CHAPTER 6
The UniSol Health phone tree might have been the most annoying of them all. That was probably because it felt like I’d listened to the same computerized female voice a thousand times. She sounded less pleasant to me than Freddy Krueger’s nails traveling down an endless chalkboard.
Press three if you’d like to cut down this phone tree with a chain saw!
I pressed five to speak with a customer service representative—same as I’d done the last twenty-three times. Odds were good I’d get a hit eventually. Going by the numbers on the UniSol Web site, the company insured one out of every four Americans.
Ruby was out with friends from school, enjoying a little get-together, which I helped to arrange. I needed privacy to make my calls, and Ruby rarely ventured farther than our front door. The desire to socialize was just one of many things Verbilifide had extinguished, along with her appetite, ability to sleep, and a host of other activities we used to take for granted.
Ruby still had her hair—this wasn’t chemo—but she looked noticeably thinner to the four girls and one guy who came over to take her out to lunch and a movie. Her friend Elisa, whose olive skin and dark hair made Ruby’s sickly pallor all the more pronounced, told my wife she looked great, while her eyes betrayed the lie.
Ruby paused briefly at our apartment’s threshold, giving me the same look Ginger uses whenever she wants to sleep in our bed. I gave Ruby a long hug, whispered in her ear, “You’ll be fine. It’s just for a little while.” I actually checked the time and made a mental note of the hour. My plan already had enough pitfalls, and I sure didn’t want Ruby coming home to the scene of the crime while the crime was taking place.
Social engineering exploits a weakness in one of humanity’s greatest strengths: our inherent desire and ability to trust. I don’t particularly enjoy lying to people, and what I was doing filled me with remorse. At least my intentions were noble, so I could justify my actions. That dollop of justification was all I needed to take those first awkward steps across the line of the law. I was a criminal as soon as I made my first call, and I did so thinking, I’m doing this for Ruby.
I pressed buttons so that my call would be routed to a living, breathing human being.
“Thank you for calling UniSol Health. How may I provide you with exceptional customer service?”
I wanted to say to the chipper-sounding UniSol rep, “Could you just give me the account number of a customer whose insurance will cover the full cost of Verbilifide?” But Social engineering requires a bit more subtlety, so instead I lied and said, “My name is Greg Johnson, and I’m calling to check on a prescription status.”
According to my game logs, Greg Johnson is an avid player of One World. If he realized that he’d spent well over two hundred hours chasing away virtual zombies while building a town out of make-believe bricks, he might opt for fewer CPU cycles and more time spent with real people. But I’m not here to judge Greg. I’m trying to use him. Greg represented the latest call I made pretending to be someone I’m not. He was next on my list of potential candidates who might have UniSol health insurance that would save my wife. According to the birth date Greg entered when he registered for my game, he’ll turn thirty-three this October. Assuming he didn’t enter bogus data, it’s close enough to my age. Good enough for my purposes.
My phone-spoofing program made the rep think Greg—aka me—was calling her from a Wisconsin area code. I had checked my log, confirming that I hadn’t made any phone calls from Wisconsin yet. Heck, I’d never even been to Wisconsin. Go, Badgers!
“I’d be happy to help you with your prescription status. I just need your account number to get us started.”
I groaned into the phone, feigning embarrassment at my own made-up forgetfulness.
“That’s the problem,” I said with another sigh. “I’m traveling on business, and I left that card at home. I’ve tried my wife—both the house phone and the cell. Even texted her. She’s not getting back to me. But that’s just like her. If she’s not one place, she’s another.”
I didn’t know what I meant by that last bit, “If she’s not one place, she’s another.” However, the point wasn’t to make a lot of sense. The point was to be chatty. Seem friendly. The guard comes down as soon as a rep thinks I’m on her side. I’m not calling to yell or harass. I’m just a regular guy with regular problems, thank you very much. I learned all this by Googling social engineering. The Internet is like a distance learning crime school.
