The French Authorities Are After Me - Maybe?

I've never been at the center of an international investigation before. Well, at least one that I knew about. But that all changed last week. Let me tell you the story.

How It Started

I was innocently driving along (unless you feel I was being criminal because I may have exceeded the posted speed limit by a little) and my phone rang. Since neither my phone or watch were showing me the dreaded "Suspected SCAM Call" identity on the phone number, and it was a US number, I answered. (It did say "wireless caller," which leads to some questions) The first thing I heard was a <beep>, as I've heard before on recorded lines. The gentleman who spoke to me didn't identify himself by name at first, but did tell me he was calling on behalf of the French Consulate in San Francisco. It seems that my identity was tied to a cellular number in France that the Paris Police were investigating because it was sending SMS phishing/spam and making phone calls for similar reasons.

He went on for a bit and I told him I was driving and had not ability to check my records or respond to his concerns. (I've had one temporary SIM for an overseas trip, but I knew it wasn't French, still, I hesitated to be entirely confident) He offered that I could show up in person to the San Francisco consulate and sort this out. I thanked him for that offer, but pointed out that I was half a country away and unlike in his country that was a trip requiring an airplane, not a short car ride. He asked if I could safely pull over to discuss and I told him that I could not. He asked when to call back and I told him a time in both Central (my time zone) and Pacific (his) to call back. He then told me he was Michael and would do so.

Breathing Space

Well, I made it home and I have to admit, part of me wasn't sure if this was really a case of my identity being stolen. I know my info is out there - I have a cell phone with one of the major US providers, which all but guarantees my info is out there somewhere, they've all been breached in the past 10 years. But I digress.

So I did a few things:

1. I reached out to some cybersecurity friends for their reactions. Luckily for me one of them knows people who know French law enforcement. Their response was that this was fishy.
2. I checked the Internet for where the French have embassies and consulates in the US. (spoiler alert: there are several closer to me than San Francisco)
3. How French phone numbers are formatted.
4. I asked my friendly neighborhood AI for input, which you see below:

Well, that all convinced me that this was a phishing attempt. I reviewed what I had said on the call, and short of them doing an AI deepfake on my voice - something I couldn't protect against unless I said nothing at all - I didn't share anything with them they didn't already know: that I answered my phone (they didn't even ask my name), and that I was driving and needed them to call back later.

Perhaps naively I assumed that was the end of it. They wouldn't waste time calling me back, would they? Nah. The phone rang again.

Send In the Closer

Since "Michael" wasn't able to close me earlier, they had someone else call. I failed to write down his name, but it was definitely a different voice. From a different number. Also a "wireless caller," with a completely different California prefix and number. He started out quite sympathetic. (I didn't get a voice recording of the call - I don't recall the legality of doing that in my state without both sides knowing about it, and he called almost 2 hours earlier than we had agreed on, so I didn't have time to prepare) But he was working hard to steer the conversation this way:

"I'll happily connect you directly to the Paris Police via our 'intergovernmental phone system' so you can give them your information and they can clear you, but we only have 2 hours to do so."

In order to help me along he offered me some important information to write down: in fact he asked me several times to take this info down:

• The date that the SIM was activated
• That he was calling from the Consulate General of France, San Francisco
• The "tracking number" of the case file
• The phone number, which it turns out was legitimately a possible French cellular number, after I did some digging..

It was pretty thorough. But here were the things that set me off:

1. The time limit. The two hour window for me to contact the Paris Police was 10:30 PM to 12:30 AM local Paris time. They made very vague references to the "urgency" of this situation, but made no mention of any life or safety threatening events that determining ownership of this phone number was critical to resolving. What's so urgent about identifying the owner of a cell phone number after most of the police force has gone home for the night if there isn't a life-or-death issue? If you ask the FTC, FBI, or local police to rush looking into phishing attacks they're going to politely (I hope) tell you to get in line.
2. The resistance to sharing any documents. Everything they pushed was to resolve this over the phone. Can't email me data because it is too sensitive - that changed later to "our email team is too busy, it would take too long." Won't send me hard copies because it would take too long, but if I wanted to come to the San Francisco office I could see them.
3. Why I was being "forced to" the San Francisco location when there is a different one within an hour's drive of my home, something I'd assume they knew if they already knew who I was. The answer? Well, these documents were rushed to us in San Francisco, the Chicago office can't help me in time (again with the short timeline).

He began being what I'll call "bureaucratically hostile," doing a fairly good job of trying to push me into doing what he wanted without yelling.

Eventually I hung up. They've tried calling twice since, from two additional numbers, none of which could even be assumed to come from the consulate's switchboard.

Shaken, Not Stirred

I don't mind telling you, the whole thing has affected me, and I'm supposed to be part of the industry that is "immune" to this stuff. We're the ones who are supposed to sniff out phishing attempts as if they're dirty diapers and we're experienced daycare workers. After all, we're the guardians of the data, the cyber warriors, the last line of digital defense. None of that mattered.

At first I was concerned that this was really an identity theft situation, and so I was concerned that I was going to have a long legal pain in the ass in store for me. That got me off of my game and thinking defensively, not alertly. Then I started getting angry. I know I don't always make the best decisions when angry either, and if I had stayed on the line I might have shared info that could have further compromised me in terms of giving them something else to dig at.

This also isn't the first time my immediate family has almost been taken in by a phishing scam. And it reinforces for me that, sadly, we all need to be extremely vigilant these days.

What Should You (or I) Do Next Time?

So learning from my own mistakes - since I clearly haven't learned from those of others - I'm going to keep these ideas in mind next time I get a potential scam call like this:

1. Be wary of anyone who refuses to offer you documentation - governments thrive on forms, and any government entity that expects you to comply with it should be showing you more paperwork than you can shake a stick at: ticket, signed warrant, etc.
2. Be wary of arbitrary time pressures. Governments are never "fast." (seriously, visit your local DMV to remind yourself of this if you need to). They operate at the pace of bureaucracy, even law enforcement. Don't let people pressure you into sharing info or the like based on some extremely short timeline.
3. Watch out for "if you have nothing to hide why don't you talk to..." or variations on a theme. You're about to be pumped for information that you probably shouldn't share.
4. Don't engage. Don't give them any information they don't already share with you first. If they ask for your address ask them to tell you what address they have for you. If they ask you for your full name, ask them to tell you what they have down. HANG UP.
5. If you have doubts, take down whatever info they share with you and find 3rd party resources to check things against. In this case I looked up where French consulates were, checked on how French phone numbers are formatted, etc. If I was still worried this was legit I could call any of the switchboard numbers for French consulates in the US and asked them about this. They would have quickly told me it was a scam - real authorities don't appreciate it when scammers impersonate them.
6. Report the numbers calling you to the FTC. Sure, they're probably not being used again by the same people, but a little info is better than none.

Good luck out there! And if you see any French Police feel free to say you don't know me.