Supporting cybercrime victims and taking reports

Grace Whitford reported her loss on the morning of Wednesday, February 11, by calling the police non-emergency line. She has told Detective Park since that the first thing the call-taker said, after hearing the words 'grandson' and 'wire transfer', was 'Oh, those people are overseas, there's really not much we can do.' Grace says she nearly hung up. She stayed on the line because her daughter was beside her. The call-taker did take a report and gave a file number, and the file was assigned to the fraud unit the next day. Park says the delay cost nothing in Grace's case, because the money had already moved by the time Grace knew she had been defrauded. But the sentence cost a great deal: it made Grace feel foolish, and for weeks afterwards she did not call when she remembered new details.

The victimology course looked at Grace's experience from her side. This lesson looks at it from the side of the officer or call-taker taking the report, and asks what a good cybercrime report looks like: one that treats the victim with respect, captures the evidence that will be needed, stops further loss and gets the file to the right place quickly.

What cybercrime victims experience

Victims of fraud and other cybercrime often feel ashamed and blame themselves, especially when they sent the money themselves. Friends and family may reinforce this by asking how they could have fallen for it. The losses can be devastating: retirement savings, a house deposit, money borrowed from relatives. Older victims may lose confidence and independence, and their families may start to question whether they can manage their own affairs. Victims of sextortion, intimate image abuse and online harassment may fear for their safety and reputation, may withdraw from school, work or social life, and may be at risk of self-harm. Business victims of ransomware may face ruin, lost jobs and liability to their customers.

Victims also often have unrealistic expectations, in both directions. Some expect police to recover the money quickly, as if the bank simply needed to be told. Others, like Grace after her call, assume nothing can be done and stop cooperating. The officer's job is to give honest information: what can be done, what probably cannot, and what the victim can do to protect themselves.

Language that helps and language that hurts

Park gives the class a list of things she has heard said to fraud victims by police, and asks them to explain what each communicates. 'There's not much we can do' tells the victim that their report is pointless. 'How did you not realize it was a scam?' tells them it was their fault. 'You should have called your bank first' may be true but is useless after the fact. 'These people are professionals, and they fool doctors, lawyers and police officers every day' tells the victim the truth and lets them keep their dignity. 'There are things we can do right now, and your report matters even if we can't get the money back' tells them why to stay involved.

The trauma-informed principles from the victimology course apply fully. Explain what will happen and why. Offer choices where possible: where to be interviewed, whether a family member or support worker can be present. Let the victim tell the story in their own order before asking for details. Avoid repeated questioning about why they did things. Say plainly what you will do next and when they will hear from you, and then make sure that happens.

Taking the report

A good cybercrime report has six parts. The first is the victim's details and how they want to be contacted, which for older victims may include a trusted family member with their permission. The second is a timeline of every contact with the offender: dates, times, the method, and what was said or written. The third is every identifier the offender used: phone numbers displayed or called back, email addresses, account names, profile links, website addresses and names given. The fourth is every payment: date, time, amount, method, the victim's account, the receiving account, wallet address or card numbers, and any reference or confirmation numbers. The fifth is what evidence the victim holds: messages, emails, call logs, receipts, screenshots, and the devices themselves. The sixth is what has been done: whether the bank has been called, whether any reports have been made elsewhere, and what referrals have been offered.

Identifiers must be copied exactly. A phone number with one wrong digit, a website address with a letter missing or a wallet address with a character swapped will send the investigator down a dead end. Where possible, officers should photograph the screen or receipt showing the identifier, or ask the victim to forward the original email or message to a police account set up for that purpose, rather than retyping it. For phone calls, the time of each call matters as much as the number, because the phone company's records are searched by time and the displayed number may be false.

