Law enforcement impersonation became a mainstream business fraud in 2026, with federal authorities warning that criminals are using synthetic voice and video to pose as senior officials. The technique works because it targets a gap every other control leaves open. Your payment approval rules assume a request comes from inside the business or from a vendor. Your privacy process assumes a data request arrives in writing from a known party. A caller claiming to be a federal agent fits neither, arrives with urgency and authority, and lands with whoever answers the phone. That person is usually the newest member of staff, and nobody has ever told them they are allowed to ask a federal agent for a reference number.
The Five Points to Settle Before the Call Comes
Each is a decision somebody should make while nothing is happening.
- Nobody is authorized to act on an unverified call. Not for data, not for money, not for access, regardless of who the caller claims to be.
- Verification means calling the agency’s published number. Never a number the caller supplies, and never a number from a document they sent.
- Real requests arrive on paper. Legal process comes through channels with a reference you can check, not as a demand for immediate action by phone.
- The front desk needs an escalation path, not a judgment call. One named person to transfer to, every time.
- Urgency is the tell. Genuine legal process moves at legal speed and rarely requires something in the next hour.
Our note on how businesses lose money to cyber-enabled fraud without noticing covers the adjacent versions of this.
Why Law Enforcement Impersonation Beats Your Existing Controls
Every fraud control in a typical business is built around one of two relationships, and a claimed government official belongs to neither. Payment controls handle requests from colleagues and suppliers, with approval thresholds and callbacks tuned to those. Data handling processes handle customers and partners, with verification steps designed for people who have a record in your systems. A caller asserting official authority sits outside both frameworks, and the frameworks have nothing to say about them. So staff fall back on instinct, and instinct in the face of claimed authority is compliance. Add synthetic audio capable of producing a convincing voice and video capable of producing a convincing face, and the remaining defense is a procedure rather than a perception.
The Request Is Usually Something Small
Impersonators rarely open by asking for money, because the first request is designed to establish the relationship rather than to extract value. Confirm an employee’s details. Send over a copy of a document. Provide a phone number for somebody in finance. Hold a line open. Each of those is easy to comply with, none of them feels like fraud, and together they produce the material for a second call that asks for something larger and arrives with the credibility of an established conversation. Treat the first small request as the moment to verify, which means having a rule that covers small requests rather than only significant ones. The counterargument that verifying every trivial enquiry is impractical has weight for routine business calls, and it does not apply here, because the number of genuine unsolicited law enforcement calls a small business receives in a year is close to zero.
Authority Is Designed to Suppress the Question
The technique relies on your staff feeling that asking for verification is itself an offense, and that feeling has to be dismantled explicitly rather than assumed away. A person claiming to be a federal agent, referencing an investigation and implying consequences for obstruction, puts an ordinary employee in a position where the safe-feeling choice is to help. Say plainly, in advance and out loud, that verifying identity is expected of them, that no legitimate official objects to it, and that nobody in your business will ever be criticized for asking. Then give them the words. The same social mechanics govern our wire transfer fraud guidance, and the fix is the same: the permission must be granted before the moment, because in the moment nobody feels able to grant it to themselves.
Building the Procedure People Will Actually Use
The procedure has to be short enough to remember under pressure, which rules out anything with branches. One rule, one action, one destination. When somebody calls claiming to represent any government agency, the person taking the call does not answer questions, does not confirm details, and transfers to a named individual, or takes a number and a name and says somebody will call back. That is the whole thing. Complexity is what makes procedures fail here, because the caller is actively working to prevent careful thought.
Script the Front Desk, and Practice It Twice
A scripted response removes the need for anybody to improvise politeness under pressure, which is the hard part rather than the decision itself. Something like: I am not able to discuss that, I will take your name and agency and have the right person call you back on your agency’s main line. It is courteous, it commits to nothing, and it does not require the person to assess whether the caller is genuine. Practice it twice in a team meeting, which is enough to make the words available when needed. The objection is that role-playing feels awkward and staff dislike it, and they do. Five minutes twice a year is the whole investment, and it converts a rule people have read into a sentence they can say, which our note on multi-layered security training argues is the only part that changes behavior.
Name One Person, Not a Department
Escalation to a role works and escalation to a department does not, because a department is a place a call goes to die while somebody works out whose problem it is. Name the person and their deputy, make sure the front desk knows both, and make sure both know they own this. That person’s job is not to determine whether the caller is genuine on the spot either. It is to take the details, end the call, and verify through the agency’s published contact route, which is a slower and entirely defensible way to proceed. Firms that skip this step end up with a genuine-sounding caller being passed around until they reach somebody senior enough to be embarrassed about asking for verification, which is exactly the outcome the technique is engineered to produce.
