‘How can I let this happen?’: How a Mesa woman got scammed out of $40K

In the early morning of Nov. 4, Heidy L. checked her work email at her East Mesa home and found a message from a coworker. It presented one of life’s banal annoyances: Norton, the privacy protection company, had charged Heidy $399 for a plan for which she had already paid.

To sort out the misunderstanding, the 68-year-old Heidy called the customer service number listed in the email. She expected the standard rigamarole — navigating an automated phone menu, waiting to speak to a human, patiently explaining the issue, asking for a supervisor, and so on.

Instead, by the time she got off the phone more than eight hours later, she had lost nearly $40,000, a figure that represents her salary and her life savings. She had been scammed. (Heidy asked that her last name be withheld out of fear of retaliation from her scammers.) The email hadn’t been from a coworker and she hadn’t been double-charged. The phone number she’d called hadn’t gone to Norton.

But the money she lost? That was real.

“How can I let this happen?” Heidy told Phoenix New Times in a phone interview, still reeling from the experience.

Heidy is, unfortunately, not alone in her victimhood. In Arizona, fraud is on the rise. Arizonans lost more than $390 million to cyber-enabled crime last year, a 444% increase since 2020, according to the FBI. Per the Common Sense Institute, there were nearly 55,000 scam victims in the state in 2024, with the average victim losing approximately $5,000.

These scams come in all shapes in sizes. Scammers have pretended to be grandchildren and Maricopa County Sheriff’s deputies. They’ve goaded people into fake romances and have tricked people into paying toll road debts, despite Arizona not having any toll roads. What many of them have in common, though, is who they target — particularly vulnerable people and populations, including seniors. 

Heidy was certainly in a vulnerable state when the scammers targeted her. A day earlier, she’d been informed that at the end of the year, she’d be losing her job as a coordinator at A Foreign Language Solution, which provides translation services to businesses in the Valley. 

“My brain was all over the place,” she said. “I don’t know what’s going to happen.”

‘Just trying to do the right thing’

Heidy thinks the scammers accessed her computer, though she’s not sure how. But the customer service number she called led her right into their trap. When she called, she spoke with a man with a South Asian accent who called himself Christopher. He transferred her to someone named Charlie, who had a similar accent. Over the next eight hours, Charlie and Heidy had more than 40 phone calls on WhatsApp, each more panicky than the last.

Initially, their conversation was businesslike. Charlie had Heidy fill out an online form to get her refund for the double charge. But as she was completing it, her screen glitched — instead of $400 refund, the form said a $40,000 refund transaction had been submitted. Charlie took on an air of distress. “Oh man, do you know how bad this is? I’m going to be in so much trouble,” Heidy recalled him saying. The $40,000 was already transferred to her account and couldn’t be undone. “We need to find a way to resolve this today,” he said.

He told Heidy she had two options. She could wait and let the banks communicate with each other, which would freeze her bank accounts for several months. Or he could give her instructions to recover the money that day. Without much of an apparent choice, Heidy took the latter.

“I was just trying to do the right thing and return the money that was not mine,” she said.

To “return” the money that had never actually been in her account, Charlie led Heidy on a wild goose chase across the East Valley that lasted the rest of the day. She didn’t have $40,000 on hand, so Charlie instructed her to withdraw funds from her bank, Navy Federal Credit Union. If anybody asked, she should claim she was “remodeling.” The bank didn’t let her withdraw $40,000 in one transaction, so Charlie had her drive to three different branches — including one in Mesa and another in Chandler — to withdraw $15,000 each time.

It’s unclear whether the withdrawals should have triggered an alert for the bank. Navy Federal Credit Union has not responded to a request for comment from New Times.

With Heidy now in possession of the cash, Charlie sent her to a scammer’s favorite accomplice: a Bitcoin ATM. 

The ATMs, which are located in many gas stations and grocery stores, are favored by scammers because it’s nearly impossible to track what happens to money deposited in them. There are around 600 of these cryptocurrency ATMs across the state, according to the Arizona Attorney General’s Office. In 2024, the FBI reported a 99% increase in complaints involving Bitcoin ATMs, more than two-thirds of which were from individuals aged 60 or older. Last year, Arizonans lost more than $177 million in cryptocurrency fraud.

