As asked, I'm posting a quote to my story here, for visibility
. The main topic is now locked, further discussion can move here
Basically, a social engineering scam that i was confronted with. It was so well executed it took me a long time before red flags started to pop up... Hope this is a learning experience (at least, for me it was). Didn't lose any funds, but got a wake up call and a very big reminder never to trust any phone call from anybody you don't physically know.
I just wanted to share a quick heads up, a real story that happened to me last/this week. I hope my story can prevent people from getting scammed... Maybe if something similar is happening to you, you can remember this thread and act accordingly.
What happened:
Last week, friday late afternoon, i got a call from a phone number my phone recognized as an official police line. The person on the other end identified himself with a normal sounding name, that is perfectly normal in my region. He identified himself as an inspector from an existing police zone, corresponding to the telephone number that was shown on my screen. The person spoke polite, perfect Dutch, no red flags whatsoever.
The first 10 minutes of the talk, he gave me a geniune looking case number, he informed me that a copy of my identity card was found in posession of a gang of scammers. He started talking to me about everything they could have done with the copy of my papers, and gave genuine tips on what to do to minimise the damage, and to prevent further damage in the future.
At this point, no red flags were raised on my side... Police telephone number, perfectly happy to give his name, police zone, case number, perfect Dutch, not asking for anything suspicious at all.
Only after ~10 minutes, he prudently mentioned crypto currencies... Since no red flags were raised on my end, i told him i did have some crypto on a hardware wallet. The "police officer" told me they worked together with a specialised company that could verify if my identity was used in the crypto community. I had expected to have some time to verify the "police officer"'s story, and went on with what i was doing, expecting to be able to verify some stuff later that evening.
About 30 minutes later, before i had come around to getting anything verified at all, i got a call from a guy from a thirth party company that gave the exact same case number the "police officer" had given me and he informed me my kyc documents were used to open accounts on several exchanges (probably to launder stolen crypto), and they were also used in the recovery of some of my accounts on a couple of exchanges. I started to get suspicious... How does a company i had never heared of have the permission to close accounts and stop verification on at least 10 different exchanges??? He also told me he would flag my KYC documents for ~3 years, so they could no longer be used to open accounts on exchanges (i started to get even more suspicious)... But ok, so far he did not ask for seed phrases, keys, transactions, download links, screen takeover,... etc, etc... Big red flags, but still no real attempt as scamming.
After about 45 minutes, he started to move towards my old ledger... I haven't used the device since ledger announced their program "wallet recovery" which proved they had an option to export data from the secure ellement. I use my ledger to store my testnet coins at the moment, since that's about all it is good for (in my opinion).
Now was the first blinking, bold, underlined, red warning flag: the guy talking to me said my KYC documents were used to recover my key from the three partners in the ledger wallet recovery program (eventough i never, ever used this program). He also started to spew gibberish about a scammer not being able to use my private key to create transactions since (in his words) you'd need the device id and pin code in order to spend any funds... Tough luck for me: the device id was leaked in a big hack last year, so only the pin code would protect me from being robbed... Time was of the essence!!! I felt a bit queezy since i suddenly was confronted with the actual absolute proof that for the last hour, i had been talking to a scammer. Since i had not verified anything, i told him i did not have access to any hardware wallet (wich is true, my wallet is locked in a metal drawer at work, i find this safest, since my work building is guarded 24/7, and the drawer is inconspicious, metal and very sturdy). I told the scammer i could only access the device on wednesday, that way i had some time putting my ducks in a row...
In the meantime, i called the police zone the initial "police officer" claimed to be a member off: they had never heared about him, but they seemed to busy to actually do some digging. Afterwards, i called my own police zone, they dug some further: the police offer does not exist, the case number is real but belongs to a completely different case AND the real procedure the police follows is to send the case to the victim's police zone. The local police zone then invites the victim to their actual building where you are talked to by a police officer in uniform (and in person). They told me that phone calls are only used to very briefly scetch a situation and make an appointment for a face to face talk in the actual police office. They also told me they'd never work with a thirth party that contacts victims directly... Everything has to go trough the local police office.
Yesterday, the "officer" called again, but i didn't yet have a response ready, so i told him to call me again today... Today i have to be very short and direct, making sure he understands he cannot scam me, getting the target off my back without telling him what gave him away (so he doesn't learn what he can do better next time)... I really don't like to make such calls, but hey, it's the only option.
Now, i wasn't scammed, but i just wanted to share my story as a warning: these guys are getting good... The days where you could conclusively tell you're talking to a scammer within the first 10 seconds of a talk seem to be over... Now they're using spoofed phone numbers, local people, existing case numbers,... I dread the future if these guys get even better than they are right now
