FBI warns hackers are filing fake police data requests to steal people’s private information

The FBI flag (Federal Bureau of Investigation) painted on a brick wall.

(Image credit: Shutterstock / BreizhAtao)

FBI issues Private Industry Notification on emergency data requests
Hackers are using stolen .gov email addresses to pose as authorities
Mitigations recommended by the FBI should be put in place

Cybercriminals are using stolen government email addresses to submit fraudulent emergency data requests to US companies to steal personally identifying information (PII) of customers, which could be used for nefarious purposes such as phishing and identity theft, experts have warned.

This attack vector has grown in popularity since August 2023, warranting the issue of a Private Industry Notification from the FBI.

The Bureau has also issued a list of mitigation measures for businesses to put in place to keep personal data safe and ensure that only authentic data requests are processed.

Fraudulent requests on the rise

Over the last year, the FBI has logged a significant uptick in forum posts from cybercriminals relating to fraudulent data requests. The trend stemmed from one user stating that for $100, they could teach people to use data requests to obtain information on any social media account. Shortly thereafter, another user discovered that by using a ‘.gov’ email address, they could pose as the authorities and obtain much more detailed information to use for phishing.

Fraudulent data requests gradually became more advanced and more threatening, with one user posting in December 2023 that they included the threat of harm or death to an individual if the data request was not processed and approved.

Shortly following this in March 2024, another known cyber criminal submitted a Mutual Legal Assistance Treaty (MLAT) to PayPal. The MLAT used details from a child trafficking investigation, including case number and legal code to appear legitimate, however PayPal declined the MLAT.

In August 2024, a cybercriminal listed “High Quality .gov emails for espionage/social engineering/data extortion/Dada requests, etc” for sale that could be used for fraudulent data access requests to obtain private customer information including names, email addresses, phone numbers, and other personal information.

The FBI recommends that businesses double check the security posture of any connections between 3rd parties they interact with and their own systems, as well as external or remote connections.

Businesses should also be wary of emergency data requests that highlight the urgency of the requests, and check all the details within the request for inconsistencies or doctoring. The full list of mitigations can be found here.

Take a look at the best malware removal tools around
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
These are the best endpoint protection solutions

Benedict has been writing about security issues for over 7 years, first focusing on geopolitics and international relations while at the University of Buckingham. During this time he studied BA Politics with Journalism, for which he received a second-class honours (upper division), then continuing his studies at a postgraduate level, achieving a distinction in MA Security, Intelligence and Diplomacy. Upon joining TechRadar Pro as a Staff Writer, Benedict transitioned his focus towards cybersecurity, exploring state-sponsored threat actors, malware, social engineering, and national security. Benedict is also an expert on B2B security products, including firewalls, antivirus, endpoint security, and password management.