inbox in the early morning. The dreamy pre-dawn is a great time to be creative; our “ego defenses” are down, Carl Jung claimed. But it’s a lousy time to be logical.
Then I learned about the tight deadline. Again: no accident.
Studies show people are more likely to respond to an internet solicitation when a quick response is required. The sense of urgency “short-circuits the resources available for attending to other cues that could potentially help detect the deception,” said Arun Vishwanath, a University of Buffalo psychologist and now a visiting lecturer at Harvard. The ticking clock is a “visceral trigger,” an express ticket to a hot state, where sound reasoning goes to die.
All these factors together may incline scam victims to overlook what should be glaring red flags. My minister didn’t use my name in the first email. Then again why would he? Obama famously texted his friends in the early morning with a simple “U up?” (Of course the real reason the scammer didn’t use my name is he didn’t have it. Until, with my response, I gave it to him.) And the grammatical errors and weird capitalizations from a person I knew to be fastidious with the language? I chalked it up to stress. Basically, I read those emails through a filter that cleaned up the language, imputed only good motives and kept me from looking up from the puppet, even once, to see if there might be strings.
III: The few, the proud, the incredibly gullible
But wait: if successful scams exploit these universal cognitive biases, why don’t all of us fall for them? Around 20 percent of the population is especially vulnerable to scams, says Stephen Lea, an emeritus psychologist at the University of Exeter in the UK who studies the personality traits of likely fraud victims.
Of the folks who receive phishing emails like mine, only around four percent actually bite, according to a recent study by the telecom giant Verizon.
So we few, we sorry few, we band of schlimazals: what’s different about us?
There’s a widespread perception that scam victims are predominantly older folk. But that isn’t quite right. Millennials are actually scammed more than any other group, according to Federal Trade Commission data. But they lose less money than seniors because they have less, notes Frank “Catch Me If You Can” Abnegale, the former con man who now consults to law enforcement. (Curiously, seniors are more likely to get scammed face-to-face. One theory is that older people are less alive to visual cues of insincerity. Shelley Taylor, the UCLA psychologist driving this research, found the brains of older people showed less activity in the areas that process risk and subtle danger.)
The stereotype that the lonely are sitting ducks is true. Lonely people are more likely to let scammers get their foot in the door; they open unsolicited mail and stay on the line with those bogus Canada Revenue Agency officers. A scammer can figure out if you’re lonely from your social-media trail. But when a reporter for Mother Jones magazine traveled to Nigeria to interview a group of email scammers, the young men were pretty clear that they didn’t care about lonely. They only cared about wealthy. “We know how much you have in your account,” one said.
I’m not lonely, not a millennial and the opposite of rich. But I was randomly phished in a pool that is statistically promising for scammers: a minister’s congregation. There’s evidence that con artists disproportionately target religious groups — although it’s less clear whether “people of faith” are actually more gullible to such scams. Most Unitarians, I’d venture, are of the “trust but verify” variety, too intellectual and circumspect to fall for these kind of shenanigans. And sure enough, I learned that no one else in my congregation was fooled. This scammer was lucky to have found me. I have a history he could only have dreamed of.
I am the kid who sent away for the full-size “Frontier Cabin” from the back of a comic book — perhaps as a place for the Sea Monkeys I’d previously ordered to hang their little crowns. That kid grew up to be the adult whom panhandlers naturally find in a crowd. I have accepted at face value every hard-luck story going, and duly coughed up five bucks for a hamburger, ten bucks for a bus ticket, twenty for gas to get back home to Abbotsford. “Remember the time you almost bought a car with a lien on it?” my wife reminded. “Or the time you went, with great hope, to the Downtown Eastside to meet the guy who said he’d found your stolen camera?” She started enumerating the scams she could remember; it took two hands.
Gullibility is a hindrance for a journalist, to say the least. It seems to take me twice as long as everyone else to write a feature. I routinely have to rip the whole thing back to the studs when I hit the fact-checking stage and discover people weren’t being entirely honest. Or at the very least, the truth is way more subtle than it was presented. Shoulder-checking earlier would have saved me a lot of trouble. But shoulder-checking earlier would have also broken the spell — the spell of the perfect story that was taking shape.
Perhaps gullibility is a “neural trait,” rather in the way hypnotizability is. (Brain scans of “very hypnotizable” people reveal distinct activity patterns, Stanford psychiatrist David Spiegel found.) Whether that proves true, there are other character traits we scam victims demonstrably share.
We are decisive. Okay, impulsive. “Ready-fire-aim.” Deficient “depth of processing” is another way to put it, and mine was abysmal in this case. I read those Christmas Eve emails the way our dog eats her dinner: I wolfed them down without really reading them. I got the gist, and then my imagination quickly filled in the rest. That’s how it works. “You see things that aren’t there,” says the cognitive scientist Vera Tobin, “or you fail to see things that are there, because your expectations are driving the bus.”
“Naive” or “trusting” come close, but social scientists prefer the descriptor “unsuspicious.” That’s another way of saying I just have a low-wattage bs detector right off the shelf.
And we are “risk takers,” physically, financially, emotionally. The psychologist Stephen Lea found that self-reported risk-takers were twice as likely to be victims of scams.
But the likelihood of being duped is also circumstantial.
Fraud victims are “far more likely to be facing a rough patch in their life,” according to Doug Shadel, lead fraud investor of Washington, DC-based AARP and author of Outsmarting the Scam Artists.