The state is working to curb crypto scams. In an August 2024 press release, the Attorney General’s Office issued a consumer warning telling residents to be on “high alert” for cryptocurrency schemes targeting “vulnerable individuals, particularly senior citizens.” The agency also put out a PSA on Veterans’ Day. (Among the standard good practices for fraud avoidance: Never click suspicious links and always confirm supposed communications from coworkers or businesses via a separate avenue.)

In late September, a new Arizona law took effect that prohibits new customers from depositing more than $2,000 into one of these machines. Existing customers are limited to $10,500 a day.

That limit didn’t protect Heidy, though. “I don’t know anything about this Bitcoin or anything,” Heidy said. “I never thought about it being a scam.” To “return” the $40,000 to “Norton,” Charlie told her to visit three different Bitcoin ATMs, making a $2,000 deposit each time. He then decided that was taking too long and told her he’d send someone to retrieve nearly $28,000 of the refund in person. 

He told Heidy to drive to a QuikTrip gas station in East Mesa. As she sat in her car, a short, dark-skinned man, in his late 20s or early 30s, arrived in a black SUV. Introducing himself as Dan, the man approached Heidy’s car window and handed her a dollar bill with a specific serial number, a “token” that Charlie had told Heidy to watch for. Heidy then handed over a bank envelope of cash.

Heidy then drove home, where she paid Charlie another $1,000 via PayPal. By that evening, Heidy had sent the scammers around $35,000 — $5,000 short of what she “owed.” Charlie said he would call her the next day to finish the refund. 

With Heidy finally off the phone, her daughter was able to get through. Only after recounting the experience for her daughter did she realize what had happened to her.

“Mom,” her daughter said, “you got scammed.” 

“No, no, no, no, no,” Heidy responded, beginning to panic. “It can’t be. I dialed.” 

Life savings gone

It was true, though. Heidy’s bank account, which she’d spent decades building while working multiple jobs and overnight shifts, was gone in less than a day.

The next day, Heidy reported the scam to the Mesa Police Department but said she was not given a promising outlook. 

“Ma’am, you don’t know how crafty these people are getting,” Heidy recalled a Mesa police employee telling her. “You’re not going to get your money back.”

Mesa police spokesperson Det. Jose Aguirre said that “police spoke to Heidy yesterday. Detectives are working on possibly recovering the money involving Bitcoin ATM’s. This is an active investigation as detectives attempt to identify all involved.”

Heidy said her bank told her that because she had withdrawn the funds, the bank couldn’t recover her money. She’s been trying to fill out a report with the FBI. Charlie has continued to call her to finish the transactions, but following police advice, she hasn’t answered. 

She’s still rattled and “so afraid of retaliation from these people,” she said. They know everything about her.

Now, she feels hopeless. She was nearing retirement and hoped to move back to Costa Rica, where her family is from and her daughter lives. That now seems impossible. “I’m not in the right state of mind right now,” she said, sounding exasperated. “So sorry. I just can’t believe this happened to me.” 

She has begun selling everything in her home on Facebook Marketplace, OfferUp and eBay — anywhere she can to recoup some money. She thinks she’ll only be able to collect “not even 2%” of what she lost.

There’s still some hope to recover more. After being contacted by New Times about Heidy’s story, the Attorney General’s Office hopes to help her. State law now requires kiosks and ATM operators to issue full refunds, including fees, to new customers who report being victims of fraud within 30 days of the transaction — a grace period that Heidy falls within. Heidy’s daughter has also set up a GoFundMe page to help her recover the lost funds. So far, $3,050 has been raised.

But all that only scratches the surface of the damage, including to her peace of mind.

“I am just in despair. I feel numb,” she said through tears. “I just wake up in the morning, and I feel like I’m not going to be able to handle this. I cry and I ask God to give me the strength to go through the day and to help me, because I cannot do this by myself.”