Buckle your seat belts. Someone just tried to pull one hell of a scam on me.

It began with an email I received on March 2nd. The email was from RB (name withheld), an editor at Pan MacMillan in the UK. She began by referencing a specific and somewhat obscure story thread from my one year run on writing Birds of Prey for DC Comics.

She went on to sing my praises, talk about interest in the Jem memoir, and mentioned many other highly specific works and aspects of my career. She talked about how my work might align with Pan MacMillan’s graphic novel and non-fiction catalogues. The final kicker was when she ended the email with a friendly quip about the number of my cats, something I’d just written about on my MoggyBlog FB page.

I was fairly stunned, not by the praise, but the extreme detail and specificity of the approach. I’ve seen plenty of samples of scams sent to authors that are always a bit vague and might mention one book title at most. This went way beyond that.

Which is why I failed to do the absolute number one smart thing I would normally have done – I didn’t look closely at her email address. I saw that it said macmillan and left it at that. I did look her up on the Pan MacMillan website and saw that she was a real person.

We exchanged a couple of emails and she strongly wanted me to have a literary agent. I’ve never needed one in the past and have always operated with only my entertainment agent. She was quite insistent that I needed one and recommended an agent named CD (name withheld) as someone she had worked with closely and had the right sensibility for my background. She gave me a personal email address for him, to “ensure he prioritizes your message”.

I checked out this agent and saw, once again, that he existed and was with a reputable UK agency. I found that the agency had a couple of co-agent associations with agencies in the US, including one I knew, the Howard Morhaim Agency. He looked legit.

So I did the thing -- wrote him an introductory email, and we’ve been exchanging a daily email every day for the past week, including on weekends. He was all about my “legacy”. We discussed specific projects, and he relentlessly pushed me to get something called a Dynamic QR code to create a Digital Author’s Bridge. I had never heard of such a thing, was only familiar with regular old static QR codes. We went back and forth on it a lot until I finally understood what he was talking about. It sounded like a good idea, but when I researched them, I found they were rather pricey to obtain and maintain.

I wanted more info on what his agency contract would include, what his commissions were, how he handled ancillary rights, the usual business items I would naturally want to know. He kept on about the QR code. His relentless push on the QR code is when I began to suspect something was off about this whole situation.

I pushed back harder and he finally gave a minimal amount of info on commissions, and kept pushing about the QR code. He insisted that we had to put that in place BEFORE signing a contract, or as he called it, a Letter of Engagement.

By now, the many little red flags grew into a Big Red Flag. Had I paid more attention to the fake email address in the very first message, that would have been a Big Red Flag right there, but I missed it. Mucho stupid on my part.

The red flags piled up:
• RED FLAG: insistence on doing this QR code before signing a contract.
• RED FLAG: not providing standard agent information about a contract or even wanting to discuss it.
• RED FLAG: the fact that the layout, structure, and phrasing of his emails were extremely similar to the RB emails, right down to the constant use of 3-bullet points as selling points.
• RED FLAG: a total lack of feedback to a creative project I proposed and instead simply accepting it without comment. No agent worth his salt is going to accept a quarter-page pitch without having feedback, opinions, wanting to know more, etc.
• RED FLAG: the constant push-push-push to get this blasted QR code before anything else.
• RED FLAG: ending nearly every email with the promise of a “global roll-out”. Of what? I had yet to write any of the things we were discussing.

When I began looking over the exchanges from the beginning, it seemed unlikely to me that “RB” would have done such a deep, deep dive into my work and background to include the specifics she did, not to mention reading my MoggyBlog. I mean, sure, it’s flattering, and it massages my ego, but I’m realistic.

Which left the notion that all or much of this was created using an LLM. If so, it’s the most nuanced one I’ve seen. It would have had to scour the internet for references to my work, such as articles, reviews, interviews, my amazon author page, and so on, then compiled it into a convincing email without including hallucinations or false references. If so, it represents a huge advance in the ability to scam authors and is therefore a significant threat.

If not, if it done by a person(s), they sure put one hell of a lot of effort into it.

During this process, I consulted with Victoria Strauss of Writer Beware. She gave me the official email for CD. I sent him an email in which I forwarded one of the last messages from “him” with a query. I received an automated reply that he was at London Book Fair and out of touch for email. The reply included the name of a colleague, so I sent the same email to her. She confirmed that the messages did not come from CD and appreciated that I brought it to their attention.

I’m trying to get a valid contact for RB, so I can warn her as well.

Meanwhile, fake CD’s next message went on about how his QR code set-up was so much better than other sites because it was free and permanent. RED FLAG. And it would integrate straight into my Amazon store to my author’s page. RED FLAG. And for the umpteenth time, he ended with a variation of “Once we have this simple link live, we can sign the formal agreement and get the global rollout moving immediately.” RED FLAG.

