Virtual kidnappings are rattling families across the US

“I have your son and I’m going to f*ck him up,” a voice on the other side of the phone said.

For two hours one afternoon in early April, 61-year-old Joseph Baker and his wife Maggie drove around their city, listening to every demand of their son Jake’s supposed kidnapper.

“If you call the police, I will know and kill him,” he threatened, according to the Bakers. “I have a scanner.”

The caller ID on Joseph’s smartphone display said the call was coming from his son’s number. The couple had no reason not to believe the man on the other end of the line, who knew personal details about the family, including where they lived.

(The victims’ names and other details have been changed for their protection.)

Related article The frightening future of robocalls: Numbers and voices you know

They complied with his orders, purchasing two pre-paid debit bank cards, relaying the card numbers to the kidnapper and filming themselves flushing the evidence down the toilet.

When Joseph hung up, he called the police, who rushed to his son’s house along with a team of medics. But they found Jake home, unharmed. It was all a scam.

“It was so real,” Maggie Baker told CNN Business. “People will do anything to help a loved one. … I keep thinking through things now. Is there anything I could have done to stop this?”

Stories like the Bakers’ are increasingly common due to the influx of spoofing, a form of robo-calling that lets a perpetrator alter what number it appears they are calling from. They can then use that number, combined with personal information they find online, to fake a situation like a kidnapping.

How scammers fake a kidnapping

“We’ve seen an uptick in virtual kidnappings in the past few years because the crime is lucrative and there’s not a lot detection from law enforcement,” Matthew Horton, the FBI’s international violent crimes unit chief, who’s been closely following virtual kidnappings, told CNN Business. “It’s a quick way to make money — and it’s a lot easier to conduct a virtual kidnapping than a real one.”

Spoofing involves a call placed from any voice-over-IP service, such as Skype, or a specialized app that allows users to enter any host number they want — whether it’s a made up number, a number in their address book, or one from the White House. It’s so easy, anyone could do it.

Skype declined a request for comment.

Some of these scams also come from pre-paid phones that are not registered and not attributable to a person.

The incidents can leave victims bilked out of up to thousands of dollars and emotionally shaken. Because a scammer knows a potential victim is more likely to pick up if they recognize the caller, they might enter a number they think is in their target’s address book.

It’s hard to quantify how common the scams are. The FBI said it does not collect national statistics on virtual kidnappings because “most victims tend to report the crime to their local law enforcement department or not report it at all.”

In some cases, victims say they hear screams in the background pretending to be from a daughter or son. Another spoofing scam targets parents and grandparents who are asked to bail their child out of jail.

But Horton noted the majority of virtual kidnapping scams that he sees aren’t targeted: “Many of these cases are done at random based on cold-calling numbers, even hotel rooms or wealthy area codes, and using social media posts to search for more information.”

Related article What you can do right now to stop robocalls

This type of scam is difficult to crack down on because of where they start. An FBI investigation out of its Los Angeles Division in 2017 found the majority of virtual kidnapping calls originated in Mexico — and that many came from within prisons there. Originally the calls targeted Spanish speakers in Los Angeles and Houston areas. Now they also happen in English and have expanded to other US cities.

“The incarcerated fraudsters — who typically bribe guards to acquire cell phones — would choose an affluent area such as Beverly Hills, California,” said FBI Los Angeles Special Agent Erik Arbuthnot in a blog post detailing the scams. “They would search the Internet to learn the correct area code and telephone dialing prefix. Then, with nothing but time on their hands, they would start dialing numbers in sequence, trolling for victims.”

Horton, who confirmed most virtual kidnappings that he’s aware of still originate from Mexico, said some criminals use spoofing apps to help orchestrate schemes.

Social media, and breaches, have also made it easier for scammers to find out personal details about their targets, and their targets’ friends and relatives.

Still, as in the Baker family’s case, the ransom demand is often low so that the scammers can skirt laws that regulate money transfers across the border.

“It’s easier to avoid some laws and red flags if you’re wiring small amounts of money,” Horton told CNN Business. “A family is also more likely to have smaller amounts of money on hand or get access to those funds more easily, especially after bank hours.”

Horton said the criminals typically put pressure on the victims to pay quickly and sometimes demand more money after the first transaction is complete.

Jake Baker, who calls the situation “traumatizing” for his family, said the local police department didn’t seem optimistic they’d be able track down the criminal.

“I was told that because there are only a few breadcrumbs, it might be tricky to find them,” he said. “I was also told that it’s a small enough of a dollar amount that it won’t likely trigger a bigger investigation.”

The city’s police department did not respond to a request for comment.

The FCC’s efforts to crack down on scam calls from unknown numbers, or from numbers pretending to be someone the recipient knows, have been slow moving but the telecom industry is working on a tool called Stir/Shaken to identify and trace spoofing efforts. AT&T, Comcast and Verizon have already completed tests, and other providers have pledged to embrace Stir/Shaken by the end of 2019. (AT&T owns CNN’s parent company, WarnerMedia.)

On Wednesday the FCC unveiled a proposal to limit unwanted robocalls that could allow carriers to apply robocall-blocking technologies to customer accounts automatically.

Meanwhile, carriers including Verizon, AT&T and T-Mobile offer free-to-download apps that autoblock robocalls and spoofing efforts. Sprint offers a paid robocall labeling and blocking service called Premium Caller ID that lets users receive information about the type of call coming in and set up preferences to block spoofed attempts.

Who’s at risk?

Tarun Wadhwa, who founded tech advisory firm Day One Insights and who closely studies issues related to identity, forgery technologies, and cybersecurity, likens virtual kidnapping to phishing. That’s when scammers or hackers send messages made to look like they’re coming from someone the victim knows, asking them to give up information or take an action like entering a password.

“This has been one of the most persistent, damaging threats in cybersecurity, all because it’s not really a technology problem,” Wadhwa said. “It’s a human psychology problem. They prey upon the fact that we are busy and are not suspicious of the veracity of every message we are seeing. It seems so simple, but I’ve seen incredibly smart people fall for this.”

Some people don’t report virtual kidnappings because they’re embarrassed they fell for a scam, want to forget what happened or know it’s a challenge for law enforcement to track down the culprits. But Horton of the FBI argues it’s critical for authorities to keep track of these incidents, and for people to spread awareness about spoofing scams so families can be prepared.

“If found in this position, we advise people to remain calm and stall the person on the phone,” Horton said. “Try to contact the victim by phone or voice or social media, such as Snapchatting them to get in touch and make sure they’re okay. It’s also good to get some proof of life or a photograph or ask to talk to the person.”

Wadhwa believes spoofing scams will only get more complex thanks to advancements in voice manipulation technology. (Think deepfakes for robocalls.) A virtual kidnapper could potentially one day mimic the voice of a loved one, in addition to their phone number.

“The challenge ahead of us is enormous: We have to convince people that what their eyes are seeing, ears are hearing, and mind is recognizing is not actually what’s going on,” Wadhwa said. “That’s an incredibly hard thing to do. And the better that gets, the more people will fall victim.”

The Baker family has since implemented a safe word they can use if they’re ever in the same situation again. They’ve also taken steps to remove personal information from the internet, making it more difficult for strangers to learn intimate details about their family.

“My son is safe and I’m thankful, but I care about all of the other parents out there going through this or will go through this in the future,” said Maggie Baker.