# What Is Law Enforcement Impersonation? | Kodex Source: https://www.kodexglobal.com/glossary/law-enforcement-impersonation > Law enforcement impersonation uses fake authority to extract user data. Learn the common techniques and the controls that actually detect them. Verification & Fraud ## Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. Also known as police impersonation, agency impersonation Law enforcement impersonation is older than the internet and works for the same reason it always has: most people do not challenge apparent authority, and the cost of appearing obstructive to a real officer feels higher than the cost of complying with a fake one. ### Common techniques - Fabricated identity. An invented officer at a real or invented agency, supported by a forged badge image or letterhead. - Real officer, wrong person. Using the name and credentials of an actual serving officer, found in public records or news coverage. Anyone who verifies only that the officer exists will be satisfied. - Spoofed communication channels. A lookalike domain, or caller ID spoofing so an incoming call displays an agency’s real number. - Pressure and urgency. Asserting that delay endangers someone, threatening obstruction charges, or demanding to escalate to a supervisor. - Partial truth. Referencing a real case number or a real ongoing investigation found in public reporting. ### What separates it from account compromise ImpersonationLaw enforcement email compromise The claimed officer May be invented or misappropriated Real The sending account Attacker-controlled, external Genuine agency mailbox Caught by verifying the officer exists Often No Caught by domain authentication Often No Caught by out-of-band callback Yes Yes The final row is the useful one. Both attacks fail against a callback to an independently sourced number, and neither reliably fails against anything else. ### Why caller ID cannot be trusted Caller ID spoofing is trivial and widely available. An inbound call displaying a police department’s real switchboard number establishes nothing. This inverts the intuitive control: the safe action is not answering a call from a trusted number, it is ending the call and dialling back on a number you looked up yourself. An impersonator controls what they can send you, never what happens when you initiate contact. ### What it means for a company - Never verify using contact details supplied by the requester. - Verify the individual holds authority, not merely that a person by that name exists. - Give staff explicit permission to pause. Impersonation exploits the fear of obstructing a real investigation. Making “I will call you back on your agency’s published number” the standard, expected response removes the social cost of using it. - Treat pressure as a signal. Genuine officers deal with verification routinely. Escalating hostility at a two-minute callback is information. FAQ ### Frequently asked questions How is impersonation different from law enforcement email compromise? Impersonation means pretending to be an officer from outside: a fabricated identity, a spoofed domain, a fake badge. Law enforcement email compromise means operating from inside a genuine officer’s real account. Impersonation can be caught by verifying the claimed identity is real; LEEC cannot, because the identity is real and only the authority is fake. Does impersonation only happen over email? No. Phone calls are common, and they add pressure that email does not. A caller can push back in real time against someone hesitating. Some attacks combine channels, sending a written request and following up with a call to add credibility and urgency. What is the single most effective control? An out-of-band callback to a number the company sourced itself. It breaks every impersonation technique that relies on controlling the communication channel, and it is cheap enough to apply to every request rather than only the suspicious ones. Glossary ### Related terms #### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. #### Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. #### Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. See Kodex’s guidance on verifying law enforcement requests. Learn more