The fraudulent emergency data request works because it attacks a process designed to be fast rather than a system designed to be secure. There is nothing technically sophisticated about most of them.
How they are constructed
Three approaches, in ascending order of effectiveness:
- Fabricated agency, fabricated sender. A made-up department and a free email account. Caught easily by domain checks.
- Spoofed domain. An imitation of a real agency’s domain. Usually caught by SPF, DKIM, and DMARC.
- Compromised genuine account. Sent from a real police mailbox the attacker controls. Passes every technical check, because everything technical about it is authentic. This is law enforcement email compromise, and it is why domain-based defences are not sufficient.
The third category is the one that matters. Defences built to catch the first two provide little protection against it.
Why the emergency framing is the attack
| Fraudulent EDR | Forged warrant | |
|---|---|---|
| Verifiable against an external record | No; no court is involved | Yes; court docket and judge |
| Expected response time | Hours | Days |
| Independent review before disclosure | None | A judge, before issue |
| Effort to produce convincingly | Low | High |
| Observed frequency | High | Low |
An emergency request is uniquely attractive because there is nothing external to check it against. A warrant names a court and a case number that can be confirmed. An emergency request names an officer and a crisis, and both exist only in the email.
Detection signals
None of these are conclusive alone; together they justify slowing down.
- The urgency asserted does not match the scope requested: a threat to one person, a request covering many accounts.
- No prior contact history with the officer or the agency.
- Resistance to a callback, or a callback number supplied inside the request itself.
- The agency has no plausible jurisdictional connection to the account.
- Formatting inconsistencies against genuine requests from the same agency.
- Requests arriving outside business hours, when review is thinnest.
What actually works
Verify the person, not the paperwork. Since the document may be genuine and the account may be genuine, the only reliable check is establishing that the specific human sending it is a serving officer with authority to make the request, through a channel the attacker does not control.
Default to preservation when verification is pending. Preserving data protects the evidence, costs a genuine investigation nothing, and discloses nothing to an unverified requester. It converts a high-stakes binary decision into a low-stakes one.
Treat verification as compatible with speed. A callback takes minutes. The framing that verification and urgency are in conflict is the attacker’s framing, and accepting it is how disclosure happens.