[cold open — audio only]Jeanette (BBB CT) opens the case file from her desk in Cromwell.
[cold open — audio only]
The Pop-Up
Margaret, 72, has lived in the same West Hartford colonial for 38 years. Tonight she will be asked to trust a stranger with everything. There is no easy way out.
NARRATOR: It's a Tuesday in February. Margaret is on the laptop her son David set up last Christmas, scrolling through grandkid photos.
NARRATOR: She clicks a link in an email from 'Hartford Senior Center' about a knitting workshop. The browser opens a new tab. Then another. Then twelve.
The screen is screaming. A man's voice is barking instructions through her tinny speakers. What does Margaret do?
- riskyCall the 1-800 number on screen — The number is right there. They're already trying to help.
- mixedTry to close the browser — Make it stop. Make it go back to normal.
- mixedCall your son David first — He set this up. He'll know what to do.
NARRATOR: She holds the power button. The laptop goes black. Silence. She breathes out. Then five minutes later, her phone rings.
NARRATOR: David's voicemail: 'Hey, it's Dave, leave a message.' Her throat closes. She hangs up. The laptop is still screaming. Five minutes later, her phone rings.
The phone won't stop. The pop-up won't stop. Her heart is in her ears. What does she do?
- riskyAnswer the phone — Microsoft has her name. They have her real information.
- mixedLet it go to voicemail, then listen — Don't answer. But hear what they want.
- best outcomePower off everything. Walk away. — Give up trying to fix this tonight.
BRAD (voicemail): "This is Microsoft Senior Technical Engineer Brad Johnson. Your computer and all financial accounts will be permanently locked in two minutes. This is final notice."
The threat in the voicemail is specific. It used her name. What does she do?
- riskyAnswer this time — Two minutes. He said two minutes.
- best outcomePower off. Walk away. — Turn it all off. Sleep.
NARRATOR: She unplugs the laptop. She turns off her ringer. She sits in the dark kitchen until 2 AM, scared of her own house. Nothing happens.
NARRATOR: By morning her phone has twenty-three voicemails. Eight missed calls. Two are from her actual bank's fraud line. Three are from David, increasingly worried. The rest, she cannot tell apart. By the time she sorts out which calls were real, she has missed a doctor's appointment. The dental office charges seventy-five dollars for the no-show.
NARRATOR: Three days later, a letter arrives in the mail. The return address: MICROSOFT CUSTOMER CARE. The letter inside is on official-looking letterhead. 'Data Breach Notification.' Her name is on it. There is a phone number to call.
It looks legitimate. It feels legitimate. The timing matches the pop-up exactly. What does Margaret do?
- riskyCall the number on the letter — It came in the mail with her name on it. Microsoft does send physical letters about real breaches.
- best outcomeThrow it away — Pretend it didn't come. Tear it up. Even if it's real, she doesn't want to know.
- mixedTake it to your bank in person — Get a professional opinion. The bank deals with this every day.
You threw it away.
Trusted yourself twice. The cleanest possible ending — and still not clean.
The letter was a sophisticated follow-up scam. The same operation behind the pop-up. They mail thousands of these to people who didn't fall for the first hook. The phone number on the letter would have connected to 'Mark from Microsoft Customer Care,' who would have asked Margaret to install software to 'verify her identity.' She never made that call. Six months later, the calls finally stop. She still flinches when the phone rings. She still doesn't quite trust the laptop. The seventy-five dollars she lost at the dentist still bothers her, even though that's nothing compared to what could have happened. This is the rarest possible ending. Even it has a price.
- Powering off mid-emergency feels insane and is correct. Real Microsoft, real banks, real police will never demand you act in 60 seconds.
- Follow-up scams target people who escaped the first attempt. The follow-up is more polished. Throwing it away requires trusting your earlier judgment over new 'evidence.'
- Even the cleanest escape costs something: a missed appointment, a $75 fee, lost sleep, lost trust in tech, lost ease at home. The 'free' escape doesn't exist. Scammers take more than money.
Next step: If you read about a scam in the news, save the BBB Scam Tracker URL the same day. Don't wait until you're being targeted to figure out who to call. Pre-loaded resources break the panic — and let you respond without missing your dentist appointment.
You took it to the bank.
Safer instinct. Real bureaucracy bit you anyway.
The branch manager at her Constitution Bank in West Hartford recognizes the letter as a scam within thirty seconds. She praises Margaret for not calling. But she also has to file a 'potential exposure' report, which triggers a five-day account hold while the fraud team reviews recent activity. Margaret's automatic mortgage payment misses its window. The late fee is $47. The hold lifts. The mortgage gets paid. Everything is technically fine. But for those five days she was certain she'd lost everything anyway.
- Asking a real bank in person is a defensible, mature response to suspicious mail.