# A quick completeness check before a fraud report is submitted
required = ["victim contact", "timeline of contacts", "offender identifiers",
            "payment details", "evidence held", "actions taken"]
report = {
    "victim contact": "Grace Whitford; daughter as second contact (consent given)",
    "timeline of contacts": "Feb 9 10:15 call; Feb 9 about 11:00 call; Feb 10 09:40 call",
    "offender identifiers": "",
    "payment details": "two wires of 9,200 dollars, Feb 9 and Feb 10",
    "evidence held": "",
    "actions taken": "file number issued",
}
missing = [part for part in required if not report.get(part)]
print("complete parts:", len(required) - len(missing), "of", len(required))
for part in missing:
    print("missing:", part)

complete parts: 4 of 6
missing: offender identifiers
missing: evidence held

Grace's original report, reconstructed from the call-taker's entry, would have failed this check in two places. It did not record the numbers that appeared on her phone's display, which Grace still had in her landline's call history, or the reference numbers on her wire transfer receipts, which were in her handbag. Park collected both when she visited Grace on February 12. The call times were what let her later obtain the phone company's records.

Stopping further loss

The first practical step in any fraud report is to stop further loss. The victim should call their bank at once, using the number on their card, to report the fraud, stop or recall payments, and change passwords. If an offender has had access to the victim's computer, the device should be disconnected from the internet and checked by a trusted technician, and passwords changed from a different, clean device. If identity documents or details have been stolen, the victim should take steps against identity fraud: placing a free credit freeze or fraud alert with the three national credit bureaus, using the Federal Trade Commission's IdentityTheft.gov site to make a recovery plan, and watching statements closely.

Victims should also be warned about recovery scams. People who have lost money are often contacted again, by the same group or one that has bought their details, pretending to be a law firm, a government agency or an investigator who can recover the money for a fee. Grace received exactly this call three weeks after her loss. A clear warning at the first contact, repeated in writing, can prevent a second loss.

Where reports go

Reporting to police and to the national center serve different purposes, and both matter. The local report creates a police file, starts the investigation, and lets the victim obtain a file number for their bank, insurer or employer. The national report lets the case be connected to others by the same offenders, which is often the only way a small local case becomes part of a prosecution. In the United States, victims and police can report to IC3, which shares complaints with investigators across the country, and consumers can report fraud to the Federal Trade Commission, whose database is used by thousands of law enforcement agencies. Platforms, banks and phone companies have their own reporting channels, which can lead to accounts being closed and numbers blocked.

Older victims may also need a referral for elder abuse. Most grandparent scams are committed by strangers, but some financial abuse of older adults is committed by family members, caregivers or people the victim trusts, sometimes using online banking or the victim's devices. Ohio's adult protective services, run through county job and family services agencies, receive reports of abuse, neglect and exploitation of adults aged 60 and over, and many professionals are required by law to report suspected exploitation. Officers should think about whether the fraud they are looking at is the only problem.

Keeping the victim informed

Cybercrime investigations are often long and often end without charges. Victims nonetheless have rights to information. Under Ohio's constitutional amendment known as Marsy's Law and Revised Code Chapter 2930, victims have rights to be treated with respect, to be informed and to be heard, and the federal Crime Victims' Rights Act applies in federal cases. Park sets a date for her next update at every contact and keeps it, even when the update is that nothing has changed. After the first call, Grace heard nothing for six weeks, which the victimology course scored as a failure. Park acknowledges that it was her own unit's failure: the investigators were focused on Pike's arrest and forgot to tell Grace that her case was connected to it.

Business and organizational victims

Organizations are victims too, and their reports need the same care. A small business that loses a supplier payment to business email compromise may lose its entire margin for the year. A municipality or school board hit by ransomware may be unable to serve the public for weeks. Organizational victims often report late, after consulting lawyers and insurers, and may want to limit what police are told. Officers should explain what the report will be used for, who will see it, and how sensitive information will be protected, and should record who in the organization is the contact, who else is involved, such as the insurer, an incident response firm or a lawyer, and what has already been done to the affected systems. For business email compromise, the same rule applies as for individuals: the organization's bank must be called immediately to try to recall the payment, and the receiving bank alerted, because recovery is possible only in the first hours.