Computers and smartphones are an integral part of everyday life. Unfortunately, criminals are always coming up with new ways to profit, so officers must understand the various types of cyber crimes likely to be reported.
Cyber crimes are defined as the use of a computer or other electronic device, including telecommunications equipment, to steal or access something of value. These crimes may also involve extortion, fraud, child abuse, computer data destruction or distribution of illegal materials. To help officers identify and combat this type of illegal activity, we'll outline different cyber crimes and how to handle them.
Identity Theft
Identity theft is the stealing of another person's identifying information, such as their name, date of birth or Social Security number. The criminal can open new bank accounts, acquire a duplicate Social Security card and apply for and receive credit cards in the victim's name. Victims can amass a mountain of debt from the imposter before they ever learn of the fraud. In some cases, a criminal can obtain the victim's bank account information and clean out their accounts.
One criminal activity that enables identity theft is a corporate data breach. This happens when sophisticated hackers breach a company's network's security and access customers' identifying information. Some of these hacks have been massive. In 2017, one credit bureau was hacked, exposing the personal information of 145 million people. In 2020, four members of China's military were charged for corporate data breaches — a reminder that perpetrators can be domestic and international.
Common Schemes
The following are the most common types of cyber crime committed through outright fraud. These frauds are mainly perpetrated using targets' telephones and email addresses. Senior citizens are particularly vulnerable to these kinds of crimes.
Advance Fee
In an advance fee scheme, the criminal tells the victim that they have qualified for a large financial loan or have won a large monetary award, but must first pay an advance for taxes or fees to access the money. The victim pays the advance fee, but never receives the promised money.
The most famous advance fee scam is that of the "Nigerian prince," who purportedly has millions of dollars in a Western Union account, but needs help to transfer the money. The victim is asked to send money or provide a bank account number to pay the transfer fee. Believe it or not, this old con first started after the French Revolution over two hundred years ago. Back then, the scam involved sending letters that sought money to help a wrongfully imprisoned Spanish prince.
The modern Nigerian prince scam started in the 1980s, first by snail mail and then by telephone and email. It is now the punch line of many jokes, but the "prince" is not unhappy — in 2018, the Nigerian prince scam still took in over $700,000.
Fake Tech Support
In this scheme, scammers misrepresent themself as tech support workers for well-known companies. They offer to fix non-existent problems they have "identified," and clean the victim's computer of viruses and malware. They attempt to gain the victim's compliance and acquire remote access to their computer. They usually convince the victim to install a "special anti-virus program" on their computer. The scam's goal is to convince the victim to pay for the false services, and to gain access to any online bank accounts to steal their money. If the victim downloads the program, it allows the scammer full access to all the computer's files, passwords and accounts.
Lottery/Sweepstakes
In a lottery or sweepstakes scam, victims are contacted and told they've won a lottery or sweepstakes they don't remember entering, or that they're set to receive money from an inheritance of an unknown relative. In either case, the victim is asked to pay a tax or transfer fee to the scammer to receive their money.
Charity
Con artists set up fake charities, often after natural disasters, and profit from their victims' belief that they are donating to help a worthy cause. People are quick to offer financial support for victims of national and international tragedies, so it's easy for scammers to take advantage even of tech-savvy individuals with the use of a fake charity.
Confidence/Romance Fraud
In this case, a scammer, usually using an alias and fake pictures, tricks their victim into entering a relationship with them online. Sometimes, this relationship can last for weeks or months, taking advantage of the victim's feelings. If the fake bond between criminal and victim is strong enough, the victim can be misled into sending money to the criminal.
One variation of this con is the grandparent fraud. In this con, a grandparent gets a call or email from a person claiming to be their grandchild. They say they are in serious trouble, and that they need money. Sometimes they ask for bail money to be wired, or gift cards to be sent. In order to cover their tracks, the scammer may even feign embarrassment and ask that "their parents" not be contacted.
Scammers often select their victims from obituaries that list surviving spouses and family members. A quick call to the funeral home about a home flower delivery can identify the target's home address and phone number. Other information can be gathered from various social media and public records sites. Between 2015 and 2020, over 91,000 cases of this kind of scam were reported.
Government Impersonation
Sometimes, criminals contact victims impersonating a government official. They are usually posing as someone in authority, such as an IRS investigator or a law enforcement officer. In either case, the con artist demands money and usually threatens to arrest the victim or to freeze all their bank accounts. The criminal then demands either a money order or gift cards to be mailed immediately. While it seems rather obvious that no government agency would require an immediate payment or accept gift cards, in 2019, nearly 14,000 victims reported paying 124 million dollars to these scammers.
Extortion
Cyber extortion involves using electronic means to extract money or property through intimidation or a fraudulent exercise of authority. It often includes threats of physical violence, threats of criminal prosecution or public exposure of embarrassing or compromising activities. There are two common types of extortion: scareware and ransomware.
