Listen to a Real Federal Warrant Scam Call
June 17, 2026
Executive Summary
CISA defines a vishing attack as a social engineering approach that leverages voice communication to get a target to divulge sensitive information. That definition matters because the threat in this case was not malware, ransomware, or a compromised inbox. It was a phone call built to manufacture authority, urgency, and isolation in just a few minutes.
STACK Cybersecurity recently recorded a live federal warrant scam call that targeted an executive. The caller claimed to represent a federal authority in the Eastern District of Michigan, used real courthouse details, invoked fake legal restrictions, and tried to force immediate compliance before the target could verify anything independently. This post breaks down how the scam worked, why the script was designed to create panic, and what your team should do the moment a similar call reaches your business.
Most business leaders still picture phishing as an email problem. That's incomplete. The Cybersecurity and Infrastructure Security Agency, or CISA, describes vishing as a voice-based social engineering attack, and modern crews use it because a live caller can adapt, escalate pressure, and keep a target engaged long enough to override normal judgment. For a small or midsize business, that can lead to credential exposure, fraudulent payments, identity theft, or disruption inside finance, human resources, or leadership workflows.
The FBI's Internet Crime Complaint Center, or IC3, reported 859,532 complaints in 2024 with losses exceeding $16 billion, and phishing or spoofing remained the top complaint category by volume. That matters here because a warrant scam call is still part of the same broader impersonation and phishing economy. It just arrives by voice instead of email.
The Recorded Incident
In this case, the caller didn't start with a technical pretext. There was no fake antivirus alert, no invoice, and no suspicious link. Instead, the scammer claimed the target was tied to a federal legal matter and attempted to use procedural language, courthouse details, and implied criminal exposure to force cooperation. That approach is consistent with Federal Trade Commission, or FTC, and federal court warnings about jury duty and warrant scams. The goal is emotional control.
The caller cited the Theodore Levin U.S. Courthouse in Detroit, which is a real federal location. The U.S. Marshals Service lists its Eastern District of Michigan headquarters there at 231 West Lafayette Boulevard, Room 300. Using real locations like that is one reason these calls can sound legitimate at first. A scammer only needs a few accurate public details to make a false story feel official.
What Is a Federal Warrant Scam?
A federal warrant scam is a form of impersonation fraud delivered through vishing. The caller pretends to be a federal agent, court officer, or law enforcement official and claims you missed jury duty, ignored a subpoena, or are tied to a criminal investigation. The goal is to pressure you into immediate action before you verify the claim through a trusted source. In some cases, the attacker wants payment. In others, the attacker wants your date of birth, Social Security number, bank details, or enough business information to stage a second attack.
FTC guidance is direct on this point. Courts never ask you to pay over the phone, and no government agency will do that. The U.S. Courts also warn that juror scam messages are fraudulent and that most contact with prospective federal jurors happens through U.S. mail, not through threatening phone calls demanding immediate compliance.
How the Caller Built Credibility
The first move was authority. The scammer used a formal tone, named a federal district, referenced a specific courthouse, and cited a detailed case number. That script is designed to put the target on defense immediately. Once a person starts trying to prove they did nothing wrong, the caller controls the pace of the conversation.
The second move was specificity. Scammers often use open-source intelligence to gather names, addresses, agencies, and public building information. The U.S. Marshals Service has warned that impostors may use badge numbers, real judge names, and courthouse addresses to sound credible. The detail itself doesn't prove legitimacy. It proves only that the caller can search the internet.
The third move was legal theater. In this call, the scammer tried to frame the conversation as part of a formal process and used language meant to sound procedural. That matters because many people hesitate when a caller sounds bureaucratic, even if the legal claims make no sense.
The Real Weapon Was Isolation
One of the most dangerous moments in a call like this is when the scammer tries to cut the target off from outside input. In this case, the caller introduced a fake confidentiality concept and implied that speaking to anyone else could create more legal trouble. That is classic social engineering. The attacker is trying to keep the target from calling a spouse, a colleague, internal IT, outside counsel, or the actual agency involved.
The FBI has warned that government impersonation scammers often refuse to speak with anyone except the target and urge victims not to tell family, friends, or financial institutions what's happening. That tactic is one of the strongest indicators the call is fraudulent.
"The most effective attackers don't break into a system first. They pressure a person into acting before that person has time to verify what's happening. When a caller combines authority, urgency, and isolation, even experienced professionals can hesitate. That's why awareness training has to reflect real business scenarios, not just theory."
Rich Miller, CEO, STACK Cybersecurity
Why Urgency Works on Smart People
These calls aren't successful because the victim is uninformed. They work because the script is built around stress. The caller introduces a threat of arrest, process failure, account restriction, public embarrassment, or executive exposure, then offers a narrow path to avoid that outcome if the target cooperates immediately.
