Law enforcement impersonation is older than the internet and works for the same reason it always has: most people do not challenge apparent authority, and the cost of appearing obstructive to a real officer feels higher than the cost of complying with a fake one.
Common techniques
- Fabricated identity. An invented officer at a real or invented agency, supported by a forged badge image or letterhead.
- Real officer, wrong person. Using the name and credentials of an actual serving officer, found in public records or news coverage. Anyone who verifies only that the officer exists will be satisfied.
- Spoofed communication channels. A lookalike domain, or caller ID spoofing so an incoming call displays an agency’s real number.
- Pressure and urgency. Asserting that delay endangers someone, threatening obstruction charges, or demanding to escalate to a supervisor.
- Partial truth. Referencing a real case number or a real ongoing investigation found in public reporting.
What separates it from account compromise
| Impersonation | Law enforcement email compromise | |
|---|---|---|
| The claimed officer | May be invented or misappropriated | Real |
| The sending account | Attacker-controlled, external | Genuine agency mailbox |
| Caught by verifying the officer exists | Often | No |
| Caught by domain authentication | Often | No |
| Caught by out-of-band callback | Yes | Yes |
The final row is the useful one. Both attacks fail against a callback to an independently sourced number, and neither reliably fails against anything else.
Why caller ID cannot be trusted
Caller ID spoofing is trivial and widely available. An inbound call displaying a police department’s real switchboard number establishes nothing. This inverts the intuitive control: the safe action is not answering a call from a trusted number, it is ending the call and dialling back on a number you looked up yourself. An impersonator controls what they can send you, never what happens when you initiate contact.
What it means for a company
- Never verify using contact details supplied by the requester.
- Verify the individual holds authority, not merely that a person by that name exists.
- Give staff explicit permission to pause. Impersonation exploits the fear of obstructing a real investigation. Making “I will call you back on your agency’s published number” the standard, expected response removes the social cost of using it.
- Treat pressure as a signal. Genuine officers deal with verification routinely. Escalating hostility at a two-minute callback is information.