This one?

It’s completely different. In that case, they were able to set up a fake business to accept payments, which is way more sophisticated than what happened to me. In my case, they just needed my login name and phone number, and I had reused the login name on several sites, so a number of places could have been involved in a breach. All the scammer had to do in my case was:

1. check if I have an account at a major banking institution
2. call me, pretending to be the fraud department
3. get me to give them my SMS code (they’d trigger through the normal “forgot my password” process)
4. keep me on the line long enough to link an external account
5. get me to give them another SMS code (“final authorization” or whatever)

That’s it, just two pieces of information, some smooth talking, and a little luck that I don’t catch on. Corey Doctorow’s situation required quite a bit more setup than that:

1. get Amex to approve them as a mechart
2. create a fake online ordering website that gets enough SEO to show up in search results
3. have someone actually place an order at the vendor so nobody gets wise

That’s a lot more sophisticated than what happened to me.