“Well, that’s not a problem, Mr. Johnson,” the rep said. “I can look it up for you. What’s your home address?”
I gave her the address Greg gave me when he registered for my game.
Fingers went tapping. A moment passed. It got real quiet when the rep became confused. Eventually, she came back on the phone and said, “I’m sorry, but we don’t seem to have a customer by that name.”
“Oh, my mistake,” I said, sounding as chipper as she. “I must have the wrong provider. Thanks for your time.”
I hung up before the rep could say good-bye. Time was running short. Ruby would be coming home, and I needed to make more calls. The next five calls yielded the same results as my attempt at being Greg Johnson. I spoofed numbers from Delaware, New Jersey, two from California, and one from Anchorage, because the Michelle Shocked song of the same name came up in my iTunes shuffle. Ruby kept such an eclectic collection of music.
I kept on calling. I got closer on my twenty-fourth call to UniSol Health. William Spader, thanks and praises, was an actual UniSol customer. Unfortunately, Spader wasn’t the ideal customer.
“Could you tell me if this policy covers my wife?” I asked.
“I’m sorry,” the representative said after much finger tapping. “But according to our records, you’re not married.”
“Oh well,” I said. “Sorry about that. Thanks for your time.”
I picked the next name from my list. Spoofing a Massachusetts exchange, I called again. This time, I was Elliot Uretsky. I was traveling on business and needed to look up my prescription coverage. Dang it, but go figure—I left my cards at home. So naturally, I provided my home address upon request. I verified Elliot’s mother’s maiden name, Askovitch, which was one of the security questions I stored in my database—oops, not encrypted—for password retrieval purposes. It was also one of the security questions UniSol asked before they’d give me any of Uretsky’s account information. I found out that my policy (I mean Elliot’s) covered my wife (I mean his). The rep gave me the account numbers, which I jotted down in a spiral-bound notebook.
And I picked up an interesting tidbit. It seemed that Elliot last filed a claim four months ago. He was also behind on making his payments. In my mind, that was a plus. To pull off this scam—lifesaving scam, that is—I intended to change his mailing address with UniSol so that he wouldn’t be receiving any of Ruby’s bills in the mail. Given that Uretsky didn’t seem very interested in keeping his health insurance coverage in good standing, I suspected he was also a guy who wouldn’t be looking for his bills.
Still, I decided to keep fishing, made ten more calls, got lucky twice, two names that would fulfill my purposes: Chuck Trent and Racine Romaguera. Both were in the UniSol network; both were married; both spouses were covered by hubby’s insurance policy. Trent was the healthiest of the lot—he hadn’t had any claims filed in the last nine months. Romaguera beat Uretsky by some, as he’d last seen a doctor six months ago.
I decided to learn a bit more about these men before I made my selection. I checked them out first on Facebook. I couldn’t tell what Uretsky looked like from his profile pic, unless Uretsky and Mario from Super Mario Bros. were related by blood. That was because the picture Uretsky used for his Facebook profile was a screen grab from the video game.
Romaguera was a bald, good-looking, outdoorsy type.
Trent’s picture showed him sunbathing on a towel. Clearly, this was a guy who thought chest hair and aviator glasses made him sexy. Their profiles were otherwise set to private, so I couldn’t glean much useful data.
LinkedIn provided me with some more basic information. All three kept profiles on the world’s largest professional network. Trent was in sales, which sort of explained his Facebook profile picture. Nothing says, “Trust me,” quite like a half-naked, oiled-up body. Romaguera was employed by Fidelity. Uretsky was a contract computer programmer with a passion for start-up companies. Maybe he was too busy developing software to realize that he’d fallen behind on his health insurance premiums. On the downside, Uretsky lived in Malden, and I wasn’t too keen on him residing so close to my home.
But the way I saw it, Uretsky was the least likely to become suspicious. When the bills stopped coming, he wasn’t going to notice. That was my thinking.
I had found my helper.