Unpacking an extortion scam

I have zero patience or compassion for people who spend their time scamming others. I usually ignore the multiple scam attempts that find their way to my inbox (or more usually spam folder), but I wanted to highlight this one to show just how inept it often is, and just how many red flags it has:

The email purports to come from Kripos – the National Criminal Investigative Service – but is being sent from a GMail address? That’s kind of weird. It’s also sent to multiple recipients, and my address here is one which I know for a fact has never been used to contact any government office (but which has been featured in a data leak some years ago, featured on HIBP).

The text appears to refer to some sort of agreement made the day before this was received, but I’m not aware of having made any agreement with them. The email has an attachment, with the file name Norwayyyyy.jpg. GMail has flagged it as spam. Those are seven red flags before even opening the attachment.

Having checked the attachment for viruses, I opened it, and the red flags continue to abound:

Starting from the top, the first few lines look OK (assuming that we ignore the Norwegian flag at the top), but when we get to “DEN NASJONALE KRIMINALPOLIET”, it starts falling apart. Wrong demonstrative pronoun, followed by a misspelling of kriminalpolitiet. There’s no such government entity – the closest thing is the former title of Kripos – Kriminalpolitisentralen. “SITERING TIL DOMSTOLEN For en rettslig undersøkelse” makes zero sense in Norwegian. Like the above wrong demonstrative pronoun, this makes me suspect how the document was created. More on that in a moment.

No Norwegian would refer to a specific legal provision as an “Artikkel”, and the citation itself (390-1) is malformed. As an aside, the cited law refers to reopening of a criminal case. All of the next section makes no sense. There’s no way you would introduce yourself like this, and the use of “fru” further confirms my suspicions about the origins of the document. The text in all caps and red font is another red flag. This is simply not how a document like this would look.

The following section again makes zero sense from a grammatical or syntactical point of view, and the cited law doesn’t actually exist. The recipient is then asked to respond to yet another GMail address, which is almost, but not entirely, unlike the former. Again, it makes no sense from a grammatical or syntactical point of view. The final full section is much of the same, though I did particularly chuckle at “sjefsjef”.

That brings us to twenty relatively clear and obvious red flags. Most of them are actually the result of the original document most likely not being in Norwegian. I strongly suspect that the original document has been auto-translated from another language – probably English. There are some word choices that just don’t make any sense – I count eight at a first glance.

What’s more, there is simply no way that this is how it would be handled. I’ve got a high degree of confidence in saying that, were I to contact the specified email address, I would be offered an opportunity to close the entire thing if I were to pay a sum of money to some foreign recipient. The whole thing is so lacking in credibility as to be funny.

Sadly, far too many people will not look critically at it. Rather, they will panic, respond to the scammer, and be at risk for getting scammed.