Scareware
Scareware is a type of malware introduced into a victim's computer when they open a spam email or click on a pop-up window. The purpose of scareware is to convince the victim that their computer was attacked by a virus, and they need to pay money to install a special anti-virus program to remedy the situation. Scareware has three goals: to receive payment for fixing the problem, to get the victim's credit card information during the payment process and to make the victim download a bogus repair program.
The fake repair program is very problematic; it allows the scammer access to all the computer's files and passwords so they can cause further damage. Scareware windows can be difficult to close, but a simple restart of the computer usually makes them go away.
Ransomware
Ransomware is malicious software designed to block access to a computer system until the victim pays a ransom. Advanced criminal networks have taken over entire hospital records systems, locking them through encryption and threatening to delete them permanently unless a significant ransom is paid. Hospitals are a prime target for a couple of reasons.
First, medical providers need constant access to patient files. If those files were deleted, thousands of patients' care may become compromised, so payment of a ransom is more likely when targeting a hospital. Secondly, patient files contain all required identifiers for identity thefts; scammers can make use of this information later if they want. Ransomware extortion requires immediate state and federal investigation. The preferred payment method of sophisticated hackers is bitcoin, because it is difficult to trace.
Theft by Internet Purchasers and Sellers
In the wake of the rise of ecommerce over the last decade, buying and selling products online has become much easier for businesses and consumers alike. Fraudsters haven't missed their opportunity to extort ecommerce, though, and the following schemes are particularly common.
Non-Payment/Non-Delivery
In non-payment situations, the seller ships items, but the buyer never sends payment, or a stolen credit card is used. Most sellers today, however, won't ship items until funds are received, so this type of fraud is less prevalent.
The more common type of fraud is more likely to affect buyers rather than sellers: fake companies accept payment for an online purchase but never intend to send the goods. This issue is quite common on third party internet sites. Con artists list many high ticket items at bargain prices, post stock photos and sell to the highest bidders. Once they receive payment, the scammer moves on, changing locations before police receive complaints.
Misrepresentation
In these cases, merchandise is purchased and paid for online, but is made with measurably lesser quality than the seller described. This may be considered a type of theft by deception. Good websites make use of customer review functionality to avoid this problem and keep sellers honest.
Cyber Crimes Concerning Children
Two specific areas of cyber crime concern children. The first is the distribution of child pornography. Cyber crime detectives monitor particular web pages that attract this type of activity. Police locate these distributors, prepare and execute search warrants and often seize computer hard drives containing large quantities of evidence.
The second area of cyber crime that exploits children happens in online chat rooms, where predatory adults attempt to lure children into inappropriate situations. As a result, select cyber crime units monitor children's chat rooms. Predators believe they are chatting with children, but are often unknowingly chatting with criminal investigators. Identifying and arresting these individuals is a high priority.
Taking the Initial Report of a Cyber Crime
Cyber crimes often cross jurisdictional and even international boundaries, making them difficult to investigate. Each state has its own legal definition of what constitutes a cyber crime. When contacted, local law enforcement should take an initial report of the incident and aid the victim in collecting and preserving potential evidence of the crime.
Evidence may include:
Canceled checks
Certified or other mail receipts
Chat room texts
Credit card receipts
Envelopes (if received via FedEx, UPS or U.S. mail)
Log files (if available, with date and timestamps)
Social media messages
Money order receipts
Phone bills
Printed or electronic copies of emails
Printed or electronic copies of web pages
Wire transfer receipts
The initial investigating officer should also assist the victim in completing an online complaint with the Internet Crime Complaint Center, commonly called IC3. This is an online cyber crime complaint system that submits information directly to the Federal Bureau of Investigation.
IC3 will review and evaluate the complaint and refer it to the proper local, state or federal authority for investigation. The particular crime reported may be one of many perpetrated by the same criminal, and that criminal may already be under investigation. The IC3 provides a national strategy for identifying and investigating cyber crimes.
Most departments have a directive or policy on how to investigate cyber crimes. Officers should always review and follow the directives and policies of their department.
Other Important Resources
Other groups that may be able to assist victims include:
CyberTipLine, operated by the National Center for Missing & Exploited Children
The Social Security Administration's page for reporting fraud, waste or abuse
The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency
The U.S. Postal Inspection Service's report page
The initial investigating officer must properly document the crime, assist in preserving evidence, and aid the victim in completing an online IC3 complaint.
Cyber crime investigations require highly trained investigators. Many police departments are limited in their ability to conduct these kinds of investigations. Most states, however, have a full-time cyber or computer crimes unit either within the attorney general's office or within the state police. These state agencies can provide valuable assistance in departmental cyber crime investigations.