Getting hacked kind of feels unpleasant.

 

Image courtesy Kevin Horvat

There was a time when I was all about following channels that busted tech support scams. One of my favorites is Jim Browning (not his real name), who's gone above and beyond to root out call centers and help people who have been scammed get their money back if possible. But he won't abide the misapprehension that only gullible people can be scammed. He even made a video about how it happened to him: the perfect storm of coincidence and being a bit tired.

As much as we like to pretend that we can't get harmed online as long as we're super careful, we're always one bad day away from getting got. Any time I have to double-verify an account, enter a code, or confirm to my credit card company that yes I really am pledging to that UK-based Kickstarter, I remember that. Because I would rather be mildly inconvenienced once in a while than have someone screw me over.

And last week someone screwed me over.

Years ago I toyed with having a Patreon. It didn't really work out. Friends were kind enough to get on board, but I realized that that sort of thing takes an established fanbase to be worth the effort that running a Patreon takes. So I shut down the creator side and stuck to being a patron of other creators, with a fairly nice run of podcasts and art that I'm happy to give money to on a monthly basis.

A little over a week ago, I got an alert that my payment method had been changed. And I panicked, because I hadn't done that. So I logged in and checked. And no, it hadn't been changed, and I was being billed properly. I couldn't find any sign of anything being altered by my account, so I assumed the email I received was itself a scam and ignored it.

Then last Thursday morning, I got an alert saying I'd received $900 in my creator account.

Initially I was confused. I'd shut it down years ago, after all. Had someone really found my page and thrown a donation at it in good faith? I know I have fans, but I'm pretty sure I don't have "$900 for no reason" fans, and I didn't feel right about offering nothing in return. I logged in, found that my creator page technically still lived, and saw the donation. I tried to return the money... but it had already been withdrawn. I checked my PayPal, and no, it hadn't.

... oh. The payment method. It was changed on the creator side.

I looked, and there was a Gmail address where my custom .com email should be. I didn't know what to do. I wasn't sure how to report it. And it seemed like whoever had used me to scam someone, it was done. I unpublished my page properly and told myself I'd look into the proper way to report the issue later that day, once I'd gotten some work done.

Unfortunately, Patreon got to me first and shut down my account. And now I've spent the last few days trying to prove that I'm me, that I don't even use my creator account, that I don't want a stranger's $900, and that I'd just like my account reactivated so I can give money to British podcasters and Midwestern movie riffers. I've already been asked for identifying information, which I sent, and now I wait.

So, fine, right? Once they see my personal info, they can prove I wasn't at fault and give me access to my account back, and we can all go back to normal. So why, in my gut, do I feel terrible?

Fortunately, plenty of friends explained it to me very well: hacking, especially the style of hacking that involves someone impersonating you to hurt someone else, is an invasion of privacy. It's messed up, and it never feels good to be taken advantage of. Pair that with the fact that getting hacked and/or scammed online is seen as a sign of being poorly prepared or gullible, and it's easy to feel guilty. I let it happen to me. I wasn't careful enough. I've spent the last few days going over that. I should have shut down my creator page properly, I should have looked more thoroughly when I got that email, I should have reported the issue immediately.

All, of course, ignoring that the hacker should not have used my account to steal hundreds of dollars from someone. Just as they shouldn't do it to anyone. We can protect ourselves, but never have I believed that me having a strong password or 2FA means that people with weak security deserve to get got. That's just gross.

So what is all this in aid of, especially on the blog of a writer and book nerd?

Well, first, watch yourselves. Because hackers and scammers are jerks, and it's getting easier to mess with people all the time.

Secondly, don't blame yourself if it happens to you. Like Jim Browning, you may get caught by coincidence and a bad day. Like me, you may make assumptions that you have things in hand that you don't. The list of people who deserve to have bad things happen to them is very small, and we do not dictate who lives on that list.

Thirdly and finally, not having my podcast backlog means I got a bunch of writing done. Which, small blessings, I suppose. But hopefully I will maintain that even when my account is straightened out. Because damned if I don't owe a lot of people a lot of things.