Email extortion scam claims to be from a CIA investigation

A new email scam that surfaced in March 2019 is claiming that the email recipient has been targeted by a law enforcement operation targeting individuals suspected of paedophilia, and the recipient will be arrested unless they pay money to a corrupt law enforcement officer who will remove the recipient’s details in return.

The scam builds on existing email scams that claim the recipient was caught browsing adult websites where – according to the email – a hacker had planted malware that took over the recipients webcam and caught them in the act. That scam attempted to extort money from the recipient by threatening to release the compromising webcam footage.

This new email scam is different, however. It claims that the recipient is one of thousands of people caught in a law enforcement sting related to viewing photos of underage children online. The email purports to come from an officer involved with that sting – in many cases this may be the CIA or NSA. The “officer” says they’ll remove the recipient’s details in return for money – paid via Bitcoin, naturally.

Sponsored Content. Continued below...

In one of the more popular examples of this scam we’ve seen recently, the crook pretends to be a “CIA technical collection officer”, and according to the email, the sting had captured around 2,000 people involved, in which the recipient is one. Pay up, and your details will be erased and you won’t be arrested, claims the crook.

Of course, like with all of these “sextortion” type email scams, the crooks are bluffing, but they’re hoping the recipient believes them and pays up.

See an example of one scan below –

Case #49237856
Distribution and storage of pornographic electronic materials involving underage children.

My name is Devon Babin and I am a technical collection officer working for Central Intelligence Agency.

It has come to my attention that your personal details including your email address (person@xxx.com) are listed in case #49237856.

The following details are listed in the document’s attachment:

• Your personal details,
• Home address,
• Work address,
• List of relatives and their contact information.

Case #49237856 is part of a large international operation set to arrest more than 2000 individuals suspected of paedophilia in 27 countries.

The data which could be used to acquire your personal information:

• Your ISP web browsing history,
• DNS queries history and connection logs,
• Deep web .onion browsing and/or connection sharing,
• Online chat-room logs,
• Social media activity log.

The first arrests are scheduled for April 8, 2019.

Why am I contacting you ?

I read the documentation and I know you are a wealthy person who may be concerned about reputation.

I am one of several people who have access to those documents and I have enough security clearance to amend and remove your details from this case. Here is my proposition.

Transfer exactly $10,000 USD (ten thousand dollars – about 2.5 BTC) through Bitcoin network to this special bitcoin address:

3DAEVKMXxAXH5njM2CZoV4U7QdK7Sf6ZZZ

You can transfer funds with online bitcoin exchanges such as Coinbase, Bitstamp or Coinmama. The deadline is March 27, 2019 (I need few days to access and edit the files).

Upon confirming your transfer I will take care of all the files linked to you and you can rest assured no one will bother you.

Please do not contact me. I will contact you and confirm only when I see the valid transfer.

Regards,
Devon Babin

Technical Collection Officer
Directorate of Science and Technology
Central Intelligence Agency

Given the similarities between this scam and previous sextortion scams, it’s likely that the crooks will use tried and tested techniques to sell their wares.

This includes spoofing the Header email to make it appear to have come from a source it didn’t, and future variants of this scam are likely to include the recipient’s email, password or phone number to add to its believability. However this information has come from previous data breaches where some of your information was leaked online, and is now being picked up by crooks to make scams like this appear believable.

The bottom line, of course, is that these emails are scams. Law enforcement hasn’t involved you in a large scale operation (at least we hope that isn’t the case!) and we recommend anyone who receives such an email to simply hit the delete button. It isn’t worth your time.