About two weeks after her sister’s unexpected death in January, Suzy Enos began the grim process of identifying and closing her sister’s apps and online accounts.
Enos shared one of those accounts with her sister, Betsy Egan, at a bank in Greenfield and thus had ready access to it. She logged in and was shocked to see a handful of UberEATS charges made by her sister — after her death.
How could that be? Enos wondered. It must be a mistake. But it wasn’t, she discovered. It was fraud, apparently committed by scammers determined to loot Egan’s financial assets after her death.
Enos, an IT director at a major corporation who lives in Bedford, went to battle online with the scammers and ultimately succeeded in protecting most of her sister’s assets, including the hundreds of thousands of dollars in retirement and savings accounts the scammers were in the process of stealing.
Enos eventually came to the conclusion the scammers were able to break into many of her sister’s apps and online accounts by taking over her mobile telephone number — not her physical phone, but her “line.’’ And to do that, the scammers posed as a family member to dupe T-Mobile, her sister’s mobile phone carrier, Enos now believes.
With control of Egan’s mobile phone number, the scammers were able to receive the authentication codes they needed when using the “I forgot my password’’ function on Egan’s apps and online accounts, Enos said. And by changing the passwords, they got into those apps and online accounts.
Enos thinks the scammers impersonated a family member when they contacted T-Mobile to report her sister’s death and arrange to have her phone number moved to a physical phone the scammers controlled, she said.
What exactly happened isn’t perfectly clear to Enos or to me. T-Mobile has been extremely guarded in the information it has provided Enos because, it says, she is not the account owner. For months, T-Mobile repeatedly told her simply that it acted in compliance with company policies.
To Enos, T-Mobile refused to even acknowledge a scam. But after I got involved, the company acknowledged that a “thief’’ committed “fraudulent activity’’ on Egan’s account and vowed to review its policies “in the ongoing fight against fraud and bad actors.’’
I pointed out that, contrary to its assertions to Enos, T-Mobile appeared to have violated its own policies. T-Mobile’s written policies allow family members with proper documentation to either close a deceased family member’s account or keep it open on the same phone. But Egan’s number was moved to a different phone. How did that happen, I asked T-Mobile several times.
“We are not going to disclose what exactly the fraudster did,’’ T-Mobile replied, to avoid helping “other bad actors’’ who might want to attempt the same scam.
One thing that may have helped the scammers in their multistep scheme was that death certificates in Massachusetts are public records and include a deceased person’s Social Security number and date of birth. T-Mobile requires that information before making changes to a deceased person’s account, and Enos believes the scammers obtained it from Egan’s death certificate. Many states redact Social Security numbers and restrict the release of death certificates to those with a relationship to the deceased.
Enos said she contacted me because she wants to spare other grieving families what she went through and to urge T-Mobile to take steps to better fend off scammers.
“Get to your family member’s mobile phone carrier and close the account before the scammers get there,’’ she said. “I learned some really hard lessons.’’
Here’s what happened:
Enos discovered her sister, 60, dead and alone in her South End condo after a brief illness. She retrieved her sister’s physical phone but paid little attention to it while grieving, arranging services, and writing a tribute, which was published on Legacy.com.
In retrospect, Enos now believes the scammers learned of Egan’s death from that family obituary and decided she was a good target for their scam so long as they could con her mobile phone carrier into moving her number to their phone.
Enos believes the scammers, once aware of Egan’s death, focused on obtaining Egan’s death certificate as soon as it became available at Boston City Hall, probably by checking online for it daily. For the scammers to successfully impersonate a family member, they had to get to Egan’s mobile phone carrier before her family did, Enos said.
Egan’s death certificate became publicly available on Feb. 7 and one of the scammers probably picked it up in person at City Hall that day or shortly thereafter without being asked why they wanted it or what their relationship was to the deceased, perfectly in accordance with state law, Enos said.
It was a few days later that Enos made the alarming discovery on her Greenfield bank account. By then she had noticed that her sister’s phone had no service. She was her sister’s only immediate next of kin, so who authorized T-Mobile to terminate her phone service? She wondered if the phone’s inexplicable lack of service and the strange charges on their shared bank account could be related.
Enos immediately called the Greenfield bank to shut down the account. A couple hours later, a bank representative called her back to say someone identifying herself as Egan — now dead two weeks — had just called on Egan’s phone number asking for the account to be reopened. The bank refused.
Enos now knew for sure she was up against scammers and that the scammers had her sister’s phone number. Enos knew that many apps and online accounts use an email address as a log in, and that the scammers probably had little trouble finding her sister’s email address online. Egan used an MIT email address and she is listed on LinkedIn as a graduate of MIT’s Sloan School of Management.
Enos said she has little doubt the scammers did their own detective work online to obtain other bits of information they used in their scam. She pointed out that commercial companies, for a fee, provide lots of personal information, including names, ages, telephone numbers, and email and mailing addresses. Once she got control of her sister’s email account a few days later, Enos found emails indicating the scammers were using one such company.
After learning from the Greenfield bank that scammers were using her sister’s phone number, Enos called T-Mobile and asked it to shut down her sister’s account, saying scammers were using it to break into Egan’s apps and online accounts. But T-Mobile said it could not divulge any information due to privacy concerns.
Enos later provided T-Mobile with the identity-theft report she filed with Boston Police. But that didn’t help either. (She also filed reports with the FBI and the state attorney general’s office.)
“I couldn’t fathom why T-Mobile wouldn’t act,’’ Enos told me.
Enos soon called a high-ranking friend at MIT who, while following proper protocols, expedited Enos’s request to have her sister’s MIT email account redirected to a new account Enos set up. That cut off the scammers from Egan’s email while allowing Enos to see various emails that tipped her off to what apps and accounts the scammers had used, like the email from Airbnb confirming a rental in California.
Enos then went into her sister’s apps and online accounts to change the passwords and to have future authentication codes sent to her sister’s email (which Enos controlled), not Egan’s phone number (which the scammers still controlled). She also stripped out her sister’s telephone number in her sister’s apps and online accounts.
Enos said that stopped additional fraudulent activity on her sister’s account. She said the scammers, in all, got away with a couple of thousand dollars in UberEATS and Airbnb charges, but nothing from her sister’s retirement and savings accounts.
Enos said people should think about what happens to their phone number when they die. If you have an iPhone, for example, Apple allows you to set up “legacy contact,’’ a trusted person who can access your phone after your death with a preset access code and death certificate.
She also said you should share with someone you trust an inventory of your apps and online accounts, with instructions on how to get into them after your death.
“Many find it hard to talk about death, but this is a final gift you can give to your loved ones,’’ she said.