Swedish Phishing

“PLEASE leave me ALONE!” Angry, frustrated, and fearful, Melissa frantically typed the email message and hit the Send button.

How much more could she take? The harassing emails from a man she had met only once had continued for 11 long years, and still there seemed to be no end in sight. When it started she was in high school; now she was married and pregnant with her second child. Given the most recent messages, she decided that her cyberstalker wasn’t just a harmless nut. He was going to do something crazy.

It all began in 1999, when Melissa’s sister, Veronica, went out on a date with Martin Amsteus, a Swedish citizen who was visiting the U.S. The two dined at the restaurant where Melissa was working as a waitress at the time, and for reasons she cannot fathom to this day, Amsteus left the restaurant convinced that one of the sisters had fallen in love with him. From his home in Sweden, he began sending strange, unwanted email messages to Melissa. She cancelled her email account and signed up with a new service, but he soon tracked her down and resumed writing her.

At times, there would be a lull in Amsteus’s email campaign, and Melissa would breathe a sigh of relief. But he would always reappear. On Valentine’s Day 2008, her sister-in-law Rikki received flowers at her home in North Carolina. Although Rikki first assumed they were from her husband, Marcus, the card was from a man she’d never met—Amsteus. In it, he begged her to send him contact information for Melissa and Veronica.

Rikki ignored Amsteus, but he had discovered her email address and began writing her. Not wanting to alarm her husband or his sisters, Rikki kept Amsteus’s communications secret at first, but as the messages grew increasingly acrimonious, she confided to Marcus about the situation. He emailed Amsteus, asking him to leave his wife alone, at which point the sulking Swede began directing his tirades at Marcus.

“He apparently had chatted with my sisters online over 10 years previously,” Marcus said. “At this time they must have been 17 or 18 years old. I knew nothing of it, but I’m sure they just decided to grow up like everyone else and cut off their ties to online chatting. Either that or this guy started really freaking them out so they banished him.”

For 2 weeks, Marcus emailed Amsteus telling him he would not provide any information about his sisters. But Amsteus was desperate and determined to find out why Melissa and Veronica had stopped replying to his messages. He’d called Melissa at one point, Marcus learned, but she’d told him there was nothing between them and that he should stop contacting her.

“Mind you, this was over 10 years ago, and apparently my sisters were still avoiding him,” Marcus said. “He kept wanting me to give him my dad’s email address ‘because he can solve this.’ I refused and told him nothing good could come of this. He was threatening to come over here, and I honestly was not sure if he was the most sane person.”

By May 2008, Amsteus was sending more than a dozen emails a day to Marcus at his office at a North Carolina college. The messages were often shrill diatribes such as this one:

And Marcus, what about that they would tell you who Veronica called that night, because you are Veronica’s brother and she would tell you—how come I still don’t KNOW, what kind if a sick game are you playing, why do you allow it to ruin somebody’s life.

If you do not answer/give me David’s [the father’s] email address, I will write others at your school explaining this in detail and asking them to ask you. I have no other choice. I have to solve this. Believe me, I am not trying to be mean. How long have I waited to get this solved … how much time of my life have I lost, what are the alternatives, what options do I have, this will just continue otherwise. I don’t know what happened, I don’t know who I talked to. Melissa refuses to answer even what clearly pertains to her. I rest my case. Your choice, give me Davids email address, please, or have other people around you sent a detailed explaination of this and the request to ask you to give it to me.

At other times, the emails arrived with only subject lines and no text in the body:

Subject: I want to solve what happened that is All, is that strange or hard?

Subject: You choose how long this will go on. It is THAT simple.

Subject: If it bothers you that I write, I will go over there, will write physical letters, WHY not give me …

That same month, Marcus sought help from WHOA, the online safety organization. WHOA sent official complaints to Amsteus’s ISP as well as to Yahoo! and Hotmail, where he had email accounts. Yahoo! quickly responded, saying that it had “taken appropriate action against the Yahoo! accounts in question, as per our Terms of Service (TOS),” but it would not disclose “the action taken on another user’s account with a third party.”

Hotmail followed suit, but there was no response from Telia, Amsteus’s ISP in Sweden. For several weeks the emails stopped, but it would not be for long.

