It was an ordinary Wednesday afternoon when I received an email from the CEO of Seattle magazine ordering me to buy gift cards for employee appreciation week. Without much hesitation, and with the assumption that it was a reasonable task for an intern, I complied with his request.

Within the hour, I found myself at QFC, the gift card aisle looming over me. The sinking feeling in my stomach grew as I received a string of text messages instructing me to buy $600 worth of Apple gift cards. On a whim, I did what most broke college students would, and called my mom. To her, it seemed obvious that I was a victim of a phishing scam.

I’m not alone. Forbes Advisor says more than 500 million phishing attacks were reported in 2022, and more than 300,000 victims lost more than $52 million. In Washington state, there were 5.29 victims for every 100,000 residents, the eighth-highest rate in the United States.

“With increasingly sophisticated phishing scams, cybercriminals are luring unsuspecting people into handing over their personal information,” according to Forbes Advisor. “These scams were once largely centered around email, but attacks are also becoming commonplace via text and phone as scammers spoof phone numbers to appear legitimate.”

In my case, I still can’t believe I came so close to losing $600. Even my friends assured me this was legitimate, especially because I am an intern. Let my experience serve as a stark reminder of how easily one can be deceived by these sophisticated cyber attacks. If something seems too good to be true, it probably is.

It’s a lesson I almost learned the hard way.