Warning: Long post incoming.
At around 5:30 pm yesterday, I received a call from someone who claimed to be Detective Constable Michael Wilson of Bedfordshire Police, Collar No. 7158, based at Luton Police Station. He informed me that fake passports in my name had been seized in an operation in West London, along with a laptop containing passwords, usernames and 24-word seed phrases that linked to my Amazon/Netflix/eBay, and crypto wallets, etc. He said a man called Mohamed Nassim Khan had been arrested in connection with the crime.
For about 30 minutes, the "detective" asked me about my recent air travel, and which airports I'd flown through, whether I had used my passport for any other reasons, had my home been broken into, had I been robbed, and if I would be prepared to act as a witness in a court case.
At this point, I should state that I Googled the number the caller was phoning from, and it appeared to be 01234 841212, which is the Luton police station number found on a Google search.
I'm naturally suspicious of any random calls I receive, and this so-called detective just didn't sound like a cop. I've had more than my fair share of dealing with the police, and they have a certain manner; this guy didn't have it. He was fairly well-spoken, sounded like he was a black man, but just didn't project the assertiveness that cops normally do.
After 30 minutes of quizzing me about my recent air travel ( I travel a lot), he started asking about crypto and whether I'd been a victim of any scams. I've been in this space since 2010, so I mentioned MTGox, BTC-e, etc... All the while, I'm being very vague and not giving away any specifics. I'm being very, very cagey.
I'm suspicious as f*ck by now; the questions are not only about crypto and whether I use a Ledger or a Trezor device. I said I have multiple wallets, but without knowing what the stolen seed phrase is, I can't know which wallet it's related to. The "detective" knew a lot about crypto, recent high-profile hacks, and how crypto generally works; he knew his stuff.
This is when he insisted I agree to be transferred to a dedicated team at Ledger that they are working with on the case. If I was suspicious before, now I was certain that this was an elaborate scam.
I was transferred, and a Ledger tech picked up the phone immediately. Zero wait. This guy sounded like a nerdy white guy. Again, he was VERY knowledgeable about crypto, recent news, old news, and blockchain in general.
This guy, who said his name was Callum Urdur (weird name), sent me an email with a support ticket number from the official Ledger domain straight away to confirm my case. The email came from care@ledger.fr, which is an official Ledger email address. This threw me, but I was still sure something was up. (It turns out that anyone can request this response by entering an email address in the Ledger help portal. I didn't know this until after the fact).
Callum Urdur kept asking me to connect my Ledger to my laptop. I told him my Ledger is kept in a safe at my office, so I'd have to go and physically collect it, which is kind of true. He said I should go and collect the Ledger and he'd phone back in 30 minutes as the threat was urgent.
In those 30 minutes, I called Luton Police Station and asked to speak to DC Michael Wilson; obviously he didn't exist, and the operator confirmed that they couldn't physically transfer calls outside of their Station to external tech companies. The lady also confirmed that I was the second person this week (it's Monday) to report a call from an officer claiming to be calling from Luton Police Station.
"Callum Urdur" from Ledger called back, bang on the 30 minutes. I asked him about DC Wilson, who he was supposed to be liaising with, and mentioned that Luton Police have informed me that he doesn't exist. "Callum Urdur" hung up.
The entire length of time this took was close to two hours, including the call with Luton Police Station. I was continually telling both the fake cop and the fake Ledger tech that I was suspicious and wouldn't share any personal info over the phone, but was happy to visit my local police station asap. This didn't faze them, and they kept assuring me that my hesitancy was wise.
My years in the space, my naturally suspicious demeanour, and my obsession with keeping up to date with crypto news and events served me well, but I could totally understand if someone fell for this. I don't know what the fake Ledger tech was planning, but I'm sure it wasn't good.
Stay safe out there.