{"id":9060,"date":"2025-06-10T12:00:00","date_gmt":"2025-06-10T11:00:00","guid":{"rendered":"https:\/\/www.markwilson.co.uk\/blog\/?p=9060"},"modified":"2025-06-13T15:32:59","modified_gmt":"2025-06-13T14:32:59","slug":"i-got-phished-and-i-should-have-known-better","status":"publish","type":"post","link":"https:\/\/www.markwilson.co.uk\/blog\/2025\/06\/i-got-phished-and-i-should-have-known-better.htm","title":{"rendered":"I got phished \u2013 and I should have known better"},"content":{"rendered":"\n

After decades working in IT, I really should have known better. I do the training. Every year, like everyone else, I click through the e-learning as quickly as I can, answer the quiz at the end, and move on to something else. I’ve even been that person who feels suitably smug when he spots the simulated phishing attempt and logs a support ticket, just in case. AKA a smart arse. A real joy to work with, I\u2019m sure.<\/p>\n\n\n\n

But this time, I slipped up. I was travelling back from Germany and needed to buy a CIV ticket<\/a> for the UK leg of the journey \u2013 from St Pancras International to my local station. The ticket office at the station could only help with the outbound leg \u2013 and that was no use to me, because (to my eternal shame and against my environmental principles) I flew out. With Ryanair. For a short hop. I wanted to take the train both ways, but couldn\u2019t justify the cost to my travelling companion. Even though the alternative was Ryanair.<\/p>\n\n\n\n

With time running out, I tried Mark Smith, The Man in Seat 61<\/a>, for advice. No luck. In a final attempt, I contacted Eurostar via X (formerly Twitter). I usually avoid X \u2013 because of Elon Musk \u2013 but I needed to get an answer quickly.<\/p>\n\n\n\n

Spot the warning signs<\/h2>\n\n\n\n

I got a reply. From @EurostarUKcs \u2013 apparently the \u201cEurostar UK Support Line\u201d. The odd capitalisation should have tipped me off. So should the fact they only had two followers and had been set up in May 2025. But I missed that. I followed them back. I sent them a Direct Message. They replied. This looked like help. And then they insisted on speaking by phone.<\/p>\n\n\n\n

I was on a moving train so I explained that a call wasn\u2019t ideal. But they called anyway, on WhatsApp, from a +245 number (Kenya). And that\u2019s when it clicked. This was a scam.<\/p>\n\n\n\n

Damage control<\/h2>\n\n\n\n

I hung up. Deleted the message history. Contacted Eurostar (the real one) just in case anyone tried to change my booking. Luckily, I hadn\u2019t given away much more than the sort of information you might post in a public forum. But it was still more than I should have.<\/p>\n\n\n\n

I got away lightly. There was no harm done, just a dented ego. But the whole episode was a timely reminder: it\u2019s not just your mother-in-law who gets phished. It can happen to any of us \u2013 even the smug ones who think they know better.<\/p>\n\n\n\n

Lessons learned<\/h2>\n\n\n\n