Having suffered a “serious negative life event” — like a divorce, a layoff, a health crisis, the death of someone close to you — more than doubles your risk of falling for a scam, according to a 2013 US Federal Trade Commission study. Also, people juggling more debt than they can handle are “significantly” more vulnerable to scams, a separate study found. (Perhaps because stress ties up cognitive resources that could otherwise be used to spot scams.) You can see how being financially underwater could create an intense desire for immediate relief, of the sort that get-rich-quick schemes offer. That’s not the kind of ruse I fell for; but the drowning metaphor still applies. Divers suffering from oxygen debt can experience “rapture-of-the-deep,” where reality-testing fails and magical thinking blooms. The journalist Jonathan Kay, author of the 2011 book Among the Truthers, found people were more likely to start believing in wild conspiracy theories after they’d hit a bumpy patch in their lives.
You’d think ignorance would be a precondition of getting bilked. But weirdly, the opposite may be true. Sometimes the problem isn’t knowing too little, but too much.
One of Bernie Madoff’s victims was a psychiatrist named Stephen Greenspan, who lost about a third of his life savings to Madoff’s Ponzi scheme. Just two days before he learned he’d been hoodwinked, Greenspan hadpublished a big authoritative tome, the fruit of decades of research in his area of expertise. It’s called The Annals of Gullibility: Why we get Duped and How to Avoid It.
“Scam victims often have better than average background knowledge in the area of the scam content,” notes the psychologist Lea.
Some expertise, it turns out, can make people a bit cocky. This is the so-called Dunning-Kruger effect. It’s basically the premise of every Will Ferrell movie. Overconfidence can produce a kind of unwarranted swagger, an almost comically obtuse misreading of events. The more we know, the less likely we are to second-guess our initial take on something — which may have arrived via the gut rather than the brain. Overconfidence disarms the sensor of sober-second thought.
And while you can teach people to detect scams, until their scam-detectors become as sensitive as a sandpapered fingertip, the effect may be short-lived.
Not long ago a group of cadets at West Point, the prestigious military academy in New York State, was trained to accurately detect e-mail phishing schemes. They got good at recognizing incoming emails with links that could activate malware and other security risks. But old habits and sloppy cognitive processing die hard. The cadets soon slipped back into their old email reading habits. Ninety percent of them fell for a phishing scheme resembling the ones they’d just learned about, a mere four hours after receiving the training.
I actually know quite a lot about scams myself. I own a copy of the 420-page scam-detecting bible How to Cheat at Everything, by short-con guru Simon Lovell. I know quirky facts, such as that there are two key pieces of information you should never divulge together: your date of birth and city of birth. (With those a scammer has 98 percent of what they need to steal your identity.) Plus, ironically enough, I’d been right in the middle of editing some articles on how to avoid scams. That kind of knowledge should have made me be able to smell a ruse at fifty paces. But here’s the thing: while I had a solid general knowledge, I’d somehow never encountered this particular dodge. There was no Nigerian prince. No one claiming to be from the Canada Revenue Agency, or Windows, or Apple. No relative had been falsely arrested and needed bail money. It wasn’t a pyramid scheme. It didn’t even involve money. Why would a crook want music? (The answer is, of course, that they don’t. The reason why scammers ask for iTunes gift cards is simple: the codes are hard to trace. And once they have them they can resell them for money on the aftermarket. Gift cards are the new wire transfers.)
*
“I’m afraid there’s nothing we can do,” said the agent from Visa’s fraud department, after silently hearing out the whole story when the investigators came back on shift after Christmas break.
“Why not?”
“Because it’s not fraud,” he said. “When we dispute a charge, our claim is against the merchant. But the merchant didn’t do anything wrong here. You willingly purchased those gift certificates.”
Wait, what? I didn’t willingly purchase them.
Or did I?
What distinguishes fraud from all other crimes is that it demands co-operation from the victim, notes Stephen Lea. The underground card magician Wesley James puts a finer point on it: “The dupe is always to some extent complicit.” But what could possibly be the payoff in getting robbed?
Maybe the answer is not so different from why we go to magic shows, or Sixth Sense-style movies with whipcrack endings. It’s weirdly pleasurable to suspend our disbelief and then have the rug pulled out from under us. “That aha moment,” says the cognitive scientist Vera Tobin, “is something humans like a lot.” The tension-and-release, after being led into jeopardy, is something I’ve probably been missing on the flat sea of midlife.
And of course, for a writer, drama is its own kind of payoff. What did I get out of the whole ordeal? I got a “moment” – a frisson of aliveness, a memory to distinguish this day from all others, forever. And, not least, a story.
Was all of that worth a few hundred bucks and public humiliation?
*
As soon as I’d learned I’d been scammed I contacted Visa. The first agent I talked to was sympathetic. He was a young man sitting alone in a call centre someone on Christmas Eve and the melodrama in this story seemed to overwhelm his stick-to-the-script professionalism.
“Oh,” he said gravely. “Oh.” Well, first of all, you were trying to do a nice thing. Never forget that.
“We will dispute this,” he said. He prepared me in advance that this was a tricky one. I might not recover the money. “I’d say it’s fifty-fifty,” he said.
He must have been looking at my name on the screen.
“Wait, are you the guy who wrote What Makes Olga Run?”
I said I was.
“That was a great book,” he said. “I will fight for you, man.”
And right then, my heart swelled with that familiar feeling of hope.
Featured Psychology Published Stories Archive