Fraudulent emergency data requests: how fake EDRs work and how to stop them

What is an emergency data request?

Start with the legitimate version, because the fraud only makes sense against it.

Under US law, nearly every disclosure of user data to law enforcement requires legal process: a subpoena, a court order, or a warrant, each signed and each reviewable. The full ladder. The exception is 18 U.S.C. § 2702(b)(8): when a provider believes in good faith that someone faces danger of death or serious physical injury, it may disclose voluntarily, immediately, with no legal process at all. A kidnapping in progress can't wait ten days for a court order.

Real EDRs are common and mostly legitimate. Verizon received more than 36,000 of them in a single half-year and complied with around 90%; across the industry, emergency requests run somewhere between 5% and 30% of total law enforcement request volume. The emergency exception exists because it saves lives. That's exactly what makes it worth stealing.

How do fake EDRs work?

The attack has three steps, and none of them is technically sophisticated.

1. Get a law enforcement email account. Criminals phish police officers, buy stolen credentials, or purchase already-compromised agency accounts on criminal forums. Foreign agency accounts work as well as domestic ones; a request from any recognizable agency address carries authority.
2. Send the emergency request. Using the real agency's address, or a lookalike, the attacker emails a provider's law enforcement contact claiming an imminent threat: a suicide risk, a kidnapping, a shooting threat. They attach forged paperwork if any is asked for. In an emergency, usually none is.
3. Receive the data. Name, home address, phone number, IP logs, sometimes message metadata. Delivered by the company, in good faith, often within hours.

This is how members of the Recursion Team and Lapsus$, several of them teenagers, pulled user data out of Apple, Meta, and Discord in 2021 using forged emergency requests sent from hacked agency accounts. Bloomberg and Krebs on Security documented the wave in 2022, and it hasn't stopped since.

Why do fake EDRs work?

Because everything about the emergency channel is optimized for speed, and every speed optimization is a verification gap.

• No court is involved. A forged warrant has to imitate a document a judge signs. A fake EDR has to imitate an email. There's no seal to check because there's no process to fake.
• The clock is the weapon. The request says someone will die. The person reading it wants to help. Slowing down to verify feels like the risky choice.
• The attack surface is enormous. There are roughly 18,000 law enforcement jurisdictions in the US alone, and each one is a set of email accounts. Confirming that an email came from a police domain says nothing about who was typing. One compromised account anywhere in the world is enough.
• Each company verifies alone. The same fraudulent requester can hit fifty companies, and each one sees a first-time contact with no history. Nobody sees the pattern, because nobody's position lets them.

A fraudulent EDR only has to work once. Verification has to work every time.

How common are fraudulent EDRs?

Common enough to have a price list. The trajectory since 2021:

• 2021. Recursion Team and Lapsus$-affiliated actors obtain user data from Apple, Meta, and Discord with forged EDRs from compromised agency accounts.
• March 2022. Krebs on Security and Bloomberg expose the trade; Senator Wyden opens an inquiry. Krebs's framing still stands: hackers had gained the power of subpoena.
• October 2023. A man poses as a police officer over email and obtains a woman's home address and phone logs from Verizon with a fake EDR sent from a Proton Mail address, missing required paperwork. He shows up at her home armed.
• November 2024. The FBI issues a public advisory: since August 2024, a documented uptick in criminal-forum posts selling government email credentials, some marketed explicitly for fraudulent EDRs, with actors claiming access to accounts from more than two dozen countries.
• 2024 to 2026. The attack productizes. Fraudulent-EDR-as-a-service listings run from roughly $100 for how-to kits to $1,000-$3,000 per successful request, some advertising turnaround under an hour. Verified police email accounts sell for around $1,000 each.

The direction is one way: cheaper, faster, more packaged. The emergency exception isn't going away, and neither is the incentive to abuse it.

What happens when a fake EDR succeeds?

The data goes to someone whose next step is the reason they wanted it.

Bloomberg's reporting traced data from forged EDRs to campaigns sextorting women and minors: the attacker uses the real name and address to make the threat credible. The Verizon case put an armed stalker at a victim's door. Fraudsters use EDR data to defeat identity checks at banks and exchanges. Doxing and swatting crews use it to attach a home address to an online handle.

For the company, the harm compounds. It disclosed a user's data to a criminal, in a channel with no court order to point to, under an exception that exists on good faith. The legal exposure is unsettled and being tested in litigation; the trust damage isn't unsettled at all.

How do you verify an emergency data request?

Not by reading the email more carefully. Checking the sending domain, the letterhead, and the badge number verifies the costume, and the costume is the thing being faked.

Verification that holds up answers three questions independently: is the agency real, confirmed against a registry of agencies rather than what the email claims; is the requester real, the individual investigator verified as a person who works there; and is the behavior right, does this request fit the requester's history and their agency's legitimate pattern of work.

The third question is the one no company can answer alone, because no single company sees enough requests to know what normal looks like. That's the argument for verifying at the network level: on Kodex, 15,000 government agencies and 150,000 investigators are verified once, and their request behavior is visible across every company they contact. A requester who fails verification at one company has failed it everywhere. No verification layer makes fraud impossible, which is why verification is layered with monitoring and revocation rather than resting on any single check. How requester verification works.

What is law enforcement email compromise?

Law enforcement email compromise, LEEC, is the upstream crime that makes fake EDRs possible: the takeover of law enforcement email accounts for use in fraud. It's the law enforcement version of business email compromise, with one difference that changes everything: a compromised business account can move a company's money, while a compromised police account can move any company's data.

Fake EDRs are the most dangerous use of LEEC, but not the only one. Compromised agency accounts also send forged subpoenas and forged court orders through the same trusted channel. See what the network catches.

Is anyone fixing this?

Slowly. Senators Wyden, Tillis, and Whitehouse introduced the Digital Authenticity for Court Orders Act, which would require digital signatures on court orders; it has not passed. The FBI's 2024 advisory tells agencies to harden their email and tells companies to scrutinize emergency requests, which is sound advice aimed at the two parties least equipped to act on it alone.

The structural fix doesn't require legislation. Fake EDRs work because requests travel over open email between strangers. Verified infrastructure, where every requester is known before they can ask, removes the condition the fraud depends on. That's the fix companies can adopt today, one at a time, and it gets stronger with each one that does.

Common questions