That time a fraudster stole my journalism identity

Hello friends!

A few months ago I wrote about the AI scammer who got fake stories past editors all over the industry last year. Disheartening, terrible, ugly stuff. SO, dear readers, to keep that uh super fun and uplifting ride going, today I have a tale from one of my favorite writers around, Gray Chapman, about an even more insidious practice: A fraudster stealing an actual journalist’s identity and using it to get work.

Gray is a freelancer in Atlanta who you might remember from her mega-viral story about “verminfluencers” a while back. She’s spent 15 years building a sterling reputation and resume, but last year someone stole all of that to get freelance work — and paychecks. This is her story.

*dun dun*

In March of last year, I took my dog for a walk and came back to the weirdest email I’ve gotten in recent memory. I almost ignored it, because the subject line — “Freelance Inquiry” — felt like generic spam, but the body stopped me in my tracks:

Hi Gray, I hope this email finds you well. My name is Alex, and I work with [an SEO agency]. I'm reaching out to this email because I was under the impression you were doing freelance work for us, but after some suspicious emails, I'm thinking someone might have presented themselves as you in order to gain work/payment. Can you please let me know if you are in fact the same person who I have been speaking with at [not my email address]?

Of course, my first instinct was that this person was scamming me. I spent about an hour furiously doing as much research as I could on her and her company, and once I established that she was a real human who worked at a real, physical office at a real company, I wrote her back, confirming that I’d never freelanced for her organization and asking her to forward me all of her correspondence with the person claiming to be me.

Alex generously provided PDFs of her correspondence with “Gray,” which spanned a little over two months. I scrolled through the emails and dissociated as I read fake-Gray’s resume (scraped from my LinkedIn with a few key differences); watched her share her gratitude for the “seamless!” onboarding process and her excitement to start contributing; and later as I saw her peddle excuses for needing more time to complete assignments. Fake-Gray’s sister-in-law abruptly passed away. Fake-Gray’s child was ill, again. Fake-Gray couldn’t join the video call (with her now-suspicious employer) because she had an emergency tonsillectomy and “can’t talk.” (Nice try, fake-Gray, but I already used that excuse to get out of a shift at my work-study telefund job in college!) I felt creeped out, publicly naked, and absolutely mortified that someone was out here missing deadlines in my name.

After reading through the emails, I asked Alex if she and her manager could meet with me on Zoom (cameras on, obviously). On our call, Alex shared her screen and walked me through the whole ordeal, from getting “my” Indeed application for their part-time content writer role, to communicating with “me” about missing my deadlines and realizing “my” work wasn’t quite up to snuff. It became clear that this person used my name, credentials, and a similar Gmail address to land the gig, then filed a handful of assignments each week for as long as they could until someone called them out on it, which, in this case, took about six weeks. Alex and I both agreed they were likely achieving this with the help of AI; while we couldn’t say for sure, using something like ChatGPT to instantly generate five SEO-optimized articles a week at $100 per page is the only way such a hustle could possibly be profitable. (And then there was the uncanny, artificially cheerful tone of the scammer’s emails: “I’m thrilled to be part of such a meaningful project!”)

I was stunned. A grifter posing as a freelance writer? Surely there are more lucrative cons to be had!

I have no idea whether this has happened before or since, but in this particular case, they managed to get away with it for a couple of payroll cycles before someone got suspicious and “Gray” went dark. It was a bizarre and bleak conversation, but to my great relief, I was able to look at the W-9 submitted by the scammer and confirm that they didn’t use my SSN or address. (On the plus side, I did get a nice little ego boost from seeing the agency’s effusive internal notes about my credentials and publication history.)

Unsurprisingly, there’s not a lot of helpful information online about what to do in these situations, but here is what I did:

Covered my ass(ets). At first, I had no idea how much of my personal information this person had accessed, so the very first thing I did was freeze my credit and pay for a standard LifeLock subscription (the cost of which I later deducted from my taxes as a business expense). And maybe I was paranoid, but I changed passwords and enabled two-factor authentication across my email, social media, and bank accounts just in case.

Asked for documentation. I asked the agency to share all the documentation they could. I saved PDFs of their correspondence with the scammer, as well as the resume they submitted and a screenshot of their fraudulent Indeed account. I also asked them to forward an email from the scammer so I could capture the Gmail header data as part of the next important step.

Tattled. I reported the fraudster to Gmail for abusing their policies using this form. I filed a report on the Internet Crime Complaint Center’s website (which mostly felt like sending a message into a void). I asked the agency to alert Indeed, which they did. As a journalist, I’m a little embarrassed to admit that I certainly could’ve been more aggressive in seeking recourse. I could’ve recruited an investigative journalist to help me determine whether the information in their W-9 was real and used those details to track them down. But ... then what? (Pretty sure the NYPD would’ve gotten a good chuckle out of me asking them to storm an apartment complex in Murray Hill to arrest someone for doing blog crimes.)

Reputation management. Once I took steps to ensure my identity and credit were safe, I had to tend to my professional reputation. In my 15 years of freelancing, I’ve worked really hard to maintain good professional relationships with the people I work with, and the thought of someone flagrantly filing mediocre work and missing deadlines in my name made me shudder. I wrote a post on LinkedIn explaining what happened, and I keep it pinned it to my profile in the hopes that future prospective employers would do their homework on me and avoid getting duped. I set up a Google alert for my name so I could spot any future articles being falsely attributed to me. I also added a notice to the top of my portfolio website alerting visitors to the scam, and asking them to verify suspicious correspondence through my email address. (A few months later, that notice caused some confusion with a potential source I was emailing, who thought I — as in, the real me — was a scammer. So I took it down.)

Mostly, I thought about how easy this grift was — and how much it sucks for my name and my work to be simply up for grabs, just by virtue of being online. Unfortunately, I’m far from the only freelancer who has experienced some version of this. The experience made me deeply resentful of how much my work requires putting myself on the internet. (It also made me very wary of certain practices that have been totally normalized for freelancers, like shooting over a W-9 via email.) I’ve imagined lots of ways in which my career will be ruined by AI, but I admit this particular iteration was not on my radar. For the millionth time, I fantasized about being a journalist in the ’90s, living high on the hog by filing like four magazine stories a year via snail mail and never having to worry about this stuff, or finding a job that simply doesn’t involve an internet connection at all (a girl can dream).

But if there’s a silver lining to be had, it’s this: Someone at this agency saw generic, presumably AI-generated writing and knew it seemed off. They saw the Temu-brand “content” being filed in my name and knew it didn’t track with my actual work. AI might be coming for my job (and my identity?), but I have spent years building a body of work that would be very difficult for a robot to replicate. LLMs can mimic my voice, and they can help a grifter limp along for a couple of months writing SEO content, but they can't travel to a disaster zone to sit with survivors, or spend months cultivating trust with the family of an incarcerated mom.

If this happens to me again (and maybe it already has, who knows!), my hope is that the agency or editor being scammed can just take one look at my actual work and realize that it doesn't at all track with whatever generic garbage a scammer is shoveling out under my name.

(Still fantasizing about being an early-’90s magazine journalist, though.)

Gray Chapman is an Atlanta-based freelancer who has written about everything from hurricanes to horse girls. In recent years her work has focused on mental and maternal health (but she'll always have a soft spot for the critter beat). Her stories have appeared in the NYT, the Guardian, The Bitter Southerner, Garden & Gun, and Atlanta Magazine. You can find her intermittently on Substack and begrudgingly on LinkedIn. Look for her latest project, a longform magazine story about motherhood and addiction she spent a year reporting, in The Bitter Southerner's fall issue (on shelves now, and online soon!).