For Harriet Thomas, the promise of a place at the Abergavenny Food Festival had come to feel like the kind of dream you learn to hold loosely. She had applied before, watched the applications go in, and never quite made the cut. Her knitting workshops, built around patience and warmth and the quiet satisfaction of making something with your own hands, had found an audience online and in small local venues. But the idea of setting up at one of Wales’ most beloved food festivals felt different. It meant visibility, legitimacy, a chance to stand among hundreds of makers and producers, to press her business card into the open palms of strangers and see the moment when they understood what she did. It was the kind of event that made her feel like a real participant in the local food scene, not just someone selling from a laptop. So when the email finally arrived, offering her the opportunity to book a place, Harriet allowed herself to feel something close to pure joy. She was “really excited” and let that feeling carry her through the process. In retrospect, she would wonder whether that very excitement was the thing that made her vulnerable. The email came from an address she recognized, or thought she recognized. It was written in the kind of convincing language that busy people receive every day. There were terms she had seen in previous correspondence, details about the festival that felt familiar, and a tone that seemed to have been written by someone who knew exactly how to talk to artisan traders. It was only later, after the confusion and the anger and the quiet shame had settled, that she would say, simply, “nothing sparked a red flag.” And she had to wonder: if a red flag didn’t spark, if every signal looked green, what more could she have done?
Harriet spent much of her working life on a computer. Running a small business from home meant answering emails, updating listings, managing accounts, and communicating with customers across time zones. She had seen her share of fraud: the fake PayPal messages, the phishing attempts hiding behind delivery notifications, the hand-picked spelling errors that gave impostors away. She had developed an almost instinctive radar for the tell-tale signs, and she was proud of it. She knew the difference between a suspicious URL and a safe one, and she double-checked payment pages before entering details. That was why, she later explained, she found it so unsettling that this particular email escaped her notice entirely. It “looked completely genuine” from the moment it appeared in her inbox. The sender’s address seemed consistent with what she had seen before. The structure was right. The tone was right. And when she clicked through to fill in a Jotform, the same kind of form she used in her own work almost daily, everything maintained that flawless illusion. The fonts matched. The branding matched. The wording was comfortable and professional, the kind of corporate polish that signalled a well-organized event, not a criminal enterprise. She filled in the form without hesitation, feeling the satisfying rhythm of a process moving smoothly. It was only after she hit submit that she began to feel something stir in the back of her mind, a minor thought that maybe she should check again. But there was nothing to check. The page looked real. The email had been followed by a chain of messages that showed genuine knowledge of the Abergavenny festival site, its facilities, the layout of the stalls, even helpful details about parking and access. She thought to herself, this is how a legitimate festival operates: carefully, thoroughly, generously. She did not know yet that someone had done their homework, that the fraudsters had studied the event and its traders closely enough to imitate its voice perfectly, and that she was not the first to be taken in.
What finally made her trust the scam completely was the personalization. The emails used her name. They answered her questions. They referred to details she had mentioned in her application, and to features of the Abergavenny event that someone would only know if they had actually walked the grounds or researched them carefully. It felt like corresponding with a real team, the kind of people who wear lanyards and stand behind registration tables with clipboards. Harriet allowed herself to picture the day itself: her stand with its colorful wool, the smell of bread and cheese drifting across the field, the murmur of happy crowds, the hands of strangers pausing over her handmade samples. She paid for her pitch. The amount seemed reasonable. The instructions were clear. There was a confirmation number, a receipt, an automated reply. It was only afterward, when she posted on Facebook to share the news with friends and customers, that the fragile architecture of her excitement collapsed. A social media post from the real festival organizers appeared, warning traders about scam emails circulating in their name. Her heart sank. She read the post three times, waiting for the words to rearrange themselves into something less terrible. They didn’t. “My heart just sank. I was so embarrassed,” she said. The embarrassment was, perhaps, harder to carry than the financial loss. She was not a careless person. She was the one who warned her friends about online fraud, who rolled her eyes at clumsy phishing attempts, who had built a business on reliability. Yet here she was, part of the cautionary tale instead of the person giving the warning. Her first instinct was to disappear, to delete the post and say nothing. But the warning from the festival gave her another idea: she could transform her mistake into something useful. She decided to speak openly about what had happened, to publicise her experience and urge other traders to be cautious, even when the world feels safe.