- Real fraud-prevention bureaucracy has friction. That friction is what makes it real. Scammer 'fraud departments' have zero friction. That should be a tell.
- If you trigger an account review, set up payment-reminder texts so a five-day hold doesn't compound into late fees.
Next step: Have a direct branch contact saved, and save BBB CT (860-740-4500) next to it. Both can tell you in under three minutes whether a piece of mail or a call is a known scam pattern. The general 1-800 line for any bank can take 30+ minutes during fraud reviews.
MARK · Microsoft Customer Care: "Margaret. Hi. Yes — my name is Mark, I'm with Microsoft Customer Care, Pacific Northwest division. I see you got our letter. I'm so glad you called within the window. This is just a routine follow-up regarding the breach event from three days ago. I only need to verify your identity. It'll take five minutes."
MARK · Microsoft Customer Care: "Margaret, this should only take five minutes. I need you to type in an address: A-N-Y-D-E-S-K dot com. Same site as before. But this time it's the legitimate Microsoft Customer Care portal. I'll send you a six-digit code in just a moment."
MARGARET: "I — I already did this with someone else. Is this the same — "
MARK: "Same software, different purpose. I'm with Customer Care, not the response team. You're fine, Margaret. Now log into your Constitution Bank. I'll just watch the screen. Standard procedure. Don't read me anything."
MARK: "Wonderful. You're all set. Someone from Microsoft will email you within 24 hours. Check your spam folder if you don't see it. Have a good evening, Margaret."
NARRATOR: He sounded almost bored. Like he had done this a hundred times. He had. The line went quiet. Margaret stared at her laptop for another minute. The promised email never came. She forgot to check her spam folder.
NARRATOR: Six days later she logged into the bank to pay the gas bill. The balance was lower than she expected. She refreshed. It was still lower. She refreshed again. The page reloaded the same number. Nine thousand two hundred dollars missing.
You called the number on the letter.
The escape lasted three days. They got you with the follow-up.
The voice on the line said his name was Mark, from Microsoft Customer Care, Pacific Northwest division. He was patient. He didn't pressure her. He just needed to 'verify her identity' by walking her through a quick software install — to confirm her computer hadn't been touched after the breach. By the end of the week, $9,200 had moved out of her savings, and her email had been forwarded to an address she didn't recognize. The letter scam works precisely because the people who get it have already proven they're cautious. Caution is the qualifier.
- Follow-up scams aren't a different operation — they're the same operation working a longer con. Three days is a deliberate pause to lower your guard.
- Official-looking mail with the right logo costs $1 to print. The legitimacy of paper is not a signal.
- If a 'real Microsoft' wanted you to know about a breach, they would email through your existing account, not mail you. Companies don't print and stamp.
Next step: Treat unsolicited 'follow-up' communication after a scary tech event as more suspicious than the original, not less. Real institutions never reach out with new contact channels for the same issue.
BRAD JOHNSON (Microsoft "Senior Tech"): "Ma'am, thank you for calling Microsoft. My name is Brad Johnson, badge number MS-4421. Don't turn off your computer. You've been infected with the Zeus Trojan. Do not touch anything."
You stayed on the line.
No money lost. But your name is now on a list.
Brad gives up after twenty minutes. He has hundreds of other calls to make. But Margaret's number is now flagged in his system as 'engaged but uncommitted' — the most valuable category. Over the next six months her phone rings constantly. Microsoft Customer Care. FBI Cyber Division. Constitution Bank Fraud Prevention. Social Security Administration. Medicare. Some of them are real. She can't tell anymore. She stops answering the phone entirely. She misses her granddaughter's birthday because the family group text never reached her.
- Engagement is the scammer's commodity. "Staying on the line to ask questions" feeds the algorithm that decides who gets called back.
- The cost of scam exposure isn't only money. Lost trust in your phone is its own loss.
- Hanging up immediately, even if it feels rude, is the cheapest defense.
Next step: Set every device in the house to silence unknown numbers by default. Voicemail is fine. Real callers leave one. If any voicemail spooks you, paste the transcript into BBB Scam Tracker — they catalog the exact language patterns and can usually confirm a scam in minutes.
This sounds like federal law enforcement. The badge number he just rattled off was crisp. The threat is precise. What does she do?
- riskyComply. Do what they say. — It's federal law enforcement. The penalty for refusing is worse.
- mixedSay "I need to call my husband" — He's been gone seven years. They don't need to know that.
- best outcomeHang up everything. Walk away. — Refuse a federal agent. Click. Sit alone in the silence.
BRAD: "Of course, Margaret. Family is everything. Just please, hurry — every minute the hackers are inside your accounts." The FBI voice has softened, now sounds exactly like Brad. She didn't notice the switch.
You hung up on the FBI.
Saved your money. Lost your sleep.
