Cybercrimes: Attack Patterns, Preservation, and Time-Critical Response
The Cybercrimes domain tests how digital intrusion and deception produce financial loss, and which investigative steps are both lawful and time-critical. Questions center on business email compromise, account takeover, phishing infrastructure, and the preservation tools that keep evidence from disappearing while you analyze.
Attack patterns to recognize
- Business email compromise (BEC): often no malware. Look for a lookalike domain, a manipulated Reply-To header, urgency, secrecy, and changed payment instructions.
- Phishing, vishing, smishing: credential harvesting, MFA fatigue prompts, session-token theft.
- Account takeover: credential stuffing, infostealer malware, SIM swap.
- Ransomware and extortion: encryption plus data theft for double extortion.
- Card-not-present and carding: dark-web marketplaces, automated BIN attacks.
Legal hooks and first moves
- 18 U.S.C. §1030 (CFAA) for unauthorized access; §1343 wire fraud for the money movement; §1028 for identity documents.
- Preservation letter under 18 U.S.C. §2703(f): 90 days, renewable. Send it before the provider's retention window closes.
- Email headers: read the Received chain from the bottom up; check SPF, DKIM, and DMARC results and the originating IP.
- Domain checks: registration date, registrar, privacy proxy, lookalike spelling, hosting ASN.
- Fund recall: the FBI Financial Fraud Kill Chain and correspondent-bank recall requests work best within 24 to 72 hours.
Worked example
A controller wires $180,000 after an email appearing to come from the CEO about a new vendor. The header shows From: [email protected] but Reply-To: [email protected], an SPF softfail, and a .co domain registered nine days earlier behind a privacy proxy. The originating IP resolves to a commercial VPN. Correct sequence: preserve the mailbox and mail-server logs, notify the sending and receiving banks immediately to attempt recall, file an IC3 complaint, then continue attribution. The VPN address alone will not identify a person, and saying it does is a common analytical error.
Traps that cost marks
- Equating an IP address with a human suspect.
- Waiting for complete analysis before calling the bank.
- Confusing a spoofed display name with a lookalike domain that actually sent the mail.
- Letting provider logs expire because no preservation letter was sent.
- Assuming a successful recall means the case is closed; document the attempt either way.