The responses to her warning were a mixture of sympathy and shock. Some people thanked her for sharing, saying they had almost fallen for the same trick. Others asked a question that she had been turning over herself: how could anyone be expected to spot this kind of fraud? It did not arrive in an email that looked like a foreign prince needing help. It arrived in the ordinary visual language of modern working life: an email address, a form, a chain of replies, a payment request. There was no single glaring defect. There was no reason to doubt. And that, she realized, was the problem. The scammers had built their trap not out of carelessness but out of careful observation. They knew that getting a stall at events like Abergavenny was fiercely competitive, and that traders, after months of uncertainty and hard work, are often desperate to secure a place. They knew that the rush to submit an application could override the caution that comes more easily in a calm moment. Harriet understood this deeply because she felt it. Every year it became a little harder to get noticed, a little harder to win one of those precious spaces, and the pressure made people act quickly. “It’s getting more and more competitive to try and get a stall at these events,” she said. “So people are more likely to fill a form in quickly thinking, I really, really want to make sure I secure my space.” In that state, your mind does not linger over suspicious details. The mind is already picturing the stall, the display, the customers. It hurries past them, telling you not to waste time, not to lose this chance. Scammers do not need to trick everyone. They only need to find the people who are already leaning forward, already dreaming. Harriet had been leaning forward for years. The scam was not aimed at foolish people. It was aimed at passionate, hopeful, hardworking traders who just wanted a seat at the table.
When Harriet reported the scam, she did not have high expectations. She knew how the story usually ended: a dead-end email address, a fraudulent payment trail, a shrug from the bank, and the empty promise of an investigation that would never arrive. Still, she went through the motions. She told the festival organizers. She shared the details with the relevant authorities. She did it because silence felt like an accomplice, and because she had no other way to fight back. But the experience left her with an uncomfortable question that would not go away. If a fraud of this sophistication could slip past someone like her, someone who was already skeptical and informed, then what hope was there for those who were less prepared? The emotional toll was greater than she expected. The embarrassment followed her around for days, surfacing in quiet moments when she was alone at her desk. She replayed the emails in her mind, looking for signs she should have noticed, as if the fault lay in some failure of concentration rather than in the cleverness of the scam. It took a while for her to accept that she was not stupid, not careless, not naive. She was simply human. And being human in an online world means having to make split-second judgments about things that can’t be touched or held. And being human means trusting a message that looks real, when every instinct suggests there is no reason to question it. There is no patch for that vulnerability. There is no software that can protect your heart from the moment you realize that a thing you wanted badly has been used as bait. What the scammers did was not just steal money. They stole her confidence. They stole the uncomplicated joy of applying for a stall. They stole the ability to read an email without wondering whether the sender was real. That kind of theft is harder to report and harder to calculate, and she knew she would carry it for a long time.
And yet, Harriet did not want the story to end with bitterness. The moment she shared her experience publicly, she discovered that she was not alone. Other traders reached out with similar stories, not to shame her but to thank her. The festival organizers, in the midst of dealing with the fallout, were supportive and appreciative of her transparency. Her friends and customers rallied around her with kindness. Posting the warning had been difficult; refusing to go silent had been harder than paying the scammer. But it gave her an unexpected gift: the knowledge that her mistake might prevent someone else from making the same one. She also came to understand that the fraud was not a reflection of her worth or her judgment. It was a reflection of a world in which authenticity is increasingly hard to prove, in which the tools that allow small businesses to thrive online can be turned against them in seconds. She began to think about the future. Would she apply again to Abergavenny? Perhaps. She loved the festival, loved the community, loved the thought of watching her workshops introduce people to the textured rituals of knitting. But she would change the way she approached every application. She would slow down. She would verify addresses by phone, or through official websites, or by reaching out to organizers through channels she already trusted. She would remember that a legitimate opportunity will still be there tomorrow, while a scam relies on you believing it will disappear if you hesitate. “I really want to make sure I secure my space,” she had thought, and that desire had made her vulnerable. But desire is also what built her business, what sustained her through the quiet online months, what made her want to stand in front of strangers and teach them something made of wool and patience. She would not let the scammers take that away from her too. She would keep applying, keep dreaming, keep making. She would just be a little wiser now, carrying the scar of the experience like a small knot in a long strand of yarn—still part of the weave, still strong enough to hold, but never forgotten.