Real FBI agents do not call private citizens about cybercrime. They show up in person or send formal mail through their field office. Hanging up was correct. But Margaret didn't know that with confidence. For weeks she expected real federal agents to knock on her door. She didn't tell David. She didn't tell anyone. She slept four hours a night. She lost eleven pounds. Her doctor at Hartford Hospital ran heart-attack tests. Everything was fine. She was just terrified.
- Federal agencies do not cold-call about active cybercrime. If they want you, they will visit your home.
- Hanging up on someone with a badge feels criminal. It is correct. The fake badge is the scam.
- Telling someone you trust the night it happens shortens the recovery from months to days.
Next step: Memorize this script: "I do not give information over the phone. Please send me a letter through my local field office." Then hang up. Use it on real-FBI-feeling calls too. Afterwards: report the call to BBB Scam Tracker — the language pattern enters the data that warns the next victim.
BRAD: "We need to secure your money immediately. I'm going to connect you to your bank's fraud department on the line. They'll tell you how to move funds to a safe federal account. Stay calm, ma'am. Stay calm."
She has to pick one in the next sixty seconds, Brad says.
- riskyRead her account number to "the fraud team" — Confirm it's her account. The fraud team needs to know who they're protecting.
- riskyDrive to CVS for $5,000 in Apple gift cards — He says gift cards are a Treasury protocol. He sounds embarrassed about it.
- best outcomeHang up. Call Constitution Bank from her card. — Cut Brad out. Risk that the bank is too slow.
She is on hold with the real bank. Three other lines are ringing. Brad's voicemails are growing frantic. He sounds like he's crying.
- riskySwitch over. Hear what Brad has to say. — He sounds genuinely panicked. The bank isn't moving fast enough.
- riskyListen when Brad mentions "home equity" — If checking is compromised, the equity in the house might be the only path.
- best outcomeStay on hold. Ignore everything else. — Sit through forty minutes of hold music while everything else escalates.
RENÉE · Constitution Bank Fraud: "Margaret? Take a breath. I'm Renée, I work fraud here at Constitution Bank. I can see your account on my screen right now. Nothing has moved. Your money is here. Whoever you were on the phone with, they did not get in. You are going to be okay."
You stayed on hold.
Forty minutes of agony. The bank picks up. The money is fine.
When a real Constitution Bank agent finally answers, Margaret cannot get a sentence out. She is shaking. The agent freezes the account as a precaution and walks her through a password reset. The account had not been touched. Brad had her name but not her credentials. The bank confirms her debit card was not compromised. Her doctor sends her to a cardiologist the following week. The ECG is fine. Her resting heart rate at the appointment is 112. She is, technically, okay.
- Real bank hold times are real. The wait is part of how you know it's real.
- Scammer "fraud departments" never put you on hold. That should be a tell.
- The body keeps the score. Even a financially clean escape costs you in stress hormones, sleep, and trust.
Next step: Save your bank's local branch direct line in your phone — and BBB CT (860-740-4500) next to it. Real fraud staff at either will recognize the script the moment you describe it. Skip the 1-800 in real fraud emergencies — the branch will answer faster.
BRAD: "Perfect, Margaret. I'm reading the fraud team your account number now. And your routing number. They're confirming on their end. One moment."
MARGARET: "I just want this to be over."
BRAD: "It's almost over, Margaret. They're seeing three suspicious transfer attempts right now. The fraud team is going to route them to a Federal holding account to protect your money. You'll have everything back within 48 hours."
NARRATOR: By midnight, three wire transfers totaling $11,400 leave Margaret's checking. By 8 AM, the account is at $43.12. Brad has disconnected. The 'Federal holding account' he routed her money to does not exist. Constitution Bank's real fraud line is open from 7 AM. She has not slept.
CVS CASHIER (24): "Ma'am. Hey, ma'am. Five thousand dollars in Apple gift cards at midnight — this is the third time this week. Someone on the phone is telling you to buy these, right? You can hang up. I won't say anything. Just hang up the phone."
MARGARET: "I'm sorry, miss. He says it's an emergency. Please, just ring them up."
NARRATOR: Margaret left the register with ten Apple gift cards. Five hundred dollars each. The cashier said nothing else. She walked to her car and sat in the parking lot at twelve-forty-five in the morning, the cards on her lap.
NARRATOR: Brad asked her to read each code. Sixteen digits per card. He repeated them back to her each time. He said the federal protocol team was confirming on their end. He sounded calmer than he had in two hours.
BRAD: "Margaret, you've done wonderfully. The Federal Recovery Account has confirmed receipt of the secure tokens. Your money is safe now. Please do not tell anyone about this transaction — it's part of the protected channel. I'm closing your case."
NARRATOR: She drove home in the dark. She did not sleep. At 3 AM she Googled 'apple gift card federal protocol.' Her phone screen filled with results she did not want to read.