That pressure can affect anyone, including experienced professionals. In a business setting, the risk escalates quickly if the target has authority over payments, payroll, legal records, sensitive employee data, or administrative access. One panicked decision can lead to a gift card purchase, a wire request, a data disclosure, or a compromised account.
FTC alerts on jury duty scams show the same pattern. The caller claims arrest is imminent and then pushes the victim toward immediate payment by wire transfer, cryptocurrency, payment app, or gift card. Real agencies don't resolve legal matters that way. Scammers do because those payment methods are fast, difficult to reverse, and easy to move.
How the Scam Started to Fail
Social engineering works best when the target accepts the caller's frame. It weakens the moment the target slows the interaction down and asks for independent verification. In this recorded call, the pressure began to break when the target asked calm, direct questions and didn't automatically accept the supposed confidentiality restrictions.
That kind of friction matters. Real federal personnel can identify themselves through verifiable channels, and legitimate legal processes don't depend on keeping you on the phone while you make a rushed decision. A scammer, on the other hand, needs uninterrupted momentum. Once you interrupt the script and verify through a trusted number already on file, the advantage usually shifts back to you.
Facts Executives Should Know
CISA says vishing is a social engineering attack that leverages voice communication and can be combined with caller ID spoofing, which means a familiar number on your screen isn't proof the caller is real.
FBI IC3 reported 859,532 cybercrime complaints in 2024 with losses exceeding $16 billion, and phishing and spoofing remained the top complaint category by number of reports.
In an FBI warning published in June 2024, the bureau said 14,190 victims reported government impersonation scams in 2023, with losses totaling more than $394 million.
The FTC states that courts never ask you to pay over the phone, and no government agency will demand payment that way to resolve a missed jury duty or warrant issue.
The U.S. Courts say most contact between a federal court and a prospective juror happens through U.S. mail, and any real phone or email contact will not include requests for sensitive personal information.
The U.S. Marshals Service has also warned that impostors may use real judge names, badge numbers, courthouse addresses, and spoofed caller ID information to make the scam sound legitimate.
How to Combat Scam Calls
Start by putting a simple phone verification rule in writing. If someone claims to be from law enforcement, a court, your bank, a vendor, or an executive colleague and asks for urgent action, your team should end the call and verify the request using a number already on file or a number your team already trusts. They should never use a callback number supplied during the suspicious conversation.
Then make internal reporting immediate and routine. Employees should know exactly where to send suspicious call details, including the incoming number, the name used by the caller, any case number mentioned, and what the caller wanted them to do. That gives your IT or security team a chance to warn the rest of the business before the same campaign reaches accounting, operations, or leadership.
Finally, train against the scenario you're most likely to face. A generic annual awareness video is not enough. Your business needs training that reflects executive impersonation, urgent payment demands, fake legal threats, and the use of real local details to create trust.
Frequently Asked Questions (FAQs)
What is a federal warrant scam?
A federal warrant scam is a form of vishing and impersonation fraud in which a caller pretends to be a federal agent, court official, or law enforcement officer. The caller claims you missed jury duty, ignored a subpoena, or are tied to a criminal matter, then pressures you to pay money or disclose personal or business information before you verify the claim independently.
Do federal courts or law enforcement warn people about warrants by phone?
No. The FTC, U.S. Courts, and U.S. Marshals Service have all warned that courts do not demand payment over the phone and that law enforcement does not call to threaten arrest unless you make an immediate payment. Federal court contact with jurors is generally handled through the mail, and legitimate officials do not ask for sensitive information or payment through a high-pressure phone call.
Why do these scam calls sound so convincing?
They sound convincing because the caller often uses real public information. That can include courthouse names, addresses, badge numbers, judge names, regional details, and spoofed phone numbers. None of that proves the caller is legitimate. It only shows the scammer gathered enough public information to build a believable script.
What should an employee do if a caller says the matter is confidential and cannot be discussed?
Treat that as a major warning sign. Social engineers use isolation to stop the target from checking with legal counsel, leadership, IT, or a family member. The right move is to end the call, report it internally, and verify the claim through a trusted contact method your team already has on file.
How can a small or midsize business reduce the risk of a vishing attack?
Build a simple verification process, train employees on real-world phone scams, and make internal reporting easy. If your business handles payments, sensitive employee records, vendor changes, or privileged system access, those teams should receive scenario-based awareness training and regular testing so they know what to do under pressure.
See how exposed your business really is
If you're not sure whether your current controls, workflows, and employee training are enough, start with a Cybersecurity Risk Assessment. You can also contact STACK Cybersecurity to talk through security awareness training, phishing simulations, and managed security support.