On May 27, Rikki received a series of rambling messages from Amsteus, which she refused to answer. Telia had notified him about WHOA’s complaint, and he complained to Melissa:

Look, this is most likely going to court now anyway, because Rikki sent a complain to that organization who contacted Telia who is my internet provider, and she obviously claimed that I was threatening her. This information Telia relayed to me, which means that I report them to datainspektionen, since they cannot, according to Swedish law keep that kind of information on me. Telia sent me a letter about this, and I have asked them to send me a copy on all information they have and letting then know that all of it goes to datainspektionen. Also, to claim that I threathened anybody is slander, which is a crime. All this will go, together with a description of this from the beginning to the end to that organisation too, I can’t remember the name of it. Get it? So I am going straight to Church street to hand this over in writing and then we can meet in court. I cannot be the only one trying. If you don’t want me to even try I wont, which means I will hand this over everything, from the beginning, in writing to David instead, and then you may as well give me his [David’s] email address.”

When Marcus learned that Amsteus was continuing to email Melissa, he asked her to forward everything to WHOA. He was growing more and more concerned about the bizarre messages the Swede was sending family members, including this one to Melissa:

To say that I threathened her is low. I want to know how you think or feel about this, if you feel the same? Because then we are not at square 0 we are at square -1. Remember how I explained how you saing you hate me etc., made it worse to me in that it becomes more important to me to solve. That is what saying I threathened does. I have zero respect for that woman now, zero. Haven’t I tried to confide and explain everything about this to you

Please let me know what you think. Can we please meet somewhere, just to meet up, it would be a huge step in solving this and in me getting over it, honestly Melissa, you know that, so can we? (please) Or should I go and try to talk to Veronica first?

WHOA filed more complaints with Yahoo! and Telia. Yahoo! again quickly took action by canceling the accounts. On July 11, WHOA officials received a long-winded comment from Amsteus:

With regard to your message to Telia, who is my internet provider, where you claim that I harass these people: This issue is now under criminal investigation. I am currently looking into the US laws on organizatons, such as yours, handling private email; over here, in Sweden, it is completely restricted by law, thus the investigation. I will also, in short, send you a full description of what this whole case is about, which includes multiple fraud. I will further provide you with evidence how this Markus says he could ask other people involved on a critical issue that would be step to completely solve this, because he is their brother, and they would listen to him, waving a carrot - but did not - when I it would take him 10 seconds and I have spent 10 years. My full description will make it obvious how your message to Telia is slander, which at least in this country is criminal.

Overall: You can try to solve something with sombody, if that person refuses to listen, you can either take it to court or ask somebody nearby, to avoid taking it to court and create hassle.

Officials at WHOA were concerned that Telia had breached the confidentiality of its complaint and they sent an email advising the ISP that “cyberstalking, according to the U.S. Department of Justice is ‘the use of the internet, email, or other electronic communications devices to stalk another person. Stalking generally involves harassing or threatening behavior that an individual engages in repeatedly.’”

Telia responded, defending its actions: “We do not give away names of private persons in cases that we investigate. Every user has the right to know what caused the warning that was sent to him. This case has reached an unpleasant level, that is true, but we find it hard to believe that any authority in Sweden will take his complaints seriously.”

WHOA instructed Marcus and Melissa to file reports about Amsteus with their local police departments. But Amsteus wasn’t finished yet. On July 12, he sent another rambling message to WHOA, which read, in part:

Below you will find a short description. Look, this started 10 years ago. And I asked for it to be solved from day one. …

I was an exchange student (the only one on campus, I think) at this small town college and this girl started talking to me over the school network, not like MSN, similar to MSN, but you saw the other one writing on real time letter by letter in real time. Now, this girl (V) is in her last year in high school, so she is using her older sister’s email account at the college to access the system. You spend hours writing on this thing, so we talked and talked, talked on the phone, she asked me to go to a football game with her; we went to a restaurant where she and her sister worked.

At the restaurant I meet her sister (M), the one owning the college email / chat access account; it turned out to be the one I had had a serious crush since before I started talking to V: The kind of thing where you hold eye contact a bit longer than necessary. Anyway I spend more time talking to V, and she tells me very personal things about her past … that makes me really protective of her.

We talk every night over this chat. I started to like her a lot. Then she started to say things like this has to end, I can’t do this anymore for people get hurt around me and I worried my ass it and over her. I told her, the only way you can hurt me is by leaving me alone..I said so truthfully. I wrote her very very private and personal emails. … I don’t know … part of me were maybe suspecting I was talking to more then one person by then. … During this time I sent her some very emotional, private email. Then the same person who had said what do you not know about her was able to quote some of the very personal things I had written her. And it seems these emails where forwarded around campus.

I have no choice but to ask them, try, beg and plead. So what do they do, they say they hate me, that what I say doesn’t count, I don’t matter, I am psycho, I need professional help, shout that I should leave them alone, I should grow up, they complain that I won’t leave them alone, but they refuse to tell me who she called or to solve this.

