Warrant for Your Arrest phone scams

Yesterday the scammers tried to hit the wrong victim! Neera Desai works for us at Malcovery Security as a Threat Intelligence Analyst on the malware team. She had received a voicemail on her phone while she was in one of her UAB Computer Science classes and knew that this could be a clue towards something big. She played it for me, and we provided a copy to law enforcement.

The recording is available here as a m4a file (QuickTime will play it):

SheriffScam.m4a

Here's a transcript:

This message is for (student name). Hi this is officer Steven Jones and I'm calling you from Jefferson County. The reason of my call is to inform you that we have received a legal complaint against you on ??? identity. So if you want to be on the safer side and not get arrested contact on 646 759 4934 I repeat (646) 759-4934. If you disregard this message you alone are responsible for the legal actions that are taken against you. Thank you and have a great day!

Later the same day HER ROOMMATE had the same scam against her, only she happened to be at a place where she could answer the phone! Her call was from "Officer Austin Reed" instead of "Officer Steven Jones".

When we started digging into this scam we realized that this is an EXTREMELY POPULAR scam! We shared the information with the North Alabama Identity Theft Task Force, the Internet Crime & Complaint Center (IC3.gov) and the National Cyber Forensics Training Alliance (NCFTA) and have learned quite a bit more about the scope and range of this attack.

The Scam Structure

There are three parts to the "signature" of this attack:

1. The victim receives a telephone call with a spoofed callerid to make it appear to be from either the IRS (they often spoof the "1040 hotline"), a law enforcement agency geographically proximal to the potential victim's location, or 911, the emergency contact number used in the United States.
2. The victim will be told that they have committed a crime, which may include running a red light and being caught by a traffic camera, failing to appear for Jury Duty, failing to pay your taxes or failing to pay them on time, or, if an international person, having a problem with immigration paperwork.
3. The victim will be instructed to send a payment immediately, with amounts ranging from $500 to $2,500, and threatened with immediate arrest if they fail to comply.

Recent Alabama Phone Scams

There does seem to be "locality waves" to this attack, where certain geographies will be heavily targeted, and then the attack will move on to another locality. As an example, in my area, dialing code (205), central Alabama, we have had several organizations do warnings about this type of attack, including:

• November 5, Fox 6 WBRC has Birmingham, AL Police Lieutenant Sean Edwards explain that several citizens have called saying they had received these calls spoofing the telephone number of the Birmingham PD (205) 254-1700. See Birmingham Police issues warning to citizens about possible spoofing.
• October 22, 2014, Birmingham News website AL.com quotes the Shelby County Sheriff's Office as having several complaints about this scam imitating their office. The Alabaster, AL Police Department also reported that they have been receiving calls from victims of this scam in the same article. See Scam Alert: 2 Shelby County law enforcement agencies warning of bogus calls.
• September 24, Birmingham Police Commander Terry Kiernan warns of phone scammers imitating the IRS. His department received 20 complaints in the past few days. (See: Local residents complain of new IRS phone scam
• September 22, Hoover, AL Police Department warn of a "Warrant For Your Arrest Scam" on their Facebook page.

Other parts of the country have also experienced this scam, including:

• November 6, Iowa State University and the Ames Police Department are receiving scam reports including calls claiming to be university and utility company officials.
• November 6, West Virginia's WCHS and WVAH report Putnam County Sheriff reports a Jury Duty Scam version, where the victim is accused of not showing up for Jury Duty and told to pay $4,500
• October 28, Jury duty scam targets Rockwall County - "My name is Lt. Gary Phillips, I'm with the Rockwall County Sheriff's Department. I need you to call me back at 972-841-5687
• October 22, Pittsburgh PD tells WPXI.com about "Warrant out for your arrest, send money" call scam
• October 22, Kenton County and Hamilton County, Kentucky tell WLWT5 News that a fake "Deputy Morgan" asks for money to keep you out of jail
• October 10, Houston FBI warns of Jury Duty Scam
• September 5, Lee County, Florida Sheriff's Office tells NBC 2Jury duty scam resurfacing locally
• September 3, Parker County Sheriff warns of jury duty scams - Sheriff Larry Fowler says the caller asks for credit card information to pay the fine.
• August 23, Bastrop Police Department warns of calls stating a warrant is out for your arrest.
• April 25, Elizabethtown Police Department, (See Arrest Warrant Scam has come to Elizabethtown
• April 14, 2014 - IRS Reiterates Warning of Pervasive Telephone Scam

What to Do?

There are TENS OF THOUSANDS of scam victims of this type all over the country. But without your clues, law enforcement doesn't know if this is one large organized crime group, ten groups, twenty groups, or a thousand individual con men acting alone. It is EXTREMELY IMPORTANT that you add your clues to the investigation.

• The Best Place to report any type of online scam is the FBI's Internet Crime & Complaint Center. To go directly to their complaint page, use this link:

  https://complaint.ic3.gov.

  Although the form has many questions that you may not be able to answer, complete the form to the best of your ability with the information you DO know. Specifically make sure to note things such as:

  • What name did the person use?
  • Did they call you by name?
  • What agency, department, or company did they claim to be with?
  • What did they accuse you of?
  • How much money did they want you to pay?
  • What number shows up in your callerid?
  • Did they give you any other numbers to call or websites to visit?

  Even if you do not have ALL of this information, any information you share can help link cases together. If someone calling Houston and someone calling Birmingham both told you to call the same phone number, that is a "link". If they used the same Officer Name, that is another "link". The more individual cases we can link together, the better chance we have of catching the criminals!

• IF YOU HAVE THE IRS VERSION of the case, be sure to report the crime to the investigators at the Department of Treasury who have set up a special website for gathering information about this scam:

  http://www.treasury.gov/tigta/contact_report_scam.shtml

• IF YOU HAVE LOST MONEY in your case, be sure to ALSO report this as a crime to your local Police Department!

Be sure to share a comment below to tell the other readers here about your experience as well!