Cyber kidnapping scam: What it is, and how to avoid becoming a victim

What is cyber kidnapping? 

Cyber kidnapping (or virtual kidnapping) is a type of online fraud where criminals trick someone into believing that a loved one has been kidnapped. These scams rely on fear, urgency, and technology, such as AI-generated voices and fake GPS data, to make the situation seem real and push people into handing over money quickly.

How does cyber kidnapping work?

Cyber kidnapping uses psychology and technology to create fear, pressuring someone into acting urgently to protect a loved one they believe has been kidnapped. These scams usually follow these steps:

1. 1.Choosing a target. Criminals often look for individuals who can pay a hefty ransom. However, sometimes, they will just cold call until someone falls for the scam.
2. 2.Gathering information. After identifying a potential target, scammers will carry out vishing (voice phishing) and collect personal data from sources like social media, data hacks, and other breaches. 
3. 3.Creating a story. Using the gathered data, criminals craft an emotionally charged scenario designed to frighten the target into making rushed decisions.
4. 4.Creating fake recordings. Scammers may obtain biometric data, like voice recordings, from the supposed kidnapping victim’s social media. Criminals can even use deepfake technology and generative AI to create realistic voices.
5. 5.Figuring out the timing. Cybercriminals monitor social media to find a time when the person they are pretending to have kidnapped will be away from family for an extended period.
6. 6.Making contact. The attacker reaches out to the scam target by phone, email, or social media, claiming their loved one is in danger. They use high-pressure tactics to demand quick action, sometimes playing pre-recorded screams to create urgency. They can even use fake GPS data to make it seem as if the alleged victim is in a dangerous location.
7. 7.Demanding a ransom. Once the scam target is convinced, the caller demands a ransom, typically through untraceable methods like cryptocurrency or gift cards.
8. 8.Covering their tracks. After receiving payment, the criminal deletes evidence, such as files and messages, and disposes of burner phones to avoid being traced.

Real-life cases of cyber kidnapping

Cyber kidnappers have used fear tactics and technology to manipulate people in several alarming cases. These incidents reveal how the scam works and the warning signs to watch for.

Kai Zhuang

A Chinese exchange student, Kai Zhuang, was found “cold and scared” in a tent in the Utah wilderness in January 2024. His parents reported paying an $80,000 ransom, telling the Riverdale Police Department he had been kidnapped. In reality, scammers manipulated the 17-year-old into isolating himself and sending a photo, which was then used to convince his parents he had been kidnapped.

The daughter of Jennifer DeStefano

Jennifer DeStefano picked up an anonymous call in April 2023 from a virtual kidnapper who demanded $1 million, saying they’d kidnapped her 15-year-old daughter. In the background, DeStefano said she could hear her daughter crying and screaming. “Mom, I messed up,” the voice said. The police arrived shortly after, and during that time, the ransom dropped to $50,000. Before any money was paid, DeStefano managed to contact her daughter and confirmed she was safe.

How to not fall victim to a cyber kidnapping scam

You can take several steps to protect yourself from falling for this type of scam. First, it's important to understand the hallmarks of a virtual kidnapper:

• The calls may not come from a family member's phone.
• Callers will try their best to keep you on the phone.
• Callers are usually not able to answer simple questions like what they look like.
• Callers ask for the ransom to be sent to a number of people in small amounts. 

In addition to recognizing these red flags, consider using the following strategies to safeguard yourself from cyber kidnapping scams:

• Limit the info you share publicly. Try to avoid sharing personal details like where you are, travel plans, and family information. Criminals can often use this data to create a convincing story. 
• Protect your phone and account. Use strong, unique passwords or passkeys for all your accounts and enable two-factor authentication (2FA) whenever possible. Passkeys are a newer, more secure alternative to passwords that help prevent phishing. Also, regularly update your software to protect against security vulnerabilities.
• Report and block suspicious calls. If you get a call from an unknown number making ransom demands, do not engage. Hang up immediately and report it to the police. Block suspicious numbers.
• Use a VPN. Cyber kidnapping can happen over the phone but also on the web. A VPN encrypts your internet connection and makes it more difficult for cybercriminals to track what you’re doing online, steal personal info, or use your virtual location data against you.

What to do if you’re being targeted

What should you do if you think you’re being targeted by a virtual kidnapper? It may seem like the most difficult situation you’ve ever dealt with, but here are some tips on what to do: 

• Try to slow the situation down. The scammer's goal is to make you act before you think. Ask to speak directly to your loved one or contact them through another method to verify their safety.
• Document everything. Take screenshots and record phone calls if that’s possible. The information can be used by the police to track the scammers down.
• Contact law enforcement as soon as possible. Make sure you report cybercrime so the police can investigate and stop it from happening to others.