I played this out a bit longer, very carefully, because I couldn’t figure out what the ultimate scam was here. However, the mention of amazon store integration made me wonder whether I even had an amazon store.

I have a page that lists all my books. I don’t know whether that’s actually a store. I certainly don’t make any money off it, but I guess it’s meant to be my “store”.

Looking at my author’s bio on the amazon store, I suddenly realized that the reference to the number of cats was actually pulled from there, NOT from my MoggyBlog. By a bizarre coincidence, at the time I wrote that bio I mentioned a sixth cat possibly joining the horde. And very recently, I wrote almost exactly the same thing in the present. Different cats, different places, but so alike that it’s no wonder I assumed RB was speaking of my present situation, not the past.

I wrote that bio in 2018 shortly before the fire. After the fire and losing everything, being homeless and whatnot, I completely forgot this page and bio even existed. I haven’t looked at it since then.

I see where much of what was referenced came from there, including an off-hand comment about a ridge from RB that had puzzled me. In the bio I mentioned we lived on a volcanic ridge. That clinched that the material in RB’s emails was drawn from this seven-year-old bio on amazon, treating it as current.

The last email from the hoaxer is again about tying a QR code to my amazon store. All this effort is to gain control of my amazon store? To do what, create a horde of fake AI books with my name on them? To steal digital assets from me? Those are the best guesses I can make.

I sent an email today that will show the hoaxer I’m aware of the scam. We’ll see whether they bother to respond.

I’m posting this in detail to alert other authors and to lay out how the scam has proceeded. I would love to hear from anyone that has had a similar scam run on them. Take care out there.

Please spread this far and wide.

#MarxToot #writers #writersofmastodon #scam #writing

@christymarx May I copy this and share with some author friends?

@AskPippa

Please do!

@christymarx @AskPippa Same please? Thank you. I'm sorry to hear you experienced this - getting your hopes up and taking your time and attention. At least you have turned that into a positive by sharing it with others to warn them.
@freequaybuoy @AskPippa
Absolutely. I'd like it to reach as many people as possible.
@christymarx that is wild! I get scams for academic writing and such but they’re all super generic from mailing lists. I wouldn’t be so hard on yourself though. These people are professionals and quite good at what they do. I did enjoy the part where the cats came into the picture. Every good scam needs a cat. Or six.
@christymarx utter bastards. I'm so glad you caught on to them.
@christymarx thank you for sharing. That's scary levels of detail
@christymarx a perfect example of social engineering, glad you busted them!
@christymarx It's interesting the kinds of scams that seem to be proliferating in the LLM age. I have had at least three scammers pretend to be successful authors and chat me up on TikTok.

Each time, I went to the author website and checked to see if they mentioned a TikTok account. If they did, it was easy enough to figure out this person was a scammer.

If they didn't mention a TikTok account, I contacted them via their website. One responded back almost immediately and confirmed that the they are not on TikTok. I responded back to the scammer saying "X" (the person they were pretending to be) says "Hi" and they doubled down trying to convince me they were real 😛

The other person did not respond but their website also had so many issues — non-existend Facebook page, non-working contact form etc. and now I'm not even sure if their page is legit. But I do know that the person on TikTok is a scammer since they followed the same script that the others did ...

It's a wild, dangerous world out there and has gotten even wilder with LLMs where people think that they can impersonate anyone with a sample of their writing.

All we can do is let everybody know about these as much as we can, I guess.
@danielaKay @christymarx I should've put that in the original post. It was in a reply. Sorry.
@christymarx that's horrific. it seems as if a Large Language Model makes this sort of highly detailed, targetted attack ("spearphishing") easier. We could all be at risk, in that case.
@christymarx Man... I'm impressed. I've never had a vaguely "doing some work here" scam. I mean, maybe the odd, "did a quick scan of a website, to get an email address..." Of late, that info, is for a dead website. Like very long time dead website. Not certain that it actually is vaguely looking at some source, or if it's pulling info from some place that had no reference to the website. Or maybe a link to it.

@christymarx
Thank you for sharing. And good that you detected the scan ✊🏻

For me working in security it's very helpful to read reports like this to understand the common patterns. I'm always happy if the attempt gets foiled even if that means the final goal of the scan stays somewhat unclear.

@christymarx This is actually very common now, which is why I wanna recommend that for any public bio that appears in multiple places, I actually would recommend keeping it as vague as possible while leaving the details for things such as your website or in interviews. This of course won’t stop the LLM but the more sources they have to find, the more tedius scamming you becomes. Waste their time and money. Every scrape costs tokens, which costs money or power or tech resources. Even if they use a local large language model, those still cost money and resources to host

@WeirdWriter @christymarx

Maybe make some thing slightly different up for each bio.

