# What Is a Fraudulent Emergency Data Request? | Kodex Source: https://www.kodexglobal.com/glossary/fraudulent-emergency-data-request > Fraudulent emergency data requests use fake urgency to extract user data without legal process. Learn how they work and how to detect them. Verification & Fraud ## Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. Also known as fake EDR, fraudulent EDR, forged emergency request The fraudulent emergency data request works because it attacks a process designed to be fast rather than a system designed to be secure. There is nothing technically sophisticated about most of them. ### How they are constructed Three approaches, in ascending order of effectiveness: - Fabricated agency, fabricated sender. A made-up department and a free email account. Caught easily by domain checks. - Spoofed domain. An imitation of a real agency’s domain. Usually caught by SPF, DKIM, and DMARC. - Compromised genuine account. Sent from a real police mailbox the attacker controls. Passes every technical check, because everything technical about it is authentic. This is law enforcement email compromise, and it is why domain-based defences are not sufficient. The third category is the one that matters. Defences built to catch the first two provide little protection against it. ### Why the emergency framing is the attack Fraudulent EDRForged warrant Verifiable against an external record No; no court is involved Yes; court docket and judge Expected response time Hours Days Independent review before disclosure None A judge, before issue Effort to produce convincingly Low High Observed frequency High Low An emergency request is uniquely attractive because there is nothing external to check it against. A warrant names a court and a case number that can be confirmed. An emergency request names an officer and a crisis, and both exist only in the email. ### Detection signals None of these are conclusive alone; together they justify slowing down. - The urgency asserted does not match the scope requested: a threat to one person, a request covering many accounts. - No prior contact history with the officer or the agency. - Resistance to a callback, or a callback number supplied inside the request itself. - The agency has no plausible jurisdictional connection to the account. - Formatting inconsistencies against genuine requests from the same agency. - Requests arriving outside business hours, when review is thinnest. ### What actually works Verify the person, not the paperwork. Since the document may be genuine and the account may be genuine, the only reliable check is establishing that the specific human sending it is a serving officer with authority to make the request, through a channel the attacker does not control. Default to preservation when verification is pending. Preserving data protects the evidence, costs a genuine investigation nothing, and discloses nothing to an unverified requester. It converts a high-stakes binary decision into a low-stakes one. Treat verification as compatible with speed. A callback takes minutes. The framing that verification and urgency are in conflict is the attacker’s framing, and accepting it is how disclosure happens. FAQ ### Frequently asked questions Who sends fraudulent emergency data requests? The population is broader than organised crime. Reporting has documented harassment and doxxing communities, individuals stalking specific people, and financially motivated actors seeking data to enable account takeover or extortion. The barrier to entry is low, which is a large part of the problem. What data do fraudulent requests typically target? Identifying information most often: names, addresses, phone numbers, email addresses, and IP addresses associated with an account. That is enough to locate a person, take over their accounts elsewhere, or escalate a harassment campaign, and it is the tier most readily disclosed under emergency provisions. Is a callback enough to stop them? A callback to an independently sourced agency number defeats the large majority, including requests sent from compromised accounts, because the attacker cannot intercept a call to a number they do not control. It fails only against an attacker who has also compromised the agency’s phone system, which is rare. Glossary ### Related terms #### Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. #### Emergency Disclosure Request (EDR) An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive. #### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. #### Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. See Kodex’s research on fraudulent emergency requests and how to stop them. Learn more