Phishing on Craigslist: Still Gullible After All These Years

I published the first single-authored book on gullibility in 2009 (an edited book by social psychologists has since been published). I prefaced my book by saying that gullibility has always been a problem for me, in line with the humorous but often true definition of a psychologist as “someone who studies things they are bad at.” My book “Annals of Gullibility” is a collection of gullibility stories, and at least half a dozen of them involved me, sometimes using a made-up name when the story was especially embarrassing.

To show that gullibility is a tendency that never fully goes away, and also to educate readers to be careful when selling items online, I am discussing my latest experience involving the sub-topic of phishing—one that I did not know about and may not even have existed in 2009. The good news, however, is that perhaps as a result of having studied gullibility, I was able to extract myself from the situation before (to my knowledge) I was done in by it.

However, I was done in, as some readers of this column know from earlier posts, by the Bernard Madoff Ponzi scheme, which happened at the same time my book was published (a Canadian finance columnist wrote, "the first Greenspan, Alan, is the economist who didn’t see the market collapse coming while the second Greenspan, Stephen, is the gullibility expert who forgot to read his own book”). Ironically, as a result of having analyzed my Madoff experience in various publications, I am now considered an authority on Ponzi schemes. My four-factor model of “foolish and gullible action” was featured in a business school textbook on such frauds.

The recent experience involved my use of Craigslist to sell two used living room chairs for a little under $100 each. I immediately received an e-mail from someone with a man’s name who said he was interested in buying both and offered to add $100 to the price if I would delete my Craigslist ad (he called it an “advert” which suggested he was British or from a former British colony) and hold the items until he was able to carry out the purchase.

I did as asked and told him that $100 was overly generous and that I would only add $50 to the total. He then wrote back and said that due to his recovery from surgery, he was unable to pick them up, but his son would mail me a check that included the price of the chairs, the extra amount (now $50) plus an additional sum to have a moving company also move other furniture items to his new place. I was asked to make the arrangements with the moving company after I showed the buyer proof that I had cashed the check.

At this point, I began to have second thoughts, both because this was more work than I had bargained for and also because it seemed like it might be a fraudulent scheme designed to get me to reveal sufficient personal information to enable the so-called purchaser to empty my bank account. I asked my adult son (whom my wife and I successfully raised to be non-gullible) what he thought, and he sent me information from a Google search that provided examples of phishing communications that sounded eerily similar. I then reposted my Craigslist ad and wrote the fake buyer that I changed my mind. Two interesting things then happened.

The first thing that happened was that a Fed Ex envelope arrived with a certified check from a business in Central Illinois on an Illinois bank (I live in California) for $1,660, well over $1,000 more than the advertised price of the chairs. I emailed the supposed buyer and asked for his name and address so I could mail the check back to him. He never replied. I also contacted the bookkeeper who supposedly signed the check from the Illinois business. She replied that it was a phony check, as their account (since closed) had been hacked, and instructed me to shred the check.

A second interesting thing happened after I reposted the chairs on Craigslist, I immediately got a positive response, this time from a supposed woman, who said that because she and her husband were moving they would add some money to the price (apparently a near-universal giveaway) if I would hold off until they could give me shipping information and funds. While this experience was quite similar to the first, the actual words used were an almost verbatim copy of an example described in a Google article on online sales phishing (which can be defined as “a technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent email solicitation in which the perpetrator masquerades as a legitimate business or reputable person”).

That the first responses to both of the ads for the chairs (which I eventually donated to charity) were phishing scams, tells me that this is a common problem and that the Latin expression Caveat Emptor (“let the buyer beware”) should be amended to include Caveat Venditor (“let the seller beware”).

Using my four-factor explanatory model, here is why I almost got taken in.

Deception Essential Reads

Understanding the Private-to-Public Filter

How Lies Get Under Your Skin

1. Personality: I am generally trusting and prefer to believe in the decency of people
2. Situation: it seemed like a plausible story and the check looked real
3. Cognition: I know little about phishing and have not heard about this variant
4. Affect: I wanted to get rid of the chairs, and for some people even a small amount of money can be a big motivator.

Unfortunately, such scammers abound, but financial survival requires always keeping one's scam-awareness flag flying.

Copyright Stephen Greenspan