David Welles, an 87-year-old retired lawyer, spent hours wrestling with a new iPad, growing increasingly frustrated as he tried to set up his email. Eventually, he decided to seek help. A quick Google search led him to a phone number that appeared to offer technical support. He believed he was calling Microsoft.

Instead, the call connected him directly to cybercriminals.

The man on the other end introduced himself as Alex. Calm, patient, and reassuring, he quickly gained Mr. Welles’s trust. Alex spoke confidently about fixing technical problems and assured him that everything could be resolved step by step. Before long, Mr. Welles was persuaded to install remote access software on both his iPhone and his laptop. That single action opened the door for the scammer to gain deep access to his personal devices, where Mr. Welles stored usernames and passwords.

“It was a big mistake,” Mr. Welles later said. As the scammer took control, he noticed his laptop screen flickering, going blank, and showing unfamiliar activity. By then, the damage was already underway.

Over nearly five hours and multiple phone calls, the scammer gradually wore him down. Text messages and call records later showed the extent of the manipulation. Just after 7 p.m., exhausted and confused, Mr. Welles called his work assistant and told her he had been speaking with Microsoft all day. She immediately felt something was wrong.

They decided to confront the situation together and called the supposed technician on a three-way line. What neither of them realized at the time was that several hours earlier, at 4:45 p.m., the scammer had already initiated a wire transfer of $85,000 from Mr. Welles’s Citibank checking account.

Even after Mr. Welles and his assistant contacted the bank later that evening to report suspected fraud, the transfer was not immediately flagged. By the time action was taken, the money was already gone.

This case is far from unique. Cybercrime has evolved into a highly organized, global industry that siphons billions of dollars from Americans every year. Fraudsters use surprisingly simple tools to launch sophisticated schemes, including malicious online advertisements purchased through search engines and social media platforms, deceptive text messages sent via VoIP services, and fake customer service phone numbers designed to look legitimate.

Once they gain access, criminals move quickly to transfer money in ways that avoid detection. When transactions originate from a customer’s own devices and accounts, banks’ fraud detection systems are far less likely to raise alarms.

Account takeovers like the one Mr. Welles experienced are increasing rapidly. According to an analysis of U.S. Treasury data by David Maimon, a criminal justice professor at Georgia State University and director of a cybersecurity research group, such incidents have tripled over the past five years. Reports filed with the Financial Crimes Enforcement Network rose from just over 5,000 in early 2020 to more than 16,500 in May of this year.

From the bank’s perspective, these transactions often appear legitimate. The activity originates from recognized devices, correct login credentials are used, and standard security steps are followed. As Professor Maimon explains, everything looks normal because the signals come directly from the customer’s own electronics.

Older Americans are particularly vulnerable. According to data from the FBI’s Internet Crime Complaint Center, people over the age of 60 lost nearly $982 million to tech support scams last year alone. That figure represents a 66 percent increase from the previous year. Even so, it is only a fraction of the estimated $16.6 billion lost to cybercrime overall in 2024, a number widely believed to understate the true scale because so many victims never report their losses.

Stolen funds are often moved through wire transfers or cryptocurrency, both of which offer fewer consumer protections than other forms of electronic payments. This gap in protection is now at the center of a legal battle. New York Attorney General Letitia James has filed a lawsuit against Citibank, arguing that stronger rules should apply when consumers use wires through online or mobile banking.

When Mr. Welles and his assistant called Citi around 8 p.m., the bank told him his accounts would be frozen. However, the bank did not mention that a large wire transfer had already occurred earlier that afternoon. Mr. Welles checked his balance, saw roughly $20,000 remaining, and assumed nothing major had happened, forgetting that he had recently moved a large sum to pay taxes.

After being a client of the bank for 50 years, Mr. Welles believed that any unusual activity would be quickly detected. That night, however, he barely slept.

The following morning, he received another phone call. The caller ID showed Citibank’s private bank. The man on the line identified himself as Michael Wink and asked whether Mr. Welles had authorized an $85,000 wire. He reassured him that there was no need to call the bank because the issue was already being handled.

Once again, it was the scammers.

Only after Mr. Welles and his assistant contacted the real Citibank did the truth become clear. The $85,000 had indeed been wired the previous afternoon. The bank attempted to recall the transfer, but it was too late. The funds had passed through Wells Fargo and moved onward.

Citibank declined to comment on whether earlier intervention might have improved the chances of recovery. Nine days later, Mr. Welles received a letter denying reimbursement. The bank explained that the transfer had been made using his online credentials and registered device, and therefore did not qualify for compensation.

Wire transfers are governed by rules originally designed for business transactions. Under these standards, banks are not required to reimburse customers if reasonable security procedures are in place and the transaction is accepted in good faith. Attorney General James’s lawsuit challenges this framework, arguing that when wires are initiated electronically through consumer banking platforms, they should fall under the same protections as other electronic transfers.

Consumer advocates support this view, noting that from the user’s perspective, an online wire transfer is no different from other digital payments. Banks counter that existing law clearly excludes wires from these protections, emphasizing that when the rules were written decades ago, consumer wire transfers were rare.

Earlier this year, a federal judge allowed New York’s case to proceed. Citibank has appealed the decision, with other banks and credit unions filing briefs in support. Some financial institutions warn that expanded liability could lead them to eliminate consumer wire services altogether.

Mr. Welles later learned that the wire had been sent to an account at Wells Fargo under the name Adedela Sodiq. Wells Fargo declined to comment on the account. Citibank stated that it takes client protection seriously and offers transaction alerts, though it does not provide a way to block transactions above a certain dollar amount.

Weeks after the incident, the harassment continued. Another caller claimed to be a senior Citi investigator and promised that the money would be recovered soon. Mr. Welles confirmed with his real bankers that this, too, was part of the scam.

In an email sent in late September, he reflected that while he would manage financially, the emotional impact was far more severe. He described ongoing anxiety and recurring nightmares, a lasting reminder of how deeply a few hours of deception had shaken his sense of security.