Beyond the Scams: Unraveling the Dark Tactics of Real-World Kidnapping Scams and Virtual Extortion



Dark Tactics Kidnapping ScamsThe world can be a scary and dangerous place. Its unethical scammers have no problem doing almost anything to make a buck, but sometimes, their plots seem to be extra messed up.

A case in point is a series of real-world kidnappings being done against foreign exchange students. The extortionists somehow convince an otherwise innocent student to isolate themselves from the world in order to pull off a supposed kidnapping. I understand that usually the student is told their families will be harmed if they do not.

The high school student in this report bought a tent and set it up in the cold, snowy wilderness. His family was sent pictures, voice recordings (which the victim took and recorded himself), and a ransom note. The family paid the extortionists $80,000. Supposedly, these types of kidnapping scams are common enough that the Chinese embassy in DC is warning Chinese travelers of the threat. 

Grandparents Bail Out Grandchildren
A far more common scam I read about all the time is grandparents being called by someone posing either as a lawyer or law enforcement. Their grandchild has supposedly been arrested, usually for drinking or an accident, and used their one phone call to call the grandparents for bail money. The grandchild is supposedly too scared to call their parents. 

Some of the grandparent victims said the calls included their grandchild’s voice or what they perceived to be their grandchild’s voice. Some grandparents have even admitted to being honored that their grandchild trusted them enough to reach out when they were in trouble. The average amount of money stolen in these types of scams ranges from a few thousand dollars to ten or more thousand dollars. 

Note: There have been many cases when the grandchild (or child) was involved with the fake kidnapping scam, but in the vast majority of kidnapping scams the child being referenced is unaware of the scam.

The scammers will never ask you to pay in person or use a credit card. They will tell you to wire the money, use gift cards, or some other method that no legitimate law enforcement agency or lawyer in the world would ever accept. Oftentimes, the scammer tells them the grandchild was detained in a foreign country like Mexico where the grandparents may think they might take the rogue payment forms. 

“Regular” Fake Kidnapping
This is a common scam where the victim involved has supposedly been kidnapped. The calls can be made to spouses, parents, or grandparents. The caller may include a faked clip of someone screaming as if they are being tortured. Some of the victims have claimed they could not rule out that the screams were not from their loved one. These “regular” kidnapping scams are also common on social media, where the victim is contacted on Instagram, Facebook, or Twitter.

Usually, the scammer has taken over someone’s account, locked out the legitimate user, and is now sending the fake kidnapping messages to their friend list. I have received a few of these myself over the years. Sometimes the involved person was really on a trip to a foreign country and so the claimed kidnapping in the country the “victim” was visiting seems more real.

There are even growing reports of AI being used to generate deepfakes using the actual child’s voice, including from this recent report involving a parent.

Accident
Another common similar ruse is a call to the victim claiming that their loved one was in a bad auto accident and money is needed to help them get the surgery they need to survive. The reason I am including this scam type here is that at least a few victims have said the accident claim turns into a kidnapping/torture scenario when the initial accident claim is met with skepticism.

Not New
These types of scams have been going on for decades, if not centuries. The Internet and social media are just making them far more common. When I was in my 20’s and newly married, someone called my wife on the telephone after I had stepped out to go shopping at a nearby hardware store. I was only gone for about 30 minutes. When I got back, my wife ran out to my car after I had parked it, sobbing and hugging me.

After I had left, the caller claimed I had been in a bad car accident and then it morphed into the kidnapping/torture scenario when my wife, an ER nurse, asked for more details and began to get suspicious. She claimed she heard me screaming as I was being tortured, so it can happen to anyone. We called the police and they said it was a common type of scam.

We wondered how they could have known when I left my house so they could make the call to my wife. The police said it was something they claimed randomly hoping they called at the right time or possibly someone was actually watching the house or saw me in the store to start the scam. Either way, it was a very scary period of time, and it emotionally scarred my wife for a long time.

Defenses
Education is the first defense. You need to make your family, friends, and co-workers aware of these types of scams. Some companies are not sure if they should educate their employees about these types of “personal scams” arguing that they do not really impact the company. But any employee dealing with the financial or emotional repercussions of a kidnapping scam is not going to be a super productive employee for a while. Plus, in teaching them to be aware of these types of scams, you are really promoting a healthy level of skepticism that should help the organization mitigate scams that are directed at businesses.

Second, the targeted extortion victims should always, somehow, make a verification call to the supposed accident or kidnapping victim before paying the ransom. In the first scenario, where the victim is already isolated and using new phones, the victim can almost never make a verification call. Many times, the claimed kidnapping/torture victim simply is not immediately contactable or does not immediately call the targeted victim back. Do not pay ransoms. Or do not pay ransoms without reliable “proof of life”. Even better, educate yourself and the others around you so you and they do not become victims. Real-world kidnappings and torture rarely happen while fake, virtual kidnappings are not uncommon. 

Code Words
One other thing that may work and save you time and money. I taught each of my kids a “secret code word” that they would have to repeat to me (or others) if someone was unexpectedly trying to pick them up claiming I sent them. In the primary scenario, anyone trying to pick them up would have to know the code word to pick my kids up. Otherwise, my kids were taught to run and go to the nearest known safe person. My kids are grown now and never had to use the code word, but they remember it, and they are now teaching it to their little ones. 

In this case, you could ask the kidnapper to have your loved one tell them the code word. They likely make up some excuse, like your loved one cannot talk or is unconscious, but at least you will know they have not provided you with a verified proof of life statement.

I know it is wild that we have to be educated and prepared for such things, but it is a different world out there and some scammers have no problem reaching for the bottom of the barrel for their scam scenarios. They just want a quick and easy payout. Claiming you have kidnapped someone is often a way to get the targeted victim to quickly comply and pay lots of money.

If teaching your child a secret word is a little much for you and your parenting style, just educate about these types of scams. A little awareness goes a long way.


Request A Demo: Security Awareness Training

products-KB4SAT6-2-1New-school Security Awareness Training is critical to enabling you and your IT staff to connect with users and help them make the right security decisions all of the time. This isn't a one and done deal, continuous training and simulated phishing are both needed to mobilize users as your last line of defense. Request your one-on-one demo of KnowBe4's security awareness training and simulated phishing platform and see how easy it can be!

Request a Demo!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/kmsat-security-awareness-training-demo



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews