I didn’t realize the caller’s number, which had a French area code.
A sharp voice on the other end of the line greeted me, identifying himself as an official with the American government.
Had I been reaching out to him on WhatsApp in search of knowledge, he asked me for help?
I made a pause. As an investigative writer at ProPublica, I’m reaching out to a lot of people all the time. However, as I racked my mind, I was unable to identify any Canadians who I had just tried to find.
The person warned against it because it appears as though one is impersonating you.
I was at a loss. What was the subject of Fake Me’s question? Was my name or my photo used by them only? How may I be sure the person warning me about this impostor wasn’t really an impostor himself?
The American standard assured me that he would give a message from his state email to verify his identity and that he would include screenshots of his exchange with Fake Me. I thanked him and we exchanged kisses. Before saying goodbye, I asked him if there was anything he’d except to get on the radar of an investigative reporter. ( Without even realizing it, I was using him for information. ) Perhaps Fake Me and True Me aren’t that dissimilar.
The screenshots the Canadian sent over after showed people with a Miami range using my ProPublica picture as their page photograph. I’ve always resided in Florida.
Fake Me referred to Robert Faturechi from ProPublica as” This is Robert Faturechi.” ” I really need to get in touch with you”.
The American requested that I refrain from divulging too much information about his job, which involves dealing with different nations, including Ukraine.
I gave ProPublica’s safety staff a heads-up. They told me that there was little we may do away from reporting the false accounts to WhatsApp.
We did, and I put the situation to bed until two weeks later when I received a second notice.
This time, a businessman from Latvia claimed to be the owner of an organization that provides military equipment to the Russian military and is working with the Russian forces on a drone development project.
” Hey”! The Latvian contacted me via Linked In. ” Was fun to talk on Signal! This link here as well”!
The only issue was that I had never interacted with him via Signal, an encrypted communications app.
The Romanian contacted me on LinkedIn because he was concerned that True Me on Signal wasn’t speaking to him. He sent over pictures of someone using my picture and claiming to get me.
Am I correct to say that you are an authority on the subject of UAVs? Unmanned aerial vehicles, a posh name for drones, were the subject of a message sent to the Estonian by Fake Me.
” My users”, the impostor explained, “are particularly interested in the application of UAVs in Ukraine”.
The Latvian had offered to speak with the Latvian about the subject in a phone conversation, but Fake Me ( who could be a man or woman ) declined, claiming that they weren’t” comfortable” talking on the phone. They asked if the Latvian was “record a voice information on this topic” or to remain the” talk in written structure.”
The Romanian, growing cautious, insisted on a video phone. Fake Me accepted, sending him step-by-step guidelines that they claimed may lead to a stable movie chat, but it turned out to be an attempt to deceive the Latvian into granting him access to his email address.
In the end, the Latvian halted Fake Me.
The imitations were disquieting. With the public’s confidence in the internet so low and the rise in attacks on journalists by those in authority, investigative reporting is difficult enough. Making possible solutions more difficult for us to deal with only makes things harder.
I can’t be sure what Fake Me is up to, but posing as a journalist in this way seems to be the latest advancement in online fraud. In the dark world of animal killing, human traffickers in Asia push their victims to con them by pretending to be friends or potential romantic partners, ProPublica has documented the dark planet of pig butchering. The objective is then money.
But sometimes the goal is stealing delicate information. Even seasoned performers may fall prey to phishing attacks, in which pretending to be real people are victims. One of the most renowned and perhaps most significant events occurred when John Podesta, the head of Hillary Clinton’s 2016 presidential campaign, received an email that purported to be a Google safety alert, giving attackers access to his private Gmail account. Hundreds of his letters, some of them very detrimental to Clinton and the Democrat Party, were published online.
From the pictures the French and Estonian sent me, I could show Fake Me wasn’t asking for credit card information or urging everyone to buy a present card. It didn’t appear to be a hoax aimed at making money.
Although I’m not sure who else they’ve reached out to, Fake Me appeared to have an interest in foreign army in both situations that I was informed of. Even some unwieldy brains operation?
I attempted to call Fake Me while using the phone number they used to contact the American security official. I received a recorded message stating that the series was no longer in operation.
On Signal and WhatsApp, the quantity rang and rang, without an answer.
