Scammers Spoof RCMP Phone Numbers to Steal Financial Details

According to the Royal Canadian Mounted Police, a phone and email scam is reaching people across Canada using caller ID that shows a real RCMP number. The calls appear to come from legitimate RCMP telephone numbers in Newfoundland and Labrador, beginning in (709) 772-XXXX.

The scam works because the caller ID looks right before the caller ever speaks. Someone picks up a call that seems to be from a genuine RCMP line in Newfoundland and Labrador. The person on the other end claims to be an RCMP officer and tells the target they are the victim of a financial scam. That claim is the hook: it puts the target on the back foot, worried about money already lost, and more willing to hand over details to fix it.

What the caller actually wants

Once on the line, the scammer asks for personal, financial and sensitive information. Some targets are then directed to follow up by email, asked to verify financial information using addresses in the format firstname.lastname@rcmp.gov. That domain is not real. The RCMP does not use it.

The scam depends on two things lining up: a spoofed number that matches a real detachment, and a reason to ask for information that sounds official rather than criminal. A cold call asking for a bank account number raises suspicion. A call from someone claiming to already be helping with a financial scam does not, at least not immediately.

The RCMP states plainly what it will never do. It will never ask for money to be transferred. It will never ask for remote access to a computer. It will never ask for personal information, including name, date of birth, phone number, email, address or banking details, through text or email.

The tell

The tell is not in how the call sounds. It is in what it asks for. Any request for financial or personal details, however the caller identifies themselves, is the signal to stop. The RCMP's advice is to end the call immediately and contact a local detachment to report the incident, rather than to continue the conversation to find out more.

The same applies to the email follow-up. An email asking for financial information to be verified is not a verification step at all. It is the second half of the same approach, using a fake domain built to look close enough to the real one to pass a glance.

Anyone who gets a call or email like this should hang up or stop replying, then contact their local detachment directly to confirm whether it was genuine. That call goes out on a number the reader finds themselves, not one given to them by the person who just rang.