Reported by Tara Siegel Bernard

(Summary shared below. To read full report, go to: https://www.nytimes.com/2025/12/12/business/tech-support-scam-bank-fraud.html)

What began as a routine attempt to fix an iPad spiraled into a devastating financial loss for David Welles, an 87-year-old retired lawyer. Searching Google for Microsoft tech support, he instead reached a sophisticated scammer who persuaded him to install remote-access software on his devices. Over nearly five hours, the criminal gained control of Mr. Welles’ laptop and phone, accessed stored credentials, and quietly initiated an $85,000 wire transfer from his Citibank checking account — all while appearing to be legitimate activity coming directly from the customer’s own devices.

By the time Mr. Welles realized something was wrong and contacted Citibank, the money had already left his account. Even after alerting the bank within hours of the fraud, no immediate red flags were raised. The wire — sent to an account at Wells Fargo and quickly moved onward — was only identified the next day, when scammers again impersonated Citi employees and contacted Mr. Welles, further deepening the deception. A recall attempt came too late.

The case highlights a broader surge in account takeovers, which have tripled over the past five years. Because fraudsters increasingly move money using a victim’s own credentials and devices, banks often see transactions as “legitimate.” According to Treasury data, tens of thousands of such incidents are now reported annually to FinCEN. Older Americans are particularly vulnerable: tech support scams alone cost those over 60 nearly $1 billion last year, according to the FBI.

Citibank ultimately declined to reimburse Mr. Welles, citing long-standing wire-transfer rules under the Uniform Commercial Code. Since the transaction was authenticated using his credentials, the bank argued it bore no liability. That position sits at the heart of a major legal fight: New York Attorney General Letitia James is suing Citi, arguing that online and mobile wire transfers should fall under the Electronic Fund Transfer Act — the same law that protects consumers from debit card and ACH fraud and typically caps losses at $500 if reported promptly.

Beyond the legal questions, the case exposes the human cost of modern cybercrime. Even weeks later, scammers continued contacting Mr. Welles, posing as investigators promising to recover his money. Though financially able to endure the loss, he described lasting psychological harm — anxiety, sleeplessness, and fear — underscoring how today’s industrialized fraud ecosystem doesn’t just drain bank accounts, but leaves lasting emotional scars as well.