# What Is Law Enforcement Email Compromise? | Kodex Source: https://www.kodexglobal.com/glossary/law-enforcement-email-compromise > Law enforcement email compromise is when attackers take over a real police email account to send fake data requests. How LEEC works, and how to stop it. Verification & Fraud ## Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. Also known as LEEC, police email compromise, law enforcement account takeover Law enforcement email compromise sits in an awkward gap. It is not quite phishing, because the attacker is not imitating anyone. It is not quite insider abuse, because the account holder is a victim. It is the use of a legitimate credential to make an illegitimate demand, and it breaks the assumption that most data request programmes are built on: that an email from a police domain came from the police. ### How law enforcement email compromise works The attack has three stages, and only the last one touches the target company. - Acquire the account. The attacker obtains credentials for a genuine law enforcement or government mailbox, typically through credential stuffing against reused passwords, a phishing campaign aimed at the agency, or credentials bought from an initial access broker. Small agencies are disproportionately targeted because they are less likely to enforce multi-factor authentication. - Study the format. Real legal process has a house style. Attackers read genuine requests already in the mailbox and copy the letterhead, case number format, statutory citations, and signature blocks. - Send the request. The fraudulent request goes out from the real account, usually framed as an emergency so that it is triaged quickly and reviewed lightly. Because stage three uses authentic infrastructure, the request passes every technical control that inspects the sender rather than the person. ### Why standard verification fails Most intake processes verify the channel, not the human. They check that the sending domain belongs to a real agency, that SPF and DMARC pass, and sometimes that the domain appears on an allowlist. Every one of those checks confirms something that is genuinely true during a LEEC attack. Spoofed requestLEEC request Sending domain Imitated or lookalike Genuine agency domain SPF / DKIM / DMARC Typically fails Passes Domain allowlist check Fails Passes Reply-to inspection Often mismatched Matches the real mailbox What actually catches it Email authentication Out-of-band identity verification The practical consequence is that a company can do everything its runbook asks and still disclose subscriber data to a criminal. ### What it means for a company receiving requests Treat the mailbox as untrusted infrastructure. If your process can be satisfied by anyone holding the password to a police inbox, then the security of your users’ data is only as strong as the password policy of the smallest agency that has ever contacted you, and you have no visibility into that. Three things move the needle: - Verify the individual, not the domain. Confirm the named officer is serving, is attached to the agency named, and is authorised to make the request. - Use an independently sourced callback number. Never a number supplied in the request itself, which the attacker controls. - Keep emergency requests inside the process, not around it. Urgency is the pressure an attacker applies deliberately. A fast path is reasonable; an unverified path is not. ### How to tell a real emergency request from a fraudulent one There is no single tell, which is the point. Useful signals are behavioural rather than technical: a request for an account with no plausible connection to the agency’s jurisdiction, an officer who has never contacted you before combined with unusual urgency, resistance to a callback, or a scope that is broader than the stated emergency would justify. None of these are proof on their own. All of them are reasons to verify before disclosing. FAQ ### Frequently asked questions How is LEEC different from a spoofed email? A spoofed email only imitates a government domain, so authentication checks like SPF, DKIM, and DMARC will usually fail and expose it. In law enforcement email compromise the attacker is sending from the genuine mailbox, so every one of those checks passes. Spoofing is a forgery problem; LEEC is an authentication problem, and it defeats domain-based defences entirely. Why do attackers target emergency requests specifically? Emergency disclosure requests are designed to bypass the normal legal process because a delay could cost a life, so they carry no court oversight and are expected to be answered in hours. That combination of urgency and missing judicial review is exactly what an attacker wants, because it removes both the time and the independent check that would otherwise catch a fraudulent request. What actually stops LEEC? Verifying the requester rather than the request. Because the email account is genuine, the only reliable defence is confirming that the specific individual sending it is a serving officer with authority to make the request, through an out-of-band identity check that does not depend on the compromised mailbox. Callback verification to an independently sourced agency number is the minimum bar. Glossary ### Related terms #### Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. #### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. #### Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. #### Emergency Disclosure Request (EDR) An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive. Domain checks cannot catch a compromised account. See how Kodex verifies the person behind the request. Learn more