We are all used to the usual scam calls, an offshore agent trying to convince you that you are due a refund, suggesting that your PC has malware and they can magically get rid of it by taking your card details or that you are going to be arrested if you do not pay some settlement fee, the kind of calls Kitboga entertains. But recently I have had several phone calls which change the threat landscape with a fingerprint of a more elaborate scam.
Call 1 – Metropolitan Police Ploy
The first call I received which did not have the usual hallmarks of a scam call, it was from a spoofed telephone number for a London Police Station with a gentleman reporting to be from the Metropolitan Police. Multicultural London English accent, in my opinion a British black male, distinctive but not out of character for such a phone call, could feasibly be a Metropolitan Police officer. Introduced in formal manner explaining he was from the cyber crime unit and was investigating a case and asked if he was speaking to me using my name. I confirmed and he continued to explain that they had arrested an individual at Heathrow airport who was found with many cloned passports and identity documents on their person including identity documents relating to myself and that they needed my help with the investigation. I was skeptical about this as its feasibility was low in my mind, I hadn’t had any identity documents stolen or lost and I have a reasonably good operational security mindset.
I politely declined to help until I had verified this was a genuine police enquiry to which he reassured me and gave me a CRIME reference number, a standard number for tracking police enquiries in the UK. He then continued to press me to which I refused and explained I needed to verify the CRIME reference number via a known police contact number and if it is indeed a real investigation I will cooperate accordingly. After this the caller remained calm and told me to do my diligence and that they’d be back in contact and hung up. Until this point whilst I was mostly confident it was a scam call, however the professional, no pressure nature did make me want to follow up and check this was indeed the case.
I checked with the police and found that while the CRIME reference number was valid, it belonged to an issue totally unrelated to the circumstances described and they advised me the call was not an official police communication and it was a scam. They also took details about the call but concluded it was unlikely they could investigate further due to the spoofed nature of the telephone number. I suspect many recipients of the phone call with the reference number, reassurances and professional nature of the caller may have been convinced that this was in fact a real call.
Call 2 – Phantom Wallet Support
The second call came several weeks later, again, not the usual scam call, well spoken British male, sounded quite young, maybe 18 to 24, home counties accent. Was posing as a support desk worker from Phantom Wallet (a popular crypto wallet), again knew my name and said he was calling with regards to my support ticket. I explained that I had not opened a support ticket and he continued to detail that they had received a support ticket asking to “reset my seed phrase”. At this point I told him straight up that I thought it was a scam call and explained that “a seed phrase generates the private keys and cannot simply be reset by a support agent.”. In hindsight this probably gave him too much information but it seemed like a nice opportunity to make him know I am technically aware. I also asked him if he could give me the last 4 characters of my wallet’s public key as I was curious if he had linked me to any of my crypto wallets in anyway, he was unable to, which is a relief. I thought this would be enough to throw him but he continued with the script and said “your information is at risk, did you receive a phone call recently from the police regarding identity theft?” linking the call to the previous attempt. After this I told him again that I believe that call is a scam, and that I do not believe he is related to the Phantom wallet project and asked him to verify who he was, he then hung up abruptly.
Observations
On both calls I probably spoke too much, I didn’t give anything away other than what they already knew but I have an odd tendency to go along with scam calls sometimes, part of me believes if I am distracting the scammers they cannot be scamming a less wise victim.
Both of the calls struck me as quite interesting:
a) Not the usual low quality scam calls we are used to – could quite easily convince somebody without their wits about them to volunteer information or potentially get exploited as a victim. I can imagine my mother for example being more than enthusiastic to help the police particularly if the caller seemed legitimate with a spoofed number and local accent.
b) Abuses a position of authority or high stakes to encourage co-operation of the victim, e.g. talking to the police or having their crypto at risk.
c) I felt the scammers had more information about me than the usual cold callers. Did they know I had crypto holdings? Was this a broad cold call, or a targeted campaign based on OSINT from a data breach?
d) Unlike normal scams, which aim to be completed in one call, this scam is clearly multipart to try and build confidence / concern in the victim as both calls were clearly linked. In the first call the scammer didn’t up the stakes when I questioned their validity, but instead remained professional calm and allowed me to walk away. Clearly a much more long term strategy.
e) Possibly a shift from high volume low reward scam method to lower volume higher reward model.
Protection Mechanisms
You can easily protect yourself from such calls by adopting a Zero Trust policy when handling calls.
- Do not trust the caller ID – it could be spoofed
- Do not trust the claims of the caller
- Do not be fooled by familiar accent or professionalism
- Do not trust the caller with any details beyond those that they volunteer to you
- Do not verify either negatively or positively information the caller attempts to ask you about
Remember a legitimate caller claiming to be your bank, the police or other such institution will always be happy for you to hang up and call back on a known number, e.g. the customer service number on the back of your credit card.
Closing Thoughts
The shift from high volume spam to patient, multi-stage social engineering marks a dangerous turn in phone-based fraud. When scammers trade aggressive scripts for calm professionalism and spoofed local authority traditional red flags disappear. Stay vigilant, assume every unverified incoming caller is untrusted, and never let professional tone or familiarity substitute for actual verification.