Carly Rowena, a 37-year-old fitness instructor, was tricked into sending £5 716.60 worth of digital assets to a scammer who promised her sizable returns on her crypto.
Carly Rowena, a British fitness and wellness influencer, is embarrassed as she recalls being duped into handing over £5,700 ($7,450) worth of cryptocurrency in a scam.
"I was like, it was too good to be true, and I still fell for it," she told CNBC Make It.
Rowena transferred the crypto to an Instagram account she believed belonged to a finance professional managing investments for a friend. But after discovering that her friend's account had been hacked, Rowena says she felt "stupid."
Here, Rowena shares her story with CNBC Make It, including the red flags she now knows to watch for when navigating the online world.
No. 1 tip to avoid scams
If something online appears "too good to be true," that's because it probably is, according to Rowena.
Her top piece of advice is to pause and think carefully about a proposition online that appears too good to be true.
Money Report
"It's stopping and thinking, and it's having a conversation with someone," she told CNBC Make It last week.
"It's giving yourself that chance to be like, no opportunity will just vanish in a second. If it's the right thing for you, and it's legit, it's not going to disappear at your fingertips like that."
Get a weekly recap of the latest San Francisco Bay Area housing news. Sign up for NBC Bay Area’s Housing Deconstructed newsletter.
Rowena also recommends screenshotting relevant messages to keep as evidence for yourself — and, if needed, the authorities — as well as contacting your bank and other trusted institutions for advice.
Rowena, 37, is an entrepreneur and content creator on Instagram, where she shares fitness and wellness advice and stories about her experience as a mom to more than 187,000 followers. The influencer, who also has 410,000 subscribers on YouTube and a sizable following on TikTok, has lived in Costa Rica with her husband and son since January.
How did the scam unfold?
In March, Rowena spotted a fake Instagram story, supposedly posted by her friend, saying she'd hired someone to manage her bitcoin and had made a lot of money.
After seeing the story, Rowena messaged her friend on Instagram to get the contact details for the person she'd claimed to hire — who, it turns out, was a scammer who had hacked her friend's account.
"I had invested some money into crypto, which I'm going to hold my hands up and say I don't fully understand," Rowena told CNBC Make It.
"It was such a clever way of doing it, because it was like: I'm already in it, but I'm not sure what to do ... so that was why I clicked on to it."
The fraudster in question directed Rowena to a fake investment platform, sent her a contract to look over and promised her a 50% return on her investments within 24 hours.
Rowena could even view an online dashboard purporting to show the influencer her investments. But in reality, this dashboard was a fake, and Rowena's crypto went straight to the scammer's pockets.
Rowena was then told she'd made a great deal of money — but that, to release the funds, she would have to pay the fake investment firm a "commission."
This struck Rowena as suspicious. She messaged her friend, who said her phone and social media accounts had been hacked — seemingly as a way to con her followers and friends.
The aftermath — 'I felt stupid'
Rowena's description of feeling shame when she realized she'd been scammed is not uncommon.
Research from cybersecurity firm Akamai published Tuesday on the impact of cybercrime on mental health shows that over 60% of victims in the U.K. said they felt traumatized by what happened to them.
Of 1,000 British victims of cybercrime surveyed by Censuswide for Akamai, 59% admitted to feelings of shame, while 67% said they felt embarrassed after the attack took place.
More than half (55%) reported continuing to experience anxiety following the cybercrime, especially when using online services.
When someone is subjected to a scam, "there is often guilt, or we might feel stupid, incompetent for getting into a situation in the first place, whatever the type of cybercrime victim we are," according to Tara Quinn-Cirillo, a chartered psychologist and associate fellow of The British Psychological Society,
It can be easy for people to let down their guard given the rapid nature of modern life, according to Quinn-Cirillo.
"It might be that that one scam that we have got caught up in, that one episode of cybercrime, has then made us doubt our ability, our competence, our intellect," Quinn-Cirillo said. "We can develop shame, so we can be embarrassed about it."
This shame can then negatively impact people by putting them off doing the things they enjoy or being active online. Rowena, for instance, hasn't invested in crypto since she was scammed as she's too scared of being defrauded again.
'Personal circuit breaker'
Victims of online fraud and scams are advised to contact institutions like their bank or the police to see if their money can be clawed back.
"It's about making sure that wherever you're going for information, that it's a reputable source," Quinn-Cirillo told CNBC Make It. "All of these big institutions will have advice on cybercrime, which is really important."
If you find yourself in a situation like Rowena, Natalie Billingham, a managing director at Akamai, recommends applying a "personal circuit breaker."
"Whether it's an email, whether it's a conversation: just take that second to stop and to think, and that then allows you to put in place protocols. How do I check this link?" Billingham told CNBC.
"If you quickly click or quickly do something, oftentimes that's when afterward you're left with a feeling of regret and then pulled down a path you'd rather not be on."
Fraudsters are persistent
"When it's online, it's like an invisible thing, "You realize that nothing's really real. No one's going to care. And then that makes you feel really stupid," Rowena said.
The account Rowena interacted with on Instagram remains active on the platform, although is a private profile. A similar account is also on Facebook.
Rowena says she continues to receive direct messages from the scammer requesting a fee to unlock her funds.
As long as the profile remains active, Rowena is concerned other people could fall prey to the same attack. "I can only imagine how much money she has if she's got all of those people," she said.
Meta, which owns Facebook and Instagram, told CNBC Make It that fraudulent activity is not allowed on its platforms and that, following an investigation into the account in question, it identified and removed several posts in violation of its rules.
"Fraudulent activity is not allowed on our platforms, and we have removed the violating content brought to our attention," a Meta spokesperson said via email. "We are continually investing in protections against fraud on our platforms, and work closely with law enforcement and regulators to tackle this issue."