I have explained how much misery this creates me, how it tears me and my life apart, they know this. I have lost ten years of my life because of this; their argument is that because this much time has passed and I am not over it I am the one who is weird and therefore it should not be solved (!!) … I will loose everything I have over this, my job, everything. For what, why? It didn’t happen yesterday, I have pointed out a billion time … not telling me what happened means that, to me, it is still going on.

Amsteus followed this with an even longer message, and WHOA filed additional complaints. When it appeared Telia had canceled Amsteus’s account, he moved to an internet café in Sweden and resumed sending email to Melissa, as well as filling out comment forms on the WHOA website. WHOA continued to send complaints to Hotmail, Yahoo!, and the internet café.

On July 22, Amsteus sent Melissa another message, which in part said, “What do you need, do I have to sit outside your house and weep? What is it that is not understood?”

The following day, Melissa’s nightmare came true: Amsteus appeared on her doorstep.

“He rang the doorbell … my dog barked like crazy. When I went to see who it was … I had no clue, so I just asked, ‘May I help you?’” Melissa recalled. “Then he said he was looking for Veronica. I could tell from his accent that it was Martin. I simply told him Veronica didn’t live here. Then he asked if her address was 702a or 702b. I repeated, ‘She doesn’t live here.’” To Melissa’s great relief, he got into a car and drove off.

Melissa immediately called her husband, Brian, who was on his way home, to tell him that Amsteus had just left and was probably headed to her sister’s home. Then she called Veronica to let her know what was happening. Armed with a description of the vehicle, Brian caught up with Amsteus and began to tail him. Amsteus passed Veronica’s house and then turned around, apparently aware he was being followed. Brian pulled into Veronica’s driveway, went into the house where his sister-in-law was sitting with her two children, and called the police.

When Amsteus knocked at the door, Veronica ignored him until the police arrived, then opened the door and told him to leave. He didn’t budge until the police ordered him to go.

“You didn’t have to call the police,” Amsteus said to Veronica. “Nobody ever told me to leave you alone or that you didn’t want to talk to me.”

The police waited until Amsteus had left the neighborhood in his rental car and then put out an all-points bulletin to make sure he didn’t return.

The next day, Amsteus emailed Melissa to explain his actions. She forwarded the long, drawn-out message to the police. Veronica’s fiancé, Justin, sent Amsteus a reply:

I am Veronica’s fiancé. Veronica and her kids are MY FAMILY. You going to my girlfriend’s house was not a good idea. Veronica doesn’t want to have anything to do with you. She doesn’t like you, love you, or want to be associated with you. You have upset the balance of her house and family by showing up and scaring the children. Not to mention showing up at her sister’s house and scaring her.

Leave her alone. Leave her family alone. If anybody in the neighborhood sees you they will call the police. There is a retired state trooper living beside Veronica and a Detective that lives across the street from her and me. I am also in law enforcement. If you continue to email, harass, or show up where Veronica is or the places she is at, then legal action will be taken. I am asking you again, man to man, adult to adult, have no further contact with Veronica or her family. I don’t know what you think you had with Veronica. Veronica states that she was 16 when she met you and that there was never anything there. Some people in law enforcement would view this behavior from you as obsessive. I hope you read this carefully and move on.

Amsteus said he was willing to meet Justin to talk about it man to man, but Justin refused to respond. So Amsteus emailed Melissa instead and threatened to send letters to everyone in her neighborhood as well as Veronica’s to tell them all about the situation.

By July 29, the police had launched an official investigation and found that Amsteus had flown from Sweden to Atlanta, rented a car, and then driven to North Carolina. They were keeping an eye on his hotel. The same day, Melissa’s father received a 14-page letter via certified mail from Amsteus, which he passed on to the police. The police advised Veronica to move out of her house until Amsteus returned to Sweden. She and her children went to stay with her parents while the investigation continued.

In August 2008, Amsteus returned to Sweden, and within a month, he started to email Melissa again. Melissa refused to respond and reported the messages to the police. In what had become a predictable routine by now, every time Yahoo! and Hotmail closed one of Amsteus’s email accounts, he would open a new one and continue writing Melissa.

Since early 2009, Melissa has had a new email account and only gives the address to people she knows and trusts. This has seemed to work. Until fairly recently, she was receiving the occasional Facebook message from Amsteus, which she would quickly delete, blocking him from further contact.

To the best of WHOA’s knowledge, Amsteus has made no further trips to the U.S., and his emails to Melissa and her family have ceased.

One can only hope that he is out of their lives for good.