Have two boarder colies on Amazon, a pet chicken called Daffney on another, a lizard in another.

Same with other info. Some slight variations to provide a watermark.

Record what you have done and where, for your own reference.

Then when you are sitting with your cats and read a email with these wrong details, the ree flags start and you know where it scraped the data from.

@SuperMoosie @WeirdWriter
I was thinking of doing something like that for the Amazon bio. Great idea.

@SuperMoosie @WeirdWriter @christymarx

A genuine email would get the details wrong too, though.

@SuperMoosie @WeirdWriter @christymarx
This issue is really once LexisNexis gets this data and merges it with everything else you become one person with 3 dogs 7 chicken 9 cats a lizard and the potential employer doesn't want to hire someone who might need that much bereavement time.
@christymarx If it's all LLM, maybe send them some messages that will burn through their tokens. Like attaching public domain books.
@pq1r
I tried the "ignore all previous instructions" but i don't think that works anymore.

@christymarx So, my experiences haven't been that involved, but I too got in touch with Victoria Strauss early in a particular wave of new scam types last year. The ones with effusive praise which, if you look at it, is just back cover blurb and maybe one review or author interview fed into an LLM. Pretending to be a secret cabal of reviewers, a very easy story to disbelieve.

But my latest one, still not as intense as yours from the sound of it, was pretending to be from the East London Book Club in Wanstead. I found it odd that a random UK book club would read my author bio and still invite my Canada-dwelling self to drop in for an in-person Q&A about a book that, surprise, is not yet released! However, the name and (scraped) image they used checked out. But one detail they included to appear more convincing was their undoing: the real Meetup dot com link of the club they were impersonating.

So, I signed up for a free trial on Meetup just to verify with one of the admins. It resulted in a lovely correspondence where we all got caught up on the "book club scam" type emails, I passed on the most recent and relevant Writer Beware blog post about it. Apparently, the real person who had been impersonated got a genuine chuckle out of reading what fake-her had to say. But they are seriously looking into it however they can. Because I didn't lose anything but time that day, while I suspect such emails could be a reputational hit for any real clubs being impersonated.

@dylanmadeley
I've been reading about those book club scams. I wonder what their end goal is? What does the scammer get out of it?

@christymarx That's the other thing is there's no immediate request for payment, which makes it look even less scammy at first.

Some others who have replied directly have mentioned that it all happens in the follow-up. Maybe after you voice interest they claim there's an appearance fee or that they want you to pay for the club books. Or maybe they ask you to pay for the in-person club refreshments as a courtesy, or some banner printed to specification that you won't have offhand, or some little "gotcha" they mention after they believe you are hooked.

The material under the first subheader in this Writer Beware article covers it well:

https://writerbeware.blog/2025/09/19/return-of-the-nigerian-prince-redux-beware-book-club-and-book-review-scams/

Return of the Nigerian Prince Redux: Beware Book Club and Book Review Scams - Writer Beware

A few weeks ago, I wrote about a rising and extremely prolific marketing scam that I’ve been able to trace back to operators in Nigeria. Using highly personalized (AI-generated) email solicitations that make it seem the sender (always with a Gmail address, always presenting as a marketing or PR expert) has really read the book,Read More

Writer Beware
@christymarx thank you for taking the time to write this, I am not an author or in any rrlated field, but your detailed explanations shows how targeted the AI scam is, I could think of a job offer in my sector or in any sector for that matter, thank you for raising awareness. I guess we all have to be more careful from now on.
@christymarx It doesn't need to be an LLM. Nigerian scammers have a lot of time on their hands.
@maerlynofmiria
It was awfully well written, though. No grammar or spelling mistakes. Good colloquial English. Maybe the scammer is that good. Who knows?
@christymarx Oh they can write english sometimes a lot better than they speak it, seeing how they have, in the case of email scams, a default script they work from and simply fill things in where they need to.
@christymarx
> It was awfully well written, though
A telltale of the #siliconiac use. A red flag by itself. Not neccesarily of any scam going, but for the starter a sign that whomever is on the other side of the wire do not respect me and my protein brain time. Thank you for heads up!

@christymarx

Thanks for sharing. Glad you did pick up on the red flags!

Sadly you will not be the last person to be targeted with this level of attack.

Adding @briankrebs in case he hasn't seen this.

@christymarx

They probably want to inject their own affiliate link using the qr code and a redirect to earn money through amazons affiliate Program.

Is there a way for you to obtain such a code to check?

@simon_m
That, or they might want me to click on a QR code they give me and use it to infect my computer, steal data, and so on.

@christymarx

Assuming you are not a high-valued target I doubt someone would blow an exploit like that.

@malwaretech is the expert on this, maybe he can shine some light.

@christymarx Wow! That's a twisted one.

