As unlikely as it is to happen, the news of a loved one being kidnapped is incredibly distressing and overwhelming. You become shocked, panicked, and fearful. It is a time when emotions run high, and you are not in full possession of your faculties.
In such moments, a cybercriminal can exploit your fear and trick you into sending them money. This is precisely what happens in virtual kidnapping scams.
So, what is virtual kidnapping, how does it work, and what can you do to spot it before you become a victim? Let’s find out.
What Is Virtual Kidnapping?
Virtual kidnapping is a menacing scam in which a cybercriminal tries to exploit your fear by falsely claiming to have kidnapped your loved one. They coerce you through calls or messages into paying the demanded ransom, but in reality, your loved one has not been kidnapped.
Virtual kidnapping is a social engineering attack. With the use of AI voice cloning and AI-generated deepfakes, it has become easier for hackers to manipulate victims into paying ransom.
How Virtual Kidnapping Works
Let’s discuss the stages of a virtual kidnapping to better understand how it plays out.
1. Setting a Potential Target
The first step to planning a virtual kidnapping scam is to identify a potential target. Virtual kidnappers will commonly look for people who are capable of paying ransom money. In searching for potential victims, cybercriminals also look for people who struggle to use technology and might not be aware of virtual kidnapping schemes.
However, a well-crafted virtual kidnapping scam can trick even cyber-aware folks into believing their loved one has been kidnapped.
2. Identifying a Potential Subject
Once a potential victim is pinpointed whom the crook will call for making a ransom demand, the next step is to identify a subject who will be supposedly kidnapped.
Usually, virtual kidnappers pick targets’ family members who have a strong online presence (i.e. those who post regularly online and share a good amount of information). Doing so allows cybercriminals to harvest useful data about subjects quickly.
3. Harvesting Data About the Subject
Threat actors start harvesting information about potential subjects to make their faux kidnapping scheme more belieable.
This can include obtaining information about the victim’s educational and professional background, contact information, things they do daily and plan to do in the future, and getting voice samples, etc.
Cybercriminals often leverage subjects’ social media platforms and online activities to gather such information.
4. Picking the Right Time to Make the Call
Crooks keep tabs on the social media activities of the potential subjects to know when they will be physically away from their loved ones.
Also, cybercriminals wait for opportunities when the subjects are likely to lose access to their cellphone network. For example, your family member has posted on their social media platforms that they will travel at a particular time.
After collecting relevant information, a threat actor can contact you saying your family member has been kidnapped. As you are not aware of their travel plan and your family member’s phone is in flight mode, you cannot verify the safety of the loved one.
During the call, the attacker may use a voice-changing app to make their voice threatening. What’s worse, they can run deepfake audio created from the voice sample of your loved one in the background to make it seem like a real kidnapping scenario.
5. Covering the Tracks
If everything goes as planned, in the last step of the virtual extortion scheme, the threat actor covers their tracks. This can include money laundering the ransom and destroying the burner phone and related files.
How to Spot a Virtual Kidnapping Scam
Here are a few pointers to spot a virtual kidnapping scam and prevent financial loss:
- Incoming calls often come from an outside area code and never from the alleged kidnapped victim’s cell phone.
- The caller asks you to pay a ransom, usually in cryptocurrency or a wire transfer service.
- The caller doesn’t put your loved one on the phone.
- The alleged kidnapper may ask you to wire ransom money to multiple people in small amounts.
- The caller cannot often answer simple questions about your supposedly kidnapped loved one, such as the colors of the clothes they’re currently wearing.
The alleged kidnapper also tries harder to keep you on the phone so that you cannot verify if your loved one is safe through other sources. This distraction tactic makes it harder for you to sniff out the scam.
How to Fight Virtual Kidnapping
Avoiding falling prey to virtual kidnappings is not tricky if you exercise caution. The following strategies will help you fight virtual kidnapping and other such scams.
1. Hang Up the Phone
If you receive an unknown call stating your loved one is kidnapped, try to stay calm and hang up the phone. In real kidnappings, the kidnappers call multiple times or make another kind of frightening gesture. Scammers, on the other hand, will likely move to the next numbers on their list.
If the person on the other side calls you again, ask them to get answers to questions that your loved one is supposed to know, such as what your dog’s favorite cookie is.
Ensure you don’t reveal any personally identifiable information (PII) about yourself or your loved one during such calls.
2. Try to Contact the Loved One
After disconnecting the ransom call demanding money, try to contact your loved one again. Maybe you can find their cell number accessible this time. You could also try calling them over the internet using something like WhatsApp or FaceTme.
If you cannot get them on their cell number or similar avenue, try to contact them through other routes. Contact them on social media, and ask them to call back via their cell phone.
Also, you should call their friends, colleagues, managers, or anyone you think might know about the whereabouts of your loved one.
3. Involve Authorities
You should inform your local police office department and notify the Federal Bureau of Investigation (FBI) as soon as possible about an incident of virtual kidnapping.
Your local police officer may provide you with some steps to follow so that they can catch the criminal.
4. Stay Vigilant
Virtual kidnapping is a form of social engineering in which criminals make you believe they have kidnapped your loved one.
To be successful in their extortion schemes, they need personal details about the target victim and the person they will claim to have kidnapped.
Social media platforms are the most popular places where threat actors harvest such information. So, avoid sharing personal details on social media and with people you don’t know. And don’t share real-time location and travel plans online.
You should also encourage your family members and loved ones to do the same. Maintaining strict privacy on social media platforms is an excellent strategy to limit the information criminals can harvest about you and your loved ones.
Virtual Kidnapping Is Sneaky and Dangerous
Though virtual kidnapping scams can take on many forms, it is always an extortion scheme. You’ll very likely need to pay money to free your allegedly kidnapped loved one, which can cause a lot of financial damage. Virtual kidnapping is becoming more sophisticated daily, especially with the use of AI.
It is crucial to practice caution when sharing things online. If crooks cannot harvest information about you and your loved ones, it is difficult for them to carry out virtual kidnapping scams and other online swindles.