Perhaps less could we do with the second imitation than we could with the first.
Signal only records a small amount of data about its users, including when people first created an account and the phone number they used to do it, but it also knows who they are messaging. That’s by style. The hands-off strategy is a part of why it’s a secure place for journalists to speak directly to resources. However, it also makes it challenging to find fake accounts. Red banners, like sending messages with cautious links, aren’t visible by Signal. ( WhatsApp cannot access messages unless a user reports them. ) Although it allows you to see who your customers are messaging, a company spokesperson said it’s unusual for them to keep that information.
Cooper Quintin, a technician at the modern private nonprofit Electronic Frontier Foundation, said he had never heard of a situation like mine on Signal. However, he was also noticing an increase in scams on the safe messaging app. According to him, Signal was doing what it was, including adding a function that stops would-be spammers from sending numerous messages at once. Signal even makes backlinks from unknown senders unclickable. However, he claimed there are limitations to what Signal can do without sacrificing its renowned private protections for its customers.
” This fits a direction.” As Signal gets more popular, more adversaries start to view it as a possible program for assaults”, said Quintin, who insisted we talk via video chat so he could be sure I wasn’t an online imitation asking to interview him about being impersonated online.
Some platforms, like Facebook and Instagram, permit users to obtain verified accounts that essentially show that they are who they claim to be. According to digital security expert Runa Sandvik, who consults for ProPublica on security issues, it wouldn’t be practical for Signal to do the same. The nonprofit that runs Signal is small, and verification would require staffing it doesn’t have. She added that it would require Signal to gather more data about its users, which would undermine the privacy safeguards that make it so well-known.
Signal did not respond to this article. A spokesperson for WhatsApp said” we have a strong track record of banning those trying to scam others and staying ahead of scammers and their tactics”. The spokesperson said WhatsApp” took appropriate action in accordance with our policies” against the account that spoofs me, but it would not specify what it was. WhatsApp generally tries to root out scam accounts even before they are identified by examining for suspicious behavior, including attempting to launch numerous accounts from a single location.
It turns out, if you’re contacted by someone pretending to be a reporter, the best way to scuttle their scam is to do a little reporting of your own.
Every journalist at ProPublica has a bio page. This is my place. On my bio page, you’ll find my Signal handle and email if you click on the Contact Me button. You can always verify that I’m the person contacting you by checking the Signal information or email address on my bio page.
Every ProPublica reporter has their own Signal numbers or usernames on their profiles, and every email has the subject line @propublica. org.
The same holds true for reporters at other news outlets. Check someone’s website and social media accounts to verify their email address, phone number, or WhatsApp number if you have any doubts. We’ve heard through the media grapevine and in published accounts about scams similar to mine hitting other organizations as well.
They contain deceptions on a smaller scale. An account on X that falsely claimed to be an intern for the news organization was recently flagged by The New York Times. In 2023, Reuters reported that two of its reporters in China were being impersonated via Instagram and Telegram accounts that were attempting to get information on activists protesting the country’s COVID-19 policies. And just this month, a correspondent for Reuters in Saudi Arabia issued a WhatsApp impersonation warning to his followers.
Be on the lookout for more sophisticated campaigns. The German government this year released a vague warning about what it described as likely a state-sponsored actor attempting to commandeer the Signal accounts of government officials and reporters across Europe. Additionally, the FBI made the announcement last month that individuals connected to Russian intelligence were attempting to deceive American government officials and journalists into giving them information that would allow the hackers to access their accounts. The FBI warned that once they had access, they could see conversations and contact lists and send messages as the victims.
These scams should worry anyone who cares about investigative reporting. I’ve written sensitive stories that have exposed errors in politics, finance, the military, and law enforcement throughout my career. Many of them lacked the courage to rely on brave individuals who have taken a chance and shared information, sometimes at real risk. I go to great lengths to protect my sources and make sure they are comfortable taking that risk. Potential sources may be less likely to engage if they doubt that I am who I say I am.
Sandvik said journalists shouldn’t be quiet about it when they are impersonated online, as I have been.
” If and when it does happen, be very public about it, which is what you’re doing now”, she said. Let people know that this is happening, so that when they hear from you, they are aware of it.
Who’s Been Trying To Be This ProPublica Reporter? appeared first on ProPublica.
