A friend of mine — let’s call her Sara — recently had her phone repaired at a local shop. She didn’t wipe it first. Shortly after, I received a message from “Sara” on Facebook Messenger.

The opening was friendly enough: “Hello, how are you doing?” But it quickly veered into the classic script — the People’s Postcode Lottery is giving money to selected people, have you heard from them?

I knew immediately this wasn’t Sara. The grammar was off, the pitch was textbook, and Sara would never cold-open with a lottery scheme. Her phone had almost certainly been cloned during the repair, giving the scammer access to her Messenger contacts and enough context to impersonate her.

So I decided to have some fun.

The Opening

The scammer asked if I’d received a letter from “the PPL” about a cash bonus. Rather than ignore them or confront them, I played along — and started building a completely unhinged backstory.

Hawaii

I pivoted hard. “Hey, so do you ever think about that time? In Hawaii?”

The scammer, desperate to keep the conversation going toward their goal, tried to stay on script. They’d been “helped with 50 grand” and saw my name on a list.

I wasn’t interested in their list. I wanted to talk about the agents who pursued us through the jungle, the wind at our backs, and the child I’d been carrying ever since.

Our Son

“I became pregnant with your child, Sara. It’s a boy. He looks just like you. He reminds me of you every single day. The way he flips pancakes. His racist tirades at the postman. Every day.”

The scammer replied: “I’m very sorry about the past.”

They then tried to redirect me to a “Disbursement Agent.” I asked if they wanted to see a picture of our son.

They said yes.

I sent a photo of Gary Coleman.

“He has your eyes.”

“Looking pretty good,” replied the scammer.

Dwayne and the Conjoined Twins

I asked if Sara had ever remarried. No. Did she still keep in touch with Dwayne? No.

“That’s a shame. It’s hard to see conjoined twins stop communicating with each other.”

“U will not understand.”

Fair.

The Arm

I told them about my new arm — the one grafted on after Hawaii. How it feels different sometimes. How I think it does things while I sleep.

“Okay.”

“I think it may have killed a duck.”

“No.”

“Yes. I woke up the other morning and my hand was covered in blood and clenching a fistful of feathers.”

“So sorry how are you feeling right now.”

“I can’t stop thinking about that duck.”

The Ask

After hours of this, the scammer finally dropped the act and went for the money: “I need $500 dollars to pay my bills.”

“I would do anything for you. Just say the word. Even after all this time.”

“I need $500 dollars to pay for delivery fees please help.”

“I don’t have $500 dollars right now. I just had to pay for a duck’s funeral. It was very sad.”

I sent a photo of a duck memorial surrounded by flowers and a framed portrait.

“Okay.”

That was the last I heard from “Sara.”

The Serious Bit

This was funny, but the underlying crime isn’t. Sara’s phone was cloned because she handed it to a repair shop without wiping her data first. The scammer got access to her Messenger, her contacts, and enough personal context to impersonate her convincingly.

If you’re getting your phone repaired:

• Back up and factory reset before handing it over
• Change your passwords after getting it back, especially email and social media
• Enable two-factor authentication on everything — it won’t stop a cloned phone, but it limits the damage

And if an old friend suddenly messages you about a lottery win, maybe ask them something only they’d know before you engage. Or, if you have the time, ask them about Hawaii.