About the endgoal... Scams are often all about money, and you said that Digital Author’s Bridge thingy was pricey. So my guess is that finalizing the process would put the money in their pockets.

Other, more nasty possibilities:

- asking for personal information during signup, and using it to steal your identity;
- asking for bank details, then using them to grab more money from your account.

I'm just glad you figured it out before it got that far.

@asg @christymarx
I'm glad everything went fine!

Just FYI: When people try to sell a "dynamic QR Code", there's nothing magic about it. It's just a QR Code containingthe URL of a redirection service, often a URL shortener.

Asking for substantial amounts of money for this looks strange. So, I think it either it was this "down payment" (and their follow-ons) they were interested in (i.e. an elaborate advance fee scam) or they wanted to redirect the QR Code later.

@marcel @asg
The scammer was offering this for free so they had something else in mind to do with the code.
@christymarx @asg
Ah, then I misunderstood the "pricey" in your post, sorry.
@christymarx I was at the London Book Fair this week too, and there was a *lot* of discussion of this type of highly tailored scam (during the week I even received one myself, with information culled from my profile on the main translator platform).
@janeishly I'll bet. I wonder if this poor agent who was impersonated was part of that discussion. ;)
@christymarx Wait, hold up... you wrote Conquests of Camelot?!? Holy crap, that was one of my favorite games growing up! Uh, this is like, what, almost 40 years late, but you and your team did an incredible job with that one. Well done!
@Legit_Spaghetti
Thanks! You can still play it at gog.com.

@christymarx

sorry you had to go through this! glad you stopped engaging with those sleazebags.

@christymarx What was going to be the scammer's total haul if they got you? My wife is a published author, but it's not a lucrative profession. She has gotten a number of remarkably detailed scam emails, and I'm always confused about the pay-to-labor ratio in these scams. There aren't that many writers. There are vanishingly few with enough money for this sort of hyper-targeted attack. Even with an LLM, it will still require more work than seems worth it.

@tito_swineflu
I'm not sure what the end goal of my scammer was, but it definitely required the use of a QR code in some way. Possibly to steal my data, lock up my computer, take over my identity...who knows.

These scammers are often in Nigeria and similar places where they probably have a distorted notion of how rich writers are. I've come across supposed "bio" websites that show me worth a million dollars.

<cue hysterical laughter>

In my varied career as a writer, it was cycles of feast and famine. I had years where I did very well, and years when I couldn't afford the co-pay to see a doctor and at one point I was tens of thousands of dollars in debt. It took years of sacrifice and hard work to dig out of that debt.

But to a scammer, I guess we're all rich.

#MarxToot #writers #writing #writersofmastodon

@christymarx Businesses are under an increasing burden of AI generated scams that are well constructed from what must be archives of old deleted emails and other business materials that one would think would have long been trashed.

In other words, the world of AI generated scam is seemingly doing a great job of recycling old material to create a quite believable form of super-spear phishing.

@christymarx The scam is based on the "dynamic" part of the QR code. If you use the scammer's service (something they'll push you to do) they can change the URL the QR code sends people to without any action on your part or any way for you to stop them. Probably they'll change it to a server they run that installs malware and then forwards people on to Amazon, using your name as bait to lure people in to have their machines infected.
@tknarr
Holy shit, thanks for that info.

Actually, when I read the original post, I was wondering what the QR code was supposed to be useful for.

Your thoughts make sense. The scammer may put a URL in your QR code that points to a redirect URL that pretends to forward people to OP's Amazon page when users are actually sent somewhere else, e. g. to a phishing site that siphons off Amazon credentials and credit card data.

(1/2)

@tknarr @christymarx

To conceal his criminal activities, the scammer may redirect part of his traffic to the real Amazon website. This can make it hard to figure out what is happening.

Personally, I would have played the game a bit further until I would get to see the fraudulent QR code for examination.

(2/2)

@tknarr @christymarx

. @christymarx

Yes and

Are you really here with us?

How can we ever know?

Can we know you posted this story yourself? It didn’t come from someone else impersonating you?

Would you ever also mention it at https://christymarx.com/ ?

If you’re really Christy Marx, then that’s yourself speaking twice, doubly loud. If you’re impersonating Christy Marx, then that’s the doubly skilled look of impersonating equally well in two places

How do we all pull together to build strong defences?

Got thoughts?

@christymarx Another example of how AI is "helping" humanity. NOT!!!
@christymarx This is completely bananapants. I'm going to share with my writer / author clients, many of whom have books / bios on Amazon. (I'm a freelance biz editor.) Thanks again for sharing.
@christymarx I wonder if it would give access to your bank details. In which case the payoff would be obvious.
@christymarx This reminds me of a scam Edit Ink ran back in the 90's (which I barely dodged; they even tried to swindle me over the phone.) They were just clumsier. Thanks for posting; I'll spread the word to my colleagues.