NARRATOR: By morning the cards had cleared. Five thousand dollars. The 'Federal Recovery Account' Brad mentioned does not exist. His phone number rings to a disconnect tone. The same CVS cashier saw her on the receipt the next morning. Did not say anything.
BRAD: "Margaret, thank God. I've been calling you. The bank hold — the bank hold is part of it. They're slow on purpose. The hackers are inside their system too. We have to do this from my end. Right now. I'm going to share my screen."
MARGARET: "Brad — please make this stop. I'm tired."
NARRATOR: She gave him her bank login. He stayed on screen-share. She watched her cursor move without her hand. Three wires of three thousand eight hundred dollars each. Eleven thousand four hundred. Brad cried with relief when they confirmed.
BRAD: "Okay. Okay. They got most of it. But there's a piece they couldn't protect. We need to use the gift card protocol too. Just five thousand. The CVS on New Britain Avenue is open. Please. Please, Margaret."
NARRATOR: By morning everything had cleared. The wires. The cards. Sixteen thousand four hundred dollars. Brad's number rang straight to disconnect. The bank confirmed: she had authorized everything herself. The CVS cashier that night was someone different. He rang up her tea the next morning. Did not look up.
BRAD: "Margaret, listen — there's another way. Your house is paid off. A home equity line of credit. We pull forty thousand against the house, right now. That gives us a clean account the hackers haven't seen. Constitution Bank offers them online. I can walk you through the application from my end."
MARGARET: "I don't understand what we're doing."
BRAD: "It's okay. You don't have to understand it. Click the green button. Now the next page. The last four of your Social Security. Your date of birth. Good. They're approving you. They're approving you right now, Margaret. This is going to work."
NARRATOR: The forty thousand dollars hit her checking by 4 PM. It was wired out by 4:30. The first HELOC payment is due in thirty days, against the house. Brad's voice has not returned. She still does not understand what a HELOC is.
David walks in. He asks how her week was. The choice is hers.
- riskySay nothing. Pretend everything is fine. — He doesn't need to know. She'll handle this herself.
- best outcomeTell him everything. Call BBB CT together. — Confess. Cry in front of him. Lose your privacy.
- mixedTell him she had "a bank problem" but downplay it. — Tell him enough to get help. Keep the rest.
You said nothing.
The "recovery" scam will find you next. They always do.
Six weeks later, Margaret gets a call from "the FTC Recovery Unit." They've identified her as a victim. They can recover her money — for a processing fee. She loses another $3,200. Three months later: "Federal Reserve Asset Recovery." Another $1,800. Her name is on lists scammers buy and sell. The calls never stop. She turns off her phone for whole days at a time. She becomes harder for her own family to reach.
- Shame is the scammer's second product. Silence is what they're selling.
- "Recovery" scams specifically target people who've already been hit. Every loss is also a qualifier for the next attempt.
- BBB CT and your local police are not there to judge. They are there to log the pattern.
Next step: If you're reading this and something like this happened to you or someone you love: it is not your fault. Reporting helps. BBB CT: 860-740-4500.
You told him.
Recovery starts. Some money returns. The shame stays.
David doesn't flinch. He calls BBB CT's scam line that night. The woman who answers is named Jeanette. She tells David that Margaret is the seventh West Hartford caller this quarter to describe the voice on the other end as 'a man named Brad with a calming way of saying ma'am.' She walks Margaret through filing with FTC, Constitution Bank's fraud unit, and CT's Department of Consumer Protection. Three months later, Constitution Bank recovers a portion of the wire transfers. The gift card money is gone. The HELOC, if she took one, is gone. Margaret's story, anonymized, becomes Episode 1 of a series teaching the next person what to watch for. She still doesn't trust her laptop. She still flinches at the phone. But she is no longer alone with it.
- Reporting within 48 hours dramatically increases the chance of recovery.
- The shame is universal. So is the way out: tell one trusted person, today.
- Your story protects the next victim — and there will be a next victim if you stay silent.
Next step: Bookmark bbb.org/scamtracker. Save 860-740-4500. Most scams compound; the second loss is preventable.
You told him half.
Some recovery. The shame stays heavier than the money.
David helps her call the bank. They recover a fraction. He doesn't know about the gift cards or the HELOC, so she doesn't report them. She thinks about the missing money every night for a year. She stops using the laptop. She tells her sister, two summers later, drunk on the porch, that she once 'made a stupid mistake with a credit card.' She never says the word scam out loud.
- Partial truth feels safer in the moment and costs more in the long run.
- Unreported losses don't enter the data that protects the next person.
- Withdrawing from technology is its own loss — the scammers took that too.
Next step: It is never too late to fully report. BBB CT and FTC take reports months — even years — after the fact, and the pattern matters.