What a Genuine Request Looks Like
Real legal process is slower, more formal, and more documented than the impersonated version, which is what makes the comparison useful to staff. Requests for records generally arrive as legal process with a case reference, an issuing authority, and a return timeframe measured in days or weeks. There is almost always a way to verify it independently through the issuing body. There is almost never a requirement to act within the hour, to keep it confidential from your own leadership, or to provide something by phone right now. Those three demands together are close to diagnostic, and teaching staff to recognize the shape is more durable than teaching them to recognize a scam.
Confidentiality Demands Deserve Extra Scrutiny
A caller instructing your staff not to tell anybody internally is describing the conditions under which fraud succeeds, and that instruction should escalate rather than restrict. There are genuine circumstances where a legal instrument prohibits disclosure, and those arrive as a documented instrument that names what may not be disclosed and to whom, not as a verbal instruction to a receptionist. So the rule is workable: any verbal instruction to keep something from your own management goes straight to management. Staff find this one easy to remember because it inverts cleanly. The fair counterpoint is that a business could theoretically interfere with a genuine investigation this way, and the practical answer is that verifying through the agency’s own published line resolves it in both directions without anybody having to guess.
Write Down What Happened, Even If Nothing Did
A short record of every unsolicited call claiming official authority is worth keeping, because the pattern is more informative than the individual call. Note the date, the claimed name and agency, what was asked for, and what your staff did. Three such calls in a fortnight is a targeting campaign rather than a coincidence, and knowing that changes how you brief people and whether you report it. Most businesses record nothing, so the second call is assessed as if it were the first. This is the same argument our incident response planning guidance makes about near misses, and the record costs a minute. It also gives you something concrete to hand to actual law enforcement if you decide to report it, which our incident response practice finds is the difference between a report that goes somewhere and one that does not.
Cover the Channels That Are Not the Phone
The same approach arrives by email, by messaging app, and increasingly by video call, so a procedure written only for the telephone leaves three doors open. An emailed notice carrying an agency seal is easy to produce and easy to believe, particularly when it references a real case number format. A video call showing a person in what looks like an official setting is now within reach of anybody with ordinary tools, and it is more persuasive than either of the others because people still treat seeing a face as verification.
The rule transfers without modification, which is the useful part: no action on an unverified contact, verify through the agency’s own published route, escalate to the named person. What changes is only where staff encounter it, so say explicitly that the rule covers every channel rather than leaving them to infer it from a policy that happens to mention calls. The reasonable objection is that written contact feels more legitimate and refusing to engage with an official-looking letter seems obstructive. Nothing in the rule requires refusing to engage. It requires confirming through an independent route before acting, which is a step a genuine official expects and a fabricated one cannot survive.
Frequently Asked Questions
Can I refuse to answer questions from someone claiming to be a federal agent?
You can decline to discuss matters on an unverified inbound call and offer to call back through the agency’s published number. No legitimate official objects to verification, and your staff should be told so explicitly.
How do I verify an official caller?
Look up the agency’s main published number independently and call it. Never use a number the caller gives you, and never rely on a document they send, since both are trivially fabricated.
What does a genuine records request look like?
Formal legal process with a case reference and an issuing authority, arriving through a documented channel with a response window measured in days or weeks rather than minutes.
Should a small business train reception for this?
Yes, and it is five minutes. One scripted sentence and one named person to transfer to covers the whole category, and reception is precisely where these calls land.
What if the caller says we cannot tell our own management?
Escalate immediately. Genuine non-disclosure obligations arrive as documented legal instruments, not as a verbal instruction to whoever answered the phone.
Who You Are Taking This Advice From
Mindcore writes and rehearses these procedures with businesses where reception, accounts, and IT are three people who also do other jobs, which is the environment this technique is built for. We script the sentence, name the escalation point and their deputy, and put the short call record somewhere that makes a pattern visible, and the guidance above comes from procedures we have built and calls clients have actually received rather than from an advisory bulletin. Matt Rosenthal, who leads Mindcore, keeps the firm focused on controls that work when somebody is being pressured by a stranger who sounds official, which means a script rather than a judgment. Your staff should not have to evaluate a professional impersonator. Our job is to make sure they never have to.
Your Next Move on Impersonation Risk
Decide who the named escalation point is and tell the people who answer your phones, today, because that single decision does most of the work here. Give them the sentence to say, and have a leader state plainly that asking any caller to be verified is expected and will never be held against them. Then add one line to whatever you use to record incidents, so an unsolicited call claiming official authority gets written down even when nothing was disclosed, and a pattern becomes visible rather than getting lost in individual memories. Spend five minutes at a team meeting practicing the sentence out loud, since a rule people have read is not the same as words they can reach for. None of this costs money and none of it requires a product. What makes firms vulnerable to this is not a missing control, it is that the most junior person in the building has never been told they are allowed to say no to authority. If you want help writing the procedure and rehearsing it with your team, book a free strategy call and we will start with whoever answers your main line.
