I Fell for It

It didn’t look like a scam.

The email carried the tone and structure of something official—something local. It seemed to come from the Chamber of Commerce on Marco Island, used clean formatting, and included what appeared to be a legitimate document link. The message itself was simple: the file was too large to send as an attachment, so it had been resent through “Adobe Secured Upload.”

There was nothing obviously wrong with it. No misspellings. No strange sender name. No urgent threats. Just a routine request to click and view a document.

So, I clicked.

The page didn’t load properly. It failed. I tried again. Still nothing. A third time—same result. At that point, it seemed like a broken link, not a threat. I moved on.

What I didn’t realize was that it had already done exactly what it was designed to do.

About a week later, the damage surfaced quietly. Friends, colleagues, and contacts began reaching out: “Did you send me this?” Every person in my contact list had received the same email—the same “Adobe Secure Upload” message—this time from me.

That’s when it became clear. The link had not been broken. It had been working perfectly.

What Actually Happened

Phishing scams have evolved well beyond the obvious emails of the past. Today’s attacks are designed to blend in seamlessly with normal business communication.

In this case, the link mimicked a legitimate link for a large document. It didn’t open any web pages or even stand out as doing anything. It simply appeared to be a link that failed, but what it really did was capture credentials or triggered a background authentication process.

Once attackers gain access to an email account, their goals are straightforward: harvest contacts, send convincing emails from a trusted source, and maintain access for as long as possible.

In my case, the attackers didn’t just log in once. They established ongoing control.

They added a passkey tied to my device, allowing them to log in repeatedly without needing my password again. They also had the ability to manipulate device activity, making it harder to detect unfamiliar access.

How They Make Money

This isn’t random mischief. It’s a business model.

Phishing operations operate at scale. A single compromised account can lead to dozens more. From there, attackers spread additional phishing links, attempt financial fraud, sell verified accounts, or use access for identity theft.

The key advantage is trust. An email from someone you know is far more likely to be opened—and clicked.

A Real-World Escalation

A friend of mine here on the island recently went through something even worse. He didn’t realize the attackers had added a second phone number alongside his real one on his account.

When they attempted to access his bank, the institution did what it was supposed to do—it sent a security verification code via text. The problem was, it didn’t just go to him. It also went to the scammer.

With that code, they were able to log in, bypass the safeguards, and drain his account.

An Unexpected Upside

There was, oddly enough, a small silver lining. In the process of cleaning up the mess, I ended up hearing from people I hadn’t spoken to in years—some in decades. The conversations didn’t start the way you’d hope—usually with, “Did you mean to send me this?”—but they turned into something better. A quick check-in became a real conversation. Not exactly the recommended networking strategy, but I’ll take the upside where I can find it.

A Different Kind of Awareness

Not long after all of this, I had a vendor knock on my door offering window washing services. The timing could not have been worse—for them. My phone had just stopped blowing up from the hacking incident, and my trust level was somewhere near zero.

When they offered to exchange contact information using an NFC bracelet, I declined. “Fool me once…” was about as far as I needed to go.

To be fair, it was likely completely legitimate. Contactless networking is becoming more common, and many professionals use NFC-enabled cards or devices. But the reality is, the same convenience creates an opportunity for abuse.

Scammers have begun using similar tactics in what is sometimes called “ghost tapping” or contactless fraud. In these situations, a tap can trigger an unexpected payment, an inflated charge, or even redirect you to a malicious site designed to capture your information.

There are a few simple ways to protect yourself:

Never tap your phone, smartwatch, or credit card against a stranger’s device.

If you are making a payment, confirm the exact amount on a trusted terminal before proceeding.

Be cautious of anyone who cannot clearly explain who they represent or refuses to provide verifiable information.

When in doubt, step back. A legitimate business will still be legitimate tomorrow.

The Real Lesson

The most dangerous emails today are the ones you weren’t expecting but that still feel plausible.

If you weren’t expecting it, don’t click it.

If you’ve already clicked, change your password immediately.

Check your recovery email and phone number.

Review device activity and remove unfamiliar devices.

Check for added passkeys or authentication methods.

Enable or reset multi-factor authentication.

Notify your contacts.

Run a security scan on your device.

A Final Thought

What makes phishing dangerous isn’t carelessness—it’s familiarity. These attacks are designed to look like the normal flow of daily communication.

In my case, nothing about the email felt urgent or threatening. It just felt ordinary.

And that’s exactly why it worked.